Skills/PyPI/cite-nexus-mcp

cite-nexus-mcp@0.2.5

VERIFIED· not started

Publisher claims: "Evidence-backed scholarly discovery and citation tools for MCP, from open metadata to institutional databases." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher akougkas · publishing for 486 daysInstalls 261Last detonated 34 min ago
$claude mcp add cite-nexus-mcp -- uvx cite-nexus-mcp
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
OPENAI_API_KEYSERP_API_KEYSERPAPI_KEYConfiguration, not credentials: CITE_NEXUS_DEFAULT_PROVIDERS, LOCAL_AI_API_BASE, LOCAL_AI_MODEL, LOCAL_AI_PROVIDER, OPENAI_API_BASE, OPENAI_MODEL
Where it talks to
no vendor host named in the codeAlso doi.org, agent-plugins.org, europepmc.org, ebi.ac.uk, nih.gov, arxiv.org, serpapi.com, google.com, searchapi.io, elsevier.com, clarivate.com, semanticscholar.org, openalex.org, crossref.org, datacite.org, unpaywall.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names doi.org, agent-plugins.org, europepmc.org, ebi.ac.uk, nih.gov, arxiv.org, serpapi.com, google.com, searchapi.io, elsevier.com, clarivate.com, semanticscholar.org, openalex.org, crossref.org, datacite.org, unpaywall.org as well as its own vendor. The guard injects OPENAI_API_KEY, SERP_API_KEY, SERPAPI_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx cite-nexus-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-15 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.3sprocessdependency install exit 1 ·
0.3sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.3sprocessscript backend runs setup only
0.3sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsscripts/check_distribution.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif path.name == ".env" or (path.name.startswith(".env.") and path.name != ".env.example"):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/cite_nexus_mcp/server.py:419 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"--env-file", type=Path, help="Explicit .env path (defaults to ./.env if present)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/cite_nexus_mcp/config.py:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Explicit configuration; importing this package never reads .env or calls a service."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/smoke_public.py:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Explicit live smoke check. No .env loading, API keys, paid providers or LLM calls."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathspyproject.toml:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…json", "llms-install.md", "README.md", "LICENSE", "pyproject.toml", "uv.lock", ".env.example", "CHANGELOG.md", "CONTRIBUTING.md"] Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_release_delivery.py:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"pkg/.env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_distribution.py:116 · Python subprocess execution detectedlisted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/cite_nexus_mcp/server.py:435 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesload_dotenv(args.env_file or Path.cwd() / ".env", override=False)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/release_gate.py:29 · Python subprocess execution detectedreturn subprocess.check_output(["git", *args], cwd=ROOT, text=True).strip()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/release_gate.py:63 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_wtfp.py:173 · Python subprocess execution detectedwith subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_providers.py:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesb'<!DOCTYPE feed [<!ENTITY x SYSTEM "file:///etc/passwd">]><feed>&x;</feed>'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_release.py:54 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_distribution.py:106 · Python subprocess execution detectedsubprocess.run([str(python), "-I", "-c", SMOKE, version], cwd=root, check=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_release_delivery.py:68 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdistribution.check_paths(["pkg/.env.example", "pkg/src/cite_nexus_mcp/server.py"])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_wtfp.py:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(tmp_path / ".env").write_text(Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_mcp.py:87 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_wtfp.py:84 · Python subprocess execution detectedoffline = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_wtfp.py:106 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_wtfp.py:125 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_wtfp.py:69 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_distribution.py:101 · Python subprocess execution detectedsubprocess.run([uv, "venv", str(environment), "--python", sys.executable], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_wtfp.py:141 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_mcp.py:89 · Python subprocess execution detectedwith subprocess.Popen( # noqa: ASYNC220 -- bounded local integration processFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_release_delivery.py:85 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_mcp.py:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_release_delivery.py:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"pkg/.env.production",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_distribution.py:103 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_distribution.py:107 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/cite_nexus_mcp/server.py:422 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"--no-env-file", action="store_true", help="Use process environment only; ignore .env files"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_mcp.py:137 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈65 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.