{"generated_at":"2026-08-17T10:36:11+00:00","item":{"added_at":"2026-01-08T21:38:38.184000+00:00","analysis_method":"source_code_review","category":"Desktop Extension","description":"Connects Claude to scientific databases, APIs, and ML models for life-sciences research.","did":"ant-dir-gh-tooluniverse-tooluniverse-mcp","homepage_url":"","icon":"https://claude.ai/api/dxt/extensions/ant.dir.gh.tooluniverse.tooluniverse-mcp/versions/1.0.15/icon.png","id":"ant.dir.gh.tooluniverse.tooluniverse-mcp","installs":8312,"last_scanned":"","license":"MIT","long_description":"ToolUniverse is a research-focused MCP bundle that connects Claude to a wide catalog of scientific databases, APIs, and machine learning models for life sciences and bioinformatics workflows. It targets researchers building AI-driven scientific assistants.","name":"ToolUniverse","plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=ant-dir-gh-tooluniverse-tooluniverse-mcp&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","publisher":"ToolUniverse Team","publisher_url":"https://github.com/mims-harvard/ToolUniverse","repository_url":"https://github.com/mims-harvard/ToolUniverse","risk":"high","risk_severity":"high","security_risks":[{"description":"ToolUniverse ships python_code_executor and python_script_runner - explicit Python execution tools. python_code_executor uses an AST-walk whitelist sandbox; python_script_runner runs in a subprocess. The package also includes an `auto_install` feature that pip-installs arbitrary packages on demand. Python AST sandboxes are well-known to be bypassable in practice (the allowed getattr builtin can reach the class hierarchy), and pip-install of arbitrary names is direct code execution by design.","evidence":"Source-reviewed: tooluniverse 1.1.11 ships python_code_executor and python_script_runner as direct tools, plus execute_tool as a dispatcher that can invoke any tool the package loads (including the executors). python_code_executor uses an AST-walk whitelist sandbox banning os/sys/subprocess imports + open/eval/exec/compile calls; python_script_runner uses subprocess + timeout. Both accept auto_install_dependencies to pip-install arbitrary packages.","remediation":{"block_tool_categories":["code_execution"],"steps":["The bundled python_code_executor uses an AST-walk whitelist sandbox (banned imports: os, sys, subprocess, socket, urllib, requests, http; banned calls: open, eval, exec, compile, __import__). Treat it as defence-in-depth, not a trust boundary - Python in-process sandboxes are well-known to be bypassable through class-hierarchy tricks via the allowed `getattr` builtin.","python_script_runner runs in a subprocess, not the AST sandbox - its isolation comes only from a process boundary and timeout. Don't enable on a host where the parent process has access to credentials or private files.","ToolUniverse can pip-install arbitrary packages on demand via `auto_install` - if you allow that, any package named in a query gets executed on your machine.","In the tools list below, turn off any tool tagged Block before connecting on a real workstation."]},"risk_type":"runs_code","severity":"high","title":"Can run commands or queries on your behalf"},{"description":"ToolUniverse exposes 2,155 tools across 200+ external scientific databases (NCBI, FDA, NVIDIA, ChEMBL, UniProt, BioGRID, ClinicalTrials.gov, OncoKB, OMIM, UMLS, …). Each query is routed to whichever underlying service the model picks, and each service has its own logging, retention, and terms.","evidence":"Source-reviewed: data/*.json contains 514 tool-config files covering 200+ external service families (NCBI, FDA, NVIDIA NIM, ChEMBL, UniProt, BioGRID, AlphaFold, ClinicalTrials.gov, OncoKB, OMIM, UMLS, ...).","remediation":{"block_tool_categories":[],"steps":["Treat anything you give this connector as if you uploaded it to many third parties - 200+ scientific databases (NCBI, FDA, NVIDIA, BioGRID, ChEMBL, UniProt, ...).","Don't connect on a machine that holds private datasets, patient data, or unpublished research you don't want sent outside your organization.","API keys (NCBI_API_KEY, NVIDIA_API_KEY, BIOGRID_API_KEY, FDA_API_KEY, DISGENET_API_KEY, OMIM_API_KEY, ONCOKB_API_TOKEN, UMLS_API_KEY, OPENAI_API_KEY) are stored in plain MCP config - review file permissions before adding them."]