← Back to search

io.github.cyanheads/brapi-mcp-server

cyanheads Scanned 22d ago

Collaborative BrAPI v2.1 MCP workspace — studies, germplasm, genotypes across Breedbase, T3, more.

C
74.7 / 100

Versions

0.3.5latest
first seen Jun 5, 2026
0.5.5
first seen May 19, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 25

brapi_connect
annotations: verified low

input object
readOnlyHint false openWorldHint true idempotentHint true
brapi_describe_filters
annotations: verified low

List the valid filter names for a BrAPI endpoint (studies, germplasm, observations, variables, images, variants, locations) — companion lookup for the `extraFilters` passthrough on any `find_*` tool. Entries reflect the BrAPI v2.1 spec; individual servers may implement subsets.

input object output object filters array endpoint string filterCount number
readOnlyHint true idempotentHint true
brapi_find_germplasm
annotations: verified low

Find germplasm by name, synonym, accession number, PUI, crop, or free-text query. Matches across registered synonyms. When the upstream total exceeds loadLimit, the full result set is materialized as a dataframe — query it with brapi_dataframe_query (SQL) instead of paging row-by-row.

crops array genus string input object names array species string synonyms array collections array germplasmPUIs array germplasmDbIds array
readOnlyHint true openWorldHint true
brapi_find_observations
annotations: verified low

Pull observation records filtered by study, germplasm, variable, season, or observation unit. When the upstream total exceeds loadLimit, the full result set is materialized as a dataframe — query it with brapi_dataframe_query (SQL).

input object trials array seasons array studies array programs array germplasm array variables array timestampTo string observations array timestampFrom string observationUnits array
readOnlyHint true openWorldHint true
brapi_dataframe_drop
annotations: verified low

Drop a dataframe by name. Idempotent — returns dropped:false rather than failing when the name is unknown. Dataframes also expire via TTL automatically; explicit drop is only needed when the operator wants to free workspace memory immediately.

readOnlyHint false openWorldHint false idempotentHint true
brapi_build_phenotype_matrix
annotations: verified low

Pull observations across one or more studies and pivot them into a germplasm × trait matrix materialized as a canvas dataframe. Returns a dataframe handle (query with brapi_dataframe_query) plus a summary of dimensions and aggregate method. Long-form output is suitable for downstream GROUP BY analysis by study, germplasm, or variable.

input object
readOnlyHint true openWorldHint true
brapi_server_info
annotations: verified low

Return the full orientation envelope for a registered BrAPI connection — server identity, capabilities, content counts, and notes. Re-running refreshes the cached capability scan; pass an alias to read a non-default connection.

input object
readOnlyHint true idempotentHint true
brapi_find_variables
annotations: verified low

Find observation variables (traits) by name, trait class, ontology term, or free-text query. Free-text queries are ranked against the returned set and may resolve to ontology URIs when the server advertises them. When the upstream total exceeds loadLimit, the full result set is materialized as a dataframe — query it with brapi_dataframe_query (SQL).

crop string input object scales array methods array studies array variables array ontologies array traitClasses array variablePUIs array
readOnlyHint true openWorldHint true
brapi_find_variants
annotations: verified low

Find variant records by variant set, reference sequence, or genomic region (start/end, 1-based inclusive / exclusive). When the upstream total exceeds loadLimit, the full result set is materialized as a dataframe — query it with brapi_dataframe_query (SQL).

end number input object start number variants array references array totalCount number variantSets array referenceName string returnedCount number
readOnlyHint true openWorldHint true
brapi_get_image
annotations: verified low

Fetch image bytes for up to ${MAX_IMAGES_PER_CALL} imageDbIds and return them inline as \

input object
readOnlyHint true openWorldHint true idempotentHint true
brapi_get_study
annotations: verified low

Fetch a single study by DbId with program, trial, and location fully resolved. Response includes cheap observation/observation-unit/variable counts as drill-down signals.

input object studyDbId string
readOnlyHint true idempotentHint true
brapi_find_genotype_calls
annotations: verified low

Pull genotype calls for a germplasm × variant set. Filter to bound cost — at minimum, set `variantSetDbId` or `germplasmDbIds`. The upstream pull is capped by deployment policy; when the pull is truncated, narrow the filters or query the spilled dataframe. `loadLimit` bounds the rows returned inline; the full collected set is materialized as a dataframe — query it with brapi_dataframe_query (SQL) instead of paging row-by-row.

input object callSetDbIds array variantDbIds array
readOnlyHint true openWorldHint true
brapi_raw_search
annotations: verified low

