GPT Researcher
BLOCKgrade F · trust 45/100An autonomous agent that conducts deep research on any data using any LLM providers
agentaiautomationdeepresearchllmsmcpmcp serverpythonOverview
From the repository's own README, as read at the audited commit.
<div align="center" id="top"><img src="https://github.com/assafelovic/gpt-researcher/assets/13554167/20af8286-b386-44a5-9a83-3be1365139c3" alt="Logo" width="80">####[](https://gptr.dev)[](https://docs.gptr.dev)[](https://discord.gg/QgZXvJAccX)[](https://badge.fury.io/py/gpt-researcher)[](https://colab.research.google.com/github/assafelovic/gpt-researcher/blob/master/docs/docs/examples/pip-run.ipynb)[](https://hub.docker.com/r/gptresearcher/gpt-researcher)[](https://skills.sh/assafelovic/gpt-researcher/gpt-researcher)[](https://twitter.com/assaf_elovic)[English](README.md) | [中文](README-zh_CN.md) | [日本語](README-ja_JP.md) | [한국어](README-ko_KR.md)</div># 🔎 GPT Researcher**GPT Researcher the first open deep research agent designed for both web and local research on any given task.** The agent produces detailed, factual, and unbiased research reports with citations. GPT Researcher provides
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add simple_js_test --env AIMLAPI_API_KEY=${AIMLAPI_API_KEY} --env ATLASCLOUD_API_KEY=${ATLASCLOUD_API_KEY} --env AVIAN_API_KEY=${AVIAN_API_KEY} --env AZURE_OPENAI_API_KEY=${AZURE_OPENAI_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"simple_js_test": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"AIMLAPI_API_KEY": "${AIMLAPI_API_KEY}",
"ATLASCLOUD_API_KEY": "${ATLASCLOUD_API_KEY}",
"AVIAN_API_KEY": "${AVIAN_API_KEY}",
"AZURE_OPENAI_API_KEY": "${AZURE_OPENAI_API_KEY}"
}
}
}
}Exposed tools (2) 2 read · 0 write · 0 destructive
| Tool | Risk | Description |
|---|---|---|
ask | read | Ask a question to the bot |
ping | read | Replies with Pong! |
Details
- Source
- assafelovic/gpt-researcher
- npm
simple_js_test@1.0.0- PyPI
gpt-researcher- Transports
- streamable-http
- Credentials it reads
AIMLAPI_API_KEYATLASCLOUD_API_KEYAVIAN_API_KEYAZURE_OPENAI_API_KEYBING_API_KEYBOCHA_API_KEYBRAVE_API_KEYCRW_API_KEYDASHSCOPE_API_KEYDEEPSEEK_API_KEYDISCORD_BOT_TOKENEXA_API_KEY- License
- Apache-2.0
- Stars
- 29,423 · pushed 16d ago
Trust audit
Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (15 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
cookies = pickle.load(open(self.cookie_filename, "rb"))
response = http.get(self.link, timeout=(5, 30), stream=True, verify=False)
vlx500_product_brief.docx
importlib.import_module(pkg)
transport?: 'beacon' | 'xhr' | 'image';
# NEXT_PUBLIC_GPTR_API_URL=http://0.0.0.0:8000 # Defaults to localhost:8000 if not set
echo ' proxy_pass http://127.0.0.1:8000;' >> /etc/nginx/nginx.conf && \
echo ' proxy_pass http://127.0.0.1:8000;' >> /etc/nginx/nginx.conf && \
echo ' proxy_pass http://127.0.0.1:8000;' >> /etc/nginx/nginx.conf && \
echo ' proxy_pass http://127.0.0.1:3001;' >> /etc/nginx/nginx.conf && \
output: '🧙♂️ Gathering information and analyzing your research topic...',
CONNECTION_STRING = 'postgresql://someuser:somepass@localhost:5432/somedatabase'
CONNECTION_STRING = 'postgresql://someuser:somepass@localhost:5432/somedatabase'
apiKey="your-api-key-if-needed"
.cursorignore
.nojekyll
.babelrc.build.json
.example.env
importlib.import_module(m.name)
cls = getattr(importlib.import_module(import_path), cls_name)
exec(compile(src, str(path), "exec"), ns)
exec(compile(wrapper, "filter_urls.py", "exec"), ns)
query_hash = hashlib.md5(query.encode()).hexdigest()[:8]
query_hash = hashlib.md5(query.encode()).hexdigest()[:8]
task_hash = hashlib.md5(task.encode('utf-8', errors='ignore')).hexdigest()[:10]Gates applied: no_behavioural_pass.
Audited 2026-09-13 · audit v0.4.0 · source sha 304e85cc096c · full audit: observations/trust-audit/mcp-server/assafelovic__gpt-researcher-1.json · Report an issue or request a re-scan
Audit history
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-13 | 304e85cc096c | BLOCK | F | 45 | first audit |
Alternatives
Other servers in the same categories, safer ones first.
Questions
What is the GPT Researcher MCP server?
An autonomous agent that conducts deep research on any data using any LLM providers
What tools does GPT Researcher expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is GPT Researcher safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (45/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does GPT Researcher need?
It reads AIMLAPI_API_KEY, ATLASCLOUD_API_KEY, AVIAN_API_KEY, AZURE_OPENAI_API_KEY, BING_API_KEY, BOCHA_API_KEY, BRAVE_API_KEY, CRW_API_KEY, DASHSCOPE_API_KEY, DEEPSEEK_API_KEY, DISCORD_BOT_TOKEN and EXA_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does GPT Researcher run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as simple_js_test at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (304e85cc096c), read on 2026-09-13. The repository is watched and re-audited when it changes.
Provenance: OBSERVED · read 2026-09-13 · job trust-audit-2026-09-13