academic-research-tools 0.1.0__tar.gz

academic_research_tools-0.1.0/.env.example

@@ -0,0 +1,15 @@
+# All credentials are optional unless you use the corresponding provider.
+# Keep this file empty in version control. Put real values in environment
+# variables or a local `.env` file that is ignored by Git.
+
+# Optional: dedicated Semantic Scholar quota.
+SEMANTIC_SCHOLAR_API_KEY=
+
+# Required only for Scopus tools. Access may also depend on subscription or IP.
+ELSEVIER_API_KEY=
+
+# Optional institutional token for eligible Scopus subscriptions.
+ELSEVIER_INST_TOKEN=
+
+# Required only for experimental Google Scholar discovery through SerpAPI.
+SERPAPI_API_KEY=

academic_research_tools-0.1.0/CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and releases follow [Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+### Planned
+
+- Crossref and OpenAlex providers
+- Citation and reference graph traversal
+- BibTeX and CSV export
+- Structured literature-screening sessions
+
+## [0.1.0] - 2026-09-08
+
+### Added
+
+- Harness-neutral Python API with normalized paper metadata and provenance
+- Unified multi-provider search with DOI, arXiv ID, and title-year deduplication
+- Official arXiv API provider with no key requirement
+- Official Semantic Scholar Academic Graph provider with optional authentication
+- Official Elsevier Scopus Search, Abstract Retrieval, and Author Search providers
+- Experimental Google Scholar discovery through optional SerpAPI
+- Local stdio MCP server using the official MCP Python SDK v2
+- Command-line status, search, and MCP serve commands
+- Native Hermes Agent adapter with per-provider credential gating
+- Synthetic offline tests, CI, security policy, and provider documentation
+
+[Unreleased]: https://github.com/istgrudd/academic-research-tools/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/istgrudd/academic-research-tools/releases/tag/v0.1.0

academic_research_tools-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,78 @@
+# Contributing
+
+Thanks for improving Academic Research Tools. Small, focused pull requests are easier to review and release safely.
+
+## Before opening code
+
+For new providers, public API changes, credential handling, or large refactors, open an issue first. Describe:
+
+- the research workflow being improved
+- the official or third-party API involved
+- authentication and rate-limit requirements
+- expected normalized fields and provenance
+- relevant terms or data-license constraints
+
+Bug fixes and documentation corrections can go directly to a pull request.
+
+## Development setup
+
+```bash
+git clone https://github.com/istgrudd/academic-research-tools.git
+cd academic-research-tools
+python -m venv .venv
+. .venv/bin/activate
+python -m pip install -e '.[dev]'
+```
+
+Run all local quality gates:
+
+```bash
+ruff check src tests __init__.py
+pytest
+python -m compileall -q src __init__.py
+python -m build
+python -m twine check dist/*
+```
+
+## Test requirements
+
+- Add a failing test before changing behaviour.
+- Use synthetic, minimal fixtures.
+- Do not include copied provider responses, licensed datasets, personal records, or credentials.
+- Unit and CI tests must not make live provider calls.
+- Test error responses, pagination, rate limits, and missing credentials where applicable.
+- Preserve provenance when normalizing or merging records.
+
+A manual live smoke test is optional before a release and must use the maintainer's own credential and quota. Never print the credential or commit the output.
+
+## Provider implementation checklist
+
+A provider should:
+
+1. live under `src/academic_research/providers/`
+2. use an official API where available
+3. validate limits before making a request
+4. use a bounded timeout and a descriptive user agent
+5. translate provider errors into actionable exceptions
+6. return normalized models with source IDs and provenance
+7. report whether authentication is required or optional
+8. document terms, coverage, quotas, and access caveats
+9. include synthetic offline tests
+
+Direct scraping of websites that prohibit it is out of scope.
+
+## Pull requests
+
+Keep commits understandable and use descriptive messages such as:
+
+```text
+feat: add Crossref provider
+fix: preserve DOI during Semantic Scholar normalization
+docs: clarify Scopus subscription requirements
+```
+
+In the pull request, include the commands run and their real outputs. CI must pass before merge. Maintainers may ask for narrower scope, additional fixtures, or legal/provider clarification.
+
+## Releases
+
+Only maintainers publish packages and tags. The release process verifies a clean source distribution and wheel, installs the wheel in a fresh environment, smoke-tests the CLI and MCP server, and checks that no credentials or large provider responses are included.

