Atlas / MCP servers / wenyuchiou / Research Hub

Research HubBLOCK

mcp/wenyuchiou/research-hub-1

AI-operable research workspace for Zotero, Obsidian, and NotebookLM. Use any two, or all three, through CLI, MCP, REST, and dashboard.

Verdict
BLOCK
Grade
F
Trust score
56 /100
Exposed tools
44 31r · 13w · 0d
Transport
stdio
License
MIT
Stars
64
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A local workspace connecting literature, research artifacts, and manuscripts through traceable work.

繁體中文 · Workspace guide · Existing setup · Developer architecture

[](https://pypi.org/project/research-hub-pipeline/) [](pyproject.toml) [](LICENSE)

Workspace preview — unmerged and unreleased. The six-page workspace below is proposed in research-hub PR #135. PyPI 1.2.0 does not include it. Use the pinned preview installation below, or try the published literature dashboard.

Why this exists

Research crosses files and tools: a paper informs a question, an analysis changes a result, and a manuscript needs revision. Keep those connections visible when you or an AI assistant picks up the next task.

Start with local files. Connect Zotero for references, Obsidian for notes, and NotebookLM for source-based briefings when needed. Empirical studies and literature reviews share the workspace.

What you work with

Read from source at commit b6e57d4fa690OBSERVED · 2026-10-08
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (pypi)
claude mcp add research-hub-pipeline -- None research-hub-pipeline==1.2.0
03

Exposed tools (44)

31 read · 13 write · 0 destructive.

ToolRiskDescription
add_paperwriteFetch a paper by DOI/arXiv ID and ingest it (one-shot).
apply_cluster_summarieswritePersist a JSON payload of per-paper summaries (when LLM was invoked
apply_crystalswritePersist crystal answers to hub/<cluster>/crystals/<slug>.md.
ask_clusterreadAnswer a question about one cluster, dispatching to the source named by ``source`` / ``mode``.
auto_research_topicreadOne-shot research pipeline: search + ingest + NotebookLM brief (+ optional crystals).
build_citationreadReturn an inline citation string for a paper.
capture_quotereadPersist a quote to <vault>/.research_hub/quotes/<slug>.md.
check_crystal_stalenessreadCheck how many crystals are stale (>10% cluster paper delta since generation).
cleanup_garbagereadGarbage-collect accumulated research-hub files (v0.46+).
cluster_prismareadPRISMA screening-provenance counts for a cluster: identified / deduped /
cluster_rebindwriteRun the cluster-rebind workflow specified by ``action``.
collect_to_clusterreadUnified ingest. Auto-routes by source shape: DOI/arXiv -> add_paper, folder -> import_folder, URL -> .url file + import.
compose_brief_draftreadAssemble a markdown draft from cluster quotes + overview + crystal TLDRs.
compose_draftreadAssemble captured quotes into a markdown draft.
download_artifactsreadDownload a generated NotebookLM briefing back to the vault.
emit_cluster_basereadEmit (or refresh) the .base dashboard file for a cluster.
emit_crystal_promptreadEmit the markdown prompt the calling AI should answer to generate crystals.
generate_dashboardreadGenerate a personal HTML dashboard for the vault.
import_folder_toolwriteWalk a local folder and ingest non-DOI files as document notes.
list_crystalsreadList all pre-computed crystal answers for a cluster.
list_quotesreadList captured quotes, optionally filtered by cluster.
notebooklm_bundlewriteBuild a NotebookLM upload bundle for a cluster.
notebooklm_downloadreadDownload the latest NotebookLM briefing artifact into the vault.
notebooklm_generatewriteTrigger NotebookLM artifact generation for a cluster notebook.
notebooklm_uploadwriteUpload the latest cluster bundle to NotebookLM using the saved session.
plan_research_workflowreadConvert a freeform user intent into a structured research plan.
propose_research_setupreadPropose names for a new research collection without creating anything.
read_cluster_memoryreadRead cluster memory. kind may be entities, claims, methods, or all.
read_crystalreadRead a specific crystal at the requested detail level.
suggest_cluster_splitreadAnalyze a cluster
summarize_clusterreadGenerate per-paper Key Findings + Methodology + Relevance via LLM CLI.
sync_clusterwriteAggregate maintenance view: staleness + scope drift + vault health + recommendations.
tidy_vaultreadOne-shot vault maintenance: doctor autofix + dedup rebuild + bases refresh + cleanup preview.
web_searchreadGeneral web search (blog posts / docs / news / GitHub READMEs).
workflow_decidereadRecord an exact human accept, decline, revise, or cancel decision.
workflow_initializereadInitialize deterministic workflow state 1.1; performs no external writes.
workflow_migratewriteDry-run a v1.0-to-v1.1 migration, or atomically apply it with backup.
workflow_resumereadResume only when policy, retry, terminal, and external-action guards allow it.
workflow_statusreadReturn validated workflow status and recovery state.
workflow_validatereadValidate v1.0 or v1.1 state without mutating it.
workspace_actionwritePrepare/show/decide/execute/reconcile a local accepted-proposal delivery.
workspace_manuscriptreadBind/state/audit the explicitly configured public writing bundle.
workspace_projectwriteProject create/demo/list/show/register/record/search via the shared workspace service.
workspace_taskwriteDurable task create/list/show/run/handoff/import/cancel/recover/decide.
04

