Atlas / MCP servers / u9401066 / PubMed Search

PubMed SearchBLOCK

Name: PubMed Search
Author: u9401066

mcp/u9401066/pubmed-search-2

MCP server by u9401066 · biomedical research · citation analysis · entrez · Audited 2026-10-09

MCP SDK v2 server for PubMed and multi-source biomedical research, with resilient search, full text, citations, and tenant-safe deployment.

Verdict

BLOCK

Grade

Trust score

42 /100

Exposed tools

38 34r · 2w · 2d

Transport

streamable-http

License

NOASSERTION

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://badge.fury.io/py/pubmed-search-mcp) [](https://www.python.org/downloads/) [](https://opensource.org/licenses/Apache-2.0) [](https://modelcontextprotocol.io/) [](https://github.com/u9401066/pubmed-search-mcp/actions/workflows/ci.yml)

Professional Literature Research Assistant for AI Agents - More than just an API wrapper

A Domain-Driven Design (DDD) based MCP server that serves as an intelligent research assistant for AI agents, providing task-oriented literature search and analysis capabilities.

✨ What's Included:

🔧 41 MCP Tools - Streamlined PubMed, Europe PMC, CORE, NCBI database access, and the versioned Research Chronicle
🛡️ Multi-Agent Service Mode - Deploy once and serve many agents: per-tenant sessions, caches, and artifacts, bearer-token auth, and per-tenant fair-share limits. See DEPLOYMENT.md
🖼️ OA Figure Extraction - Pull figure captions, direct image URLs, and PDF links from PMC Open Access articles
📘 Docs Site - Browse the complete language-switchable handbook: user workflows, architecture, 41-tool reference, pipeline tutorials, source/broker contracts, integrations and operations, security, and deployment at u9401066.github.io/pubmed-search-mcp
📖 GitHub Wiki - GitHub-native mirror of the same canonical documentation at github.com/u9401066/pubmed-search-mcp/wiki
📚 26 Claude Skills - Ready-to-use workflow guides for AI agents

Read from source at commit b043d5b88d5cOBSERVED · 2026-10-09

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add pubmed-search-mcp --env BROWSER_FETCH_BROKER_TOKEN=${BROWSER_FETCH_BROKER_TOKEN} --env BROWSER_FETCH_TOKEN=${BROWSER_FETCH_TOKEN} --env KEY=${KEY} --env NCBI_API_KEY=${NCBI_API_KEY} -- uvx pubmed-search-mcp

claude-desktop

{
  "mcpServers": {
    "pubmed-search-mcp": {
      "command": "uvx",
      "args": [
        "pubmed-search-mcp"
      ],
      "env": {
        "BROWSER_FETCH_BROKER_TOKEN": "${BROWSER_FETCH_BROKER_TOKEN}",
        "BROWSER_FETCH_TOKEN": "${BROWSER_FETCH_TOKEN}",
        "KEY": "${KEY}",
        "NCBI_API_KEY": "${NCBI_API_KEY}"
      }
    }
  }
}

Exposed tools (38)

34 read · 2 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`analyze_search_query`	read
`build_citation_tree`	read
`build_research_chronicle`	read
`convert_icd_mesh`	read	Query the curated ICD/MeSH crosswalk in one explicit direction.
`delete_pipeline`	destructive	Permanently delete a saved pipeline configuration and execution history.
`diagnose_institutional_access`	read
`fetch_article_details`	read
`find_citing_articles`	read
`find_related_articles`	read
`generate_search_queries`	read
`get_article_figures`	read	Get structured figure metadata (label, caption, image URL) and PDF links from a PMC Open Access article.
`get_article_references`	read
`get_citation_metrics`	read
`get_compound_details`	read
`get_compound_literature`	read
`get_fulltext`	read
`get_gene_details`	read
`get_gene_literature`	read
`get_institutional_link`	read
`get_pipeline_history`	read	Get execution history for a saved pipeline.
`get_text_mined_terms`	read
`list_resolver_presets`	read
`load_pipeline`	read	Load a pipeline configuration for review or editing.
`prepare_export`	read
`read`	read	Read corpus records using numeric transport IDs returned by search.
`read_research_chronicle`	read
`read_session`	read	Read session data through one schema-exact discriminated request.
`save_literature_notes`	write
`schedule_pipeline`	write	Schedule a saved pipeline for periodic execution.
`search`	read	Search title/abstract text with plain lexical terms. Supports iterative queries.
`search_biomedical_images`	read
`search_clinvar`	read
`search_compound`	read
`search_gene`	read
`test_institutional_access`	read
`unschedule_pipeline`	destructive	Remove the active schedule for a saved pipeline.
`validate_pico_plan`	read	Validate agent-provided P/I/C/O and return a runnable PICO pipeline.
`verify_reference_list`	read	Verify a plain-text reference list against PubMed evidence.

Trust audit

BLOCKgrade F · trust 42/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (12 observation(s))
Shell: declared (1 observation(s))
Dependencies: pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

src/pubmed_search/application/pipeline/config_parser.py:112

parsed = yaml.load(text, Loader=_BoundedSafeLoader)  # noqa: S506  # nosec B506

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

src/pubmed_search/infrastructure/http/safe_outbound.py:38

"metadata.google.internal",

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

docker-compose.yml:31

PUBMED_ALLOWED_ORIGINS: http://localhost:${PUBMED_LOCAL_PORT:-8765},http://127.0.0.1:${PUBMED_LOCAL_PORT:-8765}

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

tests/test_browser_fetch_broker_security.py:57

token = "local-dev-token-0123456789abcdefgh"

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

tests/test_cache_substrate.py:80

secret = "PRIVATE_CACHE_KEY_AND_EXCEPTION_DETAIL"

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

tests/test_clinicalkey_ai.py:486

secret = "oauth-client-secret-sentinel"

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

tests/test_copilot_hook_integration.py:396

secret = "PRIVATE_ERROR_DETAIL_MUST_NOT_PERSIST"

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

tests/test_input_normalizer.py:177

secret = "TOPSECRET_RESPONSE_SENTINEL"

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_pipeline, unschedule_pipeline

Why it matters. 2 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius