Atlas / MCP servers / sidneybissoli / medical-terminologies-mcp

medical-terminologies-mcpSAFE

mcp/sidneybissoli/medical-terminologies-mcp

Unified MCP server for six medical terminologies (ICD-11, LOINC, RxNorm, MeSH, ATC, CID-10) with authoritative WHO ICD-10→ICD-11 mapping and provenance on every response. Hosted endpoint: no install, no credentials.

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
33 33r · 0w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
15
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.npmjs.com/package/medical-terminologies-mcp) [](https://www.npmjs.com/package/medical-terminologies-mcp) [](https://www.npmjs.com/package/medical-terminologies-mcp) [](https://registry.modelcontextprotocol.io) [](https://lobehub.com/mcp/sidneybissoli-medical-terminologies-mcp) [](https://smithery.ai/servers/sidneybissoli/medical-terminologies-mcp) [](https://glama.ai/mcp/servers/SidneyBissoli/medical-terminologies-mcp) [](https://codeguilds.dev/packages/medical-terminologies-mcp) [](https://github.com/SidneyBissoli/medical-terminologies-mcp) [](https://github.com/sponsors/SidneyBissoli) [](https://medical.sidneybissoli.com/stats) [](https://modelcontextprotocol.io) [](https://opensource.org/licenses/MIT)

A Model Context Protocol (MCP) server providing unified access to major global medical terminologies:

  • ICD-11 - Internationa
Read from source at commit 77cbf5239a9dOBSERVED · 2026-10-10
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)
claude mcp add medical-terminologies-mcp --env WHO_CLIENT_SECRET=${WHO_CLIENT_SECRET} --env WHO_CLIENT_SECRET=${WHO_CLIENT_SECRET} -- npx -y [email protected]
claude-code (npm)
claude mcp add medical-terminologies-mcp --env WHO_CLIENT_SECRET=${WHO_CLIENT_SECRET} --env WHO_CLIENT_SECRET=${WHO_CLIENT_SECRET} -- npx -y [email protected] 3000 0.0.0.0
03

Exposed tools (33)

33 read · 0 write · 0 destructive.

ToolRiskDescription
atc_classifyreadLook up the WHO ATC (Anatomical Therapeutic Chemical) classification(s) for a drug by name. Use this tool to: - Find the ATC code for a medication (e.g.,
atc_lookupreadLook up an ATC code at level 1-4 to get its name and hierarchy level. Use this tool to: - Resolve an ATC code (e.g.,
atc_membersreadList the drugs (substances) that belong to an ATC class. Use this tool to: - Enumerate all members of a therapeutic class (e.g.,
cid10-portuguese-lookupreadProcura um termo médico em português no CID-10 brasileiro (DataSUS V2008), com contexto de capítulo e descrição clínica. Searches a Portuguese medical term in the Brazilian CID-10 with chapter context.
cid10_chapterreadGet one CID-10 chapter and its constituent groups (e.g.,
cid10_chaptersreadList the 22 chapters of CID-10 with their code ranges and Portuguese titles. Use this tool to: - See the top-level structure of CID-10 (chapters I-XXII, e.g.,
cid10_lookupreadLook up a specific CID-10 code and return its Portuguese name. Use this tool to: - Resolve a code to its Brazilian description (
cid10_searchreadSearch the Brazilian CID-10 (Classificação Estatística Internacional de Doenças, 10a Revisão) by Portuguese text. Use this tool to: - Find CID-10 codes for Brazilian SUS / ANVISA contexts (
conditionreadThe condition, symptom, or medical term to search for.
drug-inforeadCompile comprehensive information about a drug — normalized name, RxCUI, active ingredients, therapeutic classes, and WHO ATC classification — by composing RxNorm and ATC tool calls.
drug_namereadThe drug name (brand or generic) to look up. Approximate matches are accepted.
find-medical-codereadSearch a clinical condition, symptom, or medical term across all available terminologies (ICD-11, LOINC, RxNorm, MeSH, ATC, CID-10) in parallel and synthesize the matches with their codes and source terminology.
icd11_chaptersreadList all ICD-11 chapters (top-level categories) of the pinned WHO release. Use this tool to: - Get an overview of ICD-11 structure - Find which chapter covers a body system or condition type - Get chapter URIs to drill down with icd11_hierarchy (direction
icd11_hierarchyreadNavigate the ICD-11 hierarchy to find parent or child entities. Use this tool to: - Find broader categories (parents) of a condition - Find specific subtypes (children) of a condition - Understand the classification structure Name the entity by \
icd11_lookupreadGet detailed information about ONE ICD-11 entity you already have a code or URI for. Use this tool to: - Get the full definition of a disease - Retrieve coding notes, inclusions and exclusions - Get the official title and index terms (synonyms) Provide \
icd11_searchreadSearch for medical conditions, diseases, and health problems in ICD-11 (International Classification of Diseases, 11th Revision). Use this tool to: - Find ICD-11 codes for diagnoses - Search for diseases by name or keyword - Look up conditions in multiple languages Set \
languagereadPreferred language hint —
loinc_answersreadGet the list of valid answers for a LOINC questionnaire item. Use this tool to: - Find valid response options for survey questions - Get answer codes (LA...) for data entry validation - Get the item scores of scored instruments (e.g. PHQ-9:
loinc_detailsreadGet detailed information about a specific LOINC code. Use this tool to: - Get the full name and description of a LOINC code - Find the component, property, timing, and system - Check the scale type and method Provide a LOINC number in format
loinc_panelsreadGet the structure of a LOINC panel or form. Use this tool to: - See all tests included in a panel (e.g., CBC, metabolic panel) - Get the structure of assessment forms - Find related observations grouped together Returns the list of LOINC codes that make up the panel.
loinc_searchreadSearch for laboratory tests, clinical observations, and measurements in LOINC (Logical Observation Identifiers Names and Codes). Use this tool to: - Find LOINC codes for lab tests (e.g.,
mesh_descriptorreadGet detailed information about a MeSH descriptor by ID. Use this tool to: - Get the full definition (scope note) of a MeSH term - View tree numbers showing hierarchy location - See related concepts and synonyms Provide a MeSH Descriptor ID like
mesh_qualifiersreadGet allowed qualifiers (subheadings) for a MeSH descriptor. Use this tool to: - Find which qualifiers can be combined with a descriptor - Build precise MeSH search queries - Understand aspects that can be specified Qualifiers refine descriptors (e.g.,
mesh_searchreadSearch for MeSH (Medical Subject Headings) descriptors. Use this tool to: - Find MeSH terms for indexing medical literature - Look up subject headings for PubMed searches - Find controlled vocabulary terms Set \
mesh_treereadGet the tree hierarchy location(s) for a MeSH descriptor. Use this tool to: - See where a term fits in the MeSH hierarchy - Understand broader/narrower relationships - Find related terms in the same branch MeSH tree numbers show the hierarchical path (e.g., C14.280.647 for Myocardial Infarction).
rxnorm_classesreadGet therapeutic and pharmacologic classes for a drug. Use this tool to: - Find the drug class (e.g.,
rxnorm_conceptreadGet detailed information about a specific RxNorm concept by RxCUI. Use this tool to: - Get the full name and synonyms for a drug - Check the concept status (active, remapped, etc.) - View related concepts (ingredients, brands, forms) Provide an RxCUI (RxNorm Concept Unique Identifier) like
rxnorm_ingredientsreadGet active ingredients for a drug by RxCUI. Use this tool to: - Find the active ingredients in a medication - Check for single vs. multiple ingredient products - Identify the generic components of brand drugs Returns ingredient RxCUIs and names.
rxnorm_ndcreadMap between RxNorm concepts and National Drug Codes (NDC). Use this tool to: - Get all NDC codes for a drug (by RxCUI) - Find the RxCUI for an NDC code - Cross-reference between coding systems Provide either an RxCUI to get NDCs, or an NDC to get the RxCUI.
rxnorm_searchreadSearch for drugs in RxNorm (Normalized names for clinical drugs). Use this tool to: - Find drug concepts by brand or generic name - Look up medications for prescribing - Search for drug formulations Returns matching drugs with RxCUI identifiers, names, and term types.
termreadTermo médico em português a ser pesquisado (ex.:
terminology_diffreadReport what diff data is available between two versions of a terminology. For most terminologies this is **guidance only** — the server doesn
validate_codesreadValidate a mixed batch of medical codes against their source terminologies. Useful for retrospective analysis of legacy databases — flag codes that no longer exist, surface ICD-10 → ICD-11 replacements, and grade activity status where the terminology exposes it. For each input \
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (5 observation(s))
Network
declared (5 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (13)

