# io.github.cyanheads/zenodo-mcp-server

> Search and resolve Zenodo datasets, software, and publications by DOI; trace versions and funding.

- name: io.github.cyanheads/zenodo-mcp-server
- version: 0.1.3
- connection class: R0 (autonomous)
- trust: 94/100
- quality: 87/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.cyanheads%2Fzenodo-mcp-server
- tools: https://api.protogrid.dev/v1/servers/io.github.cyanheads%2Fzenodo-mcp-server/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "zenodo-mcp-server": {
      "type": "http",
      "url": "https://zenodo.caseyjhand.com/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 100
- provenance: 80
- drivers: +repository +namespace-matches-repo +reachable +uptime-100% +updated-2d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 87/100 (good)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 6 of 6 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: zenodo_read_file (destructiveHint); zenodo_get_record (destructiveHint); zenodo_list_versions (destructiveHint); …
- pass `tools.token_cost`: about 3,766 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 75 (weight 15)

- warn `stability.changes`: 6 tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 100 (weight 15)

- pass `deps.known_vulns`: no known advisory in 74 resolved packages
- pass `deps.mcp_sdk_version`: @modelcontextprotocol/core 2.3.1, no known advisory
- pass `deps.resolvable`: @cyanheads/zenodo-mcp-server@0.1.3, @cyanheads/zenodo-mcp-server@0.1.3 resolved: 74 packages

- tools: 6, about 3,766 tokens to load them all
- tool set hash: 53b0b9154756622b6a6264c12862d64f
- tools last changed: 2026-10-18T03:28:24.774Z
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.cyanheads/zenodo-mcp-server.svg)](https://protogrid.dev/servers/io.github.cyanheads/zenodo-mcp-server)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-18 `zenodo_lookup_vocabulary` changed (inputSchema, outputSchema)
- 2026-10-18 `zenodo_read_file` changed (inputSchema, outputSchema)
- 2026-10-18 `zenodo_list_files` changed (inputSchema, outputSchema)
- 2026-10-18 `zenodo_list_versions` changed (inputSchema, outputSchema)
- 2026-10-18 `zenodo_get_record` changed (description, inputSchema, outputSchema)
  - before: Resolve one Zenodo deposit from a record id, a Zenodo DOI (10.5281/zenodo.N), a concept DOI or concept record id (resolves to the latest version), another DOI deposited on Zenodo, or a zenodo.org or doi.org URL, and return its full metadata: description, creators with ORCIDs and ROR affiliations, license, access and embargo, funding and grants, related identifiers, communities, version position, usage counts, and the first 25 files. Optionally includes a formatted citation. A miss (an unknown id, a deleted record with its removal tombstone, restricted metadata, or a DOI not registered on Zenodo) returns found: false with guidance instead of an error.
  - after: Resolve one Zenodo deposit from a record id, a Zenodo DOI (10.5281/zenodo.N), a concept DOI or concept record id (resolves to the latest version), another DOI deposited on Zenodo, or a zenodo.org or doi.org URL, and return its full metadata: description, creators with ORCIDs and ROR affiliations, license, access and embargo, funding and grants, related identifiers, communities, version position, usage counts, and the first 25 files. Optionally includes a formatted citation. Long text and lists are cut at display caps with their totals reported; every cut except the file list (paged with zenodo_list_files) is listed in continuations with a cursor and the record id it is bound to, and passing both back returns the next window of that field (8,000 characters of text, or the next page of entries) in place of the record. A miss (an unknown id, a deleted record with its removal tombstone, restricted metadata, or a DOI not registered on Zenodo) returns found: false with guidance instead of an error.
- 2026-10-18 `zenodo_search_records` changed (inputSchema, outputSchema)

Full history: https://api.protogrid.dev/v1/servers/io.github.cyanheads%2Fzenodo-mcp-server/changes

