DicomSAFE
Model Context Protocol (MCP) for interacting with dicom servers (PACS etc.)
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://opensource.org/licenses/MIT) [](https://www.python.org/downloads/) [](https://pypi.org/project/dicom-mcp/) [](https://pypi.org/project/dicom-mcp/)
The dicom-mcp server enables AI assistants to query, read, and move data on DICOM servers (PACS, VNA, etc.).
🤝 Contribute • 📝 [Report Bug](https://github.com/ChristianHinge/dicom-mcp/issues) • 📝 [Blog Post 1](https://www.christianhinge.com/projects/dicom-mcp/)
--------------------------------------------------------------------- 🧑⚕️ User: "Any significant findings in John Doe's previous CT report?" 🧠 LLM → ⚙️ Tools: query_patients → query_studies → query_series → extract_pdf_text_from_dicom 💬 LLM Response: "The report from 2025-03-26 mentions a history of splenomegaly (enlarged spleen)" 🧑⚕️ User: "What's the volume of his spleen at the last scan and the scan today?" 🧠 LLM → ⚙️ Tools: (query_studies → query_series → move_series → query_series → extract_pdf_text_from_dicom) x2 (The move_series tool sends the latest CT to a DICOM segmentation node, which returns volume PDF report) 💬 LLM Response: "last year 2024-03-26: 412cm3, today 2025-04-10: 350cm3" ---------------------------------------------------------------------
✨ Core Capabilities
dicom-mcp provides tools to:
- 🔍 Query Metadata: Search for patients, studies, series, and instances using various criteria.
- 📄 Read DICOM Reports (PDF): Retrieve DICOM instances containing encapsulated PDFs (e.g., clinical reports) and extract the text content.
- ➡️ Send DICOM Images: Send series or studies to other DICOM destinations, e.g. AI endpoints for
dea65a29bd48OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add dicom-mcp --env ORTHANC_PASSWORD=${ORTHANC_PASSWORD} -- uvx dicom-mcp{
"mcpServers": {
"dicom-mcp": {
"command": "uvx",
"args": [
"dicom-mcp"
],
"env": {
"ORTHANC_PASSWORD": "${ORTHANC_PASSWORD}"
}
}
}
}Exposed tools (11)
9 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
extract_pdf_text_from_dicom | read | Retrieve a DICOM instance with encapsulated PDF and extract its text content. |
get_attribute_presets | read | Get all available attribute presets for DICOM queries. |
list_dicom_nodes | read | List all configured DICOM nodes and their connection information. |
move_series | write | Move a DICOM series to another DICOM node. |
move_study | write | Move a DICOM study to another DICOM node. |
query_instances | read | Query individual DICOM instances (images) within a series. |
query_patients | read | Query patients matching the specified criteria from the DICOM node. |
query_series | read | Query series within a study from the DICOM node. |
query_studies | read | Query studies matching the specified criteria from the DICOM node. |
switch_dicom_node | read | Switch the active DICOM node connection to a different configured node. |
verify_connection | read | Verify connectivity to the current DICOM node using C-ECHO. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (1)
images/example.png
Gates applied: no_behavioural_pass.
dea65a29bd48full audit observations/trust-audit/mcp-server/christianhinge__dicom.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | dea65a29bd48 | SAFE | B | 89 | first audit |
Questions
What is the Dicom MCP server?
Model Context Protocol (MCP) for interacting with dicom servers (PACS etc.)
What tools does Dicom expose?
11 in total: 9 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Dicom safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Dicom need?
It reads ORTHANC_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (dea65a29bd48), read on 2026-10-07. The repository is watched and re-audited when it changes.