security-paper-mcp-server

MCP server for searching papers from top-tier security conferences (S&P, USENIX Security, CCS, NDSS) and second-tier venues (ACSAC, RAID, ESORICS).

Maintained fork of the npm package @songyaeji/security-paper-mcp-server (MIT, original author: songyaeji). The npm release ships a broken DBLP query layer that returns empty results for every tool; this repository ships the fixed version. See Fixes below.

Conferences

Related MCP server: scholar-toolkit-mcp

Tools

search_papers arguments

{
  "keyword": "fuzzing",          // keyword in paper titles
  "author": "John Smith",        // author name (optional)
  "yearFrom": 2023,              // start year, 2020+ (default 2020)
  "yearTo": 2024,                // end year (default current year)
  "conferences": ["sp", "ccs"],  // conference keys: sp, usenix, ccs, ndss, acsac, raid, esorics
  "tier": "top",                 // "top" | "second" | "all"
  "limit": 50                    // max results (1–200)
}

Install & configure

Node.js >= 18. Run from this repo:

npm install
npm run build   # not required — dist/ is committed, build only for recompiling

Or install directly from GitHub:

npm install -g git+https://github.com/Opr4Mp3r/security-paper-mcp-server.git

Claude Code / Claude Desktop ~/.claude.json (or claude mcp add):

{
  "mcpServers": {
    "security-papers": {
      "command": "node",
      "args": ["/absolute/path/to/dist/index.js"]
    }
  }
}

Example prompts:

• "2024년 S&P 논문 중 fuzzing 관련 논문 찾아줘" / "find fuzzing papers at S&P 2024"

• "search malware analysis papers from CCS and NDSS"

• "list all USENIX Security 2024 papers"

Data source

DBLP — the search API (search_papers, get_stats) and the DBLP volume pages (get_conference_papers).

Fixes vs. the npm release (2026-08-01)

The npm 1.0.0 release returned no results for every tool. Root causes, all verified against the live DBLP API:

1. venue: matches venue strings, not dblp keys — the original used venue:conf/sp: (always 0 hits). The fix uses real venue strings (e.g. venue:CCS, venue:NDSS).

2. OR (|) between fielded terms is unreliable — venue:A|venue:B silently returns only venue A's results. Multi-venue searches now omit the venue filter and filter client-side.

3. Modern S&P / USENIX volumes carry year-prefixed titles (e.g. "2020 IEEE Symposium on Security and Privacy, SP 2020, …"), so a venue: filter on their base name silently drops everything from 2020 on. Those two venues now use keyword search + client-side matching.

4. get_conference_papers used the API with a client-side year filter — DBLP orders hits by its own relevance (not recency), so recent years were always missed. It now parses the DBLP table-of-contents page (db/conf/sp/sp2024.html) directly via schema.org + COinS metadata.

5. No throttling resilience — DBLP aggressively rate-limits (429/503). Added exponential backoff retries (8s/16s) including network-level failures.

Verified results: S&P 2024 → 261 papers, USENIX Security 2024 → 418, CCS 2024 → 418, all with full titles, author lists, DOIs and conference links.

Known limitations

• DBLP rate limiting is strict; frequent calls may still surface 503s (retries mitigate).

• Multi-venue keyword recall is bounded by the DBLP API page cap (100 hits) and its relevance ordering. For higher recall use resp_mcp's search_all / search_dblp.

• A small share of long titles are truncated by DBLP on the volume pages (~1%); DOIs are always complete.

• Workshop volumes sharing the abbreviation (e.g. CCSW@CCS) can appear in CCS results — this matches DBLP's own venue: behavior.

License

MIT. Original package by songyaeji; maintenance fixes by Opr4Mp3r. See LICENSE and README.original.kr.md for the original documentation.