research-hub-mcp

The server's Rust core integrates Python plugins for PDF downloading, which utilize `playwright` for headless browser automation. Running a full browser introduces a significant attack surface, potentially vulnerable to browser-based exploits if interacting with malicious or compromised web content during PDF retrieval. While the Rust code implements robust security practices for network requests (HTTPS-only, TLS validation, user-agent rotation) and file handling (path sanitization, integrity verification, size limits), the dynamic nature of web interaction through `playwright` inherently elevates risk. Reliance on external Python environments and services like GROBID (potentially containerized) also adds to the complexity and potential attack vectors if not meticulously secured. API keys for services like Google Scholar, PubMed, Semantic Scholar, CORE, and arXiv are expected via environment variables, not hardcoded. The project also incorporates circuit breakers and rate limiting for external services, enhancing stability but not directly mitigating the browser-based risks.