IRP
PYPI · IRP-AGENTS
Turn a research paper into working code and prove, claim by claim, how close it gets.
Available components
Last scanned (18 hours ago)
Scores higher than 0% of PyPI servers
Category Education and Research
Recent critical change
CVE-2026-96639 affects this package (23 Oct 2026). See the changelog before you install this server.
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security25
- Malware scan not yet available for this package.Unverified
- CVE check failed: an unpatched critical CVE affects this package; the score is capped at 0. See how to fix → View diagnostics → Fail
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 4 of 43 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to Noshadi-sec/irp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 1 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability76
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3397 tokens (~199/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management7
- Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 17 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 23 Oct 26 0
- CVE-2026-96639 affects this package: high ▼ critical
- 22 Oct 26 0
- Malware scan: pass → unverified ▼ security
- 21 Oct 26 0
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 23 Oct 2026 · Analysed pypi/irp-agents@0.6.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | Noshadi-sec/irp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/Noshadi-sec/irp/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 3365565085 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:8dcea8339f653a66ed4c4a587b09455837234f863ddd1ead7c8723234e2731f4 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Vulnerabilities 39 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-22hg-r758-rrw9 | CVE-2026-112390 | high | yes | |
| GHSA-24rc-8hj2-v98c | CVE-2026-96638 | medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | yes |
| GHSA-254f-3936-288h | CVE-2026-112391 | medium | yes | |
| GHSA-27h8-gf7j-v5hc | CVE-2026-112392 | high | yes | |
| GHSA-332p-7hrc-92wf | CVE-2026-112393 | critical | yes | |
| GHSA-3j72-p6qg-6xp7 | CVE-2026-96642 | high | yes | |
| GHSA-4558-3h8r-v8xp | CVE-2026-112394 | medium | yes | |
| GHSA-462x-pgg6-55fp | CVE-2026-112395 | medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L | yes |
| GHSA-4rm8-3hmm-39fg | CVE-2026-96641 | medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | yes |
| GHSA-4rr5-89j8-mwwm | CVE-2026-112396 | medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
| GHSA-58r4-6rv3-gfh8 | CVE-2026-112397 | high | yes | |
| GHSA-5xm2-6676-qcp9 | CVE-2026-112399 | high | yes | |
| GHSA-65qm-jvmh-6pqg | CVE-2026-112400 | high | yes | |
| GHSA-74r2-7ff9-mjj2 | CVE-2026-112401 | medium | yes | |
| GHSA-78g4-xqwv-q3g8 | high | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | yes | |
| GHSA-7mwm-ghpf-9vrm | CVE-2026-112402 | high | yes | |
| GHSA-8g5g-8vmr-9782 | CVE-2026-112403 | critical | yes | |
| GHSA-9v9v-9qvf-h2hj | CVE-2026-96644 | high | yes | |
| GHSA-c6hw-5grf-ff96 | CVE-2026-112404 | high | yes | |
| GHSA-cp9v-662q-vvx9 | CVE-2026-112405 | high | yes | |
| GHSA-f2g6-542v-9j58 | CVE-2026-112406 | high | yes | |
| GHSA-fc9g-5qg7-mf45 | CVE-2026-112891 | medium | yes | |
| GHSA-g4qv-2jxx-769h | CVE-2026-96643 | high | yes | |
| GHSA-g7cr-3p24-7wf7 | CVE-2026-96778 | high | yes | |
| GHSA-g842-9rc4-69pw | CVE-2026-96637 | high | yes | |
| GHSA-gg2r-wvfm-q9rx | CVE-2026-112892 | high | yes | |
| GHSA-j4m9-6w36-pw47 | CVE-2026-112893 | high | yes | |
| GHSA-jg86-v3jv-hrpm | CVE-2026-112894 | high | yes | |
| GHSA-mrfp-p49p-3hf2 | CVE-2026-96640 | high | yes | |
| GHSA-p4wg-p73j-c528 | CVE-2026-112895 | high | yes | |
| GHSA-p8hx-v2p6-rp84 | CVE-2026-96636 | medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | yes |
| GHSA-pchr-8j38-3x4p | CVE-2026-112896 | high | yes | |
| GHSA-q45j-58j2-45rg | CVE-2026-112897 | high | yes | |
| GHSA-rfgq-q3w2-pmv2 | CVE-2026-112898 | medium | yes | |
| GHSA-v9pv-5gc8-w2m6 | CVE-2026-96639 | critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | yes |
| GHSA-vx6w-vv9f-6gvg | CVE-2026-112899 | medium | yes | |
| GHSA-w889-685w-c8fh | CVE-2026-112900 | critical | yes | |
| GHSA-xgh8-jp6q-p5x8 | CVE-2026-112901 | medium | yes | |
| GHSA-xvh5-g6gv-559v | CVE-2026-112902 | high | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 43 packages
| Packages resolved | 43 |
|---|---|
| Stale | 3 |
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_claim Record a claim ~440
Record one number the paper claims, before writing any code (rule 5): the metric, the value as printed, where it appears and the success bar. The value is checked against the paper text. Claims recorded after code exists are flagged in the report.
