MCP server · Audited from source

GPT Researcher MCP server

by assafelovic/gpt-researcherApache-2.0 licenceAudited 19 Sep 2026 · source 304e85cc096c

npm simple_js_test 1.0.0streamable-http★ 29,523

✕BLOCKGrade F · 45/100 · 19 Sep 2026 · 304e85c

Safer alternatives View source on GitHub ↗

Is it safe? No — BLOCK, grade F (45/100). It exposes 2 tools: 2 read, 0 write and 0 destructive. The audit recorded 50 findings (0 critical, 2 high, 12 medium, 32 low). Maintainer's description: An autonomous agent that conducts deep research on any data using any LLM providers

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “GPT Researcher MCP server (assafelovic/gpt-researcher)”. Retrieved 19 Sep 2026. https://modelsatlas.com/mcp/assafelovic/gpt-researcher-1

Why this is BLOCK. The audit found 0 critical and 2 high findings; the most severe is Code injection at gpt_researcher/scraper/browser/browser.py:140. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

2 MCP servers are called GPT Researcher. You are viewing assafelovic/gpt-researcher. Compare all 2 →

assafelovic/gptr-mcp★ 371✓SAFE
assafelovic/gpt-researcher★ 29,523✕BLOCK

Trust audit

Audit 0.4.1 · full source read 19 Sep 2026

Trust score45/100✕BLOCK F

0 critical2 high12 medium32 low4 info

50 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared6 observations
NetworkDeclared15 observations
ShellDeclared2 observations
DependenciesNot pinnedSome ranges float
SecretsFoundSee the findings

Findings (50)

Sorted by severity · the 25 most severe of 50 are listed

HIGHCode injectioncode.deserialize · gpt_researcher/scraper/browser/browser.py:140

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

cookies = pickle.load(open(self.cookie_filename, "rb"))

Why: deserialises untrusted bytes into live objects
Fix: use json or yaml.safe_load

HIGHNetwork egressnet.tls_off · gpt_researcher/scraper/pymupdf/pymupdf.py:53

F-04 Network egressCWE-200 · CWE-319Layer L1

response = http.get(self.link, timeout=(5, 30), stream=True, verify=False)

Why: certificate verification is disabled
Fix: leave verification on

MEDIUMInventory / provenanceinv.binary · deep_agents/benchmark_data/internal_docs/product/vlx500_product_brief.docx

F-13 Inventory / provenanceCWE-1104Layer L0

vlx500_product_brief.docx

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

MEDIUMCode injectioncode.dynamic_import · gpt_researcher/llm_provider/generic/base.py:419

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

importlib.import_module(pkg)

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.beacon_words · frontend/nextjs/types/react-ga4.d.ts:19

F-04 Network egressCWE-200 · CWE-319Layer L1

transport?: 'beacon' | 'xhr' | 'image';

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · .env.example:14

F-04 Network egressCWE-200 · CWE-319Layer L1

# NEXT_PUBLIC_GPTR_API_URL=http://0.0.0.0:8000  # Defaults to localhost:8000 if not set

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · Dockerfile.fullstack:135

F-04 Network egressCWE-200 · CWE-319Layer L1

echo '            proxy_pass http://127.0.0.1:8000;' >> /etc/nginx/nginx.conf && \

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · Dockerfile.fullstack:143

F-04 Network egressCWE-200 · CWE-319Layer L1

echo '            proxy_pass http://127.0.0.1:8000;' >> /etc/nginx/nginx.conf && \

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · Dockerfile.fullstack:151

F-04 Network egressCWE-200 · CWE-319Layer L1

echo '            proxy_pass http://127.0.0.1:8000;' >> /etc/nginx/nginx.conf && \

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · Dockerfile.fullstack:163

F-04 Network egressCWE-200 · CWE-319Layer L1

echo '            proxy_pass http://127.0.0.1:3001;' >> /etc/nginx/nginx.conf && \

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.zero_width · frontend/scripts.js:808

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

output: '🧙♂️ Gathering information and analyzing your research topic...',

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.db_uri · docs/docs/gpt-researcher/context/tailored-research.md:114

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.db_uri · docs/docs/gpt-researcher/context/vector-stores.md:95

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · frontend/nextjs/README.md:80

