doiget

A single-binary CLI + stdio MCP server that turns DOIs and arXiv ids into local PDFs through official, OA-first APIs. Designed as the agent-facing companion to BiblioFetch.jl.

Docs: stable = the Zola site (built from main); dev = rustdoc built from next; API = docs.rs (latest published release).

Status: Shipping on crates.io (doiget-core, doiget-cli, doiget-mcp), with sigstore-signed binaries + an SBOM attached to the GitHub Release. Tier 1 + Tier 2 sources, the stdio MCP server, citation-graph expansion, and gated TDM sources are all implemented. Releases are cut by a single signed git tag through the tag-driven pipeline (see ADR-0025); release-plz was retired. See CHANGELOG.md for history and docs/PHASES.md for the phase plan.

Posture

doiget is a general-purpose automation tool for retrieving papers via official publisher APIs. By design, doiget only attempts retrieval through:

1. Public Open Access sources (default — Crossref, Unpaywall, arXiv).
2. Credentials the user has personally configured for their own institutional or personal subscriptions (opt-in, compile-time gated).

doiget does not work around any access control mechanism, redistribute papers, host content, operate as a SaaS, or bundle any publisher API keys.

Users are responsible for ensuring they have the right to access the content they request and for compliance with each source's Terms of Service.

See docs/LEGAL.md and docs/SCOPE.md.

Documentation

Architecture: docs/ARCHITECTURE.md Threat model: docs/SECURITY.md Permanent non-goals: docs/SCOPE.md Phase plan: docs/PHASES.md ADRs: docs/DECISIONS/

Installation

doiget ships a single self-contained binary — the Linux build is fully static (musl), so it runs on old glibc / HPC boxes too. Every channel installs the same checksum-verified binary from the signed GitHub Release.

Recommended: use a prebuilt binary (no Rust toolchain, no compiler). The shell / PowerShell installers below download the signed release binary directly. cargo install (further down) instead compiles from source and therefore needs a working C/C++ build toolchain — see that section for the per-platform requirements.

Shell installer (Linux / macOS)

curl -fsSL https://raw.githubusercontent.com/QAtlasHub/doiget/main/scripts/install.sh | sh

Installs to ~/.local/bin (override with DOIGET_INSTALL_DIR); pin a version with DOIGET_VERSION=0.6.0. The script verifies the published SHA-256 sidecar before installing.

PowerShell installer (Windows)

irm https://raw.githubusercontent.com/QAtlasHub/doiget/main/scripts/install.ps1 | iex

From crates.io (Rust toolchain — compiles from source)

The published crate is doiget-cli (it produces the doiget binary). cargo install doiget does not work — there is no crate by that bare name:

cargo install doiget-cli   # installs the `doiget` binary

Because this compiles from source, you need a C/C++ build toolchain (a linker is mandatory — cargo install cannot link a binary without one):

• Linux: gcc/clang + make (e.g. build-essential).
• macOS: Xcode Command Line Tools (xcode-select --install).
• Windows: either the Visual Studio Build Tools with the "Desktop development with C++" workload (provides link.exe), or a MinGW-w64 toolchain used via the GNU target (rustup toolchain install stable-x86_64-pc-windows-gnu + cargo +stable-x86_64-pc-windows-gnu install doiget-cli).

If you don't have (or don't want) a build toolchain, use one of the prebuilt installers above — they need no compiler.

npm / npx — one line in an agent config

npx -y doiget-cli serve      # MCP server, no install step
npm install -g doiget-cli    # or put `doiget` on PATH

The package is doiget-cli and the command it installs is doiget — the same shape as cargo install doiget-cli, which is where the name comes from. npm refuses the unscoped name doiget as too similar to the unrelated giget, and matching the crate turned out to be the better answer regardless: one name for the tool on both registries.

The npm packages carry the same signed release binaries as optionalDependencies — npm resolves the one matching your platform, and there is no postinstall download, so this works under --ignore-scripts and through a corporate registry mirror. npm view doiget version tells you what is published; the packages ship from tagged releases, so a very new commit may be ahead of them.

Homebrew

brew tap QAtlasHub/doiget https://github.com/QAtlasHub/doiget
brew install doiget

The tap lives in this repository rather than a separate homebrew-doiget, which is why the tap line carries an explicit URL. A dedicated tap repo would shorten it to brew tap QAtlasHub/doiget; the formula would move across unchanged.

Formula/doiget.rb installs the same signed release binary the GitHub Release publishes, pinned by the sha256 from that release's own .sha256 asset — the file the shell installer verifies against, so the two channels cannot disagree about what they installed. It is generated by scripts/update-homebrew-formula.sh, never hand-edited, and CI fails if the committed formula is not what the generator produces.

The formula tracks the latest stable release, so it can trail a very new tag by one commit; brew info doiget shows which version it pins.

Claude Code plugin

/plugin marketplace add QAtlasHub/doiget
/plugin install doiget@doiget

Reads .claude-plugin/ from this repository's default branch. The plugin's .mcp.json runs npx -y doiget-cli serve, so it needs nothing installed beforehand — npm fetches the wrapper and the one matching platform binary on first run. Until this it ran a bare doiget, which meant the plugin worked only for people who had already installed doiget some other way; that is why it was self-hosted rather than submitted to the Anthropic plugin directory, and why it is now submittable.

Channel status