biopharma-mcpSAFE
An open-source, local-first Model Context Protocol (MCP) server written in TypeScript for **Biopharma Software Infrastructure, FDA 21 CFR Part 11 GxP Audit Trailing, CDISC SDTM/Allotrope Data Exports, 4PL Dose-Response Curve Fitting, and HIPAA PII/PHI Redaction**.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://glama.ai/mcp/servers/SEOSiri-Official/biopharma-mcp)
📖 Official Architecture & Documentation: SEOSiri Biopharma Technical Guide | Developer Portal & Graph Explorer | Central MCP Directory
An open-source, local-first Model Context Protocol (MCP) server written in TypeScript for Biopharma Software Infrastructure, FDA 21 CFR Part 11 GxP Audit Trailing, CDISC SDTM/Allotrope Data Exports, 4PL Dose-Response Curve Fitting, and HIPAA PII/PHI Redaction.
🛡️ Enterprise Compliance & Regulatory Clauses
1. FDA 21 CFR Part 11 Audit Trail Clause
All operational tool executions generate an immutable SHA-256 cryptographic digest written directly to the stderr stream (generate_gxp_audit_log). This preserves audit trail integrity, operator identification, and timestamp sequence rules without altering the standard JSON-RPC data payload.
2. HIPAA PII/PHI Privacy Redaction Clause
Every data payload passed through memory is automatically processed by a zero-latency privacy cleaning loop (redactPatientPii). Common sensitive patient identifiers—including Social Security Numbers (SSN), email addresses, Date of Birth (DOB) strings, and telephone patterns—are redacted prior to memory serialization or cloud database pooling.
3. Data-at-Rest AES-256-GCM Encryption Clause
Database connection parameters and sensitive data fields stored in cloud instances are encrypted using AES-256-GCM blocks with random 12-byte initialization vectors (IVs) and authentication tags (encryptRestData / decryptRestData).
🚀 10 Zod-Validated Production Tools
- `calculate_4pl_curve`: Fits 4-Parameter Logistic non-linear regression sigmoidal dose-response curves.
2
84dd4b2e75ceOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add biopharma-mcp --env ENCRYPTION_SECRET=${ENCRYPTION_SECRET} --env JWT_SECRET=${JWT_SECRET} --env MASTER_SECRET=${MASTER_SECRET} -- npx -y @seosiri/[email protected]{
"mcpServers": {
"biopharma-mcp": {
"command": "npx",
"args": [
"-y",
"@seosiri/[email protected]"
],
"env": {
"ENCRYPTION_SECRET": "${ENCRYPTION_SECRET}",
"JWT_SECRET": "${JWT_SECRET}",
"MASTER_SECRET": "${MASTER_SECRET}"
}
}
}
}Exposed tools (10)
10 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
assess_parallelism | read | Computes shared slope and asymptotes consistency via F-Test and TOST metrics. |
calculate_4pl_curve | read | Fits and resolves 4-Parameter Logistic non-linear regression sigmoidal dose-response fields. |
calculate_lod_loq | read | Calculates Limit of Detection (LOD) and Limit of Quantitation (LOQ) from background blanks. |
calculate_z_factor | read | Validates microplate HTS metrics from positive and negative control data series. |
detect_assay_outliers | read | Employs Grubbs and IQR mathematical boundaries to filter anomalous microplate artifacts. |
export_cdisc_sdtm | read | Converts unstructured JSON payload records into CDISC SDTM / Allotrope compliant models. |
generate_gxp_audit_log | read | Records immutably hashed operation logs to maintain compliance with FDA 21 CFR Part 11. |
normalize_dilution_potency | read | Scales observed calculations dynamically across dilution ratios back to original stock concentration. |
parse_large_plate_stream | read | Memory-safe stream parser for 96-well or 384-well microplate layout string rows. |
resolve_biological_entity_safe | read | Fault-tolerant Circuit Breaker query for ChEBI or PubChem compound resolution. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (1)
@modelcontextprotocol/sdk, cors, dotenv, express, jsonwebtoken, pg, zod, @types/cors
Gates applied: no_behavioural_pass.
84dd4b2e75cefull audit observations/trust-audit/mcp-server/seosiri-official__biopharma-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 84dd4b2e75ce | SAFE | B | 89 | first audit |
Questions
What is the biopharma-mcp MCP server?
An open-source, local-first Model Context Protocol (MCP) server written in TypeScript for **Biopharma Software Infrastructure, FDA 21 CFR Part 11 GxP Audit Trailing, CDISC SDTM/Allotrope Data Exports, 4PL Dose-Response Curve Fitting, and HIPAA PII/PHI Redaction**.
What tools does biopharma-mcp expose?
10 in total: 10 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is biopharma-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does biopharma-mcp need?
It reads ENCRYPTION_SECRET, JWT_SECRET and MASTER_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does biopharma-mcp run?
It speaks sse and stdio, so it runs as a local process your client starts. It is published on npm as @seosiri/biopharma-mcp at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (84dd4b2e75ce), read on 2026-10-11. The repository is watched and re-audited when it changes.