.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/biorxiv-mcp-server</h1> <p><b>Search and retrieve bioRxiv and medRxiv preprints — by DOI, date interval, or keyword — via MCP. STDIO or Streamable HTTP.</b> <div>5 Tools</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
Five tools for working with bioRxiv and medRxiv preprint data:
| Tool | Description |
|---|---|
biorxiv_get_preprint | Fetch full metadata, abstract, revision history, and journal crosswalk for one or more preprints by DOI |
biorxiv_list_recent | List preprints posted or updated within a date interval, with optional server and category filters |
biorxiv_search_preprints | Search preprints by keyword via EuropePMC for relevance ranking, enriched with bioRxiv/medRxiv metadata |
biorxiv_get_published_version | Resolve a preprint DOI to its journal publication record (journal DOI, name, published date) |
biorxiv_list_categories | List valid subject category strings for bioRxiv and medRxiv |
biorxiv_get_preprintFetch preprint metadata by DOI — all revisions in one call.
collection[] — one API call per DOI, no enumeration loopjatsxml), and published journal DOI when the preprint has been acceptedbiorxiv, medrxiv, or both; when both, each DOI fans out in parallel and partial failures report per-DOI in failed[]biorxiv_list_recentPage through preprints in a date interval.
?category=… — pass a value from biorxiv_list_categoriescursor (0, 30, 60, …)total count per server for calculating remaining pagesserver="both", each server paginates independently; response surfaces per-server pagination state ({ biorxiv: { cursor, total }, medrxiv: { cursor, total } })biorxiv_search_preprintsKeyword search with relevance ranking.
serverdate_from, date_to)partial_resultsbiorxiv_get_published_versionResolve a preprint DOI to its journal publication crosswalk.
/pubs/{server}/{doi} endpoint for richer metadata than the published field in biorxiv_get_preprintpublished field is non-null and you need the full crosswalk recordbiorxiv_list_categoriesReturn the static subject category taxonomy for both servers.
biorxiv_list_recentBuilt on @cyanheads/mcp-ts-core:
none, jwt, oauth)in-memory, filesystem, Supabase, Cloudflare KV/R2/D1bioRxiv-specific:
BiorxivApiService wraps api.biorxiv.org — details, publications, and crosswalk endpoints with retry and exponential backoffEuropePmcService wraps the EuropePMC search endpoint for relevance-ranked keyword resultsPromise.allSettled — both biorxiv and medrxiv queried in parallel when server="both", results merged and deduplicated by DOIUser-Agent header including a mailto address (BIORXIV_MAILTO env var) per Cold Spring Harbor Lab API guidelinesAdd the following to your MCP client configuration file.
{
"mcpServers": {
"biorxiv-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/biorxiv-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"BIORXIV_MAILTO": "[email protected]"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"biorxiv-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/biorxiv-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info",
"BIORXIV_MAILTO": "[email protected]"
}
}
}
}Or with Docker:
{
"mcpServers": {
"biorxiv-mcp-server": {
"type": "stdio",
"command": "docker",
"args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT_TYPE=stdio", "-e", "[email protected]", "ghcr.io/cyanheads/biorxiv-mcp-server:latest"]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 [email protected] bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/biorxiv-mcp-server.gitcd biorxiv-mcp-serverbun installcp .env.example .env
# optionally set BIORXIV_MAILTO for polite API accessAll configuration is validated at startup via Zod schemas in src/config/server-config.ts.
| Variable | Description | Default |
|---|---|---|
BIORXIV_MAILTO | Email address included in the User-Agent header for polite API access per Cold Spring Harbor Lab guidelines. Optional, but recommended. | — |
BIORXIV_API_BASE_URL | Override the bioRxiv API base URL. | https://api.biorxiv.org |
EUROPEPMC_API_BASE_URL | Override the EuropePMC base URL. | https://www.ebi.ac.uk/europepmc/webservices/rest |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | HTTP server port. | 3010 |
MCP_HTTP_ENDPOINT_PATH | HTTP endpoint path. | /mcp |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_LOG_LEVEL | Log level (debug, info, warning, error, etc.). | info |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
OTEL_ENABLED | Enable OpenTelemetry instrumentation. | false |
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t biorxiv-mcp-server .
docker run --rm -e [email protected] -p 3010:3010 biorxiv-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/biorxiv-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools and initializes services. |
src/config | Server-specific environment variable parsing and validation with Zod. |
src/mcp-server/tools | Tool definitions (*.tool.ts). Five tools across bioRxiv and medRxiv. |
src/services/biorxiv | BiorxivApiService — details, publications, and crosswalk endpoint wrappers with retry. |
src/services/europe-pmc | EuropePmcService — preprint keyword search endpoint wrapper. |
tests/ | Unit and integration tests mirroring the src/ structure. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagesrc/mcp-server/tools/definitions/index.tsIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.