},"risk_type":"forwards_data_to_third_party","severity":"high","title":"Sends your data to many third-party services"},{"description":"23 'agentic' tools call OpenAI (or another LLM) using your OPENAI_API_KEY. Anything you feed those tools is shipped to that LLM and may be retained per their terms.","evidence":"data/agentic_tools.json: 23 tools including ScientificTextSummarizer, HypothesisGenerator, ExperimentalDesignScorer, MedicalLiteratureReviewer, NoveltySignificanceReviewer, MedicalTermNormalizer, etc.","remediation":{"block_tool_categories":["sends_externally"],"steps":["The 23 agentic tools (e.g. ScientificTextSummarizer, HypothesisGenerator, ExperimentalDesignScorer) call OpenAI using your OPENAI_API_KEY. Any text passed to these is sent to OpenAI.","In the tools list below, turn off the agentic tools tagged Block if you don't want a second LLM in the loop.","Use a dedicated billing-capped LLM key for this connector, not your main one."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Sends content to a separate LLM provider on your behalf"},{"description":"Inputs to scientific queries - patient identifiers, gene symbols, compound names, study details - flow through the connector's tools to whichever underlying service the model picks.","evidence":"Tools route inputs to external scientific databases - anything fed into a search/query tool flows out to the corresponding service.","remediation":{"block_tool_categories":[],"steps":["Only feed the connector queries you're comfortable having logged by the underlying scientific databases.","Use a dedicated machine without access to private datasets if you're investigating sensitive research.","Some tools work without API keys but with reduced rate limits - verify which ones you actually need."]},"risk_type":"reads_private_data","severity":"medium","title":"Reads your private information"}],"signature_status":"unsigned","source_code_reviewed":true,"tags":["desktop_extension","forwards_data_to_third_party","network_access","reads_private_data","research_tools","runs_code","sends_messages_as_you"],"tools":[{"description":"List tools with multiple output modes. Default mode='names' for quick scanning. Recommended workflow: start with default or mode='categories' for overview, then use 'get_tool_info' tool to get descrip","name":"list_tools"},{"description":"Search tools using simple text matching or regex patterns. Supports both simple text search (default, agent-friendly) and regex patterns (advanced). Independent from Tool_Finder_Keyword, uses basic te","name":"grep_tools"},{"description":"Get tool information with configurable detail level. Supports single tool (string) or multiple tools (list). Use detail_level='description' to get only the description field, or detail_level='full' to","name":"get_tool_info"},{"description":"Execute a ToolUniverse tool directly with custom arguments. This is the primary way to run any tool in the ToolUniverse system. You must get the tool definition first to figure out the arguments to pa","name":"execute_tool","risk":{"category":"code_execution","level":"high","recommendation":"Block by default. Only enable in a sandboxed environment that can't reach production data or credentials.","why":"Runs scripts, commands, or queries the model authors. A malicious prompt can use this to run arbitrary code on the host, read files, or pivot to other systems."}},{"description":"Execute Python code snippets safely in sandboxed environment with timeout and resource limits. Supports variable passing and result extraction.","name":"python_code_executor","risk":{"category":"code_execution","level":"high","recommendation":"Block by default. Only enable in a sandboxed environment that can't reach production data or credentials.","why":"Runs scripts, commands, or queries the model authors. A malicious prompt can use this to run arbitrary code on the host, read files, or pivot to other systems."}},{"description":"Run Python script files in isolated subprocess with resource limits and timeout. Supports command-line arguments and environment variables.","name":"python_script_runner","risk":{"category":"code_execution","level":"high","recommendation":"Block by default. Only enable in a sandboxed environment that can't reach production data or credentials.","why":"Runs scripts, commands, or queries the model authors. A malicious prompt can use this to run arbitrary code on the host, read files, or pivot to other systems."