| Name | Type | Req | Description |
|---|---|---|---|
| close_abs | – | – | Close if within this absolute difference. |
| close_rel | – | – | Close if within this fraction. |
| comparator | string | – | 'approx' for 'about this value', 'at_least' for lower bounds such as speed-ups, 'at_most' for upper bounds such as error rates. |
| metric | string | yes | Metric name, e.g. 'test_accuracy'. |
| notes | – | – | Anything a reader should know about this claim. |
| page | – | – | PDF page where the claim appears, if known. |
| seeds_in_paper | – | – | Runs or seeds the paper averaged over, if stated. |
| source_file | – | – | Paper file of the printed value, as get_section shows it (e.g. 'main.tex' or 'paper.pdf#page=7'). With source_line, the value is checked at that line. |
| source_line | – | – | Line of the printed value in source_file. |
| statement | string | yes | Short name of the claim, e.g. 'Test accuracy on CIFAR-10'. |
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
| tolerance_abs | – | – | Reproduced if within this absolute difference. |
| tolerance_rel | – | – | Reproduced if within this fraction of the paper's value (0.01 = 1%). |
| value | string | yes | The paper's number exactly as printed, e.g. '94.1%', '0.31' or '2.0x'. Only the paper's own number belongs here, never a result. |
| where | string | yes | Where the claim appears, as a reader would say it: 'Table 2, row 3', 'Figure 4', 'Section 5.2'. |
| where_kind | string | – | Kind of place the claim appears. |
No output schema declared.
No examples provided.
add_guess Record a guess ~172
Record a detail the paper left out, the choice made and why (rule 2: never change the method to make a run succeed; record a guess instead). Every guess appears in the report.
| Name | Type | Req | Description |
|---|---|---|---|
| choice | string | yes | What was chosen, e.g. '5 epochs'. |
| claims | array | – | Claim ids this guess can affect. |
| missing | string | yes | The detail the paper left out, e.g. 'Warmup length not stated'. |
| source | – | – | Where the choice comes from: a citation, a URL or 'common default'. |
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
| why | string | yes | Why, e.g. 'as in cited paper [12]'. |
No output schema declared.
No examples provided.
add_note Record a note ~110
Record a limitation, a forced deviation from the paper, something not checked, or an author contact.
| Name | Type | Req | Description |
|---|---|---|---|
| claims | array | – | Claim ids the note concerns. |
| kind | string | yes | limitation, deviation (a forced change from the paper), not_checked, author_contact or other. |
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
| text | string | yes | The note itself, in plain words. |
No output schema declared.
No examples provided.
compare Compare and judge ~285
Put a claim beside its measurements and record one of four verdicts: reproduced, close, not reproduced, or could not run. Measurements must come from full-scope runs that exited 0; 'could not run' needs the blocking error (rule 3).
| Name | Type | Req | Description |
|---|---|---|---|
| blocking_error | – | – | Could not run: the exact blocking error or constraint. |
| claim_id | string | yes | Claim to judge, e.g. 'c1'. |
| context_measurement_ids | array | – | Measurements shown for context that do not count, e.g. from a shortened run. |
| could_not_run | boolean | – | Record 'could not run' instead of a measured verdict. |
| failed_run_id | – | – | Could not run: the run that failed, if any. |
| measurement_ids | array | – | Measurements from extract_metrics, one per seed or run; their mean is compared. |
| note | – | – | Context for the verdict, shown in the report. |
| reason | – | – | Could not run: short reason, e.g. 'needs 8 GPUs for 2 days'. |
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
| unit_scale | number | – | Power of ten to convert units, e.g. 100 when the log prints 0.938 and the paper 93.8%. |
No output schema declared.
