catalog / Research / arxiv.py — arXiv API Python Wrapper

⇄ConnectorResearchFree

arxiv.py — arXiv API Python Wrapper

Name: arxiv.py — arXiv API Python Wrapper
Availability: InStock
Author: ai-supply

Pythonic client for the arXiv API: search, download, and stream 2M+ preprints by query, author, or ID.

@ai-supply

Instalações36k

⟳ upstream 4.0.0 · updated 2mo ago

↗ Repositório fonte

← More Research Research leaderboard →How we grade security →Source ↗

✓ Grade A · 95/100 · SafeSecurity assessment

✓No compromise signals9capabilities surfaced1known CVE9of 20 OWASP controls clear

External endpoints declaredExternal endpoints declaredExternal endpoints declaredExternal endpoints declared

scanned 18d agoosv · gitleaks · opengrep · picklescan + heuristicsfull breakdown in the Security tab ↓

arxiv.py — arXiv API Python Wrapper

arxiv.py is a lightweight, well-maintained Python wrapper for the arXiv API, enabling agents and researchers to search, stream, and download papers from the largest open-access preprint repository with 2M+ papers.

Key features

Rich search with filters: category, date range, author, abstract keywords
Lazy streaming results — avoids loading full pages at once
Auto-retry on transient API errors
One-line PDF download
Typed Result objects with all metadata (DOI, categories, journal ref)

Quick start

pip install arxiv

import arxiv

search = arxiv.Search(
    query="large language models",
    max_results=5,
    sort_by=arxiv.SortCriterion.SubmittedDate
)
for r in arxiv.Client().results(search):
    print(r.title, r.pdf_url)
    r.download_pdf(dirpath="./papers")

npx ai-supply add arxiv-py-api-wrapper

Curated mirror of the open-source arxiv.py (MIT). Get it from the source.

✓ Security: Safe · 9595/100 · grade Ascanned 18d ago

✓ no compromise signals10 risk-surface · 5/20 OWASP controls flagged

Compromise signals — malicious or tampered code (leaked secrets, backdoors, a dropped executable) — reduce the score, and known dependency CVEs carry a bounded penalty (they warrant review but never QUARANTINE — update the dependency to clear). Other dangerous-by-capability traits are risk surface, expected for some capabilities. Every finding is mapped to its OWASP control below.

What this capability can do · med confidence (static)

⚑ filesystem⚑ network

egress → stackoverflow.com, img.shields.io, pypi.org, lukasschwab.me, arxiv.org, export.arxiv.org, astral.sh, wiki.python.org +9

stackoverflow.comgithub.comimg.shields.iopypi.orglukasschwab.mearxiv.orgexport.arxiv.orgastral.sh

Findings mapped to the OWASP Top 10 for LLM Applications (2025) and the OWASP Machine Learning Security Top 10. Expand any flagged control for the exact findings — compromise reduces the score; expected/risk-surface do not, except a known CVE, which carries a small bounded penalty (high/critical → Review).

OWASP Top 10 for LLM Applications

⚠LLM03Supply Chainmedium

Vulnerable/compromised dependencies, models or archives in the artifact.

•Vulnerable dependencies — 2 known vulnerabilities in: pip@26.1 (CWE-1395)known CVE · -5 pts

⚠LLM05Improper Output Handlingmedium

Code that pipes model/user output into shell, eval, SQL or paths unsafely.

•Suspicious code patterns — pickle deserialization · lukasschwab-arxiv.py-93315e7/tests/test_errors.py (CWE-502)risk surface

⚠LLM06Excessive Agencylow

Over-broad tool/permission surface or unrestricted egress.

•External endpoints declared — 1 distinct host(s) · lukasschwab-arxiv.py-93315e7/.github/ISSUE_TEMPLATE/question.mdrisk surface

•External endpoints declared — 7 distinct host(s) · lukasschwab-arxiv.py-93315e7/README.mdrisk surface

•External endpoints declared — 4 distinct host(s) · lukasschwab-arxiv.py-93315e7/arxiv/__init__.pyrisk surface

•External endpoints declared — 2 distinct host(s) · lukasschwab-arxiv.py-93315e7/pyproject.tomlrisk surface

•External endpoints declared — 5 distinct host(s) · lukasschwab-arxiv.py-93315e7/tests/fixtures/id_astro-ph_0601001_s0_m100_3150dca9dc76.jsonrisk surface

•External endpoints declared — 10 distinct host(s) · lukasschwab-arxiv.py-93315e7/tests/fixtures/q_testing_s0_m100_cfe7536492ca.jsonrisk surface

•External endpoints declared — 6 distinct host(s) · lukasschwab-arxiv.py-93315e7/tests/fixtures/q_testing_s10_m10_34e56e15aaac.jsonrisk surface

•External endpoints declared — 3 distinct host(s) · lukasschwab-arxiv.py-93315e7/tests/test_errors.pyrisk surface

§LLM09MisinformationGovernance

Artifacts designed to produce false/deceptive output.

