io. github. cyanheads/ cern-opendata-mcp-server
by cyanheads · remote · local (npm) · no sign-in to list tools · v0.2.1 · published by GitHub user cyanheads
Search CERN Open Data, fetch records, files, analysis environments, CMS good-run lists, HLT paths.
7 tools: 7 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things0Claude Code: ask
- Only reads7Claude Code: allow: see these tools
1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http cern-opendata https://cern-opendata.caseyjhand.com/mcpFindings
Matches of fixed checks, with the text they matched.
The description names a tool "cern_opendata" that this server does not list.
What this check looks forMatched text
description: "Decode the vocabulary the other cern_opendata tools accept: experiments, record types, coll..."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
7 tools
Only reads 7Claude Code: allow
cern_opendata_get_analysis_envAssemble what is needed to analyse a record: its container images, CMSSW release and global tag; the condition-data, VM and validated-run records for its run periods; example softw…Reads text others writeNo findings
Why it is in this group
- The name "cern_opendata_get_analysis_env" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Assemble what is needed to analyse a record: its container images, CMSSW release and global tag; the condition-data, VM and validated-run records for its run periods; example software that declares it works with the record; and quoted sections of the guides the record links (the first two are fetched). Container images, software and guide code are licensed separately from the CC0 data. Use cern_opendata_list_files for the record's files.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
cern_opendata_get_recordsFetch full metadata for 1-20 records in one call, by recid, DOI, CMS dataset path (/Primary/Era/TIER) or documentation slug.Reads text others writeNo findings
Why it is in this group
- The name "cern_opendata_get_records" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Fetch full metadata for 1-20 records in one call, by recid, DOI, CMS dataset path (/Primary/Era/TIER) or documentation slug. Returns the description, run periods, collision and distribution details, related records, a software-environment summary, the license and a ready citation, plus what a record states of its variable dictionary, physics category, pile-up, keywords, and LHCb magnet polarity and stripping. Documentation and news pages include their markdown body in slices of at most 30,000 characters; body_offset with that one id reads on from where a slice stops. Each response holds to 64,000 bytes, except that the first record always comes back whole: records past the budget, and ids past the first 20, are listed under deferred, to pass back as ids. File lists are not included; use cern_opendata_list_files. Identifiers that do not resolve come back under missing with guidance; they do not fail the call.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
cern_opendata_get_validated_runsGet a CMS validated-run (good-run) list, which certifies the luminosity sections that are good for physics in each run.Reads text others writeNo findings
Why it is in this group
- The name "cern_opendata_get_validated_runs" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get a CMS validated-run (good-run) list, which certifies the luminosity sections that are good for physics in each run. Select it by a CMS collision dataset recid, a validated-run list recid, or a run period such as Run2012B (give exactly one of recid and run_period). Choose the full validation or the muons-only variant, and narrow to a run range; a dataset recid defaults the range to the first and last run the dataset lists. Returns the runs with their luminosity-section ranges and the list file download URL. CMS only.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
cern_opendata_list_filesList one record's files: its file indexes (groups of up to ~1,500 files) with their XRootD URI-list URLs, and per file the XRootD URI, HTTPS download URL, size, adler32 checksum an…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "cern_opendata_list_files" says "list": a word for reading.
What it can reach
- private-dataThe name "cern_opendata_list_files" says "list" and "file": it reads files.
- private-dataThe description's first sentence says "list" and "file": it reads files.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "list" and "uri": it reads web pages, which anyone can write.
Description, as the server wrote it List one record's files: its file indexes (groups of up to ~1,500 files) with their XRootD URI-list URLs, and per file the XRootD URI, HTTPS download URL, size, adler32 checksum and availability. Without index, returns the record's indexes and its regular files; with index, reads only that index and pages through its files. Files marked on demand sit on tape and must be requested on the record's portal page before download.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
cern_opendata_list_referenceDecode the vocabulary the other cern_opendata tools accept: experiments, record types, collision energies and types, file formats and data tiers, availability states, physics categ…Reads private data1 finding
Why it is in this group
- The name "cern_opendata_list_reference" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "file": it reads files.