No examples provided.
create_env Create environment ~231
Build a pinned environment for the study's code: a uv virtual environment (fast, not a sandbox) or a Docker image (isolated). Writes the lock file and records its hash. Requires recorded claims (rule 5).
| Name | Type | Req | Description |
|---|---|---|---|
| backend | string | – | 'uv' builds a virtual environment (not a sandbox); 'docker' builds an image runs are isolated in. |
| base_image | – | – | Docker base image; default python:<python>-slim. |
| gpu | boolean | – | Docker runs request all GPUs (--gpus all). |
| name | string | – | Environment name; never reused. |
| packages | array | – | Extra packages, e.g. ['numpy==2.1.0']. |
| python | string | – | Python version, e.g. '3.11'. |
| requirements | – | – | Requirements file inside code/. Defaults to code/requirements.txt when it exists. |
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
| system_packages | array | – | Debian packages for the Docker image. |
No output schema declared.
No examples provided.
extract_metrics Extract metrics ~121
Pull numbers from a completed run's stdout, stderr or the files it wrote, by key, regex, JSON pointer or CSV column. Each measurement keeps its file, line and file hash. Numbers from any other source are refused (rule 1).
| Name | Type | Req | Description |
|---|---|---|---|
| run_id | string | yes | Completed run to read, e.g. 'r3'. |
| specs | array | yes | One spec per number to extract. |
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
No output schema declared.
No examples provided.
fetch_paper Fetch paper ~245
Create the study directory and fetch the paper into it: arXiv LaTeX source first (exact equations), the PDF as fallback and for page images. Records arXiv ID and version, file hashes and an outline of sections, tables, figures, equations and algorithms. Call this first; a study holds one paper.
| Name | Type | Req | Description |
|---|---|---|---|
| paper | string | yes | arXiv ID or URL (e.g. '2501.12345' or '2501.12345v2'), a direct PDF URL, or a local path to a PDF, a LaTeX source directory, or a .tar.gz/.zip source archive. |
| parser | string | – | PDF text parser when no LaTeX is used. 'auto' uses Docling when installed, else pypdf. |
| prefer | string | – | Read LaTeX source when it exists (exact equations), else the PDF. |
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
| with_pdf | boolean | – | Also download the PDF so get_page_image can show figures, tables and equations. |
No output schema declared.
No examples provided.
get_page_image Look at a page ~99
Render one page of the paper PDF as a PNG image, for equations, figures and tables that text extraction loses. Saved under paper/pages/.
| Name | Type | Req | Description |
|---|---|---|---|
| dpi | integer | – | Rendering resolution; raise it for small math. |
| page | integer | yes | 1-based page number of the paper PDF. |
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
No output schema declared.
No examples provided.
get_section Read a section ~227
Read part of the paper with its original file and line numbers: a section, a table, figure, equation or algorithm, a LaTeX label, the abstract, a PDF page, a line range, or 'index' for the full outline. Use the shown file:line when recording claims and method map entries.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | What to read: a section id ('sec:3', 'sec:3.2'), an item id ('tab:2', 'fig:1', 'eq:4', 'alg:1'), a LaTeX label ('eq:loss'), a section title, 'abstract', 'index' for the outline, 'page:5' for one PDF… |
| max_lines | integer | – | Return at most this many lines. |
| offset | integer | – | Skip this many lines of the selection (paging). |
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
No output schema declared.
No examples provided.
list_claims List claims ~52
List every recorded claim with its success bar and current verdict.
| Name | Type | Req | Description |
|---|---|---|---|
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
No output schema declared.
No examples provided.
map_method Map method to code ~211
Link an equation or algorithm step in the paper to the file and line in code/ that implements it. The file's hash is recorded so the report flags mappings whose code changed later.
| Name | Type | Req | Description |
|---|---|---|---|
| code_file | string | yes | File inside the study's code/ directory, e.g. 'src/loss.py'. |
| code_line | integer | yes | First line that implements the element. |
| end_line | – | – | Last line, when the implementation spans several. |
| note | – | – | Why this line implements the element, if not obvious. |
| paper_element | string | yes | The paper element, e.g. 'Eq. 3 (loss)' or 'Algorithm 1, line 4'. |
| paper_ref | – | – | Index id or LaTeX label of that element, e.g. 'eq:3' or 'eq:loss'; checked against the paper. |
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
No output schema declared.
No examples provided.
report Write the report ~137
Write report.md and report.json from the evidence log only: claim table, verdicts, guesses, method map and provenance. Refuses until every claim has a verdict with evidence (the completion gate) unless draft=true.
| Name | Type | Req | Description |
|---|---|---|---|
| bundle | – | – | Absolute path of a new directory to receive a shareable bundle (report, evidence, code, locks, logs; never the paper PDF or source). |
| draft | boolean | – | Write report.draft.md/json even if the completion gate has not passed. |
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
No output schema declared.
