# @the-40-thieves/alexandria-mcp

152-source digital library MCP server. Natural language search across academic papers, public domain books, legal records, government archives, and software documentation.

- **Type:** MCP server
- **Trust:** 85/100 (A), scored on the package rubric
- **Verification:** verified (build provenance)
- **Version:** 11.0.0
- **Author:** suavecito585
- **License:** MIT
- **npm:** @the-40-thieves/alexandria-mcp
- **Source:** https://github.com/The-40-Thieves/alexandria-mcp
- **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport)

## Trust

85/100 (A), scored on the package rubric
- Publisher verified: no
- Build provenance: verified attestation
- npm trusted publishing (OIDC): yes
- Install scripts: nothing suspicious found
- Prompt-injection scan: not run
- Obfuscation scan: not run
- Evidence age: 0 days

## Security scan

- **Status:** clean
- **Scanned:** 2026-09-05T18:15:33.290Z
- **Version scanned:** 11.0.0
- **CVEs:** none found by OSV at scan time

## Tools

38 declared. Statically extracted from the shipped source — a floor on the surface, not a census.
- `circl` — CIRCL Vulnerability Lookup: full-text search across CVE, GHSA and other vulnerability feeds, run by Luxembourg's CERT. No API key required.
- `context7mcp` — Context7 documentation search via its own MCP server (resolve-library-id then query-docs). Works keyless; set CONTEXT7_API_KEY for a higher rate. Additive to th
- `datacite` — DataCite: DOI metadata for research datasets and software (Zenodo, Figshare, Dryad, OSF, and more all register here) - one source for the whole data-repository 
- `dbnomics` — DBnomics: an aggregator of macroeconomic and statistical datasets from central banks, statistical agencies, and international organizations worldwide. No API ke
- `epatri` — EPA Toxics Release Inventory (TRI): facility search by name, part of EPA's tracking of industrial toxic chemical releases. No API key required.
- `euvd` — EUVD: the European Union Vulnerability Database, ENISA's aggregation of CVE, GHSA and vendor advisories. No API key required.
- `fred` — FRED: the Federal Reserve Bank of St. Louis's economic data API, hundreds of thousands of US and international time series. Requires free FRED_API_KEY.
- `ghsa` — GitHub Security Advisories: advisories curated by GitHub across public repositories and package ecosystems. Works keyless (60 req/h); set GITHUB_TOKEN for a hig
- `githubmcp` — GitHub code search via the official Copilot MCP server (search_code, get_file_contents). Requires GITHUB_TOKEN; hidden without it.
- `githubsearch` — GitHub code search: full-text search across public repository contents. Requires GITHUB_TOKEN (the /search/code endpoint rejects unauthenticated requests).
- `guardian` — The Guardian Open Platform: full-text search across Guardian journalism, with article body text. Requires free GUARDIAN_API_KEY.
- `hal` — HAL (Hyper Articles en Ligne): 4M+ full-text French/EU academic deposits with a Solr search across titles, abstracts, and full text. No API key required.
- `hansard` — UK Parliament Hansard: full-text search over Commons and Lords debates, with the complete member-by-member record of any one debate. No API key required.
- `hapi` — HDX HAPI (Humanitarian Data Exchange, Humanitarian API): conflict-event and coordination data. A country-name query resolves to a conflict-events lookup; other 
- `huggingface` — Hugging Face Hub paper search via its MCP hf_fs tool (an hf://papers search). Full text is read via the arxiv source (every result id is a bare arXiv id). No AP
- `library_list_sources`
- `library_health_check`
- `library_ask`
- `library_search` — Search a specific library source by name. Use library_ask instead for natural language queries across multiple sources. Sources marked [full text] support libra
- `library_read` — Fetch text from a library source. Full-text sources return cleaned text (truncated at 200k chars). Metadata sources return item details and an external URL.
- `library_index` — Dry run: fetch text, chunk semantically, score OCR quality. No writes. Full-text sources only.
- `library_ingest` — Chunk, embed, and store a text. Idempotent. Full-text sources only. Requires OPENAI_API_KEY + SUPABASE_URL + SUPABASE_SERVICE_ROLE_KEY.
- `library_recommend` — Get papers similar to a given paper using Semantic Scholar's recommendation engine. Pass a paperId from a semanticscholar search result. Returns up to 500 simil
- `library_answer` — Ask a question in plain English and get a synthesized answer with inline [n] citations, fused across sources with reciprocal rank fusion. Use this instead of li
- `library_research`
- `library_citations`
- `jina` — Jina AI's live web search and page reader MCP server (search_web, read_url). Works keyless for connecting; set JINA_API_KEY for actual search/read calls (unauth
- `jinaarxiv` — Jina AI's search_arxiv tool: arXiv preprint search via the same MCP server as jina. Full text is read via the arxiv source when a result carries an arxiv_id. Wo
- `search` — fake search
- `read` — fake read
- `mdnmcp` — MDN Web Docs's own MCP server: web platform reference and guides, with full document text via get-doc. No API key required. Additive to the existing mdn REST so
- `nvd` — NIST NVD: the National Vulnerability Database, CVE records enriched with CVSS scores and CPE matches. Works keyless at a slow pace; set NVD_API_KEY for a faster
- `paperswithcode` — Papers with Code: machine learning papers cross-referenced with their code implementations.
- `reliefweb` — ReliefWeb: humanitarian reports and situation updates from UN OCHA and partner organizations. Requires a registered RELIEFWEB_APPNAME.
- `rentcast` — RentCast: US rental and sale market statistics by ZIP code. Requires free-tier RENTCAST_API_KEY (50 requests/month).
- `stackexchange` — Stack Overflow (via the Stack Exchange API): advanced full-text question search. Works keyless at the shared rate limit; set STACKEXCHANGE_KEY for a dedicated p
- `twelvedata` — Twelve Data: stock, ETF, and forex symbol search across global exchanges, with a daily time series read. Requires free TWELVEDATA_API_KEY.
- `ukparliament` — UK Parliament Bills API: public legislation before the House of Commons and House of Lords. No API key required.