Passthrough to any BrAPI POST /search/{noun} endpoint, returning the resolved envelope (async polling resolved upstream). Spills to a canvas dataframe when the upstream advertises more rows than `loadLimit` AND the result is a list shape; inline `result` is unchanged. Skips spillover when the caller drives paging via `body.page` / `body.pageSize`. No distributions or foreign-key resolution applied.

input object
readOnlyHint true openWorldHint true
brapi_dataframe_describe
annotations: verified low

Start here after a spillover. Lists dataframes (or describes one) with columns, row counts, and originating-source provenance. The dataframe name appears inline on every find_* response that spilled (`result.dataframe.tableName`) — pass it as `dataframe` to inspect schema and provenance before writing the first brapi_dataframe_query. Listing without a name is unavailable when this server runs as a shared HTTP endpoint without per-caller auth; pass a known name instead.

readOnlyHint true openWorldHint false idempotentHint true
brapi_dataframe_query
annotations: verified low

Run SQL across in-memory dataframes. Dataframes auto-populate when find_* tools spill (named `df_<uuid>`) — the dataframe name appears inline on every find_* response that spilled (`result.dataframe.tableName`), so the typical flow is find_* → read the name → query here. Use brapi_dataframe_describe to inspect schema and provenance for a known name. SELECT only — writes/DDL/COPY/PRAGMA/ATTACH/file-reads are rejected. Use SQL as the paging idiom: `LIMIT/OFFSET` to walk results, projection to trim columns, aggregation to summarize. Use `registerAs` to chain — the result lands as a new dataframe.

shown number
readOnlyHint false openWorldHint false idempotentHint false
brapi_export_genotype_matrix
annotations: verified low

Pull genotype calls for a germplasm × variant set and pivot them into a matrix. `format` controls the output: `matrix-json` registers a wide germplasm × variant canvas dataframe for SQL analysis; `vcf-lite` returns VCF-subset text (in the `vcf` field) and also registers the dataframe; `plink` returns .ped/.map text (in the `ped`/`map` fields) and also registers the dataframe. vcf-lite/plink pull /variants metadata for CHROM/POS/REF/ALT (`.`/`0` when the server lacks them). Column names are SQL-safe identifiers; `variantColumnLegend` maps them back to original variant IDs.

input object variantSetDbId string
readOnlyHint true openWorldHint true
brapi_raw_get
annotations: verified low

Passthrough to any BrAPI GET /{path} endpoint. Returns the raw upstream envelope without enrichment or foreign-key resolution. Emits a `suggestion` field when a curated tool exists for the same data. Spills to a canvas dataframe when the upstream advertises more rows than `loadLimit` AND the result is a list shape (`result` array or `result.data` envelope); inline `result` is unchanged. Skips spillover when the caller drives paging via `params.page` / `params.pageSize`.

input object
readOnlyHint true openWorldHint true
brapi_germplasm_performance
annotations: verified low

Aggregate a single germplasm's observations across every study it appears in, returning per-variable summary statistics (n, mean, median, sd, min, max), the contributing studies, and seasons. Study-anchored: discovers the germplasm's studies first (with a dialect-honor cross-check, capped at 200 studies), then pulls observations per study — avoids the unanchored germplasm-only pull that stalls on SGN/Breedbase. Pass an explicit studyDbIds set to skip discovery and its 200-study cap — e.g. process a chunk of the full study list retrieved via brapi_find_studies with extraFilters.germplasmDbIds. For the underlying observation matrix, use brapi_build_phenotype_matrix.

input object germplasmDbId string
readOnlyHint true openWorldHint true
brapi_get_germplasm
annotations: verified low

Fetch a single germplasm by DbId with attributes and direct parents. Response companions report study count, direct parent count, and direct descendant count — signals for pedigree depth and observation coverage.

input object germplasmDbId string
readOnlyHint true idempotentHint true
brapi_find_studies
annotations: verified low

Locate studies matching crop, trial type, season, location, or program. Enriches results with program/trial/location context in one call. When the upstream total exceeds loadLimit, the full result set is materialized as a dataframe — query it with brapi_dataframe_query (SQL).

crop string input object active boolean trials array seasons array programs array studyNames array totalCount number trialTypes array
readOnlyHint true openWorldHint true
brapi_walk_pedigree
annotations: verified low

Walk germplasm ancestry or descendancy as a deduplicated DAG, with multi-generation traversal, cycle detection, and depth limits. Returns nodes + edges plus traversal stats (depthReached, rootCount, leafCount, cycleCount, deadEndCount).

input object
readOnlyHint true openWorldHint true
brapi_find_locations
annotations: verified low

