ResearchPilot

io.github.cnucho/researchpilotcnuchostreamable-httpv0.2.0Scanned 34 minutes ago

Plan and verify evidence-aware research workflows with specialist execution receipts.

23 tools: 9 change things and 14 only read.

Reads private data · 0
Reads text others write · 2
Can send data out · 0
3 findings

Anlyon alternative

9 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

23 tools

Changes things 9Creates or changes something that can be changed back.Claude Code: ask

researchpilot_build_collection_recipeBuild a reproducible collection plan for YouTube metadata, web text, legal references, data APIs, or a bounded text corpus.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Build a reproducible collection plan for YouTube metadata, web text, legal references, data APIs, or a bounded text corpus. This returns a plan only and never claims collection occurred.
Annotations the server declares
- title: ResearchPilot: Build Collection Recipe
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_check_methodCheck one ResearchPilot capability by canonical capability ID and distinguish discussion/planning, direct execution, certified core, registered engine, and specialist handoff.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Check one ResearchPilot capability by canonical capability ID and distinguish discussion/planning, direct execution, certified core, registered engine, and specialist handoff.
Annotations the server declares
- title: ResearchPilot: Check Method
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_content_analysis_templateCreate a bounded content-analysis codebook and validation skeleton with sampling/coding/context units, category contracts, pilot coding and human/AI validation requirements.1 finding
Why it is in this group
- The description's first verb is "create": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "researchpilot_content_analysis_template" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "create": a word for a change.
  What this check looks for
Description, as the server wrote it
Create a bounded content-analysis codebook and validation skeleton with sampling/coding/context units, category contracts, pilot coding and human/AI validation requirements. Categories remain researcher proposals.
Annotations the server declares
- title: ResearchPilot: Content Analysis Template
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_open_workspaceOpen the interactive ResearchPilot workspace when the user wants to select a project, inspect method capability, review research context, or edit an instruction before continuing i…1 finding
Why it is in this group
- The name "researchpilot_open_workspace" says "open": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "researchpilot_open_workspace" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "researchpilot_open_workspace" says "open": a word for a change.
  What this check looks for
Description, as the server wrote it
Open the interactive ResearchPilot workspace when the user wants to select a project, inspect method capability, review research context, or edit an instruction before continuing in the host AI conversation.
Annotations the server declares
- title: ResearchPilot: Open Workspace
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_prepare_specialist_executionPrepare a rigorous specialist execution request bound to the authenticated project, exact ResearchContext digest, capability authority, and input artifact digests.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Prepare a rigorous specialist execution request bound to the authenticated project, exact ResearchContext digest, capability authority, and input artifact digests. This does not execute the analysis or transfer local raw files.
Annotations the server declares
- title: ResearchPilot: Prepare Specialist Execution
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
researchpilot_record_routing_feedbackRecord explicit user feedback about a ResearchPilot capability/tool outcome.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Record explicit user feedback about a ResearchPilot capability/tool outcome. Call only when the user explicitly accepts, rejects, corrects, or reports failure/success. Do not store the user's full research question or source text.
Annotations the server declares
- title: ResearchPilot: Record Routing Feedback
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
researchpilot_save_work_artifactSave a substantive project-specific plan, interpretation, critique, draft, or specialist result as a non-canonical WORKING artifact.No findings
Why it is in this group
- The name "researchpilot_save_work_artifact" says "save": a word for a change.
Description, as the server wrote it
Save a substantive project-specific plan, interpretation, critique, draft, or specialist result as a non-canonical WORKING artifact. Use for durable ResearchPilot continuity; this never accepts a research decision or authorizes execution.
Annotations the server declares
- title: ResearchPilot: Save Work Artifact
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
researchpilot_text_analysis_pilotCreate a bounded text-analysis pilot package: collection recipe, codebook skeleton, corpus manifest, pilot/validation plan, AG-UI state, and specialist handoff route.1 finding
Why it is in this group
- The description's first verb is "create": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "researchpilot_text_analysis_pilot" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "create": a word for a change.
  What this check looks for
Description, as the server wrote it
Create a bounded text-analysis pilot package: collection recipe, codebook skeleton, corpus manifest, pilot/validation plan, AG-UI state, and specialist handoff route. Design only; no coding or validation is claimed.
Annotations the server declares
- title: ResearchPilot: Text Analysis Pilot
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_update_user_preferencesUpdate bounded ResearchPilot working/writing preferences only when the user explicitly states a stable preference.No findings
Why it is in this group
- The name "researchpilot_update_user_preferences" says "update": a word for a change.
Description, as the server wrote it
Update bounded ResearchPilot working/writing preferences only when the user explicitly states a stable preference. These preferences affect presentation/workflow, never scientific authority or method validity.
Annotations the server declares
- title: ResearchPilot: Update User Preferences
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Only reads 14Looks things up and changes nothing.Show 14 read-only tools