## Install

**Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"alexandria\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"@the-40-thieves/alexandria-mcp\"\n      ],\n      \"env\": {\n        \"OPENAI_API_KEY\": \"<YOUR_OPENAI_API_KEY>\",\n        \"ALEXANDRIA_API_KEY\": \"<YOUR_ALEXANDRIA_API_KEY>\",\n        \"CORE_API_KEY\": \"<YOUR_CORE_API_KEY>\",\n        \"COURTLISTENER_API_KEY\": \"<YOUR_COURTLISTENER_API_KEY>\",\n        \"GOVINFO_API_KEY\": \"<YOUR_GOVINFO_API_KEY>\",\n        \"GOOGLE_BOOKS_API_KEY\": \"<YOUR_GOOGLE_BOOKS_API_KEY>\",\n        \"GITHUB_TOKEN\": \"<YOUR_GITHUB_TOKEN>\",\n        \"NASA_ADS_API_KEY\": \"<YOUR_NASA_ADS_API_KEY>\",\n        \"EUROPEANA_API_KEY\": \"<YOUR_EUROPEANA_API_KEY>\",\n        \"SEMANTIC_SCHOLAR_API_KEY\": \"<YOUR_SEMANTIC_SCHOLAR_API_KEY>\"\n      }\n    }\n  }\n}"
```
**Credentials it will ask for** (names only — Forge never holds a value):
- `OPENAI_API_KEY` — OpenAI API Key (optional)
- `ALEXANDRIA_API_KEY` — Alexandria API Key (optional)
- `CORE_API_KEY` — Core API Key (optional)
- `COURTLISTENER_API_KEY` — Courtlistener API Key (optional)
- `GOVINFO_API_KEY` — Govinfo API Key (optional)
- `GOOGLE_BOOKS_API_KEY` — Google Books API Key (optional)
- `GITHUB_TOKEN` — GitHub Token (optional)
- `NASA_ADS_API_KEY` — Nasa Ads API Key (optional)
- `EUROPEANA_API_KEY` — Europeana API Key (optional)
- `SEMANTIC_SCHOLAR_API_KEY` — Semantic Scholar API Key (optional)
Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each <YOUR_NAME> in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one.
- This entry needs 10 credentials (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset.

## Blast radius

Moderate blast radius — holds an api key; runs on your machine.
- Floor 26, ceiling 26 (tier: moderate)
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/%40the-40-thieves%2Falexandria-mcp
- Install plan: https://forgeregistry.com/api/v1/packages/%40the-40-thieves%2Falexandria-mcp/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/%40the-40-thieves%2Falexandria-mcp
- HTML page: https://forgeregistry.com/registry/%40the-40-thieves%2Falexandria-mcp
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.