Atlas / MCP servers / dhi13man / oorep-mcp

oorep-mcpSAFE

mcp/dhi13man/oorep-mcp

Model Context Protocol (MCP) server and client SDK that provides AI assistants with access to OOREP (Open Online Repertory) - a comprehensive homeopathic repertory and materia medica database.

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
8 7r · 1w · 0d
Transport
stdio
License
MIT
Stars
3
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.npmjs.com/package/oorep-mcp) [](https://github.com/Dhi13man/oorep-mcp/actions/workflows/ci.yml) [](https://github.com/Dhi13man/oorep-mcp/actions/workflows/codeql.yml) [](https://scorecard.dev/viewer/?uri=github.com/Dhi13man/oorep-mcp) [](https://opensource.org/licenses/MIT)

An MCP server and TypeScript client SDK that gives AI assistants access to OOREP's homeopathic repertory and materia medica reference data.

TL;DR

# Install and run (no setup required)
npx -y oorep-mcp
// Or use programmatically
import { createOOREPClient } from 'oorep-mcp';

const client = createOOREPClient();
const results = await client.searchRepertory({ symptom: 'headache worse motion' });
console.log(results.rubrics);
client.destroy();

Ask your AI assistant: "Search OOREP for remedies for throbbing headache worse from light"

What is OOREP?

OOREP (Open Online Repertory) is an open-source homeopathic database containing:

  • 12+ Repertories - Systematic indexes of symptoms mapped to remedies (Kent, Boger, Boericke, etc.)
  • Multiple Materia Medicas - Detailed remedy descriptions and therapeutic indications
  • 600+ Remedies - Comprehensive remedy database with names, abbreviations, and alternates

How Homeopathic Data is Structured

graph TB
subgraph Repertory[Repertory Structure]
Chapter[Chaptere.g. Head]
Rubric[Rubrice.g. Pain - Throbbing]
R1[Belladonna - 4]
R2[Glonoine - 3]
R3[Natrum mur - 2]
Chapter --> Rubric
Rubric --> R1
Rubr
Read from source at commit 561eb769486aOBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)
claude mcp add oorep-mcp -- npx -y [email protected]
03

Exposed tools (8)

7 read · 1 write · 0 destructive.

ToolRiskDescription
analyze-symptomsreadTest prompt
conversationreadMulti-turn conversation
emptyreadEmpty prompt
multireadMulti-message prompt
remediesreadComma-separated list of remedy names to compare (e.g.,
symptom_descriptionwriteOptional initial symptom description to start the analysis
testreadTest tool
test-promptreadTest prompt
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (4 observation(s))
Network
declared (2 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (8)

LOWInventory / provenance · inv.hidden_file · CWE-1104
.gitmodules
.gitmodules
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierrc.json
.prettierrc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/lib/oorep-client.ts:18
import pkg from '../../package.json' with { type: 'json' };
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/sdk/adapters/google-genai.ts:41
} from '../../utils/schemas.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/sdk/adapters/langchain.ts:24
import { z } from '../../utils/schemas.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/sdk/adapters/langchain.unit.test.ts:6
import { z } from '../../utils/schemas.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/sdk/adapters/openai.ts:35
import { NotFoundError } from '../../utils/errors.js';
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, zod, @eslint/js, @types/node, @vitest/coverage-v8, eslint, prettier, tsx
Why it matters. 11 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 561eb769486afull audit observations/trust-audit/mcp-server/dhi13man__oorep-mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11561eb769486aSAFEB89first audit
06

Questions

What is the oorep-mcp MCP server?

Model Context Protocol (MCP) server and client SDK that provides AI assistants with access to OOREP (Open Online Repertory) - a comprehensive homeopathic repertory and materia medica database.

What tools does oorep-mcp expose?

8 in total: 7 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is oorep-mcp safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does oorep-mcp need?

It reads AZURE_OPENAI_API_KEY, GEMINI_API_KEY and SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does oorep-mcp run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as oorep-mcp at 1.2.4.

How current is this page?

The grade is for one exact copy of the source (561eb769486a), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement