mcp-nci-evsSAFE
NCI Thesaurus concepts and the other cancer-research vocabularies served by NCI Enterprise Vocabulary Services: codes, synonyms, definitions and hierarchy.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
NCI Thesaurus (NCIt) concepts and the other controlled vocabularies served by the NCI Enterprise Vocabulary Services REST API — the C-codes that CDISC, GDC, CTRP, SEER and the NCI trial systems all key on.
Part of Pipeworx — an MCP gateway connecting AI agents to 1683+ live data sources.
Tools
evs_search_concepts(term, terminology?, type?, include?, page_size?, from_record?)
— name → code. Searches NCIt by default; also ICD-10, MedDRA, SNOMED CT, HGNC, GO and others served by the same API.
evs_concept(code, terminology?, include?)— code → full record: preferred
name, definitions with source, every synonym with its term type and source, semantic types, and cross-terminology maps to ICD-O-3 / ICD-10 / MedDRA.
evs_terminologies(latest_only?)— which vocabularies are queryable and at
which loaded version. A concept record is only interpretable against its version, so this is how you pin an answer.
evs_concept_relations(code, terminology?, kinds?)— parents, children,
roles, associations, inverse associations, descendants. Use it to expand a disease into its subtypes before querying trial or genomic data.
Auth
Keyless.
Data sources
- — term search.
- — one concept.
- — relations.
- — loaded terminologies.
Traps
The API version prefix is `/api/v1`, not bare `/`. The paths in NCI's own prose omit it; without it every call 404s with a Spring "No static resource" body that looks like the endpoint was withdrawn.
Relations are separate endpoints, not an `include`. There is no /relationships path — it 404s. Parents, chil
a05b1787f63aOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-nci-evs -- npx -y @pipeworx/[email protected]
{
"mcpServers": {
"mcp-nci-evs": {
"command": "npx",
"args": [
"-y",
"@pipeworx/[email protected]"
]
}
}
}Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
evs_concept | read | Fetch one NCI Enterprise Vocabulary Services concept by its code — the full record for an NCIt C-code (or a code in another served terminology). AUTHORITATIVE for the concept\ |
evs_concept_relations | read | Walk the NCIt hierarchy and relationship graph around one concept code, via NCI Enterprise Vocabulary Services. AUTHORITATIVE for |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (1)
@modelcontextprotocol/sdk, tsx, typescript, @cloudflare/workers-types
Gates applied: no_behavioural_pass.
a05b1787f63afull audit observations/trust-audit/mcp-server/pipeworx-io__mcp-nci-evs.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | a05b1787f63a | SAFE | B | 89 | first audit |
Questions
What is the mcp-nci-evs MCP server?
NCI Thesaurus concepts and the other cancer-research vocabularies served by NCI Enterprise Vocabulary Services: codes, synonyms, definitions and hierarchy.
What tools does mcp-nci-evs expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is mcp-nci-evs safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does mcp-nci-evs need?
No credential environment variables were found in its source, so it appears to need none.
How does mcp-nci-evs run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @pipeworx/mcp-nci-evs at 0.1.2.
How current is this page?
The grade is for one exact copy of the source (a05b1787f63a), read on 2026-10-11. The repository is watched and re-audited when it changes.