# `io.github.srikarjy/biolab-mcp-server` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/io.github.srikarjy/biolab-mcp-server
- JSON: https://anlyon.dev/api/v1/servers/io.github.srikarjy/biolab-mcp-server
- Version: 0.3.0 (active)
- Publisher: io.github.srikarjy (GitHub account)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Repository: https://github.com/srikarjy/biolab-mcp-server
- Metadata from the official MCP Registry, synced 2026-10-21T18:49:48.101Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Biolab MCP Server
Auditable MCP server for PubMed, Europe PMC, ClinicalTrials.gov, and bioRxiv/medRxiv queries
```

Scanned 2026-10-21T19:27:34.658Z over streamable-http.

**30 tools: 18 change things and 12 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 18 | ask |
| Only reads | read | 12 | allow |

## Exfil surface

No private-data -> untrusted-input -> outbound path in this server alone: no tool is tagged outbound.

| Tag | Meaning | Tools |
| --- | --- | --- |
| private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | `mcp__biolab__search` |
| untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | `mcp__biolab__run_all_evidence_watches` `mcp__biolab__run_evidence_watch` `mcp__biolab__search` `mcp__biolab__search_biorxiv` `mcp__biolab__search_clinicaltrials` `mcp__biolab__search_europepmc` `mcp__biolab__search_evidence` `mcp__biolab__search_pubmed` |
| outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | none |

## Findings

- **warn** Annotations that disagree with the tool in `search_evidence` ([annotation-conflict](https://anlyon.dev/methodology#annotation-conflict))

```untrusted-server-text
The server marks "search_evidence" as not read-only (readOnlyHint: false), and its words say it reads.

annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "search_evidence" says "search": a word for reading.
```

- **warn** Annotations that disagree with the tool in `search` ([annotation-conflict](https://anlyon.dev/methodology#annotation-conflict))

```untrusted-server-text
The server marks "search" as not read-only (readOnlyHint: false), and its words say it reads.

annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "search" says "search": a word for reading.
```

- **warn** Annotations that disagree with the tool in `search_pubmed` ([annotation-conflict](https://anlyon.dev/methodology#annotation-conflict))

```untrusted-server-text
The server marks "search_pubmed" as not read-only (readOnlyHint: false), and its words say it reads.

annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "search_pubmed" says "search": a word for reading.
```

- **warn** Annotations that disagree with the tool in `search_europepmc` ([annotation-conflict](https://anlyon.dev/methodology#annotation-conflict))

```untrusted-server-text
The server marks "search_europepmc" as not read-only (readOnlyHint: false), and its words say it reads.

annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "search_europepmc" says "search": a word for reading.
```

- **warn** Annotations that disagree with the tool in `search_clinicaltrials` ([annotation-conflict](https://anlyon.dev/methodology#annotation-conflict))

```untrusted-server-text
The server marks "search_clinicaltrials" as not read-only (readOnlyHint: false), and its words say it reads.

annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "search_clinicaltrials" says "search": a word for reading.
```

- **warn** Annotations that disagree with the tool in `search_biorxiv` ([annotation-conflict](https://anlyon.dev/methodology#annotation-conflict))

```untrusted-server-text
The server marks "search_biorxiv" as not read-only (readOnlyHint: false), and its words say it reads.

annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "search_biorxiv" says "search": a word for reading.
```


## Changes things (18)

Creates or changes something that can be changed back. Claude Code: ask.

### `add_evidence_to_collection`

- The name "add_evidence_to_collection" says "add": a word for a change.

Description, as the server wrote it:

```untrusted-server-text
Add or update a retrieval in a scientist-reviewed evidence collection.
```

### `create_claim`

- The name "create_claim" says "create": a word for a change.

Description, as the server wrote it:

```untrusted-server-text
Create a scientific claim record without asserting that it is true.
```

### `create_evidence_collection`

- The name "create_evidence_collection" says "create": a word for a change.

Description, as the server wrote it:

```untrusted-server-text
Create a reviewed evidence collection in a project.
```

### `create_evidence_watch`

- The name "create_evidence_watch" says "create": a word for a change.

Description, as the server wrote it:

```untrusted-server-text
Create a saved query for explicit evidence-change monitoring.
```

### `create_project`

- The name "create_project" says "create": a word for a change.

Description, as the server wrote it:

```untrusted-server-text
Create a persistent scientist research project.
```

### `link_claim_evidence`

- The name "link_claim_evidence" says "link": a word for a change.

Description, as the server wrote it:

```untrusted-server-text
Propose or record how one retrieval relates to a claim.
```

### `replay_execution`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Re-run a recorded execution and report whether its outputs reproduced. Writes nothing.
```

### `run_all_evidence_watches`

- The name "run_all_evidence_watches" says "run": a word for a change.
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data.

Description, as the server wrote it:

```untrusted-server-text
Run all active watches and return explicit per-watch failures.
```

### `run_evidence_watch`

- The name "run_evidence_watch" says "run": a word for a change.
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data.

Description, as the server wrote it:

```untrusted-server-text
Run one evidence watch and record added, removed, or revised evidence.
```

### `run_tool`

- The name "run_tool" says "run": a word for a change.

Description, as the server wrote it:

```untrusted-server-text
Run a registered tool and seal an ExecutionRecord (inputs, versions, output hashes).

    Args:
        tool: tool name from list_execution_tools
        inputs: tool inputs (JSON object); stored verbatim so the run can be replayed
        agent_id: calling agent or workflow identity
        retrieval_ids: evidence retrievals this run was derived from, for provenance links
    
```

### `search`

- The name "search" says "search": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
- Tag private-data: The description's first sentence says "search" and "chat": it reads messages.
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data. The description's first sentence says "search" and "chat": it reads messages, which other people can write.
- Findings: warn annotation-conflict

Description, as the server wrote it:

```untrusted-server-text
Search all evidence sources for ChatGPT/Codex knowledge compatibility.
```

### `search_biorxiv`

- The name "search_biorxiv" says "search": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data.
- Findings: warn annotation-conflict

Description, as the server wrote it:

```untrusted-server-text
List bioRxiv/medRxiv preprints by category and log each to the audit trail.

    No free-text search exists on this API — only category listing (last 30 days).

    Args:
        category: category, e.g. "neuroscience", "bioinformatics", or "all"
        agent_id: which agent is asking, e.g. "aletheia:advocate"
        max_results: how many preprints to retrieve (default 5)
        server: "biorxiv" or "medrxiv" (default "biorxiv")
    
```

### `search_clinicaltrials`

- The name "search_clinicaltrials" says "search": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data.
- Findings: warn annotation-conflict

Description, as the server wrote it:

```untrusted-server-text
Search ClinicalTrials.gov and log every retrieved study to the audit trail.

    Args:
        query: condition/disease search string, sent to ClinicalTrials.gov verbatim
        agent_id: which agent is asking, e.g. "aletheia:advocate"
        max_results: how many studies to retrieve (default 5)
    
```

### `search_europepmc`

- The name "search_europepmc" says "search": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data.
- Findings: warn annotation-conflict

Description, as the server wrote it:

```untrusted-server-text
Search Europe PMC and log every retrieved article to the audit trail.

    Args:
        query: exact search string, sent to Europe PMC verbatim — no normalization
        agent_id: which agent is asking, e.g. "aletheia:advocate"
        max_results: how many articles to retrieve (default 5)
    
```

### `search_evidence`

- The name "search_evidence" says "search": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data.
- Findings: warn annotation-conflict

Description, as the server wrote it:

```untrusted-server-text
Search several scientific sources in one explicitly audited workflow.

    Args:
        query: scientific evidence query sent to each selected source
        agent_id: calling agent or workflow identity
        sources: any of pubmed, europepmc, clinicaltrials, uniprot, opentargets
        max_results: maximum results to preserve per source (1-50)
    
```

### `search_pubmed`

- The name "search_pubmed" says "search": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data.
- Findings: warn annotation-conflict

Description, as the server wrote it:

```untrusted-server-text
Search PubMed and log every retrieved paper to the audit trail.

    Args:
        query: exact search string, sent to PubMed verbatim — no normalization
        agent_id: which agent is asking, e.g. "aletheia:advocate"
        max_results: how many papers to retrieve (default 5)
    
```

### `trace_claim`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Trace a claim to supporting, conflicting, contextual, or insufficient evidence.
```

### `verify_executions`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Verify the execution hash chain and that every output artifact is intact.
```

## Only reads (12)

Looks things up and changes nothing. Claude Code: allow.

