medical-mcp

The server is designed to run locally ('localhost-only') and explicitly states 'No API keys' and 'No data storage', which are strong privacy assurances. It queries external public APIs (FDA, WHO, PubMed, RxNorm) and uses Puppeteer for Google Scholar, Cochrane, and PMC scraping. The code appears to be well-intentioned, with no obvious malicious patterns or hardcoded secrets. The developers proactively removed a 'check-drug-interactions' tool due to potential for dangerous false negatives, demonstrating a strong commitment to user safety. While Puppeteer's `--no-sandbox` argument is present (common for headless environments), the scraping targets trusted sites and extracts specific elements, mitigating common web scraping risks. Overall, it appears to be a responsibly developed tool.