reactome-mcp (reactome/reactome-mcp) is an MCP server listed on the M8ven Trust Index. It scores 56 out of 100, grade D. It declares 56 tools. No publisher has claimed this listing.

Caution

56/100

reactome-mcp

Item: reactome-mcp
Rating: 56
Author: M8ven

Enables AI assistants to search, browse, analyze, and export biological pathway data from Reactome through natural language.

→ reactome/reactome-mcp · listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

reactome

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

⚠️

Known vulnerabilities in dependencies: 3 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 1 credential: NEO4J_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes56 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

reactome_analyze_identifier

Analyze a single gene/protein identifier for pathway enrichment. Returns pathways containing this identifier.

reactome_analyze_identifiers

Perform pathway enrichment analysis on a list of gene/protein identifiers. Returns over-represented pathways sorted by p-value.

reactome_get_analysis_result

Retrieve a previously computed analysis result using its token. Allows filtering and pagination.

reactome_analysis_found_entities

Get the identifiers that were found in a specific pathway from an analysis result.

reactome_analysis_not_found

Get the list of identifiers that could not be mapped in an analysis.

reactome_analysis_resources

Get a summary of the molecule types (resources) found in an analysis.

reactome_compare_species

Compare Homo sapiens pathways to another species to identify orthologous pathways.

reactome_analysis_pathway_sizes

Get the distribution of pathway sizes (binned) from an analysis result.

reactome_filter_analysis_pathways

Filter an analysis result to only include specific pathways.

reactome_cypher_query

Run a Cypher query against the local Reactome Neo4j graph database. The session runs in READ mode, which rejects native write clauses (CREATE/MERGE/DELETE/SET/REMOVE). APOC procedures that can write through that guardrail (apoc.cypher.runWrite, apoc.periodic.*, apoc.create/merge/refactor.*, apoc.loa…

reactome_cypher_schema

Introspect the Reactome graph schema — labels with node counts, relationship types with cardinalities, per-label and per-rel property types (with mandatory flags), indexes, and constraints. Fetched live from the database via APOC on first call and cached in-memory for the rest of the session (~100–3…

reactome_cypher_sample

Return a small sample of nodes for a given label, to inspect shape and typical property values.

reactome_get_entity

Get detailed information about a physical entity (protein, complex, compound, etc.) by its Reactome ID.

reactome_complex_subunits

Get all subunits (components) of a complex. Recursively retrieves components of nested complexes.

reactome_entity_other_forms

Get all other forms of a physical entity (modified forms, in different compartments, in complexes, etc.).

reactome_entity_component_of

Find larger structures (complexes, sets) that contain this entity as a component.

reactome_participants

Get all molecular participants (inputs, outputs, catalysts, regulators) in a reaction or pathway.

reactome_participating_physical_entities

Get all physical entities participating in an event (molecules directly involved in reactions).

reactome_reference_entities

Get all reference entities (external database references) for participants in an event.

reactome_complexes_containing

Find all Reactome complexes that contain a specific external identifier (e.g., UniProt ID).

reactome_export_diagram

Export a pathway diagram as an image. Returns the URL to download the diagram.

reactome_export_reaction

Export a reaction diagram as an image.

reactome_export_fireworks

Export the pathway overview (fireworks) diagram for a species.

reactome_export_sbgn

Export a pathway or reaction to SBGN (Systems Biology Graphical Notation) XML format.

reactome_export_sbml

Export a pathway or reaction to SBML (Systems Biology Markup Language) format.

reactome_export_pdf

Export pathway or reaction documentation to PDF format.

reactome_export_analysis_report

Generate a PDF report for an analysis result.

reactome_export_analysis_csv

Export analysis results as CSV files.

reactome_export_analysis_json

Export complete analysis result as JSON.

reactome_species

Get the list of species available in Reactome.

reactome_diseases

Get the list of diseases annotated in Reactome.

reactome_database_info

Get Reactome database version and name information.

reactome_mapping_pathways

Map an external identifier to Reactome pathways.

reactome_mapping_reactions

Map an external identifier to Reactome reactions.

