mcp-databnfSAFE
Search the BnF open catalogue: authors, works, editions and links to what is digitised.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/mcp-databnf) [](https://github.com/smeet666/mcp-databnf/actions/workflows/ci.yml) [](./LICENSE) [](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.smeet666/mcp-databnf) [](https://glama.ai/mcp/servers/smeet666/mcp-databnf) [](https://m8ven.ai/mcp/smeet666-mcp-databnf-abxqfo) [](https://lobehub.com/mcp/smeet666-mcp-databnf) [](https://cursor.com/en/install-mcp?name=databnf&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIm1jcC1kYXRhYm5mIl19) [](https://insiders.vscode.dev/redirect/mcp/install?name=databnf&config=%7B%22name%22%3A%22databnf%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22mcp-databnf%22%5D%7D)
data.bnf.fr is the open data service of the Bibliothèque nationale de France. It publishes the authority records the national library maintains: the people it catalogues, with their dates, their places, their languages and their fields of activity; the works they wrote, with the editions each work was published in; and the links to the copies digitised in Gallica. A record states whether the library considers it established or still provisional.
This server connects a chat client to that service. You can search for an author or a work by name, read a record in full, list what an author wrote, list
427b63ea9c80OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-databnf -- npx -y [email protected]
Exposed tools (7)
7 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
find_digitised | read | |
get_author | read | |
get_work | read | |
list_editions | read | |
list_works | read | |
search_authors | read | |
search_works | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (8)
boundaries.test.ts
injection.test.ts
import { BnfClient } from "../../src/bnf/client.js";import { runFindDigitised } from "../../src/tools/findDigitised.js";import { runGetAuthor } from "../../src/tools/getAuthor.js";import { runGetWork } from "../../src/tools/getWork.js";import { runListEditions } from "../../src/tools/listEditions.js";@modelcontextprotocol/sdk, zod
Gates applied: no_behavioural_pass.
427b63ea9c80full audit observations/trust-audit/mcp-server/smeet666__mcp-databnf.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 427b63ea9c80 | SAFE | B | 89 | first audit |
Questions
What is the mcp-databnf MCP server?
Search the BnF open catalogue: authors, works, editions and links to what is digitised.
What tools does mcp-databnf expose?
7 in total: 7 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is mcp-databnf safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does mcp-databnf need?
No credential environment variables were found in its source, so it appears to need none.
How does mcp-databnf run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcp-databnf at 2.1.2.
How current is this page?
The grade is for one exact copy of the source (427b63ea9c80), read on 2026-10-12. The repository is watched and re-audited when it changes.