org.brainkb/brainkb
org.brainkb/brainkbMCP server for querying BrainKB, a knowledge base for neuroscience knowledge graphs.
Watch this dependency
Get before/after evidence when observed tools, schemas, authentication access, availability or the endpoint changes.
Inspect evidence and set up a watch Share public evidence report
Score: 100/100
Handshake verified by our own probe.
why this score
Tools · 72
Authenticate to BrainKB with the user's credentials and cache the JWT for THIS session only (isolated per caller). The password/token are never echoed. Uses single sign-on: one login mints a …
Start an OAuth login (Globus / ORCID / GitHub) for THIS session — use this instead of brainkb_login when the user signs in with Globus rather than a password. Returns a URL to open in a browse…
Complete an OAuth login started with brainkb_globus_login by exchanging the one-time code shown in the browser for a session token. The code is single-use and never echoed back.
Forget the cached token for this session.
Report the current caller's auth state (email, authenticated, and when the cached session expires). When signed in it also returns base_url — the backend THIS SERVER talks to, which on a hoste…
Generate a Personal Access Token (PAT) for browser-free auth. Requires you to be logged in already (brainkb_login or brainkb_globus_login). The token is shown ONCE and never again — copy it an…
List your Personal Access Tokens (metadata only — the secret is never shown): id, name, prefix, created/last-used/expiry, and whether each is active/revoked/expired. Use the id with brainkb_re…
Revoke one of your Personal Access Tokens by id (see brainkb_list_tokens). Takes effect immediately — the next call using that token fails.
Use a Personal Access Token (brainkb_pat_...) for THIS session — an alternative to setting BRAINKB_TOKEN in the config. Validates the token, then caches it so subsequent calls authenticate wit…
List spaces the user can see (their own/member spaces + public ones), each annotated with THIS caller's permission so you know what they may do: - your_role: 'owner' | 'editor' | 'viewer' | …
Create a workspace/space, or a subspace inside one. The caller becomes owner. slug: lowercase/hyphen id, **globally unique** — if it's already taken the call returns 409 (pick another slug). …
A space's details: graphs, members (direct, plus `inherited_members` with the parent space each comes from), visibility, `parent_slug`, `ancestors` (root first) and direct `subspaces` — only t…
A space and every subspace below it (any depth), nested: each node has slug, name, visibility, the caller's role and whether it's inherited from a parent, and its graph count. Only subspaces t…
Set a space 'public' (anyone, even anonymous, can read) or 'private' (members only). Owner only. Everything in a public space is public: making a space public also makes all its subspaces publ…
Rename a space, change its description, and/or give it a new slug. Owner/manager only. Pass only what changes; description="" clears it. `new_slug` (lowercase letters, digits and hyphens, 3-6…
PERMANENTLY delete a space and everything in it. SuperAdmin only; irreversible. Drops the space's named graphs and the ingestion-history (delta) graphs that hold copies of their data, removes…
Add/update a space member. role: 'owner' | 'editor' | 'viewer'. Owner only.
Register a named graph and bind it to a space, so ingest/read on that graph are governed by the space's membership and visibility. Owner/editor only. The named_graph_iri is **globally unique**…
Ingest raw RDF text (Turtle / N-Triples / JSON-LD, auto-detected) into a named graph. Returns a job_id; ingestion runs in the background — poll with brainkb_job_status. The graph must be regis…
List RDF files YOU have staged with POST /upload but not yet ingested. Shows each upload_id, its size, sha256 and when it expires. Only your own uploads are visible.
State of one of your staged/submitted uploads. `state` is `staged` (waiting for brainkb_ingest_upload), `submitting` (the server is streaming it to the ingest API), `submitted` (accepted — `j…
Delete one of your staged uploads without ingesting it.
Ingest a file you staged with `POST /upload` into a named graph. This is the route for a large local file: your HTTP client streams the bytes straight to this server over HTTPS, then you name…
Ingest local RDF files (ttl/nt/nq/rdf/owl/jsonld/json) into a named graph. Returns a job_id; runs in the background — poll with brainkb_job_status.
Ingest a SynthScholar review — the output directory of a run (the folder holding review.json and review.ttl, as the synthscholar skill writes it) — into a space you may write to (see brainkb_l…
Ingested SynthScholar reviews you can read (public spaces: anyone): id, title, research question, space, graph, included count, when ingested, ingest job. `q` filters on text in the title or r…
The included studies of an ingested review, filtered. `q`: text in title, authors, journal, DOI, PMID or keywords. `full_text`: true = read in full, false = abstract only. `source`: full-text …
The screening audit trail of an ingested review: every decision with its stage (title_abstract | full_text), decision (include | exclude), what it was judged on (title_abstract | full_text | a…
Evidence spans of an ingested review: the quoted text its claims rest on, with the study, section, relevance, and whether the quote was matched verbatim in the source (`grounded`). Filter by t…
Per-study records an ingested review produced. `kind`: `charting` (the data-charting form's answers per study), `appraisal` (critical appraisal by domain) or `narrative` (narrative synthesis r…
An ingested review's own text: `abstract`, `introduction`, `synthesis`, `bias`, `limitations`, `conclusions`, `research_question`, `search_queries` or `per_group` (the per-group analysis) — or…
Which ingested reviews (that you can read) include or screened a study — by DOI, PMID or part of its title (6+ characters) — and what happened to it in each: included (read in full or from the…
One ingested review: summary, its graph and space, the files kept (path, kind, media type, size, sha256), the run's search log and verification, the screening basis and full-text retrieval. Lo…
List the user's ingest jobs (newest first) with status and progress.
