# security-paper-mcp-server

MCP server for searching papers from top-tier security conferences (S&P, USENIX Security, CCS, NDSS) and second-tier venues (ACSAC, RAID, ESORICS).

Maintained fork of the npm package [`@songyaeji/security-paper-mcp-server`](https://www.npmjs.com/package/@songyaeji/security-paper-mcp-server) (MIT, original author: songyaeji). The npm release ships a broken DBLP query layer that returns empty results for every tool; this repository ships the fixed version. See [Fixes](#fixes) below.

## Conferences

| Tier | Conferences |
|------|-------------|
| Top (四大顶会) | S&P (IEEE Symposium on Security and Privacy), USENIX Security, CCS, NDSS |
| Second | ACSAC, RAID, ESORICS |

## Tools

| Tool | Description |
|------|-------------|
| `search_papers` | Keyword / author / year / conference / tier search with DBLP |
| `get_conference_papers` | All papers of a conference in a given year (parses the DBLP volume page) |
| `list_conferences` | Supported conferences and available years |
| `get_stats` | Yearly / per-conference statistics for a keyword |

### search_papers arguments

```jsonc
{
  "keyword": "fuzzing",          // keyword in paper titles
  "author": "John Smith",        // author name (optional)
  "yearFrom": 2023,              // start year, 2020+ (default 2020)
  "yearTo": 2024,                // end year (default current year)
  "conferences": ["sp", "ccs"],  // conference keys: sp, usenix, ccs, ndss, acsac, raid, esorics
  "tier": "top",                 // "top" | "second" | "all"
  "limit": 50                    // max results (1–200)
}
```

## Install & configure

Node.js >= 18. Run from this repo:

```bash
npm install
npm run build   # not required — dist/ is committed, build only for recompiling
```

Or install directly from GitHub:

```bash
npm install -g git+https://github.com/Opr4Mp3r/security-paper-mcp-server.git
```

Claude Code / Claude Desktop `~/.claude.json` (or `claude mcp add`):

```json
{
  "mcpServers": {
    "security-papers": {
      "command": "node",
      "args": ["/absolute/path/to/dist/index.js"]
    }
  }
}
```

Example prompts:

- "2024년 S&P 논문 중 fuzzing 관련 논문 찾아줘" / "find fuzzing papers at S&P 2024"
- "search malware analysis papers from CCS and NDSS"
- "list all USENIX Security 2024 papers"

## Data source

[DBLP](https://dblp.org) — the search API (`search_papers`, `get_stats`) and the DBLP volume pages (`get_conference_papers`).

## Fixes vs. the npm release (2026-08-01)

The npm 1.0.0 release returned **no results for every tool**. Root causes, all verified against the live DBLP API:

1. **`venue:` matches venue strings, not dblp keys** — the original used `venue:conf/sp:` (always 0 hits). The fix uses real venue strings (e.g. `venue:CCS`, `venue:NDSS`).
2. **OR (`|`) between fielded terms is unreliable** — `venue:A|venue:B` silently returns only venue A's results. Multi-venue searches now omit the venue filter and filter client-side.
3. **Modern S&P / USENIX volumes carry year-prefixed titles** (e.g. "2020 IEEE Symposium on Security and Privacy, SP 2020, …"), so a `venue:` filter on their base name silently drops everything from 2020 on. Those two venues now use keyword search + client-side matching.
4. **`get_conference_papers` used the API with a client-side year filter** — DBLP orders hits by its own relevance (not recency), so recent years were always missed. It now parses the DBLP table-of-contents page (`db/conf/sp/sp2024.html`) directly via schema.org + COinS metadata.
5. **No throttling resilience** — DBLP aggressively rate-limits (429/503). Added exponential backoff retries (8s/16s) including network-level failures.

Verified results: S&P 2024 → 261 papers, USENIX Security 2024 → 418, CCS 2024 → 418, all with full titles, author lists, DOIs and conference links.

### Known limitations

- DBLP rate limiting is strict; frequent calls may still surface 503s (retries mitigate).
- Multi-venue keyword recall is bounded by the DBLP API page cap (100 hits) and its relevance ordering. For higher recall use `resp_mcp`'s `search_all` / `search_dblp`.
- A small share of long titles are truncated by DBLP on the volume pages (~1%); DOIs are always complete.
- Workshop volumes sharing the abbreviation (e.g. CCSW@CCS) can appear in CCS results — this matches DBLP's own `venue:` behavior.

## License

MIT. Original package by songyaeji; maintenance fixes by Opr4Mp3r. See `LICENSE` and `README.original.kr.md` for the original documentation.