Skip to content

Genomic Intelligence

by genomicintelligence.ai · remote · no sign-in to list tools · v1.0.0 · published by ai.genomicintelligence

Hosted DNA language models: promoter, splice, enhancer, chromatin, expression, annotation

Changes · 12

15 tools: 12 change things and 3 only read.

Scanned Oct 21, 2026

6 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http genomic-intelligence https://mcp.genomicintelligence.ai/mcp

Findings

Matches of fixed checks, with the text they matched.

5 warn1 info
  • The server marks "fetch_ensembl_sequence" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "fetch_ensembl_sequence" says "fetch": a word for reading.

    What this check looks for
  • The server marks "fetch_region" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "fetch_region" says "fetch": a word for reading.

    What this check looks for
  • The server marks "fetch_gene_for_expression" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "fetch_gene_for_expression" says "fetch": a word for reading.

    What this check looks for
  • The server marks "find_genes" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "find_genes" says "find": a word for reading.

    What this check looks for
  • The server marks "find_genes_and_predict_expression" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "find_genes_and_predict_expression" says "find": a word for reading.

    What this check looks for
  • The description is 2,126 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...redict_expression takes a raw region and finds each TSS for you."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

15 tools

Changes things 12Claude Code: ask
  • fetch_ensembl_sequenceFetch a gene's reference sequence from Ensembl and store it.Reads text others write1 finding

    Why it is in this group

    • The name "fetch_ensembl_sequence" says "fetch": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "fetch_ensembl_sequence" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "fetch_ensembl_sequence" says "fetch": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Fetch a gene's reference sequence from Ensembl and store it. Returns a handle ({ref, name, length, preview, ...}). Pass the `ref` to predict_* tools — the bases stay server-side. For expression, use fetch_gene_for_expression instead (it prepares the TSS-centred window that model needs).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • fetch_gene_for_expressionFetch a gene's sequence prepared for expression prediction.Reads text others write1 finding

    Why it is in this group

    • The name "fetch_gene_for_expression" says "fetch": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "fetch_gene_for_expression" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "fetch_gene_for_expression" says "fetch": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Fetch a gene's sequence prepared for expression prediction. Resolves the gene's canonical-transcript TSS via Ensembl and stores a gene-sense sequence centred on it, as a handle to pass to predict_expression(sequence_ref=...). Longer TSS-centred sequence gives better predictions, so this already fetches as much flank on each side of the TSS as the listed expression models recommend (the largest bio_spec.recommended_flank_bp from list_models). One handle serves every expression model: the API reads what the chosen model needs around the TSS and ignores the rest. The handle records `tss_index` (the TSS offset into it), and predict_expression uses it when you do not pass one, so no offset arithmetic is needed. Every expression model accepts at least 9,198 bp with the TSS at least 4,599 bp from each end. Near a chromosome end the flank is shortened to what fits (reported as `flank_shortened`), never below 4,599 bp; a TSS closer to the end than that is an error.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • fetch_regionFetch a genomic region by coordinates from Ensembl and store it.Reads text others write1 finding

    Why it is in this group

    • The name "fetch_region" says "fetch": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "fetch_region" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "fetch_region" says "fetch": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Fetch a genomic region by coordinates from Ensembl and store it. For "find the genes in chr8:127,680,000-127,800,000"-style requests: resolves a coordinate range to reference sequence and returns a handle ({ref, name, length, ...}) to pass to find_genes / predict_* — the bases stay server-side. Plus strand by default, which is what the gene-finder expects. For a gene by name use fetch_ensembl_sequence; for expression use fetch_gene_for_expression.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • find_genesFind genes (transcript intervals) in a genomic region (async, ~8-25s).Reads text others write1 finding

    Why it is in this group

    • The name "find_genes" says "find": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "find_genes" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "find_genes" says "find": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Find genes (transcript intervals) in a genomic region (async, ~8-25s). Takes 1,000–500,000 bp. The floor is the strictest of the scanning tasks: gene finding needs a region, not a site. (Only expression's 9,198 bp is higher, and that is the sequence around one TSS rather than a region to search.) Gene-finding: detects transcript boundaries (TSS + PolyA) and returns one interval per predicted transcript — start/end, strand, a confidence score, and predicted TSS/PolyA positions (BED-style feature intervals, not free-text notes). Use this for "what genes are here", "find / locate genes", or "annotate this region". Each transcript also carries its type (mRNA/lnc_RNA) and internal exon/intron/CDS structure in `exons`/`introns`/`cds` arrays, plus a browser-ready GFF3 track in `data.formats.gff3`. To get each gene's *expression* from a raw region, use find_genes_and_predict_expression instead — expression needs a per-gene TSS window, so predict_expression cannot run on a whole region. Submits an async job internally. With wait=True (default), blocks and streams progress, then returns the result {data, meta} — it never returns a job_id on this path. (If a generous block ceiling is exceeded it returns a timeout error, not a job handle.) With wait=False (detached), returns {data: {job_id, status: 'submitted'}} immediately — poll it with get_job.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • find_genes_and_predict_expressionFind genes in a sequence, then predict each gene's expression (composite).Reads text others write1 finding

