← Back to search

io.github.cyanheads/npi-providers-mcp-server

cyanheads streamable_http Scanned 22d ago

Look up US healthcare providers in the NPPES NPI registry and resolve NUCC specialty codes.

B
87.4 / 100

Versions

No versions found.

PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 3

npi_lookup_taxonomy
annotations: verified low

Resolve and browse the NUCC Healthcare Provider Taxonomy — the specialty code set NPPES uses — fully offline (bundled). Mode `resolve` turns a plain-language specialty (e.g. "cardiologist", "heart doctor") into matching taxonomy entries; mode `get` returns the full entry for an exact code; mode `browse` walks the hierarchy (grouping → classification → specialization), optionally filtered by grouping and by NPI section (Individual/NPI-1 vs Non-Individual/NPI-2). A resolved entry\'s specialization, or its classification when specialization is absent, maps directly to npi_search_providers.taxonomy_description.

code string mode literal input discriminatedUnion
readOnlyHint true openWorldHint false idempotentHint true
npi_get_provider
annotations: verified low

Fetch the complete NPPES record for one or more NPI numbers (up to 10 per call). Decodes an NPI from a claim, prescription, or another health data source into a fully populated provider profile: every taxonomy with its primary flag, license number and state; all practice and mailing addresses; credential, sex, sole-proprietor flag; enumeration and last-updated dates; active/deactivated status; secondary identifiers (Medicaid, etc.); and FHIR/Direct endpoints. The 10-digit NPI format is validated before any API call. Reports partial success: well-formed NPIs with no registry record (deactivated or never enumerated) land in notFound, while NPIs whose lookup hit an upstream error (registry unavailable, timeout) land in errored — kept distinct from confirmed misses — rather than failing the whole call.

npi string input object output object reason string
readOnlyHint true openWorldHint true idempotentHint true
npi_search_providers
annotations: verified low

Search the NPPES NPI registry for individual practitioners and healthcare organizations by name, organization name, location, provider type, and specialty. Plain-language specialty terms (e.g. "cardiologist", "pediatric cardiologist") resolve through the bundled NUCC taxonomy; the top match\'s specialization or classification becomes taxonomy_description, and all resolved candidates are returned in metadata. Location belongs in the dedicated city/state/postal_code inputs, not inside specialty. Each provider row includes the NPI, name, primary specialty, city/state/ZIP, type, and active/deactivated status; the NPI is the input for npi_get_provider when the full record is needed. At least one search criterion is required, and the registry rejects state-only searches. For specialty searches, returned providers are limited to the requested city/state/postal_code even when the registry includes providers outside that location. The registry never reports a true match total and only the first 1200 matches are reachable, so broad queries are capped.

readOnlyHint true openWorldHint true idempotentHint true

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 16

info
Tool 'npi_lookup_taxonomy' annotations are consistent annotation_checker · 80%
info
Tool 'npi_get_provider' annotations are consistent annotation_checker · 80%
info
Tool 'npi_search_providers' annotations are consistent annotation_checker · 80%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
info
package.json metadata manifest_parser · 100%
info
Tool: npi_lookup_taxonomy manifest_parser · 75%
info
Tool: npi_get_provider manifest_parser · 75%
info
Tool: npi_search_providers manifest_parser · 75%
info
Required env vars (4) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 13 components sbom_generator · 100%
high
Hardcoded Password found in cyanheads-npi-providers-mcp-server-def7615/framework-skills/api-utils/references/security.md secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%