Find research stations / field sites by country, abbreviation, type, location ID, or free-text. Countries filter by ISO 3166-1 alpha-3 code via countryCodes, or by free-form English country name via countryNames (resolved client-side to alpha-3 — "Uganda" → "UGA"). Optional bbox parameter restricts rows to a latitude/longitude window. When the spec-correct GeoJSON [lon, lat, alt] reading produces zero matches and at least one row carries a Point geometry, the bbox filter retries once with axes swapped (handles non-conformant servers that store [lat, lon, alt]) and surfaces a warning + `coordinateAxisOrder: "swapped"`. When the upstream total exceeds loadLimit, the full result set is materialized as a dataframe — query it with brapi_dataframe_query (SQL).

input object locations array countryCodes array locationNames array
readOnlyHint true openWorldHint true
brapi_submit_observations
annotations: verified low

Submit observations for a study. Default mode `preview` validates rows against the study variables and returns a routing breakdown without writing. Mode `apply` asks the caller to confirm the write, then creates new rows or updates existing ones based on observationDbId presence. Additive only — no observation is destroyed.

input object studyDbId string
readOnlyHint false openWorldHint true idempotentHint true destructiveHint false
brapi_find_images
annotations: verified low

Filter images by observation unit, observation, study, descriptive ontology term, file name, or MIME type. Returns metadata only — use brapi_get_image to fetch bytes inline. When the upstream total exceeds loadLimit, the full result set is materialized as a dataframe — query it with brapi_dataframe_query (SQL).

input object images array studies array observations array imageFileNames array observationUnits array
readOnlyHint true openWorldHint true
brapi_dataframe_export
annotations: verified low

Export a dataframe to disk (CSV, Parquet, or JSON) under BRAPI_EXPORT_DIR and return the absolute path of a file the human can open in Excel, Tad, DuckDB CLI, etc. Source dataframes are immutable after spillover, so re-exporting the same df_<uuid> is byte-stable. Use `columns` for thin projection or `sql` for filtering/aggregation; for repeated derived views, query with registerAs first then export the derived dataframe.

readOnlyHint false openWorldHint false idempotentHint false

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 63

info
Tool 'brapi_connect' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_describe_filters' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_find_germplasm' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_find_observations' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_dataframe_drop' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_build_phenotype_matrix' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_server_info' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_find_variables' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_find_variants' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_get_image' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_get_study' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_find_genotype_calls' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_raw_search' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_dataframe_describe' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_dataframe_query' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_export_genotype_matrix' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_raw_get' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_germplasm_performance' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_get_germplasm' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_find_studies' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_walk_pedigree' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_find_locations' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_submit_observations' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_find_images' annotations are consistent annotation_checker · 80%
info
Tool 'brapi_dataframe_export' annotations are consistent annotation_checker · 80%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
info
package.json metadata manifest_parser · 100%
info
Tool: brapi_connect manifest_parser · 75%
info
Tool: brapi_describe_filters manifest_parser · 75%
info
Tool: brapi_find_germplasm manifest_parser · 75%
info
Tool: brapi_find_observations manifest_parser · 75%
info
Tool: brapi_dataframe_drop manifest_parser · 75%
info
Tool: brapi_build_phenotype_matrix manifest_parser · 75%
info
Tool: brapi_server_info manifest_parser · 75%
info
Tool: brapi_find_variables manifest_parser · 75%
info
Tool: brapi_find_variants manifest_parser · 75%
info
Tool: brapi_get_image manifest_parser · 75%
info
Tool: brapi_get_study manifest_parser · 75%
info
Tool: brapi_find_genotype_calls manifest_parser · 75%
info
Tool: brapi_raw_search manifest_parser · 75%
info
Tool: brapi_dataframe_describe manifest_parser · 75%
info
Tool: brapi_dataframe_query manifest_parser · 75%
info
Tool: brapi_export_genotype_matrix manifest_parser · 75%
info
Tool: brapi_raw_get manifest_parser · 75%
info
Tool: brapi_germplasm_performance manifest_parser · 75%
info
Tool: brapi_get_germplasm manifest_parser · 75%
info
Tool: brapi_find_studies manifest_parser · 75%
info
Tool: brapi_walk_pedigree manifest_parser · 75%
info
Tool: brapi_find_locations manifest_parser · 75%
info
Tool: brapi_submit_observations manifest_parser · 75%
info
Tool: brapi_find_images manifest_parser · 75%
info
Tool: brapi_dataframe_export manifest_parser · 75%
info
Required env vars (9) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 12 components sbom_generator · 100%
high
Hardcoded Password found in cyanheads-brapi-mcp-server-b7492bd/framework-skills/api-utils/references/security.md secret_scanner · 65%
high
Generic API Key Assignment found in cyanheads-brapi-mcp-server-b7492bd/src/config/server-config.ts secret_scanner · 75%
high
Hardcoded Password found in cyanheads-brapi-mcp-server-b7492bd/src/config/server-config.ts secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%