cyanheads PubMed MCP Server

Quick Verdict

cyanheads/pubmed-mcp-server 2.9.8 is an unofficial, Apache-2.0 Model Context Protocol server for biomedical literature. Its 10 tools connect PubMed, PubMed Central, Europe PMC, Unpaywall, and related NCBI services. The set covers search, article metadata, best-effort full text, similar and citing literature, spelling assistance, MeSH lookup, citation matching and formatting, and DOI/PMID/PMCID conversion. It supports local stdio and Streamable HTTP. The project can run with Bun and provides an npm path for Node.js 24, as well as a container image.

This is a structured literature-retrieval layer, not a medical decision system. Abstracts, indexed records, preprints, patents, open-access articles, and text extracted from PDFs have different evidentiary value. Any diagnosis, treatment, drug, or safety claim requires a qualified reviewer to examine the original paper, study design, limitations, population, and current clinical guidance. The public hosted endpoint is community-operated, not hosted by NCBI. Local deployment is the safer default for confidential search strategies, institutional keys, or any workflow near patient information. Article content must also be treated as untrusted input because it can contain prompt-injection text.

Best For

• Researchers who want structured biomedical search, article metadata, related records, and identifier normalization inside an AI client.
• Developers building literature monitoring, citation export, or research-plan prototypes with mandatory human review.
• Librarians, educators, and students who need PubMed and Europe PMC discovery in one workflow.
• MCP operators able to restrict permissions, redact logs, rate-limit upstream requests, and preserve provenance.
• It is not appropriate for autonomous diagnosis, unreviewed clinical recommendations, paywall circumvention, identifiable patient data, or treating a generated synthesis as a systematic review.

Key Features

• Ten literature tools: PubMed search, Europe PMC search, article fetch, full-text fetch, related literature, spell check, MeSH lookup, citation lookup, citation formatting, and ID conversion.
• Precise PubMed queries: Boolean and field-tag syntax, date ranges, publication types, language, species, abstract, and free-full-text filters.
• Broader Europe PMC search: Discover preprints, patents, Agricola, and EPMC-only records with cursor-based pagination.
• Full-text fallback chain: Try NCBI PMC, Europe PMC JATS XML, and an optionally configured Unpaywall open-access location.
• Research metadata: Retrieve authors, abstracts, journals, grants, MeSH, and similar, citing, or referenced articles.
• Flexible runtime: Use stdio or Streamable HTTP with Bun, Node.js 24/npm, or Docker deployment paths.
• Optional NCBI key: Run at the lower unauthenticated request rate or provide a key for a higher allowed rate.
• Structured failures: Distinguish unavailable full text, parse errors, and upstream failures instead of silently returning an empty result.

Use Cases

A careful workflow starts by translating a research question into keywords, MeSH headings, publication types, and date boundaries. The search tool returns candidate PMIDs, after which the client can fetch abstracts and structured metadata in batches. A researcher then decides which records deserve full-text review and can export BibTeX, RIS, APA, MLA, or Vancouver citations. Related-literature tools are useful for expanding from a known paper, but provider similarity and citation order are discovery aids, not quality rankings.

The full-text function should be understood as a best-effort search for lawful open copies. PMC and Europe PMC JATS generally provide cleaner structure. An Unpaywall fallback can lead to HTML or a PDF that is converted into Markdown or plain text. Tables, equations, footnotes, multi-column ordering, figure captions, and supplements can be lost or rearranged. Clients should retain the DOI, PMID, PMCID, source tier, availability reason, and original URL. A parser failure must never be summarized as evidence that the paper did not discuss a topic.

Another practical use is reproducible monitoring. Save the exact query, applied filters, retrieval date, source, result count, and identifiers before asking a model to summarize. This preserves a route back to the database when rankings change. It also separates retrieval from interpretation, making it easier for a reviewer to identify whether an omission came from the query, upstream indexing, full-text access, parsing, or the language model.