researchpilot_capabilitiesRead canonical ResearchPilot capability authority.No findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read canonical ResearchPilot capability authority. Use this before claiming that ResearchPilot can directly execute a research method.
Annotations the server declares
- title: ResearchPilot: Capabilities
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_get_profileReturn the authenticated ResearchPilot user profile for the current OAuth connection.No findings
Why it is in this group
- The name "researchpilot_get_profile" says "get": a word for reading.
Description, as the server wrote it
Return the authenticated ResearchPilot user profile for the current OAuth connection. Use only for user identity/personalization, not as research evidence.
Annotations the server declares
- title: ResearchPilot: Get Profile
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_get_project_contextRead one authenticated user's cloud ResearchPilot project state: research question, decisions, analysis/result summaries, stale state, source identities/digests and local-artifact …No findings
Why it is in this group
- The name "researchpilot_get_project_context" says "get": a word for reading.
Description, as the server wrote it
Read one authenticated user's cloud ResearchPilot project state: research question, decisions, analysis/result summaries, stale state, source identities/digests and local-artifact availability. Raw local research files are intentionally absent.
Annotations the server declares
- title: ResearchPilot: Get Project Context
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_get_user_memoryRead the authenticated user's ResearchPilot working preferences and bounded routing history.No findings
Why it is in this group
- The name "researchpilot_get_user_memory" says "get": a word for reading.
Description, as the server wrote it
Read the authenticated user's ResearchPilot working preferences and bounded routing history. These are workflow/presentation signals, never scientific authority.
Annotations the server declares
- title: ResearchPilot: Get User Memory
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_handoff_contextRead the immutable ResearchContext snapshot carried by a ResearchPilot handoff, including an evidence catalog without source bodies.No findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read the immutable ResearchContext snapshot carried by a ResearchPilot handoff, including an evidence catalog without source bodies. This does not mutate Studio state or authorize execution.
Annotations the server declares
- title: ResearchPilot: Handoff Context
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_handoff_summaryValidate the outer ResearchPilot specialist handoff identity and return a bounded context summary without source bodies.No findings
Why it is in this group
- The description's first verb is "validate": a word for reading.
Description, as the server wrote it
Validate the outer ResearchPilot specialist handoff identity and return a bounded context summary without source bodies. Use the original handoff package as the authority.
Annotations the server declares
- title: ResearchPilot: Handoff Summary
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_list_projectsList the authenticated user's active ResearchPilot projects, newest first.No findings
Why it is in this group
- The name "researchpilot_list_projects" says "list": a word for reading.
Description, as the server wrote it
List the authenticated user's active ResearchPilot projects, newest first. Use before choosing a project when the user's phrase such as 'my study' is ambiguous.
Annotations the server declares
- title: ResearchPilot: List Projects
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_list_work_artifactsList saved working artifacts for one authenticated ResearchPilot project.No findings
Why it is in this group
- The name "researchpilot_list_work_artifacts" says "list": a word for reading.
Description, as the server wrote it
List saved working artifacts for one authenticated ResearchPilot project. Use this to continue prior host-AI plans, interpretations, critiques, or drafts without treating them as researcher-approved canonical decisions.
Annotations the server declares
- title: ResearchPilot: List Work Artifacts
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_read_handoff_evidenceRead one exact evidence page from a ResearchPilot handoff after verifying the outer source digest against the immutable ResearchContext snapshot.No findings
Why it is in this group
- The name "researchpilot_read_handoff_evidence" says "read": a word for reading.
Description, as the server wrote it
Read one exact evidence page from a ResearchPilot handoff after verifying the outer source digest against the immutable ResearchContext snapshot.
Annotations the server declares
- title: ResearchPilot: Read Handoff Evidence
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_read_work_artifactRead one saved working artifact after verifying that both project and artifact belong to the authenticated ResearchPilot owner.No findings
Why it is in this group
- The name "researchpilot_read_work_artifact" says "read": a word for reading.
Description, as the server wrote it
Read one saved working artifact after verifying that both project and artifact belong to the authenticated ResearchPilot owner.
Annotations the server declares
- title: ResearchPilot: Read Work Artifact
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_research_registrySearch ResearchPilot's unified method/model, source-provider, official-reference, or planned-plugin registry.No findings
Why it is in this group
- The description's first verb is "search": a word for reading.
Description, as the server wrote it
Search ResearchPilot's unified method/model, source-provider, official-reference, or planned-plugin registry. Planning/discovery only; registry presence never authorizes execution or collection.
Annotations the server declares
- title: ResearchPilot: Research Registry
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
researchpilot_search_datasetsSearch ResearchPilot dataset/data-paper providers with explicit provider availability states.Reads text others writeNo findings
Why it is in this group
- The name "researchpilot_search_datasets" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Search ResearchPilot dataset/data-paper providers with explicit provider availability states. Returned records remain source candidates, not automatic dataset-fit approval.
Annotations the server declares
- title: ResearchPilot: Search Datasets
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
researchpilot_search_literatureSearch research literature through ResearchPilot's OpenAlex/Crossref adapter.Reads text others writeNo findings
Why it is in this group
- The name "researchpilot_search_literature" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Search research literature through ResearchPilot's OpenAlex/Crossref adapter. Bibliographic verification is not scientific-quality or full-text verification.
Annotations the server declares
- title: ResearchPilot: Search Literature
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
researchpilot_validate_specialist_receiptValidate a specialist execution receipt against its ResearchPilot request and authenticated project/context identity.No findings
Why it is in this group
- The name "researchpilot_validate_specialist_receipt" says "validate": a word for reading.
Description, as the server wrote it
Validate a specialist execution receipt against its ResearchPilot request and authenticated project/context identity. This verifies identity, input digests, sample accounting, diagnostics and validation-state structure; it does not independently validate scientific correctness.
Annotations the server declares
- title: ResearchPilot: Validate Specialist Receipt
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; researchpilot_search_datasets
researchpilot_search_literature
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