Findings
- Warn
The description names a tool "cern_opendata" that this server does not list.
What this check looks forMatched text
description: "Decode the vocabulary the other cern_opendata tools accept: experiments, record types, coll..."
Description, as the server wrote it Decode the vocabulary the other cern_opendata tools accept: experiments, record types, collision energies and types, file formats and data tiers, availability states, physics categories, LHCb magnet polarities and stripping streams and versions, identifier forms, query syntax, licensing, and the CMS run periods that have validated-run lists. Static and offline; omit topic for every table.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: false
cern_opendata_search_recordsSearch the CERN Open Data Portal's datasets, software, environments, documentation and supplementary records with exact-vocabulary filters and an optional full-text query.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "cern_opendata_search_records" says "search": a word for reading.
What it can reach
- private-dataThe input names a file (input.file_type), and the tool reads: it reads files.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Search the CERN Open Data Portal's datasets, software, environments, documentation and supplementary records with exact-vocabulary filters and an optional full-text query. The filters are experiment, record type, physics category, keyword, collision energy and type, file format, data-taking year, event count, availability, collection, and LHCb magnet polarity, stripping stream and stripping version. Returns compact hits with recids plus live facet counts. Each facet ignores its own filter, so its counts show the alternatives under the other filters. Filter values are exact upstream; common spellings are normalized, and cern_opendata_list_reference lists the vocabulary. Paging reaches the first 10,000 matches.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
cern_opendata_search_trigger_pathsLook up CMS High-Level Trigger paths by exact name (HLT_IsoMu24) or prefix pattern (HLT_IsoMu*), optionally for one data-taking year.Reads text others writeNo findings
Why it is in this group
- The name "cern_opendata_search_trigger_paths" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Look up CMS High-Level Trigger paths by exact name (HLT_IsoMu24) or prefix pattern (HLT_IsoMu*), optionally for one data-taking year. Paths outside the HLT_ family, such as AlCa_EcalPi0, DST_ and DQM_ paths, output modules and HLTriggerFinalPath, are found by their own names, in the case given. Each match is a per-year path record parsed into the primary datasets its title names, the first and last run the path was seen online, per-version run ranges, the L1 seed, and links to the HLT menu records. Covers CMS open data from 2011-2016. Prescale factors are not returned: each HLT menu record holds a configuration file (cern_opendata_list_files with a menu_recid) whose PrescaleService block lists the prescale in each column of every path it prescales (a path it leaves out has prescale 1), and the CMS luminosity records (collection CMS-Luminosity-Information) hold prescale files that log which column applied by run and luminosity section.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.
- Reads private data3
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write6
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Install
Pinned to version 0.2.1. Values in angle brackets are yours to fill in.
claude mcp add --transport http cern-opendata https://cern-opendata.caseyjhand.com/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__cern-opendata__cern_opendata_search_records",
"mcp__cern-opendata__cern_opendata_get_records",
"mcp__cern-opendata__cern_opendata_list_files",
"mcp__cern-opendata__cern_opendata_get_analysis_env",
"mcp__cern-opendata__cern_opendata_get_validated_runs",
"mcp__cern-opendata__cern_opendata_search_trigger_paths",
"mcp__cern-opendata__cern_opendata_list_reference"
],
"ask": [],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as cern-opendata. Review it before you use it.
Capability tags behind 7 rules
- mcp__cern-opendata__cern_opendata_search_records private-data, untrusted-input
- mcp__cern-opendata__cern_opendata_get_records untrusted-input
- mcp__cern-opendata__cern_opendata_list_files private-data, untrusted-input
- mcp__cern-opendata__cern_opendata_get_analysis_env untrusted-input
- mcp__cern-opendata__cern_opendata_get_validated_runs untrusted-input
- mcp__cern-opendata__cern_opendata_search_trigger_paths untrusted-input
- mcp__cern-opendata__cern_opendata_list_reference private-data
