MCP server for OMIM (Online Mendelian Inheritance in Man) API access with code execution, data staging, and SQL query capabilities
Server has 4 tools with explicit schemas and descriptions. Naming follows verb_noun convention (query_data, get_schema, omim_execute, omim_search). Descriptions are present (avg ~150 chars) but lack actionable context for LLM selection. Input schemas are well-typed with Zod validation. Critical gaps: no output schemas documented, no error handling guidance, no parameter constraints (enums, ranges), and omim_execute accepts arbitrary code, a severe security risk without sandboxing validation details visible in source.
Retrieve the schema of staged data. Returns table structure, column names, types, and relationships for data that has been staged into SQLite.
Execute JavaScript code in a sandboxed V8 isolate with access to OMIM API via api.get/api.post, SQL query capabilities via api.query/db.queryStaged, and data staging via db.stage. The isolate has pre-injected catalog search helpers (searchSpec, listCategories, getEndpoint, describeEndpoint) and API proxy functions. Large responses (>100KB) are automatically staged into SQLite.
Search the OMIM API catalog for endpoints. Supports two modes: (1) Catalog mode - token-based keyword search over static endpoint catalog, (2) OpenAPI mode - evaluates agent-written JavaScript with full resolved OpenAPI spec available for advanced searching (searchPaths, listTags, getOperation, describeOperation, describeEndpoint).
Query staged data using SQL. Executes SELECT queries against data that has been staged into SQLite via the execute tool or db.stage() function.
omim_execute accepts arbitrary JavaScript code with minimal validation visible. No sandboxing guarantees, timeout enforcement, or resource limits documented in tool description. LLM cannot assess safety or failure modes.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields. query_data and omim_execute responses are unstructured.
query_data description lacks context: when to use vs omim_execute, what 'staged data' means, max result limits. Parameter 'sql' has no format constraints (max length, SELECT-only enforcement).
omim_search description conflates two modes (catalog vs OpenAPI) without clear selection guidance. LLM cannot determine which mode to invoke or what JavaScript syntax is valid.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 50 | 2026-07-28+ | v2 |
No error handling guidance. Tools do not document retryable vs fatal errors, recovery steps, or what to do when data_access_id is invalid or expired.