academic_research_tools-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rudi Firdaus
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

academic_research_tools-0.1.0/MANIFEST.in

@@ -0,0 +1,18 @@
+include .env.example
+include CHANGELOG.md
+include CONTRIBUTING.md
+include LICENSE
+include README.md
+include SECURITY.md
+include __init__.py
+include plugin.yaml
+
+recursive-include docs *.md
+recursive-include integrations *.md
+recursive-include src/academic_research/skills *.md
+recursive-include tests *.py
+
+global-exclude __pycache__
+global-exclude *.py[cod]
+global-exclude .env
+global-exclude .DS_Store

academic_research_tools-0.1.0/PKG-INFO

@@ -0,0 +1,218 @@
+Metadata-Version: 2.4
+Name: academic-research-tools
+Version: 0.1.0
+Summary: Evidence-grounded academic literature discovery for AI agents, MCP clients, and Python applications.
+Author-email: Rudi Firdaus <digitalrudi14@gmail.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/istgrudd/academic-research-tools
+Project-URL: Documentation, https://github.com/istgrudd/academic-research-tools#readme
+Project-URL: Issues, https://github.com/istgrudd/academic-research-tools/issues
+Keywords: academic-research,arxiv,scopus,semantic-scholar,mcp
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Science/Research
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Scientific/Engineering :: Information Analysis
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: mcp<3,>=2.2
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == "dev"
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: ruff>=0.9; extra == "dev"
+Requires-Dist: twine>=5; extra == "dev"
+Dynamic: license-file
+
+# Academic Research Tools
+
+Evidence-grounded academic literature discovery for AI agents, MCP clients, command-line workflows, and Python applications.
+
+[![CI](https://github.com/istgrudd/academic-research-tools/actions/workflows/ci.yml/badge.svg)](https://github.com/istgrudd/academic-research-tools/actions/workflows/ci.yml)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue.svg)](https://www.python.org/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
+Academic Research Tools provides one normalized interface over several literature sources while preserving the source and identifiers of every record. Its core is independent of any agent harness; MCP, CLI, Python, and Hermes are adapters over the same implementation.
+
+## Providers
+
+| Provider | Credential | Availability | Notes |
+|---|---|---|---|
+| arXiv | None | Core | Official public Atom API |
+| Semantic Scholar | Optional `SEMANTIC_SCHOLAR_API_KEY` | Core | Unauthenticated access uses shared public quota |
+| Scopus | `ELSEVIER_API_KEY` | Core, optional at runtime | Metadata and abstracts may require subscription or institutional IP |
+| Google Scholar through SerpAPI | `SERPAPI_API_KEY` | Experimental | Third-party SerpAPI integration; not direct scraping or an official Google Scholar API |
+
+The package remains useful without credentials: arXiv is available immediately and Semantic Scholar can be queried without a key, subject to public rate limits.
+
+## Features
+
+- Normalized `Paper`, `Author`, `SearchResult`, and `UnifiedSearchResult` contracts
+- Concurrent multi-provider search with partial-failure reporting
+- Conservative deduplication by DOI, base arXiv ID, or normalized title plus year
+- Per-record provenance and provider identifiers
+- Local stdio MCP server for compatible clients
+- Automation-friendly CLI and direct Python API
+- Thin native Hermes Agent adapter
+- Local-first credentials with no telemetry
+
+## Installation
+
+### From GitHub
+
+```bash
+git clone https://github.com/istgrudd/academic-research-tools.git
+cd academic-research-tools
+python -m venv .venv
+. .venv/bin/activate
+python -m pip install .
+```
+
+### From PyPI
+
+After the first package release:
+
+```bash
+pip install academic-research-tools
+# or
+pipx install academic-research-tools
+```
+
+No credential is required to verify the installation:
+
+```bash
+academic-research --version
+academic-research status
+academic-research search "traffic flow estimation low visibility" \