### `fetch`

- The name "fetch" says "fetch": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Fetch one preserved evidence record by retrieval ID.
```

### `get_artifact`

- The name "get_artifact" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Fetch an output artifact by its sha256 (text only; capped in size).
```

### `get_evidence_collection`

- The name "get_evidence_collection" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Return a collection and its reviewed evidence items.
```

### `get_execution`

- The name "get_execution" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Fetch one execution record, including output artifact hashes.
```

### `get_project_report`

- The name "get_project_report" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Return collections, claims, evidence links, watches, and events for a project.
```

### `get_retrieval`

- The name "get_retrieval" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Retrieve a full retrieval record by its retrieval_id.

    Args:
        retrieval_id: the UUID returned by search_pubmed
    
```

### `list_evidence_collections`

- The name "list_evidence_collections" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
List evidence collections, optionally within one project.
```

### `list_evidence_events`

- The name "list_evidence_events" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
List change events previously detected by an evidence watch.
```

### `list_evidence_watches`

- The name "list_evidence_watches" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
List saved evidence watches, optionally within one project.
```

### `list_execution_tools`

- The name "list_execution_tools" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
List runnable tools with their pinned versions, containers and devices.
```

### `list_executions`

- The name "list_executions" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
List recent execution records, newest first.
```

### `list_projects`

- The name "list_projects" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
List scientist research projects.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `biolab`:

```json
{
  "permissions": {
    "allow": [
      "mcp__biolab__fetch",
      "mcp__biolab__list_projects",
      "mcp__biolab__list_evidence_collections",
      "mcp__biolab__get_evidence_collection",
      "mcp__biolab__list_evidence_watches",
      "mcp__biolab__list_evidence_events",
      "mcp__biolab__get_project_report",
      "mcp__biolab__list_execution_tools",
      "mcp__biolab__get_execution",
      "mcp__biolab__list_executions",
      "mcp__biolab__get_artifact",
      "mcp__biolab__get_retrieval"
    ],
    "ask": [
      "mcp__biolab__search_evidence",
      "mcp__biolab__search",
      "mcp__biolab__create_project",
      "mcp__biolab__create_evidence_collection",
      "mcp__biolab__add_evidence_to_collection",
      "mcp__biolab__create_evidence_watch",
      "mcp__biolab__run_evidence_watch",
      "mcp__biolab__run_all_evidence_watches",
      "mcp__biolab__create_claim",
      "mcp__biolab__link_claim_evidence",
      "mcp__biolab__trace_claim",
      "mcp__biolab__search_pubmed",
      "mcp__biolab__search_europepmc",
      "mcp__biolab__search_clinicaltrials",
      "mcp__biolab__search_biorxiv",
      "mcp__biolab__run_tool",
      "mcp__biolab__verify_executions",
      "mcp__biolab__replay_execution"
    ],
    "deny": []
  }
}
```

Capability tags behind the rules (a read tagged outbound is asked about):

- `mcp__biolab__search_evidence`: untrusted-input
- `mcp__biolab__search`: private-data, untrusted-input
- `mcp__biolab__run_evidence_watch`: untrusted-input
- `mcp__biolab__run_all_evidence_watches`: untrusted-input
- `mcp__biolab__search_pubmed`: untrusted-input
- `mcp__biolab__search_europepmc`: untrusted-input
- `mcp__biolab__search_clinicaltrials`: untrusted-input
- `mcp__biolab__search_biorxiv`: untrusted-input