    Why it is in this group

    • The name "find_genes_and_predict_expression" says "find": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "find_genes_and_predict_expression" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "find_genes_and_predict_expression" says "find": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Find genes in a sequence, then predict each gene's expression (composite). Server-side chaining in ONE call: finds genes (transcript intervals, with their TSS) in the sequence, then predicts expression off each discovered TSS in the given experimental context. This is the right tool whenever you want expression for a raw region or sequence — e.g. "find the genes in chr8:… and predict their expression in K562". predict_expression scores the sequence around ONE TSS and needs you to know where that TSS is (a 9,198 bp window with the TSS at its midpoint, or a longer sequence plus `tss_index`); this tool discovers every gene's TSS itself. It has no 9,198 bp floor and no tss_index; it starts with gene finding, so it takes 1,000–500,000 bp. Runs async internally at every size (the annotate stage is slow even for small inputs), so progress always streams. With wait=True (default), blocks and streams progress, then returns the result {data, meta} — it never returns a job_id on this path. With wait=False (detached), returns {data: {job_id, status: 'submitted'}} immediately — poll it with get_job. Because it ends in expression, `description` (cell type / assay context) is REQUIRED.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • load_demo_sequenceLoad a bundled demo reference sequence and return a handle.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Load a bundled demo reference sequence and return a handle. The server ships one curated, task-correct positive control per task (list them via the gi://sequences resource) — e.g. `expression_hbb_k562` is a ready-to-use K562 expression window for predict_expression. Stores the demo and returns a handle to pass to a predict_* tool: no Ensembl fetch, no quota. Handy for smoke-testing a prediction end-to-end.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • predict_chromatinChromatin annotation across 919 features (G0 DeepSEA).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Chromatin annotation across 919 features (G0 DeepSEA). 200–500,000 bp. The model reads a 1,000 bp context window; 200–999 bp is accepted and scored against a padded window.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • predict_enhancerPredict enhancer activity (G0 DeepSTARR).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Predict enhancer activity (G0 DeepSTARR). 50–500,000 bp. 50 bp is the task's admission floor (the API 422s below it), not a statement about what the model reads: enhancer models score a 249 bp context window, so 50–248 bp is accepted and scored against a padded window. For a meaningful call, submit at least the 249 bp context.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • predict_expressionPredict a gene's expression from the sequence around its TSS.Reads text others write1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Info

      The description is 2,126 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...redict_expression takes a raw region and finds each TSS for you."

      What this check looks for
    Description, as the server wrote it
    Predict a gene's expression from the sequence around its TSS. Expression is cell-type-specific, so `description` (cell type / assay context, e.g. 'K562 cell line') is REQUIRED — the API rejects requests without it. The input rule is the same for every expression model: at least 9,198 bp, with the TSS at least 4,599 bp from each end, up to 500,000 bp. Longer TSS-centred sequence gives better predictions: each model's bio_spec.recommended_flank_bp (see list_models) says how many bp it reads on each side of the TSS, and flank beyond that is ignored. Less flank, down to 4,599 bp, is accepted and scored, but the model then reads less than it was trained on. Omit `model` for the server's default. - A 9,198 bp sequence with the TSS at offset 4,599 (the midpoint) needs no `tss_index`. - Any longer sequence needs `tss_index`: the 0-based offset of the TSS into it (a fetch_gene_for_expression handle carries its own). The API cuts what the model reads around that offset and never scans for a TSS itself. Under 9,198 bp, or a TSS closer than 4,599 bp to either end, is rejected here and by the API (422). A locus with no offset is rejected too, because it is indistinguishable from a mis-centred window. A very N-rich or low-complexity window can also be refused by the API (422). An offset that is merely WRONG (e.g. counted over a wrapped FASTA's characters, or against a chromosome coordinate instead of an offset into THIS sequence) still succeeds and scores the wrong window — verify meta.task_specific_counts.scored_window in the response. Easiest paths: fetch_gene_for_expression(gene) already fetches a long TSS-centred handle (as much flank as the listed models recommend) and records its `tss_index`, which is sent for you when you pass that handle without one; find_genes_and_predict_expression takes a raw region and finds each TSS for you.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • predict_promoterPredict promoter regions (G0).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Predict promoter regions (G0). 300–500,000 bp. Returns the {data, meta} envelope: data.regions lists predicted promoters with start/end/score. 300 bp is the task floor for every promoter model. The default g0-promoter-2000bp scans a 2,000 bp context window, so a shorter (but ≥300 bp) sequence is still scored — against a window padded out to that size. Check the chosen model's bio_spec.context_window_bp via list_models to know whether it saw real sequence or padding.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • predict_splicePredict splice donor/acceptor sites (G0 BigBird).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Predict splice donor/acceptor sites (G0 BigBird). 100–500,000 bp. The model reads a 15,000 bp context window, so anything shorter is scored against a padded window — feed a whole transcript locus when you can. It is also strand-specific, and the wrong strand fails silently and plausibly — it returns sites at different positions, often still scoring above 0.9, not the near-zero scores once documented here. Nothing in the response flags it, so submit the transcript's own orientation (fetch_region takes `strand`).

