{
  "markdown": "# doiget\n\n> A single-binary CLI + stdio MCP server that turns DOIs and arXiv ids into local PDFs through official, OA-first APIs.\n> Designed as the **agent-facing companion** to [BiblioFetch.jl](https://github.com/sotashimozono/BiblioFetch.jl).\n\n[![crates.io](https://img.shields.io/crates/v/doiget-core.svg)](https://crates.io/crates/doiget-core)\n[![downloads](https://img.shields.io/crates/d/doiget-core.svg)](https://crates.io/crates/doiget-core)\n[![MSRV](https://img.shields.io/crates/msrv/doiget-core.svg)](https://crates.io/crates/doiget-core)\n[![docs.rs](https://img.shields.io/docsrs/doiget-core)](https://docs.rs/doiget-core)\n[![CI](https://github.com/QAtlasHub/doiget/actions/workflows/ci.yml/badge.svg)](https://github.com/QAtlasHub/doiget/actions/workflows/ci.yml)\n[![codecov](https://codecov.io/gh/QAtlasHub/doiget/branch/main/graph/badge.svg)](https://codecov.io/gh/QAtlasHub/doiget)\n[![issues](https://img.shields.io/github/issues/QAtlasHub/doiget)](https://github.com/QAtlasHub/doiget/issues)\n[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)\n\n[![docs (stable)](https://img.shields.io/badge/docs-stable-blue)](https://codes.sota-shimozono.com/doiget/)\n[![docs (dev/next)](https://img.shields.io/badge/docs-dev%20%28next%29-orange)](https://codes.sota-shimozono.com/doiget/dev/)\n[![API (docs.rs)](https://img.shields.io/badge/API-docs.rs-blue)](https://docs.rs/doiget-core)\n\n**Docs:** stable = the Zola site (built from `main`); dev = rustdoc built from `next`; API = `docs.rs` (latest published release).\n\n**Status:** Shipping on crates.io (`doiget-core`, `doiget-cli`,\n`doiget-mcp`), with sigstore-signed binaries + an SBOM attached to the GitHub\nRelease. Tier 1 + Tier 2 sources, the stdio MCP server, citation-graph\nexpansion, and gated TDM sources are all implemented. Releases are cut by a\nsingle signed git tag through the tag-driven pipeline (see\n[ADR-0025](docs/DECISIONS/0025-tag-driven-release.md)); `release-plz` was\nretired. See [CHANGELOG.md](CHANGELOG.md) for history and\n[docs/PHASES.md](docs/PHASES.md) for the phase plan.\n\n## Posture\n\ndoiget is a general-purpose automation tool for retrieving papers via official publisher APIs.\nBy design, doiget only attempts retrieval through:\n\n1. Public Open Access sources (default — Crossref, Unpaywall, arXiv).\n2. Credentials the user has personally configured for their own institutional or personal subscriptions (opt-in, compile-time gated).\n\n**doiget does not** work around any access control mechanism, redistribute papers, host\ncontent, operate as a SaaS, or bundle any publisher API keys.\n\nUsers are responsible for ensuring they have the right to access the content they request and\nfor compliance with each source's Terms of Service.\n\nSee [docs/LEGAL.md](docs/LEGAL.md) and [docs/SCOPE.md](docs/SCOPE.md).\n\n## Documentation\n\n| Reader | Entry point |\n|---|---|\n| CLI user | This README, then `doiget --help`, then [docs/CONFIG.md](docs/CONFIG.md) and [docs/ERRORS.md](docs/ERRORS.md) for non-trivial flags / exit codes |\n| Agent / MCP host integrator | [docs/MCP_TOOLS.md](docs/MCP_TOOLS.md) + [docs/INTEGRATION/README.md](docs/INTEGRATION/README.md) |\n| Library user (Rust) | [docs/PUBLIC_API.md](docs/PUBLIC_API.md) + crates.io rustdoc |\n| Contributor | [CONTRIBUTING.md](CONTRIBUTING.md) → [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) → [docs/DECISIONS/](docs/DECISIONS/) |\n| Publisher legal team | [docs/LEGAL.md](docs/LEGAL.md) + [CONTACT.md](CONTACT.md) |\n| Security researcher | [docs/SECURITY.md](docs/SECURITY.md) + [docs/PROVENANCE_LOG.md](docs/PROVENANCE_LOG.md) + [docs/CAPABILITY.md](docs/CAPABILITY.md) |\n| BiblioFetch.jl user | [docs/MIGRATION.md](docs/MIGRATION.md) + [docs/STORE.md](docs/STORE.md) + [docs/SAFEKEY.md](docs/SAFEKEY.md) |\n\nArchitecture: [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md)\nThreat model: [docs/SECURITY.md](docs/SECURITY.md)\nPermanent non-goals: [docs/SCOPE.md](docs/SCOPE.md)\nPhase plan: [docs/PHASES.md](docs/PHASES.md)\nADRs: [docs/DECISIONS/](docs/DECISIONS/)\n\n## Installation\n\ndoiget ships a single self-contained binary — the Linux build is fully static\n(musl), so it runs on old glibc / HPC boxes too. Every channel installs the\n**same checksum-verified binary** from the signed GitHub Release.\n\n> **Recommended: use a prebuilt binary (no Rust toolchain, no compiler).** The\n> shell / PowerShell installers below download the signed release binary\n> directly. `cargo install` (further down) instead *compiles from source* and\n> therefore needs a working C/C++ build toolchain — see that section for the\n> per-platform requirements.