Infona OssBLOCK
Messy CSV, JSON, or text → one LLM schema pass → deterministic rows into Neo4j → ask in English (Cypher).
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Messy CSV, JSON, or text → one LLM schema pass → deterministic rows into Neo4j → ask in English (Cypher).
Luna (or your configured model) sees the file once and names types, attributes, relationships. Every cell maps through that schema via insert_facts. Then ask compiles English to Cypher on the populated graph. Ingest does not merge intra-file fragments — er rebuild is the second pass. Ontology extend and field-conflict handling are part of the same loop.
infona.ai (waitlist / demo) · what's free · API · agents
2816f7d6a9b5OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env CEREBRAS_API_KEY=${CEREBRAS_API_KEY} --env DEMO_KEY=${DEMO_KEY} --env EXA_API_KEY=${EXA_API_KEY} -- npx -y @infona-ai/[email protected]{
"mcpServers": {
"mcp": {
"command": "npx",
"args": [
"-y",
"@infona-ai/[email protected]"
],
"env": {
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"CEREBRAS_API_KEY": "${CEREBRAS_API_KEY}",
"DEMO_KEY": "${DEMO_KEY}",
"EXA_API_KEY": "${EXA_API_KEY}"
}
}
}
}Exposed tools (41)
31 read · 7 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
ClinicalTrial | read | |
Drug | read | A pharmaceutical product |
SynthWidget | read | |
agent | read | |
apply_ontology_change | write | |
apply_ontology_changes | write | |
ask | read | |
create_knowledge_graph | write | |
create_tenant | write | |
delete_function | destructive | |
delete_knowledge_graph | destructive | |
delete_skill | destructive | |
er_rebuild | read | |
evolve_ontology | read | |
export_kg | read | |
get_entity | read | |
get_job | read | |
get_skill | read | |
grep | read | |
ingest_csv | read | |
ingest_dlt | read | |
ingest_text | read | |
inspect_graph_schema | read | |
invoke_function | write | |
list_functions | read | |
list_jobs | read | |
list_knowledge_graphs | read | |
list_local_files | read | |
list_records | read | |
list_skills | read | |
list_tenants | read | |
put_skill | write | |
recompute_stats | read | |
register_function | read | |
schedule | write | |
search | read | |
skills_prompt_block | read | |
type_summary | read | |
validate_skill | read | |
view_ontology | read | |
wait_for_job | read |
Trust audit
BLOCKgrade F · trust 51/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (14 observation(s))
- Shell
- declared (7 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
result = eval(expression, {"df": df, "pd": pd, "np": np, "__builtins__": safe_builtins}) # noqa: S307print("OPENROUTER_API_KEY required for eval (LLM judge calls)", file=__import__("sys").stderr)geonames_cities15000.tsv.gz
module = importlib.import_module(module_name)
module = importlib.import_module(module_name)
module = importlib.import_module(module_name)
module = importlib.import_module(module_name)
module = importlib.import_module(module_name)
# INFONA_LLM_BASE_URL=http://127.0.0.1:11434/v1
# INFONA_QUERY_BASE_URL=http://127.0.0.1:11434/v1
# INFONA_EMBED_BASE_URL=http://127.0.0.1:11434/v1
# INFONA_LLM_BASE_URL=http://127.0.0.1:11434/v1
# INFONA_EMBED_BASE_URL=http://127.0.0.1:11434/v1
"ANTHROPIC_API_KEY=sk-ant-api03-9xQvT2mKp4Lw8Rn6Bz1Yc3Hd5Fg7Jk9Mq2St4Uv6Wx8Za", # boundary-ok: fake credential planted for this self-test
'"k":"sk-ant-api03-9xQvT2mKp4Lw8Rn6Bz1Yc3Hd5Fg7Jk9Mq",' # boundary-ok: fake credential planted for this self-test
'KEY="sk-ant-api03-9xQvT2mKp4Lw8Rn6Bz1Yc3Hd5Fg7Jk9Mq"', # boundary-ok: fake credential planted for this self-test
"aws_access_key_id = AKIAQ7WXYZ12ABCD34EF", # boundary-ok: fake infra string planted for this self-test
result = sandbox(relpath, "key AKIAQ7WXYZ12ABCD34EF") # boundary-ok: fake credential planted for this self-test
assert sandbox(exempt, "KEY = 'AKIAQ7WXYZ12ABCD34EF'").returncode == 1 # boundary-ok: fake credential planted for this self-test
"probe.py", 'KEY = "AKIAQ7WXYZ12ABCD34EF" # boundary-ok: planted fixture'
'A = "AKIAQ7WXYZ12ABCD34EF" # boundary-ok: fixture\n'
INFONA_DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/postgres"
'DSN = "postgresql://svc:[email protected]:5432/app"', # boundary-ok: fake credential planted for this self-test
dsn="postgresql://user:hunter2@db/app",
"dsn": "postgresql://user:[email protected]:5432/app",
Gates applied: no_behavioural_pass.
2816f7d6a9b5full audit observations/trust-audit/mcp-server/infona-ai__infona-oss.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 2816f7d6a9b5 | BLOCK | F | 51 | first audit |
Questions
What is the @infona-ai/mcp MCP server?
Messy CSV, JSON, or text → one LLM schema pass → deterministic rows into Neo4j → ask in English (Cypher).
What tools does @infona-ai/mcp expose?
41 in total: 31 read-only, 7 that write, and 3 that can delete or overwrite (delete_function, delete_knowledge_graph, delete_skill). Every one is listed on this page with its risk.
Is @infona-ai/mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (51/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @infona-ai/mcp need?
It reads ANTHROPIC_API_KEY, CEREBRAS_API_KEY, DEMO_KEY, EXA_API_KEY, INFONA_ANTHROPIC_API_KEY, INFONA_API_KEY, INFONA_API_KEYS, INFONA_CEREBRAS_API_KEY, INFONA_EXTRACT_MAX_TOKENS, INFONA_EXTRACT_MAX_TOKENS_HARD, INFONA_EXTRACT_MIN_TOKENS_PER_RECORD and INFONA_EXTRACT_TOKENS_PER_RECORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @infona-ai/mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @infona-ai/mcp at 0.1.66.
How current is this page?
The grade is for one exact copy of the source (2816f7d6a9b5), read on 2026-10-12. The repository is watched and re-audited when it changes.