reactome_orthology

Get orthologous events or entities in a different species.

reactome_query

Query any Reactome database object by its identifier. Returns detailed information about the object.

reactome_psicquic_resources

List available PSICQUIC registry services for protein-protein interaction data.

reactome_psicquic_summary

Get a summary of protein-protein interactions from a PSICQUIC resource.

reactome_psicquic_details

Get detailed protein-protein interactions from a PSICQUIC resource.

reactome_static_interactors

Get curated protein-protein interactions from Reactome's static interactor database.

reactome_interactor_pathways

Find Reactome pathways where the interactors of a protein are found.

reactome_interactor_summary

Get a summary of curated interactions for a protein.

reactome_get_pathway

Get detailed information about a specific pathway or reaction by its Reactome ID.

reactome_top_pathways

Get all top-level (root) pathways for a species. These are the main pathway categories like 'Immune System', 'Metabolism', etc.

reactome_pathway_ancestors

Get the ancestor pathway hierarchy for an event (pathway or reaction). Shows how a pathway fits into the broader Reactome structure.

reactome_pathway_contained_events

Get all events (sub-pathways and reactions) contained within a pathway.

reactome_pathways_for_entity

Find lower-level pathways that contain a specific entity (protein, gene, compound, etc.).

reactome_diagram_pathways_for_entity

Find pathways with diagrams that contain a specific entity. Useful for visualization.

reactome_events_hierarchy

Get the complete event hierarchy (pathways and reactions tree) for a species. Warning: This returns a large data structure.

reactome_search

Search the Reactome knowledgebase for pathways, reactions, proteins, genes, compounds, and other entities.

reactome_search_paginated

Search Reactome with pagination support for browsing through large result sets.

reactome_search_suggest

Get auto-complete suggestions for a search query.

reactome_search_spellcheck

Get spell-check suggestions for a search query.

reactome_search_facets

Get available facets (filters) for search results, either globally or for a specific query.

reactome_search_pathways_of

Find all pathways that contain a specific entity by its database ID.

reactome_search_diagram

Search for entities within a specific pathway diagram.

// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configALLOWED_ORIGINS

configCYPHER_QUERY_TIMEOUT_MS30000 Server-side transaction timeout (ms) for reactome_cypher_ tools. Runaway queries are terminated after this.

configLOG_LEVELinfo debug / info / warn / error. Logs are JSON on stderr; stdout is reserved for the MCP protocol.

configNEO4J_DATABASEgraph.db Matches the default in reactome_neo4j_env.

🔐 secretNEO4J_PASSWORDneo4j Works against auth-disabled local images (reactome_neo4j_env). Set explicitly for any remote database.

configNEO4J_URI_(unset)_ Set to enable the optional Cypher tools (see below).

configNEO4J_USER"": "neo4j",

configREACTOME_ANALYSIS_SERVICE_URLderived from REACTOME_BASE_URL Fine-grained override for the Analysis Service only.

configREACTOME_BASE_URLREACTOME_CONTENT_SERVICE_URL derived from Fine-grained override for the Content Service only.

configREACTOME_CONTENT_SERVICE_URLderived from REACTOME_BASE_URL Fine-grained override for the Content Service only.

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deployPORT

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

56/56 tools missing one or more hints — reactome_analyze_identifier (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); reactome_analyze_identifiers (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); reactome_get_analysis_result (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +53 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

51/56 tool handlers declare input schemas (91%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

Only 1/56 tool handlers wrap calls in try/catch (2%)

Wrap each tool handler body in try/catch and return a structured error response.

Tool test coverage

Only 5/56 tools referenced in tests (9%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

3 child_process calls — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.0 (high), @modelcontextprotocol/sdk@1.12.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/reactome/reactome-mcp?variant=verified)](https://m8ven.ai/mcp/reactome/reactome-mcp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: ee385df5120996442a4cb81d72b16c337cbeff4c

code hash: 2ebee808b7eb3ffd22bf2c3dc7ac7c3582bb976919f02171644511776760b968

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client