dhis2w (winterop-com/dhis2w) is an MCP server listed on the M8ven Trust Index. It scores 66 out of 100, grade C. It declares 940 tools. No publisher has claimed this listing.

Caution

66/100

dhis2w

Item: dhis2w
Rating: 66
Author: M8ven

DHIS2 toolkit for Python — client, CLI, MCP server, browser automation.

→ winterop-com/dhis2w · listed on github_repo_search

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

winterop-com

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

⚠️

Tool descriptions don’t match what handlers do

3 tools describe read intent but their handlers mutate — metadata_export (line 216: Path(output_path).write_text(); metadata_export (line 216: Path(output_path).write_text(); metadata_export (line 216: Path(output_path).write_text()

✅

940 tools verified — handlers match their declared behaviour

1 read-only tool verified — handlers contain no write/delete/exec

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 1 credential: DHIS2_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes316 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

search_tools

Search the federated tool surface; returns matching tools with their input schemas.

data_aggregate_get

Fetch a DHIS2 aggregate data value set.

data_aggregate_push

Bulk push aggregate data values via POST /api/dataValueSets.

data_aggregate_set

Set a single aggregate data value via POST /api/dataValues.

data_aggregate_delete

Delete a single aggregate data value via DELETE /api/dataValues.

data_aggregate_followup

Set or clear the follow-up flag on a single aggregate data value (PUT /api/dataValues/followup).

analytics_query

Run a DHIS2 analytics query.

analytics_events_query

Run an event analytics query at /api/analytics/events/{mode}/{program}.

analytics_enrollments_query

Run an enrollment analytics query at /api/analytics/enrollments/query/{program}.

analytics_outlier_detection

Run `/api/analytics/outlierDetection` — flag anomalous data values.

analytics_tracked_entities_query

Line-list tracked entities via `/api/analytics/trackedEntities/query/{trackedEntityType}`.

apps_list

List every installed DHIS2 app (`GET /api/apps`). Returns typed App records.

apps_get

Return one installed app by `key`; None if not installed.

apps_install_from_file

Install / update an app from a local `.zip` at `path` (`POST /api/apps`).

apps_install_from_hub

Install an App Hub app by version id or app id; returns the resolved install target.

apps_uninstall

Remove an installed app by `key` (`DELETE /api/apps/{key}`).

apps_reload

Re-read every app from disk (`PUT /api/apps`). No new versions fetched.

apps_hub_list

List apps available in the configured App Hub (`GET /api/appHub`).

apps_hub_versions

List every published version of one App Hub app by app id (newest first).

apps_restore

Reinstall every hub-backed entry in the given snapshot.

apps_snapshot

Capture a portable inventory of every installed app.

apps_hub_url_get

Read DHIS2's configured App Hub URL (`keyAppHubUrl` system setting).

apps_hub_url_set

Point DHIS2 at a different App Hub by writing the `keyAppHubUrl` system setting.

apps_update

Update a single installed app to its latest App Hub version.

apps_update_all

Walk every installed app; install the latest App Hub version where available.

customize_logo_front

Upload an image file as the DHIS2 login-page splash / upper-right logo.

customize_logo_banner

Upload an image file as the DHIS2 top-menu banner logo (authenticated pages).

customize_style

Upload a CSS file served as `/api/files/style` on every authenticated page.

customize_show

Return DHIS2's read-only `/api/loginConfig` summary (what the login app renders).

customize_apply

Apply a committed preset directory in one call.

datastore_list_namespaces

List every namespace in the DHIS2 data store. `user=True` targets the per-user store.

datastore_list_keys

List every key in a data-store namespace.

datastore_get

Return the value at `namespace/key` — arbitrary user JSON (object, array, or scalar).

datastore_set

Create or update `namespace/key`. `value` is arbitrary JSON. Returns a status line.

datastore_delete

Delete `namespace/key` from the data store. Returns a status line.

doctor_run

Probe a DHIS2 instance — metadata health + DHIS2 data-integrity by default.

doctor_metadata

Run only the workspace metadata-health probes (no DHIS2 integrity, no bug drift).

doctor_integrity

Run only DHIS2's `/api/dataIntegrity/summary` probes.

doctor_bugs

Run only BUGS.md workaround drift probes (workspace maintenance).

files_documents_list

List DHIS2 documents (`/api/documents`).

files_documents_get

Return typed metadata for one document by UID.

files_documents_create_external

Create an EXTERNAL_URL document — no bytes uploaded, DHIS2 links out to `url`.

files_documents_delete

Delete one document by UID.

files_resources_get

Return typed metadata for one file resource (`/api/fileResources/{uid}`).

maintenance_task_type_list

List every background-job type DHIS2 tracks under /api/system/tasks.

maintenance_task_list

List every task UID recorded for a given job type (most-recent first).

maintenance_task_status

Return every notification emitted by a task, oldest first.

maintenance_cache_clear

POST /api/maintenance/cache — clear every server-side cache.

maintenance_cleanup_soft_deleted

Hard-remove soft-deleted rows of the given kind.

maintenance_dataintegrity_checks

List every built-in data-integrity check definition.

maintenance_dataintegrity_run

Kick off a data-integrity run; returns the task envelope.

maintenance_dataintegrity_result

Read the stored result of a completed data-integrity run (summary or details mode).

