.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/openalex-mcp-server</h1> <p><b>Access the OpenAlex academic research catalog - 270M+ publications through MCP. STDIO & Streamable HTTP.</b> <div>5 Tools • 2 Prompts</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://openalex.caseyjhand.com/mcp
</div>
Five tools for querying the OpenAlex academic research catalog:
| Tool Name | Description |
|---|---|
openalex_search_entities | Search, filter, sort, or retrieve by ID across all 8 entity types. |
openalex_analyze_trends | Group-by aggregation for trend and distribution analysis. |
openalex_resolve_name | Resolve a name or partial name to an OpenAlex ID via autocomplete. |
openalex_get_citation_graph | Walk the citation graph one hop from a seed work: cites, cited_by, or related_to. |
openalex_describe_fields | List valid filter, group_by, and select field names for an entity type — call before building a query to avoid invalid-field errors. |
openalex_search_entitiesPrimary discovery and lookup tool. Covers all OpenAlex entity types (works, authors, sources, institutions, topics, keywords, publishers, funders).
us|gb), NOT (!us), ranges (2020-2024), comparisons (>100)select to choose fields, or ["*"] for the full recordselect field names produce an error listing the valid fields for that entity typeopenalex_analyze_trendsAggregate entities into groups and count them for trend, distribution, and comparative analysis.
include_unknown to show entities with no value for the grouped fieldopenalex_resolve_nameName-to-ID resolution via autocomplete. Always use this before filtering by entity — names are ambiguous, IDs are not.
openalex_get_citation_graphOne-hop citation graph traversal from a seed work. Wraps the OpenAlex cites/cited_by/related_to filters behind an explicit direction argument so callers do not have to know the filter names.
cites: works that cite the seed (incoming citations)cited_by: works the seed cites (its reference list)related_to: OpenAlex algorithmic "related works" (~8-30 typical, may be empty for less-cited seeds)seed_id; validates the seed via a singleton /works/{id} lookup before walking, so non-existent seeds surface as NotFoundfilters/sort/select to narrow the graph (e.g., publication_year=">2020", is_oa="true")openalex_describe_fieldsDiscover valid field names before constructing a query — avoids invalid-field 400 errors. Backed by a catalog generated from OpenAlex's own field validation.
filter, group_by, or select)group_by resolves to the same valid-field set as filterquery (a partial or guessed name) to rank results by name similarity — surfaces the right field when you only know roughly what you want| Prompt | Description |
|---|---|
openalex_literature_review | Guides a systematic literature search: formulate query, search, filter, analyze citation network, synthesize findings. |
openalex_research_landscape | Analyzes the research landscape for a topic: volume trends, top authors/institutions, open access rates, funding sources. |
Built on @cyanheads/mcp-ts-core:
none, jwt, oauth)OpenAlex-specific:
AbortSignalA public instance is available at https://openalex.caseyjhand.com/mcp — no installation required. Point any MCP client at it via Streamable HTTP:
{
"mcpServers": {
"openalex-mcp-server": {
"type": "streamable-http",
"url": "https://openalex.caseyjhand.com/mcp"
}
}
}Add to your MCP client config (e.g., claude_desktop_config.json):
{
"mcpServers": {
"openalex-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/openalex-mcp-server"],
"env": {
"OPENALEX_API_KEY": "[email protected]"
}
}
}
}No API key needed — just provide your email to access the polite pool (10x faster rate limits).
git clone https://github.com/cyanheads/openalex-mcp-server.gitcd openalex-mcp-serverbun install| Variable | Description | Default |
|---|---|---|
OPENALEX_API_KEY | Optional. Email address for the OpenAlex polite pool (10x faster rate limits). Without it, anonymous rate limits apply. | — |
OPENALEX_BASE_URL | OpenAlex API base URL. | https://api.openalex.org |
MCP_TRANSPORT_TYPE | Transport: stdio or http. | stdio |
MCP_HTTP_PORT | Port for HTTP server. | 3010 |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth. | none |
MCP_ALLOWED_ORIGINS | Comma-separated allow-list of browser Origin headers for HTTP transport. Unset = loopback-only; set to * to disable. | _loopback only_ |
MCP_LOG_LEVEL | Log level (RFC 5424). | debug |
LOGS_DIR | Directory for log files (Node.js only). | <project-root>/logs |
OTEL_ENABLED | Enable OpenTelemetry instrumentation (spans, metrics, completion logs). | false |
bun run build
bun run start:http # or start:stdio bun run devcheck # Lints, formats, type-checks
bun run test # Runs test suitedocker build -t openalex-mcp-server .
docker run -e OPENALEX_API_KEY=your-key -p 3010:3010 openalex-mcp-server| Directory | Purpose |
|---|---|
src/mcp-server/tools/definitions/ | Tool definitions (*.tool.ts). |
src/mcp-server/prompts/definitions/ | Prompt definitions (*.prompt.ts). |
src/services/openalex/ | OpenAlex API client service and domain types. |
src/config/ | Environment variable parsing and validation with Zod. |
tests/ | Unit and integration tests, mirroring the src/ structure. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for logging, ctx.state for storageopenalex_resolve_name before using them in filtersIssues and pull requests are welcome. Run checks before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.