Pricing

Version 2.9.8 and its npm package are available under Apache-2.0 without a project subscription. An NCBI API key is optional: unauthenticated use operates under a lower request rate, while a valid key normally permits a higher rate. Compute, storage, observability, containers, reverse proxies, backups, and engineering remain deployment costs. Enabling the Unpaywall fallback requires an appropriate contact email and compliance with upstream courtesy and rate policies.

Apache-2.0 covers the server code, not journal articles, figures, supplementary files, or every database record. “Open access” is not one universal permission. Individual articles can use different Creative Commons licenses or repository-specific access conditions. Abstracts, citation metadata, and full text can also have different rights. Before downloading in bulk, caching, embedding, redistributing, training on, or publishing extracted material, review the source and license for each relevant corpus and article.

Pros

• Ten tools cover a substantial path from query construction through full-text attempts, citations, MeSH, and identifier conversion.
• PubMed and Europe PMC together improve discovery of preprints and additional open records.
• The fallback chain reports provenance and unavailable reasons, making failures easier to audit.
• Local stdio and Streamable HTTP support both individual clients and controlled service deployments.
• An optional NCBI key allows low-friction testing before a properly governed higher-rate setup.
• Apache-2.0 source can be inspected, and Bun, Node.js 24/npm, and Docker options fit several environments.
• Citation formatting and ID normalization reduce context switching between separate research utilities.

Cons

• The project is not an official product of NCBI, NLM, Europe PMC, a publisher, or a medical institution.
• Its public endpoint has no official NCBI service-level, privacy, or retention guarantee.
• Full text depends on open availability and article-level rights; it cannot lawfully bypass a paywall.
• HTML and PDF parsing can damage tables, equations, sections, notes, and reading order.
• Preprints, patents, abstracts, and peer-reviewed articles cannot be combined as equivalent evidence.
• Papers and retrieved web content can contain prompt injection and should never control privileged tools.
• Generated medical summaries may omit negative findings, subgroup differences, limitations, or newer guidelines.
• Several upstream services create separate availability, rate-limit, policy, and schema-change risks.

Alternatives

FAQ

Is this an official NCBI MCP server?

No. It is a community project maintained by cyanheads and calls public services including NCBI. The hosted URL is not an NCBI domain. Research and medical decisions must be verified against original databases and publications.

Is an NCBI API key required?

No. The server can operate at the lower unauthenticated rate. A key normally raises the permitted request rate. In both cases, clients must respect NCBI policy and control concurrency, retries, and batch sizes.

Can it retrieve every paper’s full text?

No. The chain only tries PMC, Europe PMC, and lawful open locations found through a configured Unpaywall fallback. It returns reasons when no open copy exists, parsing fails, or a service is unavailable; it does not bypass publisher access controls.

Are formatted citations guaranteed to be correct?

No. Formatting depends on upstream metadata, which can omit or later change authors, pages, online dates, and journal details. Verify citations against the article page and the target journal’s current instructions before submission.

Can it be used to provide medical advice?

Not by itself. It retrieves literature; it does not examine a patient, apply clinical guidelines, or automatically assess bias and evidence quality. Qualified professionals must review any diagnosis, treatment, medication, or safety conclusion.

How should prompt injection in papers be handled?

Treat titles, abstracts, article bodies, PDFs, and linked pages as untrusted data. Process them with read-only, low-privilege tools; isolate system instructions; block content from triggering commands, writes, or secret access; and preserve citations for human verification.

Bottom Line

cyanheads PubMed MCP Server 2.9.8 organizes PubMed, Europe PMC, open-full-text attempts, MeSH, citation utilities, and related-literature discovery into a practical MCP interface. It is more structured than general web search for biomedical retrieval, yet it remains an unofficial intermediary. A public endpoint, parsed article body, or model-generated synthesis should never replace the primary source.

Begin with local stdio and non-sensitive queries. Pin the package version and preserve complete queries, filters, PMIDs or DOIs, source labels, and timestamps. Test full-text parsing, citation formatting, limits, partial failures, and service outages before adding a key or exposing HTTP. Keep expert review for medical content, check article rights individually, and ensure every retrieved document remains low-privilege data rather than an instruction source.