maintenance_refresh_analytics

Regenerate the analytics star schema (POST /api/resourceTables/analytics, job=ANALYTICS_TABLE).

maintenance_refresh_resource_tables

Regenerate resource tables only (POST /api/resourceTables, job=RESOURCE_TABLE).

maintenance_refresh_monitoring

Regenerate monitoring tables (POST /api/resourceTables/monitoring, job=MONITORING).

maintenance_validation_run

Run a validation-rule analysis synchronously + return violations.

maintenance_validation_result_list

List persisted validation results, with optional filters.

maintenance_validation_validate_expression

Parse-check a DHIS2 expression + render a human description.

maintenance_predictors_run

Run predictor expressions + emit data values.

messaging_list

List conversations the authenticated user is part of.

messaging_get

Fetch one conversation with its full message thread.

messaging_send

Create a new conversation with an initial message; returns the typed conversation.

messaging_reply

Reply to an existing conversation with a plain-text message.

messaging_mark_read

Mark one or more conversations as read.

messaging_mark_unread

Mark one or more conversations as unread.

messaging_delete

Delete a conversation (soft-delete for the calling user).

messaging_set_priority

Set a conversation's ticket-workflow priority: NONE / LOW / MEDIUM / HIGH.

messaging_set_status

Set a conversation's ticket-workflow status: NONE / OPEN / PENDING / INVALID / SOLVED.

messaging_assign

Assign a conversation to a user (ticket workflows).

messaging_unassign

Remove the assignee from a conversation.

metadata_type_list

List every metadata resource type the connected DHIS2 instance exposes.

metadata_list

List instances of a metadata resource (e.g. `dataElements`, `indicators`).

metadata_count

Count instances of a metadata resource without fetching the rows.

metadata_get

Fetch one metadata object by UID from the named resource.

metadata_search

Cross-resource text search via `/api/metadata` on id / code / name.

metadata_usage

Reverse lookup — find every object that references the given UID.

metadata_export

Download a metadata bundle from `GET /api/metadata`.

metadata_diff

Structurally compare two metadata bundles (or one bundle vs the live instance).

metadata_diff_profiles

Diff a narrow metadata slice between two registered profiles.

metadata_merge

Export a metadata slice from one profile and import it into another.

metadata_merge_bundle

Import a saved bundle file into a target profile.

metadata_legend_set_get

Fetch one LegendSet by UID with its colour bands resolved inline.

metadata_legend_set_create

Create a LegendSet with ordered colour-range legends.

metadata_legend_set_delete

Delete a LegendSet by UID.

metadata_patch

Apply an RFC 6902 JSON Patch to a metadata object.

metadata_rename

Bulk-rename metadata objects by RFC 6902 patch.

metadata_share

Merge a sharing change across many UIDs of one resource (read-merge-write).

metadata_retag

Bulk-rewrite ref / enum fields across a filtered cohort.

metadata_import

Upload a metadata bundle via `POST /api/metadata`.

metadata_option_set_get

Fetch one OptionSet (with options inline) by UID or business code.

metadata_option_set_find

Locate one option in a set by `option_code` or `option_name`.

metadata_option_set_attribute_get

Read one attribute value off an Option; None if unset.

metadata_option_set_attribute_set

Set / replace one attribute value on an Option (read-merge-write).

metadata_option_set_attribute_find

Reverse lookup — find the Option in a set whose attribute matches a value.

metadata_attribute_get

Read one attribute value off any resource with `attributeValues`.

metadata_attribute_set

Set / replace one attribute value on any resource (read-merge-write).

metadata_attribute_delete

Remove one attribute value; True if anything was removed, False on no-op.

metadata_attribute_find

Reverse lookup — UIDs of every resource whose attribute value matches.

metadata_program_rule_get

Show one ProgramRule with actions resolved inline.

metadata_program_rule_vars_for

List every `ProgramRuleVariable` in scope for a program.

216 further tools are not listed here. The complete surface is in the source.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configVITE_SERVE_TARGET

configMCP_ROUTER_READONLY

configDHIS2_VERSION

configDHIS2_PROFILEThe dhis2w-cli and dhis2w-mcp packages share a profile system that walks env → ./.dhis2/profiles.toml → ~/.config/dhis2/profiles.toml:

configGITHUB_OUTPUT

configDHIS2_HEADFUL

configDHIS2_URL

configDHIS2_PAT

configDHIS2_USERNAME

🔐 secretDHIS2_PASSWORD

configXDG_CONFIG_HOME

// quality suggestions

Tool annotations

1/940 tools have annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

940/940 tools missing one or more hints — search_tools (missing: destructiveHint, idempotentHint, openWorldHint); data_aggregate_get (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); data_aggregate_push (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +937 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Descriptions match behaviour

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool test coverage

316/940 tools referenced in tests (34%)

Write tests that reference each tool by name so every tool has at least one test.

Tool description accuracy

3 tools have description/behavior mismatches: metadata_export: description implies read-only but handler writes/deletes/executes; metadata_export: description implies read-only but handler writes/deletes/executes; metadata_export: description implies read-only but handler writes/deletes/executes

Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/winterop-com/dhis2w?variant=verified)](https://m8ven.ai/mcp/winterop-com/dhis2w)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 2d38fbdf73ec2cff0e4e2cd5872f93bfaffe602f

code hash: de92ef197cd900d242181f93d6a516d7f536b57827ac239a7bb1bf9d320a150f

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client