GPT Researcher

GPT Researcher is an open-source research agent maintained by Assaf Elovic that produces research reports with citations from web and local sources. Its MCP client surface is opt-in: setting the RETRIEVER environment variable to mcp (or a hybrid value such as tavily,mcp) activates a retriever that reads a list of mcp_configs dictionaries, each naming a server by name plus either a command and args pair for a local stdio subprocess, the default when no connection URL is given, or a connection_url for a remote server whose scheme selects a websocket or streamable HTTP transport. The dependency floor is mcp>=1.9.1 and langchain-mcp-adapters>=0.1.0, and the client code calls the latter library's MultiServerMCPClient rather than the mcp SDK directly. Only the tools feature is documented or implemented: the retriever selects relevant tools across configured servers with an LLM step, then calls them with generated arguments. No resources, prompts, sampling, elicitation, or roots handling appears in the client code or documentation, and no project surface names an MCP specification revision, so spec status is recorded as unknown.

As of 2026-09-15 the project carries three disagreeing version numbers: the PyPI package reports 0.16.0, the pyproject.toml on the main branch declares 0.15.1 in both its legacy Poetry block and its modern project block, and the newest GitHub tag is v3.6.1, a separate numbering line altogether. None of the three matches v0.14.8, the version CVE-2026-37006 named as the fix for an unauthenticated WebSocket configuration flaw, a discrepancy the published story already flagged and this pass confirms extends across all three surfaces. The package ships as a pip install, a Docker image (gptresearcher/gpt-researcher on Docker Hub), and a self-hosted web frontend served by FastAPI with an optional Next.js build. The project's SECURITY.md documents the MCP configuration surface as an operator-trust boundary, stating that accepting MCP server commands from an authenticated operator is an intended feature and that exposing the endpoint to untrusted clients falls outside the project's threat model.