+  --sources arxiv semantic_scholar --limit 5
+```
+
+See [Getting started](docs/getting-started.md) and [Credential setup](docs/credentials.md).
+
+## MCP quick start
+
+Run the local stdio server:
+
+```bash
+academic-research serve
+```
+
+If you use `uvx` without a prior install, configure the MCP client to execute:
+
+```bash
+uvx --from academic-research-tools academic-research serve
+```
+
+Generic MCP configuration:
+
+```json
+{
+  "mcpServers": {
+    "academic-research": {
+      "command": "uvx",
+      "args": [
+        "--from",
+        "academic-research-tools",
+        "academic-research",
+        "serve"
+      ],
+      "env": {
+        "SEMANTIC_SCHOLAR_API_KEY": "${SEMANTIC_SCHOLAR_API_KEY}",
+        "ELSEVIER_API_KEY": "${ELSEVIER_API_KEY}"
+      }
+    }
+  }
+}
+```
+
+Only include environment variables for providers you intend to use. Details: [generic MCP](docs/integrations/generic-mcp.md), [Claude Desktop](docs/integrations/claude-desktop.md), and [Cursor](docs/integrations/cursor.md).
+
+### MCP tools
+
+- `research_provider_status`
+- `search_papers`
+- `search_arxiv`
+- `search_semantic_scholar`
+- `search_scopus`
+- `get_scopus_abstract`
+- `search_scopus_authors`
+- `search_google_scholar`
+
+## Python API
+
+```python
+from academic_research import ResearchService
+
+client = ResearchService.from_environment()
+result = client.search(
+    "traffic flow estimation under low visibility",
+    sources=["arxiv", "semantic_scholar", "scopus"],
+    limit_per_source=10,
+    year="2020-2026",
+)
+
+for paper in result.papers:
+    print(paper.title, paper.doi, paper.provenance)
+
+if result.errors:
+    print("Partial provider failures:", result.errors)
+```
+
+A provider that is not configured is excluded from `ResearchService.from_environment()`. Explicitly requesting a missing provider returns an actionable error rather than silently changing the requested source list.
+
+## Hermes Agent
+
+Current Hermes installations can install the repository directly:
+
+```bash
+hermes plugins install istgrudd/academic-research-tools --enable
+```
+
+Pip-distributed discovery is also declared through the `hermes_agent.plugins` entry-point group. Scopus and SerpAPI use per-tool checks, so missing optional credentials never disable arXiv or Semantic Scholar.
+
+See [Hermes integration](docs/integrations/hermes.md).
+
+## Credential safety
+
+Credentials are read only from environment variables. This project does not:
+
+- accept secrets as command-line arguments
+- print credential values in `status`
+- store credentials or API responses automatically
+- send telemetry
+- require all providers to be configured
+
+Do not commit `.env`; it is ignored by Git. See [SECURITY.md](SECURITY.md).
+
+## Development
+
+```bash
+python -m venv .venv
+. .venv/bin/activate
+python -m pip install -e '.[dev]'
+ruff check src tests __init__.py
+pytest
+python -m build
+```
+
+Tests use synthetic fixtures and do not spend provider quota. See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Scope and limitations
+
+- Search ranking and coverage differ by provider.
+- Citation counts from different providers are retained with provenance and should not be treated as directly interchangeable.
+- Deduplication is intentionally conservative; ambiguous records may remain separate.
+- This project does not bypass paywalls or grant access beyond the user's provider entitlement.
+- Remote hosted MCP, long-term credential storage, and automatic literature-review decisions are outside the v0.1 scope.
+
+## Legal and data-provider notice
+
+This project is an independent, unofficial integration and is not affiliated with or endorsed by Elsevier, Scopus, Semantic Scholar, arXiv, Google, or SerpAPI. Users are responsible for complying with each provider's API terms, acceptable-use policies, subscription conditions, and data licenses. The MIT license covers this project's source code, not provider data or services.
+
+Thank you to arXiv for use of its open access interoperability.
+
+## License
+
+Source code is available under the [MIT License](LICENSE).