Trust audit

BLOCKgrade F · trust 56/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (6 observation(s))
Network
declared (8 observation(s))
Shell
declared (2 observation(s))
Dependencies
pinned
Secrets in source
none-found

Findings (25)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
src/research_hub/direction_review.py:455
dossier = yaml.load(dossier_text, Loader=_UniqueLoader)
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
scripts/verify_native_research_handoff.py:67
results["first_ingest_rc"] = pipeline.run_pipeline(papers_json=path, cluster_slug="native-review", query="initial, query", verify=False)
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
scripts/verify_native_research_handoff.py:81
pipeline.run_pipeline(papers_json=path, cluster_slug="native-review", query='follow-up, "citation"', verify=False)
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
scripts/verify_native_research_handoff.py:93
pipeline.run_pipeline(papers_json=path, cluster_slug="native-review", query='follow-up, "citation"', verify=False)
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
skills/notebooklm-brief-verifier/SKILL.md:139
- Don't tell the user to ignore NLM. Tell them which parts to trust and
Why it matters. asks the agent to act without the user's knowledge
HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
src/research_hub/skills_data/notebooklm-brief-verifier/SKILL.md:139
- Don't tell the user to ignore NLM. Tell them which parts to trust and
Why it matters. asks the agent to act without the user's knowledge
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
src/research_hub/cli_pipeline.py:305
return importlib.import_module(name) is not None
LOWInventory / provenance · inv.binary · CWE-1104
docs/examples/doctor-output.txt
doctor-output.txt
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
docs/examples/init-output.txt
init-output.txt
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.hidden_file · CWE-1104
openwiki/.last-update.json
.last-update.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
src/research_hub/verify.py:311
return hashlib.sha1(f"{kind}:{identifier}".encode("utf-8")).hexdigest()
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
tests/test_verify.py:122
return hashlib.sha1(f"{kind}:{identifier}".encode("utf-8")).hexdigest()
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/verify_native_research_handoff.py:97
unsafe["slug"] = "../../outside"
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/test_artifact_delete_endpoint.py:64
status, payload = _post(artifact_server.port, "/artifact-delete?path=../../etc/passwd")
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/test_native_research_handoff.py:200
("slug", "../../outside"), ("slug", "nested/paper"), ("slug", "nested\\paper"),
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/test_native_research_handoff.py:201
("slug", 12), ("sub_category", "../../outside"), ("sub_category", "/outside"),
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/test_notebooklm_brief_mirror.py:98
expected = f"brief_archive_path: ../../.research_hub/artifacts/alpha/{report.artifact_path.name}"
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
CHANGELOG-archive/CHANGELOG-pre-1.0.md:711
`http://127.0.0.1:8765/` (live, when `serve --dashboard` is
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:54
Open [the local workspace](http://127.0.0.1:8765/app/). The demo needs no account and contains a small numerical summation example and a literature-review fixture. These are teaching inputs, not model
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.zh-TW.md:54
開啟[本機工作區](http://127.0.0.1:8765/app/)。示範不需要帳號,包含小型數值加總範例與文獻回顧測試資料。這些是教學輸入,並非模型產生的研究發現。
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/audit_v0.27.md:44
dashboard server listening on http://127.0.0.1:18765/
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/audit_v0.27.md:46
$ curl http://127.0.0.1:18765/healthz
LOWNetwork egress · net.tls_off · CWE-200, CWE-319
tests/stress/test_pipeline_ingest.py:41
rc = run_pipeline(dry_run=False, cluster_slug="stress", verify=False)
Why it matters. certificate verification is disabled
Fix. leave verification on
LOWNetwork egress · net.tls_off · CWE-200, CWE-319
tests/stress/test_v073_perf_budgets.py:73
assert pipeline.run_pipeline(dry_run=False, cluster_slug="stress", verify=False) == 0
Why it matters. certificate verification is disabled
Fix. leave verification on
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
CHANGELOG.md:282
maturity audit flagged: the institutional-access credential path and the
Why it matters. asks the agent to read credentials

Gates applied: instruction_override, no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha b6e57d4fa690full audit observations/trust-audit/mcp-server/wenyuchiou__research-hub-1.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-08b6e57d4fa690BLOCKF56first audit
06

Questions

What is the Research Hub MCP server?

AI-operable research workspace for Zotero, Obsidian, and NotebookLM. Use any two, or all three, through CLI, MCP, REST, and dashboard.

What tools does Research Hub expose?

44 in total: 31 read-only, 13 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Research Hub safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (56/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Research Hub need?

It reads BRAVE_SEARCH_API_KEY, GOOGLE_CSE_API_KEY, RESEARCH_HUB_API_TOKEN, TAVILY_API_KEY and ZOTERO_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Research Hub run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as research-hub-workspace at 0.0.0.

How current is this page?

The grade is for one exact copy of the source (b6e57d4fa690), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement