Connect MCP

InSecLab Papers is a Model Context Protocol (MCP) server: ask Claude or Cursor "what is the status of ISL-2026-0012" without opening the web app. Permissions are the same as on the web: you only see the works you are allowed to see.

Connection details

Item	Value
Endpoint	https://papers-inseclab.khoi.pro/mcp (JSON-RPC over HTTP)
Sign-in	The app's own OAuth; CLI tokens papers_… are not used
Client registration	Client ID Metadata Document (CIMD); dynamic client registration (DCR) is off

Clients with CIMD support

On the first connection the client opens the browser at the sign-in page, then the consent page (showing the client name, lab and permissions). Click Cho phép (Allow); the client gets a token that lasts 5 minutes and refreshes it automatically.

Claude Code

claude mcp add --transport http papers https://papers-inseclab.khoi.pro/mcp
# in a Claude Code session: /mcp → choose papers → Authenticate

Claude Desktop: Settings → Connectors → Add custom connector → URL https://papers-inseclab.khoi.pro/mcp → Connect.

Cursor: add to ~/.cursor/mcp.json, then enable papers in Settings → MCP:

{ "mcpServers": { "papers": { "url": "https://papers-inseclab.khoi.pro/mcp" } } }

Tools

Tool	Purpose	Writes data
works_search	Search works with the same filters as the web table	No
work_get	One work: code, title, members, submissions, latest version	No
version_list	Versions of a work, newest first	No
check_report_get	Latest results of the 10 checks	No
diff_get	A 600-second link to the latexdiff PDF	No
latex_flatten	A 600-second link to the flattened .tex file	No
version_upload	Create a new version (never overwrites)	Yes: the client asks you to confirm

Errors look like { "ok": false, "error": { "code": "not_found", … } }. A work you cannot access is reported exactly like a work that does not exist.

Clients without CIMD support

A client reporting invalid_client or "client registration failed" does not support CIMD. Ask the admin to create a public client (PKCE, no secret) and send you its client_id; configure that client_id in your app, then connect as above.

For a client that only supports the device flow, request a code at POST /api/auth/device/code with that client_id, open https://papers-inseclab.khoi.pro/device, enter the code and click Cho phép (Allow). The code lasts 15 minutes and can be approved once; the session must have passed 2FA. The /device page is shared with papers login, but the two kinds of code are different.