.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/wikidata-mcp-server</h1> <p><b>Search and fetch Wikidata entities, execute SPARQL queries, and resolve external identifiers via MCP. STDIO or Streamable HTTP.</b> <div>7 Tools • 1 Resource</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://wikidata.caseyjhand.com/mcp
</div>
7 tools for working with Wikidata's knowledge graph:
| Tool | Description |
|---|---|
wikidata_search_entities | Search for items or properties by text query, returning QIDs/PIDs with labels, descriptions, and match metadata |
wikidata_get_entity | Fetch a full entity by QID or PID with optional field and language filtering |
wikidata_get_labels | Batch-resolve up to 50 QIDs or PIDs to human-readable labels and descriptions |
wikidata_get_statements | Fetch property claims for an entity with qualifier detail and QID label resolution |
wikidata_get_sitelinks | Fetch Wikipedia and Wikimedia project article URLs for a Wikidata item |
wikidata_sparql_query | Execute a SPARQL SELECT query against the Wikidata Query Service |
wikidata_resolve_external_id | Look up a Wikidata entity by an external identifier (DOI, PubMed ID, ORCID, OpenAlex ID, etc.) |
wikidata_search_entitiesSearch Wikidata for items or properties by text query.
type="item" for real-world concepts (people, places, works); type="property" for predicate P-IDswikidata_get_entityFetch a Wikidata entity by QID or PID with field selection.
Q76) fetch items; P-IDs (e.g. P31) fetch properties — endpoint routing is automaticfields parameter trims the response to labels, descriptions, aliases, statements, or sitelinkslanguages parameter filters multilingual maps to specific language codeswikidata_get_labelsBatch-resolve QIDs/PIDs to human-readable labels and descriptions.
wbgetentities APIfound count and notFound IDs for partial-result handlingwikidata_get_statementsFetch property claims for a Wikidata entity with full qualifier and reference detail.
properties parameter fetches only specific P-IDs — omit to return all statementsresolve_labels=false for raw QIDs only (faster, smaller payload)wikidata_get_sitelinksFetch Wikipedia and Wikimedia project article URLs for a Wikidata item.
enwiki) to article titles and URLssites parameter filters to specific site codeswikis_only=true returns only Wikipedia links (excludes Wiktionary, Wikiquote, Wikisource, etc.)wikidata_sparql_queryExecute a SPARQL SELECT query against the Wikidata Query Service (Blazegraph).
wd:, wdt:, p:, ps:, pq:, wikibase:, bd:) are auto-injectedwikibase:label SERVICE auto-injected when language is set and the query uses ?<var>Label variables{ type, value, "xml:lang"? }timeout parameter (1–55s) applies earlierwikidata_resolve_external_idLook up a Wikidata entity by an external identifier.
match=null when not foundmultipleMatches when a Wikidata data integrity issue causes more than one entity to claim the same external ID| Type | Name | Description |
|---|---|---|
| Resource | wikidata://entity/{id} | Compact markdown summary of a Wikidata entity — labels, English description, instance-of, Wikipedia link, image, and statement count |
All resource data is also reachable via tools.
Built on @cyanheads/mcp-ts-core:
none, jwt, oauth)in-memory, filesystem, Supabase, Cloudflare KV/R2/D1Wikidata-specific:
wbgetentities API for efficient batch label resolutionUser-Agent per Wikimedia policyAgent-friendly output:
wikidata_get_labels designed to follow SPARQL result sets — run the query, then humanize in one callwikidata_resolve_external_id handles DOI/PMID/ORCID normalization transparently, with multipleMatches for data integrity edge caseswikidata_get_statements resolves QID values to labels in the same call, with resolve_labels=false escape hatch for raw payloadsAdd the following to your MCP client configuration file.
{
"mcpServers": {
"wikidata-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/wikidata-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"wikidata-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/wikidata-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"wikidata-mcp-server": {
"type": "stdio",
"command": "docker",
"args": ["run", "-i", "--rm", "-e", "MCP_TRANSPORT_TYPE=stdio", "ghcr.io/cyanheads/wikidata-mcp-server:latest"]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpgit clone https://github.com/cyanheads/wikidata-mcp-server.gitcd wikidata-mcp-serverbun installAll configuration is validated at startup via Zod schemas. Key environment variables:
| Variable | Description | Default |
|---|---|---|
MCP_TRANSPORT_TYPE | Transport: stdio or http | stdio |
MCP_HTTP_PORT | HTTP server port | 3010 |
MCP_HTTP_ENDPOINT_PATH | HTTP endpoint path where the MCP server is mounted | /mcp |
MCP_PUBLIC_URL | Public origin override for TLS-terminating reverse-proxy deployments | none |
MCP_AUTH_MODE | Authentication: none, jwt, or oauth | none |
MCP_LOG_LEVEL | Log level (debug, info, notice, warning, error) | info |
MCP_GC_PRESSURE_INTERVAL_MS | Opt-in Bun-only forced-GC interval (ms). Try 60000 if heap growth is observed under HTTP load. | 0 (disabled) |
LOGS_DIR | Directory for log files (Node.js only) | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend: in-memory, filesystem, supabase, cloudflare-kv/r2/d1 | in-memory |
WIKIDATA_USER_AGENT | User-Agent string for Wikimedia requests (policy requires a descriptive value) | wikidata-mcp-server/0.1 (https://github.com/cyanheads/wikidata-mcp-server) |
WIKIDATA_SPARQL_TIMEOUT_MS | Max wait for a SPARQL response in ms | 55000 |
WIKIDATA_REST_TIMEOUT_MS | Max wait for REST API responses in ms | 10000 |
OTEL_ENABLED | Enable OpenTelemetry | false |
# One-time build
bun run rebuild
# Run the built server
bun run start:http
# or
bun run start:stdio bun run devcheck # Lints, formats, type-checks, and more
bun run test # Runs the test suite| Directory | Purpose |
|---|---|
src/mcp-server/tools | Tool definitions (*.tool.ts). Seven tools for entity lookup, statements, sitelinks, SPARQL, and external ID resolution. |
src/mcp-server/resources | Resource definitions. Entity summary resource. |
src/services/wikidata | Wikidata service layer — REST API client, SPARQL client, statement normalization, types. |
src/config | Server-specific environment variable parsing and validation with Zod. |
tests/ | Unit and integration tests, mirroring the src/ structure. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for logging, ctx.state for storagecreateApp() arraysIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.