ModelsAtlas
Explore
Atlas / MCP servers / dl-li / LibreGene

LibreGeneBLOCK

mcp/dl-li/libregene
MCP server by dl-li · ai tools · bioinformatics · biology · Audited 2026-10-11
⚑ Report / re-scanSource ↗

An open-source, agent-ready plasmid editor.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
2 2r · 0w · 0d
Transport
streamable-http
License
GPL-3.0
Stars
4
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

LibreGene — Plasmid Editor

中文版

⚠️ Early Development — APIs and file formats are not yet stable. Tested on macOS and Windows — Linux builds are not yet verified.

A lightweight cross-platform desktop plasmid editor. SVG rendering, feature annotation, primer design & visualization, restriction digestion analysis — all free and open-source.

Features

Feature Annotation

  • Clean, minimal display — CDS and mRNA features are translated on the fly, amino acids rendered right under the sequence
  • Auto-detection — paste a sequence into the New Sequence dialog and common features (promoters, resistance markers, ori, tags...) are detected via the pLannotate feature database and can be annotated with one click
  • ORF search — scan open reading frames on both strands, all six frames, and display them inline
  • GC content track — per-base sliding-window GC% rendered as a blue→white→red gradient band below the sequence, with adjustable window size
  • Compound (multi-segment) features, custom colors, strand toggling, enriched GenBank I/O that preserves colors and primers

Primers

  • Binding visualization — each primer is aligned against the template with mismatches, annealing region and Tm (nearest-neighbor) shown at a glan
Read from source at commit bb3ee496a201OBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add libregene -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "libregene": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Exposed tools (2)

2 read · 0 write · 0 destructive.

ToolRiskDescription
AlignmentreadAlign Sanger reads or sequences against the template
DotplotreadDot-plot comparison of two DNA/RNA sequences
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryFAIL
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (5 observation(s))
Network
declared (3 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (25)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104
src-tauri/src/payload.rs
payload.rs
Why it matters. member named after an attack tool
Fix. remove or justify
MEDIUMInventory / provenance · inv.binary · CWE-1104
assets/Fonts/texgyreheros-bold.otf
texgyreheros-bold.otf
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
assets/Fonts/texgyreheros-bolditalic.otf
texgyreheros-bolditalic.otf
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
assets/Fonts/texgyreheros-italic.otf
texgyreheros-italic.otf
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
assets/Fonts/texgyreheros-regular.otf
texgyreheros-regular.otf
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
assets/Fonts/texgyretermes-bold.otf
texgyretermes-bold.otf
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
src/dialogs/McpGuideDialog.jsx:58
- URL (Streamable HTTP): http://127.0.0.1:${port}/mcp
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
backend/libregene-core/src/codon.rs:1314
let egfp = "ATGGTGAGCAAGGGCGAGGAGCTGTTCACCGGGGTGGTGCCCATCCTGGTCGAGCTGGACGGCGACGTAAACGGCCACAAGTTCAGCGTGTCCGGCGAGGGCGAGGGCGATGCCACCTACGGCAAGCTGACCCTGAAGTTCATCTGCACCACCGGCAAGCTGCCCGTGCCCTGGCCCACCCTCGTGAC
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
backend/libregene-core/src/codon.rs:1378
let egfp_aa = "MVSKGEELFTGVVPILVELDGDVNGHKFSVSGEGEGDATYGKLTLKFICTTGKLPVPWPTLVTTLTYGVQCFSRYPDHMKQHDFFKSAMPEGYVQERTIFFKDDGNYKTRAEVKFEGDTLVNRIELKGIDFKEDGNILGHKLEYNYNSHNVYIMADKQKNGIKVNFKIRHNIEDGSVQLADHYQQ
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
backend/libregene-core/src/annotate.rs:1089
let lacz = feats.iter().find(|f| f.name == "lacZα").expect("lacZα feature");
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
backend/libregene-core/src/annotate.rs:1093
assert!(!lacz.fragment, "lacZα at 95.4% coverage should be complete");
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
backend/libregene-core/src/annotate.rs:1096
"lacZα start {}",
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
backend/libregene-core/src/annotate.rs:1219
!feats.iter().any(|x| x.name == "lacZα"),
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
backend/libregene-core/src/annotate.rs:1220
"lower-scoring lacZα overlapping lacZ must be dropped"
MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWInventory / provenance · inv.hidden_file · CWE-1104
scripts/setup-windows/.vsconfig
.vsconfig
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
backend/libregene-core/src/annotate.rs:1047
let gbk = include_str!("../../../examples/pUC19 Annotated.gbk");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
backend/libregene-core/src/codon.rs:1681
let gbk = include_str!("../../../examples/pCas9.gbk");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
backend/libregene-core/src/digest/tests.rs:1068
let gbk = include_str!("../../../../examples/pUC19 Annotated.gbk");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
backend/libregene-core/src/enzyme/search.rs:12
let json = include_str!("../../data/comm_only_enzymes.json");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
backend/libregene-core/src/enzyme/search.rs:24
let json = include_str!("../../data/enzyme_providers.json");
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
AGENTS.md:22
HTTP API:`libregene serve`,前缀 `http://127.0.0.1:8765`,见 `src/api.js`。
LOWPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
.github/workflows/build.yml:90
sudo apt-get update
Why it matters. asks for elevated privileges
LOWPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
.github/workflows/build.yml:91
sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev
Why it matters. asks for elevated privileges
LOWPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
.github/workflows/build.yml:139
sudo apt-get install -y flatpak flatpak-builder
Why it matters. asks for elevated privileges

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha bb3ee496a201full audit observations/trust-audit/mcp-server/dl-li__libregene.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11bb3ee496a201BLOCKD69first audit
06

Questions

What is the LibreGene MCP server?

An open-source, agent-ready plasmid editor.

What tools does LibreGene expose?

2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is LibreGene safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does LibreGene need?

No credential environment variables were found in its source, so it appears to need none.

How does LibreGene run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as libregene at 0.5.1.

How current is this page?

The grade is for one exact copy of the source (bb3ee496a201), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement