Local Deep Research
local-deep-research · by LearningCircuit
Local Deep Research achieves ~95% on SimpleQA benchmark (tested with GPT-4.1-mini). Supports local and cloud LLMs (Ollama, Google, Anthropic, ...). Searches 10+ sources - arXiv, PubMed, web, and your private documents. Everything Local & Encrypted.
No known CVEs
MIT license
Actively maintained
Last commit 1d ago
Works with most clients
Transport: stdio, sse, http
0 tools
Grade F
Step 1
Install in your client
Config is the same across clients — only the file and path differ.
CD
Supported in Claude Desktopstdio, sse, http · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"local-deep-research": {
"env": {
"LDR_LLM_PROVIDER": "openai",
"LDR_LLM_OPENAI_API_KEY": "sk-..."
},
"command": "ldr-mcp"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/local-deep-research)
Read me
What Local Deep Research does
AI-powered research assistant for deep, agentic research
Test This Server
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
uvx 'local-deep-research' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Scored, not listed
Why this score
Five weighted categories — click any category to see the underlying evidence.
Score breakdown
62/100across 5 weighted dimensions
0255075100
23
15
14
10
−38
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev3 fixed
CVE-2026-46526medium · fixedCVSS 5
local-deep-research has an SSRF bypass in `safe_get`
### Summary The URL checking logic in local-deep-research has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. ### Details The current project uses `validate_url` to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by urlparse to prevent SSRF attacks. <img width="1173" height="1107" alt="QQ20260430-212334-30-1" src="https://github.com/user-attachments/assets/52b356aa-9ad3-4b1d-a472-39a2ada3ea23" /> Howeve
CVE-2026-43979medium · fixedCVSS 5
local-deep-research is Vulnerable to HTML Injection via Unescaped User Input in PDF Export (`pdf_service.py:_markdown_to_html`)
## Summary `PDFService._markdown_to_html()` constructs an HTML document by interpolating user-controlled values — specifically `title` (sourced from `research.title` or `research.query`) and `metadata` key-value pairs — directly into an f-string without any HTML escaping. An authenticated attacker can craft a research query containing HTML special characters to inject arbitrary HTML tags into the document processed by WeasyPrint during PDF export. This injection can be chained to trigger a Serv
CVE-2025-67743medium · fixedCVSS 6.3
Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service
## Summary The download service (`download_service.py`) makes HTTP requests using raw `requests.get()` without utilizing the application's SSRF protection (`safe_requests.py`). This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints (AWS/GCP/Azure), as well as perform internal network reconnaissance, by submitting malicious URLs through the API, depending on the deployment and surrounding controls. **CWE**: CWE-918 (Server-Side Request Forger
Community
Reviews
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is Local Deep Research safe to use?
- Local Deep Research has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
- How do I install Local Deep Research?
- Local Deep Research supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
- What AI clients work with Local Deep Research?
- Local Deep Research is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
- Is Local Deep Research actively maintained?
- Local Deep Research is actively maintained — last commit was 1 day ago. It has 8,606 GitHub stars.
Related
Similar servers
Others in search / ai-ml
Context797Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors
58.2k 2
Tavily Mcp96Production ready MCP server with real-time search, extract, map & crawl.
2.2k 4
Sequential Thinking MCP Server96Dynamic problem-solving through sequential thought chains
87.8k 1
Brave Search MCP Server96Web and local search using Brave Search API
87.7k 2
MCP Security Weekly
Get CVE alerts and security updates for Local Deep Research and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.