academic_research_tools-0.1.0/README.md

@@ -0,0 +1,190 @@
+# Academic Research Tools
+
+Evidence-grounded academic literature discovery for AI agents, MCP clients, command-line workflows, and Python applications.
+
+[![CI](https://github.com/istgrudd/academic-research-tools/actions/workflows/ci.yml/badge.svg)](https://github.com/istgrudd/academic-research-tools/actions/workflows/ci.yml)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue.svg)](https://www.python.org/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
+Academic Research Tools provides one normalized interface over several literature sources while preserving the source and identifiers of every record. Its core is independent of any agent harness; MCP, CLI, Python, and Hermes are adapters over the same implementation.
+
+## Providers
+
+| Provider | Credential | Availability | Notes |
+|---|---|---|---|
+| arXiv | None | Core | Official public Atom API |
+| Semantic Scholar | Optional `SEMANTIC_SCHOLAR_API_KEY` | Core | Unauthenticated access uses shared public quota |
+| Scopus | `ELSEVIER_API_KEY` | Core, optional at runtime | Metadata and abstracts may require subscription or institutional IP |
+| Google Scholar through SerpAPI | `SERPAPI_API_KEY` | Experimental | Third-party SerpAPI integration; not direct scraping or an official Google Scholar API |
+
+The package remains useful without credentials: arXiv is available immediately and Semantic Scholar can be queried without a key, subject to public rate limits.
+
+## Features
+
+- Normalized `Paper`, `Author`, `SearchResult`, and `UnifiedSearchResult` contracts
+- Concurrent multi-provider search with partial-failure reporting
+- Conservative deduplication by DOI, base arXiv ID, or normalized title plus year
+- Per-record provenance and provider identifiers
+- Local stdio MCP server for compatible clients
+- Automation-friendly CLI and direct Python API
+- Thin native Hermes Agent adapter
+- Local-first credentials with no telemetry
+
+## Installation
+
+### From GitHub
+
+```bash
+git clone https://github.com/istgrudd/academic-research-tools.git
+cd academic-research-tools
+python -m venv .venv
+. .venv/bin/activate
+python -m pip install .
+```
+
+### From PyPI
+
+After the first package release:
+
+```bash
+pip install academic-research-tools
+# or
+pipx install academic-research-tools
+```
+
+No credential is required to verify the installation:
+
+```bash
+academic-research --version
+academic-research status
+academic-research search "traffic flow estimation low visibility" \
+  --sources arxiv semantic_scholar --limit 5
+```
+
+See [Getting started](docs/getting-started.md) and [Credential setup](docs/credentials.md).
+
+## MCP quick start
+
+Run the local stdio server:
+
+```bash
+academic-research serve
+```
+
+If you use `uvx` without a prior install, configure the MCP client to execute:
+
+```bash
+uvx --from academic-research-tools academic-research serve
+```
+
+Generic MCP configuration:
+
+```json
+{
+  "mcpServers": {
+    "academic-research": {
+      "command": "uvx",
+      "args": [
+        "--from",
+        "academic-research-tools",
+        "academic-research",
+        "serve"
+      ],
+      "env": {
+        "SEMANTIC_SCHOLAR_API_KEY": "${SEMANTIC_SCHOLAR_API_KEY}",
+        "ELSEVIER_API_KEY": "${ELSEVIER_API_KEY}"
+      }
+    }
+  }
+}
+```
+
+Only include environment variables for providers you intend to use. Details: [generic MCP](docs/integrations/generic-mcp.md), [Claude Desktop](docs/integrations/claude-desktop.md), and [Cursor](docs/integrations/cursor.md).
+
+### MCP tools
+
+- `research_provider_status`
+- `search_papers`
+- `search_arxiv`
+- `search_semantic_scholar`
+- `search_scopus`
+- `get_scopus_abstract`
+- `search_scopus_authors`
+- `search_google_scholar`
+
+## Python API
+
+```python
+from academic_research import ResearchService
+
+client = ResearchService.from_environment()
+result = client.search(
+    "traffic flow estimation under low visibility",
+    sources=["arxiv", "semantic_scholar", "scopus"],
+    limit_per_source=10,
+    year="2020-2026",
+)
+
+for paper in result.papers:
+    print(paper.title, paper.doi, paper.provenance)
+
+if result.errors:
+    print("Partial provider failures:", result.errors)
+```
+
+A provider that is not configured is excluded from `ResearchService.from_environment()`. Explicitly requesting a missing provider returns an actionable error rather than silently changing the requested source list.
+
+## Hermes Agent
+
+Current Hermes installations can install the repository directly:
+
+```bash
+hermes plugins install istgrudd/academic-research-tools --enable
+```
+
+Pip-distributed discovery is also declared through the `hermes_agent.plugins` entry-point group. Scopus and SerpAPI use per-tool checks, so missing optional credentials never disable arXiv or Semantic Scholar.
+
+See [Hermes integration](docs/integrations/hermes.md).
+
+## Credential safety
+
+Credentials are read only from environment variables. This project does not:
+
+- accept secrets as command-line arguments
+- print credential values in `status`
+- store credentials or API responses automatically
+- send telemetry
+- require all providers to be configured
+
+Do not commit `.env`; it is ignored by Git. See [SECURITY.md](SECURITY.md).
+
+## Development
+
+```bash
+python -m venv .venv
+. .venv/bin/activate
+python -m pip install -e '.[dev]'
+ruff check src tests __init__.py
+pytest
+python -m build
+```
+
+Tests use synthetic fixtures and do not spend provider quota. See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Scope and limitations
+
+- Search ranking and coverage differ by provider.
+- Citation counts from different providers are retained with provenance and should not be treated as directly interchangeable.
+- Deduplication is intentionally conservative; ambiguous records may remain separate.
+- This project does not bypass paywalls or grant access beyond the user's provider entitlement.
+- Remote hosted MCP, long-term credential storage, and automatic literature-review decisions are outside the v0.1 scope.
+
+## Legal and data-provider notice
+
+This project is an independent, unofficial integration and is not affiliated with or endorsed by Elsevier, Scopus, Semantic Scholar, arXiv, Google, or SerpAPI. Users are responsible for complying with each provider's API terms, acceptable-use policies, subscription conditions, and data licenses. The MIT license covers this project's source code, not provider data or services.
+
+Thank you to arXiv for use of its open access interoperability.
+
+## License
+
+Source code is available under the [MIT License](LICENSE).