3 warn

Warnresearchpilot_open_workspace
The server marks "researchpilot_open_workspace" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "researchpilot_open_workspace" says "open": a word for a change.
What this check looks for
Warnresearchpilot_content_analysis_template
The server marks "researchpilot_content_analysis_template" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "create": a word for a change.
What this check looks for
Warnresearchpilot_text_analysis_pilot
The server marks "researchpilot_text_analysis_pilot" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "create": a word for a change.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http researchpilot https://researchpilot-academy-production.up.railway.app/mcp

claude mcp add --transport http researchpilot https://researchpilot-academy-production.up.railway.app/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__researchpilot__researchpilot_capabilities",
      "mcp__researchpilot__researchpilot_search_literature",
      "mcp__researchpilot__researchpilot_search_datasets",
      "mcp__researchpilot__researchpilot_research_registry",
      "mcp__researchpilot__researchpilot_handoff_summary",
      "mcp__researchpilot__researchpilot_handoff_context",
      "mcp__researchpilot__researchpilot_read_handoff_evidence",
      "mcp__researchpilot__researchpilot_get_profile",
      "mcp__researchpilot__researchpilot_list_projects",
      "mcp__researchpilot__researchpilot_get_project_context",
      "mcp__researchpilot__researchpilot_get_user_memory",
      "mcp__researchpilot__researchpilot_list_work_artifacts",
      "mcp__researchpilot__researchpilot_read_work_artifact",
      "mcp__researchpilot__researchpilot_validate_specialist_receipt"
    ],
    "ask": [
      "mcp__researchpilot__researchpilot_open_workspace",
      "mcp__researchpilot__researchpilot_check_method",
      "mcp__researchpilot__researchpilot_build_collection_recipe",
      "mcp__researchpilot__researchpilot_content_analysis_template",
      "mcp__researchpilot__researchpilot_text_analysis_pilot",
      "mcp__researchpilot__researchpilot_update_user_preferences",
      "mcp__researchpilot__researchpilot_record_routing_feedback",
      "mcp__researchpilot__researchpilot_prepare_specialist_execution",
      "mcp__researchpilot__researchpilot_save_work_artifact"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as researchpilot. Review it before you use it.

Capability tags behind 2 rules

mcp__researchpilot__researchpilot_search_literature untrusted-input
mcp__researchpilot__researchpilot_search_datasets untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.cnucho/researchpilot/verify?hash=dc181938a6a51f061f804ba8d40251f8b8a45437ae2bed00a2ea2cbf1c634bc7" | jq -e '.changed == false'

Pinned hash dc181938a6a5, from Oct 23, 2026, 12:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.cnucho/researchpilot/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.github.cnucho/researchpilot.svg)](https://anlyon.dev/servers/io.github.cnucho/researchpilot)

Source: MCP Registry · repository. Synced Oct 23, 2026, 12:17 UTC.