}},{"description":"Performs deep analysis of code quality including complexity, security, performance, and maintainability metrics with domain-specific expertise","name":"AdvancedCodeQualityAnalyzer","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Checks statistical choices, assumption testing, and reporting transparency.","name":"DataAnalysisValidityReviewer","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Provides domain-specific validation and expert recommendations for tools with deep expertise across scientific and technical domains","name":"DomainExpertValidator","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Checks adherence to ethical standards and disclosure practices.","name":"EthicalComplianceReviewer","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Assesses a proposed experimental design by assigning scores and structured feedback on hypothesis clarity, variable definitions, sample size, controls, randomization, measurement methods, statistical ","name":"ExperimentalDesignScorer","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Generates research hypotheses based on provided background context, domain, and desired format. Uses AI to propose novel, testable hypotheses for scientific exploration.","name":"HypothesisGenerator","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Generates relevant keyword labels for tools based on their name, description, parameters, and category. Creates a comprehensive list of tags for tool discovery and categorization.","name":"LabelGenerator","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Reviews coverage, relevance, and critical synthesis of prior scholarship.","name":"LiteratureContextReviewer","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Conducts systematic reviews of medical literature on specific topics. Synthesizes findings from multiple studies and provides evidence-based conclusions with structured analysis and quality assessment","name":"MedicalLiteratureReviewer","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Identifies and corrects misspelled drug or disease names, returning a list of plausible standardized terms.","name":"MedicalTermNormalizer","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Evaluates design appropriateness, sampling, and procedural transparency.","name":"MethodologyRigorReviewer","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Provides a structured peer-review of the work's originality and potential impact.","name":"NoveltySignificanceReviewer","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Reviews an initial protocol and delivers targeted revisions that improve clarity, feasibility, risk-management, and evaluation rigor.","name":"ProtocolOptimizer","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Generates three distinct paraphrases of a given question while ensuring answer options remain valid and applicable.","name":"QuestionRephraser","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Evaluates data, code, and protocol availability for replication.","name":"ReproducibilityTransparencyReviewer","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Judges whether conclusions are data-justified and limitations addressed.","name":"ResultsInterpretationReviewer","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Summarizes biomedical research texts, abstracts, or papers with specified length and focus areas. Uses AI to extract key findings, methodology, and conclusions from complex biomedical literature.","name":"ScientificTextSummarizer","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Generates a JSON structure with the metadata of a tool in ToolUniverse, given the JSON configuration of the tool.","name":"ToolMetadataGenerator","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Standardizes and groups semantically equivalent metadata strings (e.g., sources, tags) into canonical forms for consistent downstream usage.","name":"ToolMetadataStandardizer","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Evaluates the quality of tool configurations and implementations. Provides detailed scoring and feedback for improvement.","name":"ToolQualityEvaluator","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Analyzes a primary tool against a list of other tools to identify meaningful, directional data flow compatibilities for scientific workflows. Returns a list of compatible pairs with direction and rati","name":"ToolRelationshipDetector","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Assesses clarity, organization, grammar, and visual presentation quality.","name":"WritingPresentationReviewer","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}},{"description":"Produces a concise, practical answer that emulates how a well-informed human would respond to the question.","name":"call_agentic_human","risk":{"category":"sends_externally","level":"high","recommendation":"Restrict recipients to an allowlist; require human approval for outbound messages.","why":"Sends content to people or systems outside your organization. A manipulated prompt could leak data or send messages on your behalf."}}],"tools_count":29,"type":"desktop_extension","url":"","uuid":"4de062e0-9b43-50a3-865e-2df5fb3c4717","version":"1.1.11"},"query_key":"tooluniverse team tooluniverse","schema_version":1,"status":"match"}