academic_research_tools-0.1.0/SECURITY.md

@@ -0,0 +1,48 @@
+# Security Policy
+
+## Supported versions
+
+Until a stable release, only the latest `0.1.x` release receives security fixes.
+
+## Reporting a vulnerability
+
+Please do not open a public issue for credential exposure, command execution, dependency confusion, path traversal, or another exploitable vulnerability.
+
+Prefer a private GitHub Security Advisory:
+
+1. open the repository's **Security** tab
+2. select **Report a vulnerability**
+3. include affected version, reproduction steps, impact, and a suggested mitigation if known
+
+If private reporting is unavailable, contact `digitalrudi14@gmail.com` with the subject `Academic Research Tools security report`. Do not include real API keys or provider data in the initial message.
+
+## Credential model
+
+Academic Research Tools is local-first:
+
+- provider credentials are read from environment variables
+- credentials are not accepted as CLI arguments
+- `status` reports booleans only and never echoes values
+- no telemetry is implemented
+- provider responses are returned to the caller and are not automatically persisted
+- MCP v0.1 uses local stdio transport rather than a hosted credential-custody service
+
+`.env` files are ignored by Git. `.env.example` contains empty values only. Users remain responsible for their shell history, process environment, MCP host configuration, local file permissions, and provider account security.
+
+## Safe disclosure and rotation
+
+If a credential may have been exposed:
+
+1. revoke or rotate it with the provider immediately
+2. remove it from current files and runtime configuration
+3. if committed, rewrite repository history where appropriate
+4. invalidate cached CI artifacts or logs that contained it
+5. notify affected collaborators privately
+
+Deleting only the latest Git commit is not sufficient after a secret has been pushed.
+
+## Provider and data security boundaries
+
+The MIT license covers this source code, not provider data. This project does not grant access beyond a user's API key, subscription, or institutional network entitlement. Vulnerabilities in Elsevier, Semantic Scholar, arXiv, Google, SerpAPI, an MCP host, or another dependency should also be reported to the responsible vendor.
+
+Do not submit vulnerability reports containing large copyrighted API responses, unpublished papers, personal data, or third-party credentials.

academic_research_tools-0.1.0/__init__.py

@@ -0,0 +1,14 @@
+"""Directory-plugin shim for installing this repository directly in Hermes."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_SOURCE = Path(__file__).parent / "src"
+if str(_SOURCE) not in sys.path:
+    sys.path.insert(0, str(_SOURCE))
+
+from academic_research.hermes_plugin import register  # noqa: E402
+
+__all__ = ["register"]

academic_research_tools-0.1.0/docs/architecture.md

@@ -0,0 +1,48 @@
+# Architecture
+
+Academic Research Tools separates data access from agent integration.
+
+```text
+Claude · Hermes · Cursor · other MCP hosts · CLI · Python
+                         │
+                 adapters / MCP
+                         │
+       validation · normalization · deduplication
+                         │
+       arXiv · Semantic Scholar · Scopus · SerpAPI
+```
+
+## Core
+
+`src/academic_research/` contains provider-neutral contracts and orchestration:
+
+- `models.py`: JSON-safe normalized records
+- `service.py`: provider selection, concurrent searches, partial failures, and conservative deduplication
+- `status.py`: credential-safe availability booleans
+- `providers/`: official or explicitly documented third-party API clients
+
+Core provider code has no dependency on Hermes or another agent harness.
+
+## Adapters
+
+- `mcp_server.py` exposes local stdio tools through the official MCP SDK.
+- `cli.py` offers status, search, and serve commands.
+- `hermes_plugin.py` registers native Hermes tools and delegates to the same facade.
+
+## Failure model
+
+Provider failures are isolated. Unified search returns successful records plus an `errors` mapping and warnings. A caller can decide whether partial evidence is acceptable.
+
+## Deduplication
+
+Records merge in this order:
+
+1. normalized DOI
+2. base arXiv ID
+3. normalized title plus publication year
+
+The merge retains source IDs, contributing providers, provider-specific metadata, and citation-count provenance. It prefers a non-empty or richer abstract but does not infer missing claims.
+
+## Credential boundary
+
+Provider keys enter only through process environment variables. Local stdio MCP avoids a hosted credential-custody service. Remote MCP transport and persistent secret storage are intentionally outside v0.1.