Detectable only by runtime behavioral evaluation; addressed via responsible-use attestation.

◷LLM10Unbounded ConsumptionRuntime-enforced

Unbounded loops/recursion causing DoS or runaway cost.

Enforced at runtime by the gateway (rate limits + spend caps + size caps); static check flags unbounded loops.

✓LLM01Prompt InjectionPassed

✓LLM02Sensitive Information DisclosurePassed

✓LLM04Data and Model PoisoningPassed

Backdoors/poisoning in training data or serialized models.

Behavioral poisoning needs model execution; static check covers unsafe serialization + dataset skew only.

✓LLM07System Prompt LeakagePassed

✓LLM08Vector and Embedding WeaknessesPassed

PII or plaintext source leakage in embedding/vector exports.

Embedding inversion/poisoning is largely runtime; static check covers PII in vector exports.

OWASP Machine Learning Security Top 10

⚠ML06AI Supply Chainmedium

Compromised PyPI/npm packages, typosquats, unsafe serialized models.

•Vulnerable dependencies — 2 known vulnerabilities in: pip@26.1 (CWE-1395)known CVE · -5 pts

⚠ML09Output Integritymedium

Middleware tampering with model outputs in transit.

Gateway enforces TLS + response integrity; static check flags output-rewriting code.

•Suspicious code patterns — pickle deserialization · lukasschwab-arxiv.py-93315e7/tests/test_errors.py (CWE-502)risk surface

§ML01Input Manipulation (Adversarial)Governance

Models vulnerable to adversarial perturbations.

Requires runtime robustness evaluation; addressed via publisher robustness attestation.

§ML03Model InversionGovernance

Training data reconstructable from a model's outputs.

Runtime/evaluation property; addressed via model-card data-provenance + DP attestation.

§ML04Membership InferenceGovernance

Determining whether a record was in the training set.

Runtime/evaluation property; addressed via overfitting disclosure + DP attestation.

§ML08Model SkewingGovernance

Models trained on skewed data producing biased output.

Requires fairness evaluation; addressed via model-card bias/limitations disclosure.

✓ML02Data PoisoningPassed

Poisoned training datasets with triggers or anomalous distributions.

Static check covers trigger phrasing, PII and label skew; full poisoning detection is runtime.

✓ML05Model TheftPassed

Unlicensed re-distribution / license-incompatible derivatives.

Static check verifies license declaration; extraction throttling is runtime.

✓ML07Transfer Learning AttackPassed

Backdoored base models / LoRA adapters propagating to derivatives.

Backdoor detection needs behavioral probing; static check covers unsafe serialization + provenance.

✓ML10Model Poisoning (Weights)Passed

Tampered model weight files; integrity must be verifiable.

Static check enforces safe formats + records a content hash for downstream verification.

Other findings (3) · hygiene / uncategorized

•Unrecognized file type — '.gitignore' is not on the allowlist · lukasschwab-arxiv.py-93315e7/.gitignorerisk surface

•Unrecognized file type — '.python-version' is not on the allowlist · lukasschwab-arxiv.py-93315e7/.python-versionrisk surface

•Unrecognized file type — '.?' is not on the allowlist · lukasschwab-arxiv.py-93315e7/Makefilerisk surface

✔ verified source · pinned lukasschwab-arxiv.py-93315e7

Check against a policy

The same gate an agent runs before installing (POST /api/v1/trust/arxiv-py-api-wrapper/check). Click a policy:

Consume arxiv.py — arXiv API Python Wrapper programmatically. Authenticate with an API key or session — see Authorize an agent.

# Agents: CHECK BEFORE YOU INSTALL (no auth) — score, grade, level, capability manifest
curl https://ai-supply.store/api/v1/trust/arxiv-py-api-wrapper

# Gate against your org policy (returns { pass, violations })
curl -X POST https://ai-supply.store/api/v1/trust/arxiv-py-api-wrapper/check \
  -H "Content-Type: application/json" \
  -d '{"minGrade":"B","denyPermissions":["shell"],"denyUnknownEgress":true}'

# CLI
npx ai-supply add arxiv-py-api-wrapper

# REST (install → download)
curl -X POST https://ai-supply.store/api/v1/listings/arxiv-py-api-wrapper/install \
  -H "Authorization: Bearer $AIM_KEY"

# MCP tool
install_listing({ "slug": "arxiv-py-api-wrapper" })

OpenAPI spec →