\n\n### Shell installer (Linux / macOS)\n\n```sh\ncurl -fsSL https://raw.githubusercontent.com/QAtlasHub/doiget/main/scripts/install.sh | sh\n```\n\nInstalls to `~/.local/bin` (override with `DOIGET_INSTALL_DIR`); pin a version with\n`DOIGET_VERSION=0.6.0`. The script verifies the published SHA-256 sidecar before installing.\n\n### PowerShell installer (Windows)\n\n```powershell\nirm https://raw.githubusercontent.com/QAtlasHub/doiget/main/scripts/install.ps1 | iex\n```\n\n### From crates.io (Rust toolchain — compiles from source)\n\nThe published crate is **`doiget-cli`** (it produces the `doiget` binary).\n`cargo install doiget` does **not** work — there is no crate by that bare name:\n\n```sh\ncargo install doiget-cli   # installs the `doiget` binary\n```\n\nBecause this **compiles from source**, you need a C/C++ build toolchain (a\nlinker is mandatory — `cargo install` cannot link a binary without one):\n\n- **Linux:** `gcc`/`clang` + `make` (e.g. `build-essential`).\n- **macOS:** Xcode Command Line Tools (`xcode-select --install`).\n- **Windows:** either the **Visual Studio Build Tools** with the *\"Desktop\n  development with C++\"* workload (provides `link.exe`), **or** a MinGW-w64\n  toolchain used via the GNU target\n  (`rustup toolchain install stable-x86_64-pc-windows-gnu` +\n  `cargo +stable-x86_64-pc-windows-gnu install doiget-cli`).\n\nIf you don't have (or don't want) a build toolchain, use one of the prebuilt\ninstallers above — they need no compiler.\n\n### npm / npx — one line in an agent config\n\n```sh\nnpx -y doiget-cli serve      # MCP server, no install step\nnpm install -g doiget-cli    # or put `doiget` on PATH\n```\n\nThe package is `doiget-cli` and the command it installs is `doiget` — the same\nshape as `cargo install doiget-cli`, which is where the name comes from. npm\nrefuses the unscoped name `doiget` as too similar to the unrelated `giget`, and\nmatching the crate turned out to be the better answer regardless: one name for\nthe tool on both registries.\n\nThe npm packages carry the same signed release binaries as `optionalDependencies`\n— npm resolves the one matching your platform, and there is **no postinstall\ndownload**, so this works under `--ignore-scripts` and through a corporate\nregistry mirror. `npm view doiget version` tells you what is published; the\npackages ship from tagged releases, so a very new commit may be ahead of them.\n\n### Homebrew\n\n```sh\nbrew tap QAtlasHub/doiget https://github.com/QAtlasHub/doiget\nbrew install doiget\n```\n\nThe tap lives in this repository rather than a separate `homebrew-doiget`, which\nis why the tap line carries an explicit URL. A dedicated tap repo would shorten\nit to `brew tap QAtlasHub/doiget`; the formula would move across unchanged.\n\n`Formula/doiget.rb` installs the **same signed release binary** the GitHub\nRelease publishes, pinned by the `sha256` from that release's own `.sha256`\nasset — the file the shell installer verifies against, so the two channels\ncannot disagree about what they installed. It is generated by\n`scripts/update-homebrew-formula.sh`, never hand-edited, and CI fails if the\ncommitted formula is not what the generator produces.\n\nThe formula tracks the latest **stable** release, so it can trail a very new\ntag by one commit; `brew info doiget` shows which version it pins.\n\n### Claude Code plugin\n\n```\n/plugin marketplace add QAtlasHub/doiget\n/plugin install doiget@doiget\n```\n\nReads `.claude-plugin/` from this repository's default branch. The plugin's\n`.mcp.json` runs `npx -y doiget-cli serve`, so it needs **nothing installed\nbeforehand** — npm fetches the wrapper and the one matching platform binary on\nfirst run. Until this it ran a bare `doiget`, which meant the plugin worked\nonly for people who had already installed doiget some other way; that is why it\nwas self-hosted rather than submitted to the Anthropic plugin directory, and\nwhy it is now submittable.