security-paper-mcp-server

MCP server for searching papers from top-tier security conferences (S&P, USENIX Security, CCS, NDSS) and second-tier venues (ACSAC, RAID, ESORICS).

Maintained fork of the npm package @songyaeji/security-paper-mcp-server (MIT, original author: songyaeji). The npm release ships a broken DBLP query layer that returns empty results for every tool; this repository ships the fixed version. See Fixes below.

Conferences

Tier	Conferences
Top (四大顶会)	S&P (IEEE Symposium on Security and Privacy), USENIX Security, CCS, NDSS
Second	ACSAC, RAID, ESORICS

Tools

Tool	Description
search_papers	Keyword / author / year / conference / tier search with DBLP
get_conference_papers	All papers of a conference in a given year (parses the DBLP volume page)
list_conferences	Supported conferences and available years
get_stats	Yearly / per-conference statistics for a keyword

search_papers arguments

{
  "keyword": "fuzzing",          // keyword in paper titles
  "author": "John Smith",        // author name (optional)
  "yearFrom": 2023,              // start year, 2020+ (default 2020)
  "yearTo": 2024,                // end year (default current year)
  "conferences": ["sp", "ccs"],  // conference keys: sp, usenix, ccs, ndss, acsac, raid, esorics
  "tier": "top",                 // "top" | "second" | "all"
  "limit": 50                    // max results (1–200)
}

Install & configure

Node.js >= 18. Run from this repo:

npm install
npm run build   # not required — dist/ is committed, build only for recompiling

Or install directly from GitHub:

npm install -g git+https://github.com/Opr4Mp3r/security-paper-mcp-server.git

Claude Code / Claude Desktop ~/.claude.json (or claude mcp add):

{
  "mcpServers": {
    "security-papers": {
      "command": "node",
      "args": ["/absolute/path/to/dist/index.js"]
    }
  }
}

Example prompts:

• "2024년 S&P 논문 중 fuzzing 관련 논문 찾아줘" / "find fuzzing papers at S&P 2024"
• "search malware analysis papers from CCS and NDSS"
• "list all USENIX Security 2024 papers"

Data source

DBLP — the search API (search_papers, get_stats) and the DBLP volume pages (get_conference_papers).

Fixes vs. the npm release (2026-08-01)

The npm 1.0.0 release returned no results for every tool. Root causes, all verified against the live DBLP API:

1. venue: matches venue strings, not dblp keys — the original used venue:conf/sp: (always 0 hits). The fix uses real venue strings (e.g. venue:CCS, venue:NDSS).
2. OR (|) between fielded terms is unreliable — venue:A|venue:B silently returns only venue A's results. Multi-venue searches now omit the venue filter and filter client-side.
3. Modern S&P / USENIX volumes carry year-prefixed titles (e.g. "2020 IEEE Symposium on Security and Privacy, SP 2020, …"), so a venue: filter on their base name silently drops everything from 2020 on. Those two venues now use keyword search + client-side matching.
4. get_conference_papers used the API with a client-side year filter — DBLP orders hits by its own relevance (not recency), so recent years were always missed. It now parses the DBLP table-of-contents page (db/conf/sp/sp2024.html) directly via schema.org + COinS metadata.
5. No throttling resilience — DBLP aggressively rate-limits (429/503). Added exponential backoff retries (8s/16s) including network-level failures.

Verified results: S&P 2024 → 261 papers, USENIX Security 2024 → 418, CCS 2024 → 418, all with full titles, author lists, DOIs and conference links.

Known limitations

• DBLP rate limiting is strict; frequent calls may still surface 503s (retries mitigate).
• Multi-venue keyword recall is bounded by the DBLP API page cap (100 hits) and its relevance ordering. For higher recall use resp_mcp's search_all / search_dblp.
• A small share of long titles are truncated by DBLP on the volume pages (~1%); DOIs are always complete.
• Workshop volumes sharing the abbreviation (e.g. CCSW@CCS) can appear in CCS results — this matches DBLP's own venue: behavior.

License

MIT. Original package by songyaeji; maintenance fixes by Opr4Mp3r. See LICENSE and README.original.kr.md for the original documentation.