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

LOWInventory / provenanceinv.hidden_file · .cursorignore

F-13 Inventory / provenanceCWE-1104Layer L0

.cursorignore

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · docs/static/.nojekyll

F-13 Inventory / provenanceCWE-1104Layer L0

.nojekyll

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · frontend/nextjs/.babelrc.build.json

F-13 Inventory / provenanceCWE-1104Layer L0

.babelrc.build.json

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · frontend/nextjs/.example.env

F-13 Inventory / provenanceCWE-1104Layer L0

.example.env

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWCode injectioncode.dynamic_import · .github/workflows/tests.yml:51

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

importlib.import_module(m.name)

Why: No further detail recorded for this rule.
Fix: —

LOWCode injectioncode.dynamic_import · tests/test_retriever_requires_scraping.py:128

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

cls = getattr(importlib.import_module(import_path), cls_name)

Why: No further detail recorded for this rule.
Fix: —

LOWCode injectioncode.eval_exec · tests/test_agent_creator_json_shape.py:31

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

exec(compile(src, str(path), "exec"), ns)

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

LOWCode injectioncode.eval_exec · tests/test_filter_urls_guards.py:28

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

exec(compile(wrapper, "filter_urls.py", "exec"), ns)

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

LOWInsecure cryptocrypto.weak_hash · backend/report_type/basic_report/basic_report.py:69

F-09 Insecure cryptoCWE-327 · CWE-338Layer L1

query_hash = hashlib.md5(query.encode()).hexdigest()[:8]

Why: No further detail recorded for this rule.
Fix: —

LOWInsecure cryptocrypto.weak_hash · backend/report_type/detailed_report/detailed_report.py:81

F-09 Insecure cryptoCWE-327 · CWE-338Layer L1

query_hash = hashlib.md5(query.encode()).hexdigest()[:8]

Why: No further detail recorded for this rule.
Fix: —

LOWInsecure cryptocrypto.weak_hash · backend/server/server_utils.py:126

F-09 Insecure cryptoCWE-327 · CWE-338Layer L1

task_hash = hashlib.md5(task.encode('utf-8', errors='ignore')).hexdigest()[:10]

Why: No further detail recorded for this rule.
Fix: —

Tools it exposes

2 declared in source · 0 destructive

2 read0 write0 destructive

Tool	What it does	Risk
`ask`	Ask a question to the bot	read
`ping`	Replies with Pong!	read

Safer alternatives

Graphiti✓SAFE

getzep/graphiti

Build Real-Time Knowledge Graphs for AI Agents

3 destructiveGrade B

Mcpdoc✓SAFE

langchain-ai/mcpdoc

Expose llms-txt to IDEs for development

3 readGrade B

GPT Researcher✓SAFE

assafelovic/gptr-mcp

MCP server for enabling LLM applications to perform deep research via the MCP protocol

1 writeGrade B

Audit history

2026-09-19
✕BLOCK F 45 / 100
Source changed, verdict held · 304e85cc096c

README badge

Badges show the current verdict, BLOCK included

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about GPT Researcher MCP server

What is the GPT Researcher MCP server?

An autonomous agent that conducts deep research on any data using any LLM providers

What tools does GPT Researcher expose?

2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is GPT Researcher safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (45/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does GPT Researcher need?

It reads AIMLAPI_API_KEY, ATLASCLOUD_API_KEY, AVIAN_API_KEY, AZURE_OPENAI_API_KEY, BING_API_KEY, BOCHA_API_KEY, BRAVE_API_KEY, CRW_API_KEY, DASHSCOPE_API_KEY, DEEPSEEK_API_KEY, DISCORD_BOT_TOKEN and EXA_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does GPT Researcher run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as simple_js_test at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (304e85cc096c), read on 2026-09-19. The repository is watched and re-audited when it changes.

Which GPT Researcher MCP server is the right one?

assafelovic/gptr-mcp. 2 servers share the name; see the side-by-side comparison.

I already installed GPT Researcher. What should I do?

Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.

Can the verdict change?

Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

assafelovic/gpt-researcher on GitHub — the source we read, its licence, stars and activityObserved · 19 Sep 2026
ModelsAtlas trust audit — BLOCK verdict for commit 304e85cc096cObserved · 19 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the GPT Researcher MCP server?
GChatGPT CClaude PPerplexity
What tools does GPT Researcher expose?
GChatGPT CClaude PPerplexity
Is GPT Researcher safe to connect to an agent?
GChatGPT CClaude PPerplexity