OverleafBLOCK
Model Context Protocol (MCP) server that lets AI assistants read Overleaf projects, parse LaTeX document structure, and push section-level edits back via Git. Compatible with Claude Desktop, Cursor, Windsurf, and any MCP client.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An MCP (Model Context Protocol) server that provides access to Overleaf projects via Git integration. This allows Claude and other MCP clients to read LaTeX files, analyze document structure, extract content, and write files from and to Overleaf projects.
Features
- 📄 File Management: List, read, and write files from and to Overleaf projects
- 📋 Document Structure: Parse LaTeX sections and subsections
- 🔍 Content Extraction: Extract specific sections by title
- 📊 Project Summary: Get overview of project status and structure
- 🏗️ Multi-Project Support: Manage multiple Overleaf projects
Quick Start (recommended)
No clone, no npm install. Add this block to your Claude Desktop config and restart Claude Desktop.
Config file location
macOS / Linux
{
"mcpServers": {
"overleaf": {
"command": "npx",
"args": ["-y", "@mjyoo2/overleaf-mcp"],
"env": {
"OVERLEAF_PROJECT_ID": "YOUR_OVERLEAF_PROJECT_ID",
"OVERLEAF_GIT_TOKEN": "YOUR_OVERLEAF_GIT_TOKEN"
}
}
}
}Windows — Claude Desktop on Windows needs cmd /c to find npx:
{
"mcpServers": {
"overleaf": {
"command": "cmd",
"args": ["/c", "npx", "-y", "@mjyoo2/overleaf-mcp"],
"env": {
"OVERLEAF_PROJECT_ID": "YOUR_OVERLEAF_PROJECT_ID",
"OVERLEAF_GIT_TOKEN": "YOUR_OVERLEAF_GIT_TOKEN"
}
}
}
}Restart Claude Desktop. The overleaf tools should appear in the 🔧 menu.
Multi-Project Setup
The env-var Quick Start only handles a single project. For multiple projects, drop a projects.json file into the user config directory and skip the env block in your Claude Desktop config.
File location
9137df6b60e0OBSERVED · 2026-10-06Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add overleaf-mcp --env OVERLEAF_GIT_TOKEN=${OVERLEAF_GIT_TOKEN} --env OVERLEAF_GIT_TOKEN_FILE=${OVERLEAF_GIT_TOKEN_FILE} -- npx -y @mjyoo2/[email protected]{
"mcpServers": {
"overleaf-mcp": {
"command": "npx",
"args": [
"-y",
"@mjyoo2/[email protected]"
],
"env": {
"OVERLEAF_GIT_TOKEN": "${OVERLEAF_GIT_TOKEN}",
"OVERLEAF_GIT_TOKEN_FILE": "${OVERLEAF_GIT_TOKEN_FILE}"
}
}
}
}Exposed tools (8)
6 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_section_content | read | Get content of a specific section |
get_sections | read | Get all sections from a LaTeX file |
list_files | read | List files in an Overleaf project |
list_projects | read | List all configured Overleaf projects |
read_file | read | Read a file from an Overleaf project |
status_summary | read | Get a comprehensive project status summary |
write_file | write | Write content to a file in an Overleaf project and push to Overleaf |
write_section | write | Replace a single section in a LaTeX file and push to Overleaf. Safer than write_file for targeted edits — only the named section is replaced, leaving the rest of the file untouched. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (4)
const { stdout } = await exec(const { stdout } = await exec(@modelcontextprotocol/sdk
- The Overleaf Git token grants full read/write access to your project — treat it like a password.
Gates applied: no_behavioural_pass.
9137df6b60e0full audit observations/trust-audit/mcp-server/mjyoo2__overleaf.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-06 | 9137df6b60e0 | BLOCK | D | 69 | first audit |
Questions
What is the Overleaf MCP server?
Model Context Protocol (MCP) server that lets AI assistants read Overleaf projects, parse LaTeX document structure, and push section-level edits back via Git. Compatible with Claude Desktop, Cursor, Windsurf, and any MCP client.
What tools does Overleaf expose?
8 in total: 6 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Overleaf safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Overleaf need?
It reads OVERLEAF_GIT_TOKEN and OVERLEAF_GIT_TOKEN_FILE from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Overleaf run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @mjyoo2/overleaf-mcp at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (9137df6b60e0), read on 2026-10-06. The repository is watched and re-audited when it changes.