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • store_inline_sequenceStore a human-pasted sequence and return a handle to re-use it.No findings

    Why it is in this group

    • The name "store_inline_sequence" says "store": a word for a change.
    Description, as the server wrote it
    Store a human-pasted sequence and return a handle to re-use it. For a sequence you've already pasted into the conversation, this gives back a short handle so you can run several tasks on it without re-pasting the bases in each predict_* call. Note that the full sequence still passes through the LLM on THIS call — it does not save context on its own. For large sequences, prefer fetch_ensembl_sequence / fetch_gene_for_expression / load_local_fasta, which acquire the bases server-side and never round-trip them. A line-wrapped FASTA *body* may be pasted verbatim: whitespace is stripped before storing, so the handle's `length` counts bases and a later `tss_index` counts into the same string the API measures. (A FASTA `>` header line is not a sequence and is rejected by the API's alphabet check.)

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
Only reads 3Claude Code: allow
  • get_jobPoll an async job once.Reads text others writeNo findings

    Why it is in this group

    • The name "get_job" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Poll an async job once. Returns the {data, meta} result if complete, a progress envelope if still running, or an error envelope if it failed.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • list_jobsList the caller's recent async jobs (also available as gi://jobs/recent).Reads text others writeNo findings

    Why it is in this group

    • The name "list_jobs" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List the caller's recent async jobs (also available as gi://jobs/recent).

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: true
    • readOnlyHint: true
  • list_modelsList available models for a task.Reads text others writeNo findings

    Why it is in this group

    • The name "list_models" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List available models for a task. Use to discover model ids before passing one as the `model` argument to a predict tool. The same catalog is also available as the resource `gi://models`. Returns a FLAT object — {task, default_model, models: [...]} — not the {data, meta} envelope the predict tools return. Each model carries a `bio_spec`, whose useful fields are `request_max_bp` (the enforced ceiling, 500,000 everywhere) and `context_window_bp` (what the model reads in one step — compare your sequence length against it: a shorter one is scored against a padded window). `trained_window_bp` is the fixed receptive field where there is no sliding window (null for a model without one). For expression, `recommended_flank_bp` is how many bp the model reads on each side of the TSS; longer TSS-centred input is better, and fetch_gene_for_expression already fetches the largest listed value. `request_max_bp` is the only cap; the other fields describe what the model reads, not what the route accepts.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: true
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:19 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
12
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 12 tools that change things (12 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://mcp.genomicintelligence.ai/mcp: tools/list returned 15 tools to an anonymous client, including fetch_ensembl_sequence (write), fetch_region (write), fetch_gene_for_expression (write), load_demo_sequence (write), store_inline_sequence (write) and 7 more

    What this check looks for

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http genomic-intelligence https://mcp.genomicintelligence.ai/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__genomic-intelligence__list_models",
      "mcp__genomic-intelligence__get_job",
      "mcp__genomic-intelligence__list_jobs"
    ],
    "ask": [
      "mcp__genomic-intelligence__fetch_ensembl_sequence",
      "mcp__genomic-intelligence__fetch_region",
      "mcp__genomic-intelligence__fetch_gene_for_expression",
      "mcp__genomic-intelligence__load_demo_sequence",
      "mcp__genomic-intelligence__store_inline_sequence",
      "mcp__genomic-intelligence__predict_promoter",
      "mcp__genomic-intelligence__predict_splice",
      "mcp__genomic-intelligence__predict_enhancer",
      "mcp__genomic-intelligence__predict_chromatin",
      "mcp__genomic-intelligence__predict_expression",
      "mcp__genomic-intelligence__find_genes",
      "mcp__genomic-intelligence__find_genes_and_predict_expression"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as genomic-intelligence. Review it before you use it.

Capability tags behind 13 rules
  • mcp__genomic-intelligence__list_models untrusted-input
  • mcp__genomic-intelligence__fetch_ensembl_sequence untrusted-input
  • mcp__genomic-intelligence__fetch_region untrusted-input
  • mcp__genomic-intelligence__fetch_gene_for_expression untrusted-input
  • mcp__genomic-intelligence__predict_promoter untrusted-input
  • mcp__genomic-intelligence__predict_splice untrusted-input
  • mcp__genomic-intelligence__predict_enhancer untrusted-input
  • mcp__genomic-intelligence__predict_chromatin untrusted-input
  • mcp__genomic-intelligence__predict_expression untrusted-input
  • mcp__genomic-intelligence__find_genes untrusted-input
  • mcp__genomic-intelligence__find_genes_and_predict_expression untrusted-input
  • mcp__genomic-intelligence__get_job untrusted-input
  • mcp__genomic-intelligence__list_jobs untrusted-input