\n\n### Channel status\n\n| Channel | Status |\n|---|---|\n| Shell / PowerShell installer | shipping |\n| GitHub Release binaries (signed, SBOM) | shipping |\n| `cargo install doiget-cli` | shipping (needs a C linker) |\n| `.mcpb` Claude Desktop extension | shipping since 0.8.4 |\n| MCP Registry | listed |\n| npm / npx | `doiget-cli` (installs the `doiget` command); see below for what is published |\n| Claude Code plugin | self-hosted marketplace, as above |\n| Homebrew | `Formula/doiget.rb` in this repo; see above for the tap line |\n| Nix | `flake.nix` exposes `packages.default` / `packages.doiget`, not only a dev shell. The outputs exist; `nix profile install` has not been exercised |\n| `.deb` | **not built** — low value; most Linux users take the binary or Nix |\n| Docker | **not planned** — see below |\n\nDocker was ranked second in #501 on the grounds that a container is \"the only\narchitecture the Tier-3 features can legally be used in\". That premise does not\nhold: ADR-0002 decides that the default published binary contains **no TDM\nsource code at all**, and an image built from the published binary would ship\n`oa-only,citation` like every other prebuilt channel. The architecture the\nsentence describes is real, and it is served by building from source with\n`--features tdm-<publisher>`, which is not a distribution channel. What remains\nis \"a shape enterprises can pin and scan\" — worth something, but doiget is a\nsingle statically-linked binary, so a container solves no dependency problem\nhere and the existing `.sha256` plus cosign bundle already give a pinnable,\nverifiable artefact.\n\nnpm was the one channel whose pipeline was written and whose packages did not\nexist. npm Trusted Publishing cannot perform a package's *first* publish — the\nsetting lives under a package's Settings, and there is no Settings page for a\npackage that has never been published — so the release job, which carries no\ntoken by design, cannot create them. `scripts/bootstrap-npm.sh` does the\nonce-only placeholder publish that unblocks it; `CONTRIBUTING.md` has the\nrunbook.\n\nAs of 2026-08-27 the four per-platform packages are published as `0.0.0`\nplaceholders. npm points `latest` at a package's first publish whatever\n`--tag` says, so those placeholders are deprecated — that notice is the only\nwarning until a release moves `latest` to a real version.\n\n[#247](https://github.com/QAtlasHub/doiget/issues/247) was closed as completed\nwhile four of its five channels did not exist; the remaining ones are tracked in\n[#501](https://github.com/QAtlasHub/doiget/issues/501). Every release asset is\ncosign-keyless signed (`<asset>.cosign.bundle`) for optional verification.\n\n## Quick start\n\n```sh\n# Fetch a paper by DOI (Open Access only by default)\ndoiget fetch 10.1103/PhysRevLett.130.200601\n\n# Fetch by arXiv id\ndoiget fetch arXiv:2401.12345\n\n# Batch fetch\ndoiget batch refs.txt\n\n# Verify a bibliography's references resolve (no PDF download) — CI gate\ndoiget verify docs/references.bib --strict\n\n# Lint a .bib for structural issues (no network): missing fields,\n# blank fields, $$-display-math titles. Read-only and math-aware.\ndoiget lint docs/references.bib\n\n# Inspect what was fetched\ndoiget info 10.1103/PhysRevLett.130.200601\n\n# Run as MCP server (stdio)\ndoiget serve\n```\n\nDefault features fetch only Open Access PDFs through Crossref / Unpaywall / arXiv.\nInstitutional TDM access (Springer OA, APS Harvest, Elsevier ScienceDirect TDM) is **not** in\nthe default published binary; it must be opted in at build time per publisher.\nSee [docs/SOURCES.md](docs/SOURCES.md).\n\n## Coexistence with BiblioFetch.jl\n\ndoiget and BiblioFetch.jl share the same on-disk store format (TOML metadata + PDF files\nunder a configurable store root). doiget defaults to `./papers` (under the current working\ndirectory; ADR-0036), BiblioFetch.jl to `~/papers/`; point both at the same root (e.g.\n`DOIGET_STORE_ROOT=~/papers`) to share one store. The shared schema, locking protocol, and\natomic write contract are\nspecified in [docs/STORE.md](docs/STORE.md). Reference test vectors for the shared safekey\nalgorithm are in [docs/SAFEKEY.md](docs/SAFEKEY.md).\n\n| Tool | Best for |\n|---|---|\n| BiblioFetch.jl | Julia REPL, research vault, citation graph exploration |\n| doiget | Agents / MCP hosts, batch operations, scripted pipelines, container deployments |\n\n## License\n\nMIT for the doiget source code and binaries (see [LICENSE](LICENSE)).\n\nThe license under which doiget retrieves papers is **separate** and is determined by each\npaper's own license, the publisher's API Terms of Service, and the user's own access rights.\ndoiget does not relicense fetched content.\n\n## Contact\n\nTakedown requests, security disclosures, and other formal correspondence:\n[CONTACT.md](CONTACT.md).\n",
  "bytes": 13201,
  "sha": "597bdd5c6e789be9e398aefe157523005d8a8d2e9194fbc421ea0982d08cf666",
  "repo_slug": "qatlashub/doiget",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_qatlashub_doiget_6c757c80/readme"
}