No examples provided.
run Run a command ~333
Run one command in code/ with the named environment. Saves stdout and stderr, exit code, time, peak memory, seed, the code commit and the hash of every file the run writes. Only scope 'full' can count toward a verdict (rule 4). Use wait=false and run_status for long runs.
| Name | Type | Req | Description |
|---|---|---|---|
| command | string | yes | Shell command to run inside the environment, e.g. 'python train.py --epochs 30'. |
| commit | boolean | – | Commit code/ to git before the run so the report names the exact code. |
| cwd | string | – | Working directory inside code/. |
| env | – | – | Environment from create_env; null uses the host environment (no lock file). |
| memory_limit | – | – | Docker only: memory cap such as '8g'. |
| network | boolean | – | Docker only: allow network access during the run. |
| note | – | – | What this run is for, shown in the report. |
| scope | string | – | 'full' is the faithful configuration and is the only scope that can count; 'shortened' (fewer steps or data) and 'smoke' never count. |
| seed | – | – | Seed, passed as IRP_SEED and PYTHONHASHSEED and recorded. |
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
| timeout_s | integer | – | Stop the run after this many seconds. |
| wait | boolean | – | Wait for the run to finish. For runs longer than your client's tool timeout, pass false and poll run_status. |
No output schema declared.
No examples provided.
run_remote Run on a GPU cloud ~305
Run one command on a paid GPU provider (Modal today; RunPod and Hugging Face Jobs planned). Returns a cost estimate and refuses until the person approves it (rule 6) and the estimate fits the budget a person set with `irp budget`. The time limit equals the estimated hours.
| Name | Type | Req | Description |
|---|---|---|---|
| approved | boolean | – | Set true only after showing the person the cost estimate and receiving their approval. |
| command | string | yes | Shell command to run in the remote sandbox. |
| env | string | – | Environment whose requirements and Python version the sandbox uses. |
| gpu | string | yes | GPU type, e.g. 'A10G', 'A100', 'H100'. |
| gpu_count | integer | – | Number of GPUs; multiplies the estimate. |
| hours | number | yes | Time limit in hours; also the basis of the cost estimate. |
| note | – | – | What this run is for, shown in the report. |
| outputs | array | – | Files under code/ to copy back after the run. |
| provider | string | – | Compute provider. |
| scope | string | – | 'full' is the only scope that can count; see run. |
| seed | – | – | Seed, passed as IRP_SEED and recorded. |
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
| wait | boolean | – | Wait for completion; remote runs usually outlast tool timeouts. |
No output schema declared.
No examples provided.
run_status Run status ~113
Report a run's status, exit code and the last lines of its output; optionally wait for it to finish.
| Name | Type | Req | Description |
|---|---|---|---|
| run_id | string | yes | Run id, e.g. 'r3'. |
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
| tail_lines | integer | – | Lines of stdout and stderr to return. |
| wait_s | integer | – | Wait up to this many seconds for the run to finish. |
No output schema declared.
No examples provided.
study_status Study status ~73
Show the study at a glance: paper, claims and verdicts, guesses, environments, runs, and what still blocks a final report. Use it to resume work.
| Name | Type | Req | Description |
|---|---|---|---|
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
No output schema declared.
No examples provided.
verify Verify the evidence ~58
Recheck the evidence log's hash chain and the hash of every recorded file; reports each problem.
| Name | Type | Req | Description |
|---|---|---|---|
| study | string | yes | Absolute path of the study directory. fetch_paper creates it; every other tool reads and appends to its evidence log. |
No output schema declared.
No examples provided.
How do I install the IRP MCP server?
IRP runs locally as a PyPI package, launched with uvx irp-agents. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · irp-agents
claude mcp add noshadi-sec-irp -- uvx irp-agents
What is the IRP MCP server?
IRP is an MCP server listed in the public MCP registry as io.github.Noshadi-sec/irp. Turn a research paper into working code and prove, claim by claim, how close it gets. This page covers its PyPI package (irp-agents).
What tools does the IRP MCP server expose?
IRP exposes 17 tools: fetch_paper, get_section, get_page_image, add_claim, list_claims, and 12 more. Their descriptions and schemas cost roughly 3,212 tokens of context every time the server is loaded.
Is the IRP MCP server still maintained?
IRP is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the IRP MCP server under?
IRP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.