arxiv-txt-mcp

The server primarily acts as a proxy to an external `arxiv-txt.org` service (or a user-configured self-hosted instance). The `ARXIV_TXT_URL` environment variable allows configuration of this external service. While this flexibility is a feature, an attacker able to control this environment variable in a deployment could redirect requests to a malicious endpoint, potentially leading to Server-Side Request Forgery (SSRF) if the target `arxiv_id` is also malformed or the external service itself is vulnerable. However, the code itself does not contain obvious direct injection vulnerabilities like `eval`, `exec`, or hardcoded secrets. It relies on the trusted nature of the `arxiv-txt.org` service and proper environment configuration.