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
worker/src/config.ts:10
import { SERVER_INFO } from "../../dist/worker-lib.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
worker/src/envelope.ts:62
import { classeDoErroRpc, classifyError, errorText } from "../../dist/worker-lib.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
worker/src/index.ts:15
import { unknownCursorError } from "../../dist/worker-lib.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
worker/src/index.ts:17
import { StatsCounter, toolRegistry } from "../../dist/worker-lib.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
worker/src/index.ts:32
import trava from "../../surface.lock.json";
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/server, @sbissoli/mcp-provenance, @sbissoli/mcp-search, @sbissoli/mcp-upstream, pino, zod, @modelcontextprotocol/client, @sbissoli/mcp-evals
Why it matters. 17 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
worker/package.json
agents, @cloudflare/workers-types, typescript, vite, vitest, wrangler
Why it matters. 6 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
CLAUDE.md:179
- Endpoints: `POST /mcp` (JSON-RPC), `GET /` (landing), `GET /health` (liveness JSON with tool_count), `GET /status` (version + deploy metadata), `GET /metrics` (UsageTracker aggregates), `GET /stats`
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
INFOInventory / provenance · inv.oversize · CWE-1104
assets/gemini.png
assets/gemini.png
Why it matters. 4743663 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
src/data/cid10.json
src/data/cid10.json
Why it matters. 1941776 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
src/data/icd10-to-icd11.json
src/data/icd10-to-icd11.json
Why it matters. 5408993 bytes not read
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
NOTICE.md:34
- API access requires free OAuth credentials from https://icd.who.int/icdapi.
Why it matters. asks the agent to read credentials
INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
docs/glama-dockerfile.md:97
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl git && curl -fsSL https://deb.nodesource.com/setup_24.x | bash - && apt-get install -y --no-install-recommends nod

Gates applied: no_behavioural_pass.

Audited 2026-10-10 · audit v0.4.1 · source sha 77cbf5239a9dfull audit observations/trust-audit/mcp-server/sidneybissoli__medical-terminologies-mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-1077cbf5239a9dSAFEB89first audit
06

Questions

What is the medical-terminologies-mcp MCP server?

Unified MCP server for six medical terminologies (ICD-11, LOINC, RxNorm, MeSH, ATC, CID-10) with authoritative WHO ICD-10→ICD-11 mapping and provenance on every response. Hosted endpoint: no install, no credentials.

What tools does medical-terminologies-mcp expose?

33 in total: 33 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is medical-terminologies-mcp safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does medical-terminologies-mcp need?

It reads KEY and WHO_CLIENT_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does medical-terminologies-mcp run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as medical-terminologies-mcp-worker at 0.0.0.

How current is this page?

The grade is for one exact copy of the source (77cbf5239a9d), read on 2026-10-10. The repository is watched and re-audited when it changes.

Advertisement