Agent engineering · September 9, 2026
Giving an AI Agent Write Access to Your Paper
Four ways to connect an AI model to a LaTeX project, what each one can actually destroy, and the questions worth asking before you approve a consent screen.
By Shihab Shahriar Antor · Updated 2026-09-09
Most writing about AI and LaTeX is about output quality. That is the easy half. A document either compiles or it does not, and a compiler is a faster reviewer than any human. The half that gets skipped is the connection itself.
Once a model can write, three questions decide how bad a mistake can get, and none of them are about the model. What can it reach? Is a wrong edit recoverable? Can access be withdrawn cleanly? Those are properties of the integration, and they differ enormously between approaches that all look identical in a demo.
Four access models, ranked by blast radius
Every current way to point a language model at a LaTeX project falls into one of four shapes. The differences that matter are on the right-hand columns.
| Access model | What it can see | Blast radius of a bad edit | How you revoke it |
|---|---|---|---|
| Paste into a chat window | Only the text you paste. Not the bibliography, not included chapters, not the compile log. | None. Nothing is written. The cost is that you paste the result back by hand and the model never learns whether it built. | Close the tab. |
| Local MCP server over your filesystem | Whatever path you started it on, which is usually broader than one project. | Real files on your disk. Recovery depends entirely on whether that directory is under version control. | Kill the process and hope nothing was mid-write. |
| A bridge holding your editor session | Everything that account can see, because it is acting as you. | Every project on the account, with no scope boundary between them. | Change your password, which logs out everything else too. |
| Hosted server with scoped OAuth | Only the scopes shown on a consent screen you approved. | Bounded by those scopes, and recoverable if the service keeps version history. | Revoke that one client. Nothing else is affected. |
Checked 9 September 2026. The fourth row is what LetX's hosted MCP server does; the middle two describe the majority of LaTeX MCP servers currently published, most of which bridge to Overleaf or to a local directory.
Read the tool list, not the description
A server's marketing tells you what it is for. Its tool list tells you what it can do. Those are different documents, and only one of them is enforced.
The useful exercise before approving anything is to split the tools into the ones that only read and the ones that change state, then ask what the worst plausible outcome of each write is. Here is that split for the LetX server, which publishes thirteen tools.
search_templatesRead onlyPublic catalogue. Touches nothing you own.
get_templateRead onlyPublic catalogue. Touches nothing you own.
list_projectsRead onlyDiscloses your project names to the client.
list_project_filesRead onlyDiscloses your file structure to the client.
read_project_fileRead onlySends document contents to the client. This is the one people underestimate.
create_project_from_templateWritesAdds a project. Cannot damage an existing one.
create_projectWritesAdds a project. Cannot damage an existing one.
update_project_fileWritesOverwrites file content. The highest-consequence tool in the list, and the reason version history matters.
compile_latexWritesSpends compile quota. No document is modified.
compile_projectWritesSpends compile quota and returns the PDF or the real error log.
set_project_compilerWritesChanges a project setting that affects every later build.
searchDeep researchPublic catalogue search for deep-research clients.
fetchDeep researchPublic catalogue lookup for deep-research clients.
Five read, six write, two catalogue. Note that read_project_file is a disclosure risk rather than a destruction risk, and the two categories need separate thinking: an edit can be undone, a disclosure cannot.
Why compiling changes the economics
An agent that cannot compile is guessing, and it will guess confidently. It cannot see that \usepackage{subfigure} conflicts with the class you are using, or that the undefined control sequence comes from a macro defined three files away, because it never sees the log.
An agent that compiles gets a hard signal on every attempt. That narrows what it can be wrong about, and it changes what a failed edit costs: instead of a plausible-looking patch you discover is broken tomorrow, you get an error now, attached to a line.
Be precise about what this proves, though. A successful compile establishes that the toolchain accepted the source and produced output. It says nothing about whether the mathematics is right, the citations exist, the argument holds, or the journal will accept the formatting. It removes one category of uncertainty completely and leaves every other category untouched.
- 01
Start on a project you could afford to lose
Not the thesis. Give the agent a real but non-critical document first, and watch what it actually touches rather than what it says it will touch.
- 02
Read the consent screen as a list of capabilities
Scopes are the enforced contract. If a screen asks for broader access than the task needs, that gap is permanent until you revoke it.
- 03
Confirm history exists before the first write
The question is not whether the agent will make a bad edit. It is whether you can get back to the version before it. Verify you can restore, rather than assuming.
- 04
Check the training and retention position
Read access means documents leave your control. LetX's published policy states private documents are not used to train models without explicit opt-in consent; confirm the equivalent for any provider before connecting.
- 05
Keep the compile in the loop
Prefer a setup where the agent compiles what it wrote. An edit that has not been built is a hypothesis, however confident the response sounds.
- 06
Revoke when the task is done
Standing access to a document project is not free. Revoking a scoped OAuth grant costs nothing and can be re-approved in seconds.
Where this leaves the current tools
The LaTeX MCP space filled up quickly in 2026. Most published servers are local processes over a directory, or bridges that hold an Overleaf session, and both are reasonable for a solo author who understands the trade. Neither gives you a scope boundary or a revocation path that stops short of a password change.
The hosted, scoped variant is a different shape: what the agent produces stays a real project with collaborators and version history rather than a file that has to be carried back somewhere. Whether that matters depends entirely on whether anyone else touches the document. For a solo preprint it may not. For a thesis with a supervisor, or a paper with five co-authors, it is most of the point.
Questions
- Is it safe to let an AI agent edit my thesis?
- It depends on the connection, not the model. Safe means three things: the agent's access is scoped to what the task needs, a bad edit is recoverable from version history, and you can revoke access without changing your account password. A hosted server using scoped OAuth gives you all three. A local process over your home directory gives you none of them unless you have version control.
- What is the difference between an MCP server and pasting into ChatGPT?
- A paste is a snapshot: the model sees only the text you gave it, cannot see your bibliography or compile log, never learns whether its answer builds, and the result has to be copied back by hand. An MCP connection exposes named operations against the real project, so the model can read the files it needs, make a targeted edit, compile, and read the actual error.
- Which tools should I be most careful about approving?
- update_project_file, because it overwrites content, and read_project_file, because it sends document contents to a third party. The first is the bigger operational risk and the second is the bigger confidentiality risk. An overwrite can be undone from history; a disclosure cannot be undone at all.
- Does compiling mean the agent got it right?
- No. A successful compile proves the toolchain accepted the source and produced a document. It proves nothing about the mathematics, the citations, the argument, or a journal's requirements. It removes one class of error completely and leaves the rest to you.
- Can I connect Claude or ChatGPT to LetX?
- Yes. LetX runs a hosted MCP server at api.letx.app/mcp using OAuth 2.1, documented as tested with Claude, ChatGPT, and Claude Code. It is a Pro plan feature, and connecting is a consent flow rather than an API key paste, so the client never receives your password and access can be revoked afterwards.
The engineering detail behind the LetX implementation, including every scope and what each tool changes, is on the MCP scope reference. If you are evaluating this for a department rather than yourself, the procurement brief covers data handling and the requirements LetX does not currently meet.
The canonical setup guides live with the product at letx.app/mcp.