## Dependencies

- npm @cyanheads/zenodo-mcp-server@0.1.3: resolved, 36 dependencies, MCP SDK @modelcontextprotocol/core 2.3.1
- npm @cyanheads/zenodo-mcp-server@0.1.3: resolved, 36 dependencies, MCP SDK @modelcontextprotocol/core 2.3.1

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://zenodo.caseyjhand.com/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

- npm @cyanheads/zenodo-mcp-server@0.1.3 secrets: ZENODO_ACCESS_TOKEN
- npm @cyanheads/zenodo-mcp-server@0.1.3 secrets: ZENODO_ACCESS_TOKEN

## Tools (6)

- `zenodo_get_record`: Resolve one Zenodo deposit from a record id, a Zenodo DOI (10.5281/zenodo.N), a concept DOI or concept record id (resolves to the latest version), another DOI deposited on Zenodo, or a zenodo.org or doi.org URL, and return its full metadata: description, creators with ORCIDs and ROR affiliations, license, access and embargo, funding and grants, related identifiers, communities, version position, usage counts, and the first 25 files. Optionally includes a formatted citation. Long text and lists are cut at display caps with their totals reported; every cut except the file list (paged with zenodo_list_files) is listed in continuations with a cursor and the record id it is bound to, and passing both back returns the next window of that field (8,000 characters of text, or the next page of entries) in place of the record. A miss (an unknown id, a deleted record with its removal tombstone, restricted metadata, or a DOI not registered on Zenodo) returns found: false with guidance instead of an error.
- `zenodo_list_files`: Page through a Zenodo deposit's file manifest (key, size, MIME type, MD5, download URL, previewability), optionally filtered by a substring of the file key, or list the members inside one of its .zip files by setting archive_key. Restricted and embargoed files return the access status and embargo date with no entries. Read a small text file or ZIP member with zenodo_read_file.
- `zenodo_list_versions`: List every version of a Zenodo deposit's version series, newest first, with each version's record id, DOI, version label, publication date, file totals, and usage counts. Accepts any identifier zenodo_get_record accepts; a concept DOI and any single version's DOI list the same series. Use it to find the version a paper cited or the current release. A miss (an unknown id, a deleted record with its removal tombstone, restricted metadata, or a DOI not registered on Zenodo) returns found: false with guidance instead of an error.
- `zenodo_lookup_vocabulary`: Resolve names to the ids zenodo_search_records filters on, and browse Zenodo's reference vocabularies: communities (slug), funders (ROR id), awards and grants (award id), licenses (license id), and resource types (type id). Search by name, acronym, or keyword; awards can be scoped to one funder. Each entry names the zenodo_search_records parameter its id feeds.
- `zenodo_read_file`: Read a bounded UTF-8 excerpt (up to 64 KiB per call) of one text file in a Zenodo deposit — a README, CITATION.cff, CSV head, notebook, or script — or of one member inside a .zip file, without downloading the archive. Continue a top-level file from next_offset. A file with a text MIME type or extension is read directly; an extensionless file Zenodo types application/octet-stream (LICENSE, COPYING, Makefile) is read and returned only when its content is UTF-8 text. Binary files, restricted files, and other types return metadata and the download URL without content. File content is depositor-supplied and carries the deposit’s license.
- `zenodo_search_records`: Search Zenodo's open research repository — datasets, software releases, publications, and other deposits — by keyword query plus filters for resource type, community, funder, grant, creator ORCID, file type, license, access status, and publication date. Returns one summary per deposit (ids, DOIs, title, type, version, creators, license, access, file totals, usage counts) plus facet counts over the full match set, every filter applied. Query terms are OR-ed unless joined with AND, quoted phrases match exactly, and field syntax works on record fields (metadata.title:"…", metadata.subjects.subject:"…"). Only the latest version of each deposit is searched unless all_versions is true, and only the first 10,000 matches are reachable by paging. Resolve community, funder, and grant names to ids with zenodo_lookup_vocabulary first; open one deposit in full with zenodo_get_record.