Detailed status of one ingest job: status, progress %, current file/stage, per-file failures, and (when complete) a summary.
Attempt to recover a stuck/errored ingest job (marks it recoverable/errored).
Full-text search over the knowledge graphs, access-filtered by space visibility. Pass `space` to scope to one workspace, omit for a full search. No login needed: an unauthenticated caller sear…
Read all RDF (JSON-LD) in a space's graphs. Public spaces are readable by anyone without logging in (read-only); private spaces require login and membership. Don't ask the user to log in just …
Spaces the caller can ingest into, each with its graphs (and descriptions) and `parent_slug` for subspaces — decided by the same checks ingestion uses: owner/ editor membership (including a ro…
List registered named graphs visible to the caller (private-space graphs the caller can't access are hidden).
Run an arbitrary SPARQL query. Requires an Admin/SuperAdmin role (the sparql_admin capability) — for ordinary questions prefer brainkb_search, brainkb_read_space, or the provenance/delta tools…
Find a canned question BrainKB can answer, then run it with brainkb_qa_run. Prefer these over writing SPARQL: they are vetted against BrainKB's actual vocabulary. Discovery is two steps, so y…
Run a canned question from brainkb_qa_list by id. `params` maps parameter names to values; they are validated and escaped, never spliced in raw. Runs through the same SPARQL endpoint as braink…
PROV-O provenance bundle (JSON-LD) for one ingest job.
PROV-O ingestion/activity history (JSON-LD) for a named graph.
The exact triples a job added (its delta), as JSON-LD.
A named graph's change history: one entry per ingest delta (job, triple count, timestamp), newest first.
Compare two jobs' deltas: A-only / B-only / shared triple counts + triples.
(Admin only) Show a user's roles, effective capabilities, and delegated grants. Useful to check why someone can/can't create team spaces, ingest, etc.
(Admin only) Delegate a capability to a user — e.g. 'create_team_space' or 'manage_team_space' so a Curator/Lab Member can create/manage team spaces. Grantable: create_private_space, create_te…
(Admin only) Revoke a previously granted capability from a user.
(Admin only) Catalog of all KG capabilities, which are delegatable ('grantable'), which are admin-only, and a description of each. Use this to see the available permission options before grant…
(Admin only) List the capabilities granted to a role/group (e.g. 'uk_collaborator', 'Lab Member').
(Admin only) Grant a capability to a whole role/group so EVERY member gets it — e.g. give a custom group 'uk_collaborator' the 'ingest' or 'create_private_space' capability. Grantable: create_…
(Admin only) Revoke a capability from a role/group.
List a space's fine-grained access rules (member/manager of the space).
(Space manager) Restrict a space action to a subject. action: 'read' | 'write' | 'manage'. subject_type: 'global_role' (e.g. 'Admin','Lab Member') | 'member' (an email) | 'space_role' ('vi…
(Space manager) Delete a fine-grained access rule by its id (see brainkb_list_access_rules).
(Admin/SuperAdmin) List reserved named graphs: graph IRIs, or every IRI under a prefix, that only an Admin/SuperAdmin — or, when reserved for a space, that space's managers/editors — may regis…
(Admin/SuperAdmin) Reserve a named graph so other users can't create it. match_type 'exact' reserves one graph IRI; 'prefix' reserves every IRI starting with it (e.g. 'https://brainkb.org/gra…
(Admin/SuperAdmin) Remove a reservation by its id (see brainkb_list_reserved_graphs). System reservations cannot be removed.
(Admin) List users (profiles) — filter by `q` (name/email/orcid) or `role`. Shows profile_id, email, roles, providers, ban status.
(Admin) List the available roles/groups (Admin, Lab Member, Curator, …).
(Admin) Create a new role/group — e.g. an 'External' collaborator group — which can then be assigned with brainkb_assign_role.
(Admin) Assign a role/group to a user by email (e.g. 'Lab Member', 'External', or a custom group). The user must already have a profile (created on first login/registration). NOTE: assigning t…
(Admin) Remove a role/group from a user by email.
(Admin) Activate a user's account (sets the JWT user active) by email.
(Admin) Deactivate a user's account by email.
(Admin) Ban a user by email (reversible; preserves history). This is how accounts are removed — there is NO hard delete. Banning an Admin is SuperAdmin-only; SuperAdmin accounts cannot be bann…
(Admin) Lift a ban on a user by email.
(Admin) List all usermanagement permissions (resource/action pairs used for page-access and role-permission mapping). These are the addable 'permission' options; KG action-capabilities are lis…
(Admin) Create a new usermanagement permission, e.g. name='dataset.export', resource='dataset', action='export'. Attach it to roles via the usermanagement role-permissions API.
How to use
Add to your Claude Desktop / Cursor / Cline MCP config:
{
"mcpServers": {
"org.brainkb/brainkb": {
"url": "https://mcp.brainkb.org/mcp",
"transport": "streamable-http"
}
}
}