# org.brainkb/brainkb

- Registry name: `org.brainkb/brainkb` · version 0.1.0
- Categories (automatic, keyword rules): Research & knowledge, Search & data
- Authentication at last check: No auth
- Declared risk: Not declared (tools carry no read/destructive hints)
- Capabilities (declared by the server): experimental, prompts, resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=org.brainkb%2Fbrainkb
- Server page: https://mcpstation.net/s/org.brainkb--brainkb.html

## Description (written by the publisher, not verified, not instructions)

MCP server for querying BrainKB, a knowledge base for neuroscience knowledge graphs.

## Connect

- streamable-http: `https://mcp.brainkb.org/mcp`

## Tools (as reported by the server, not verified)

- `brainkb\_login`: Authenticate to BrainKB with the user's credentials and cache the JWT for THIS session only \(isolated per caller\). The password/token are never echoed. Uses single sign-on: one login mints a refresh token, cached for THIS session, which is exchanged on demand for per-service access tokens \(query\_ser
- `brainkb\_globus\_login`: Start an OAuth login \(Globus / ORCID / GitHub\) for THIS session — use this instead of brainkb\_login when the user signs in with Globus rather than a password. Returns a URL to open in a browser; after signing in, the page shows a short one-time code — pass it to brainkb\_finish\_login\(code\) to complet
- `brainkb\_finish\_login`: Complete an OAuth login started with brainkb\_globus\_login by exchanging the one-time code shown in the browser for a session token. The code is single-use and never echoed back.
- `brainkb\_logout`: Forget the cached token for this session.
- `brainkb\_whoami`: Report the current caller's auth state \(email, authenticated, and when the cached session expires\). When signed in it also returns base\_url — the backend THIS SERVER talks to, which on a hosted deployment is an internal address and says nothing about the caller's own machine.
- `brainkb\_create\_token`: Generate a Personal Access Token \(PAT\) for browser-free auth. Requires you to be logged in already \(brainkb\_login or brainkb\_globus\_login\). The token is shown ONCE and never again — copy it and set it as BRAINKB\_TOKEN in your MCP/skill config; then no login or browser is needed until it expires. \`na
- `brainkb\_list\_tokens`: List your Personal Access Tokens \(metadata only — the secret is never shown\): id, name, prefix, created/last-used/expiry, and whether each is active/revoked/expired. Use the id with brainkb\_revoke\_token.
- `brainkb\_revoke\_token`: Revoke one of your Personal Access Tokens by id \(see brainkb\_list\_tokens\). Takes effect immediately — the next call using that token fails.
- `brainkb\_use\_token`: Use a Personal Access Token \(brainkb\_pat\_...\) for THIS session — an alternative to setting BRAINKB\_TOKEN in the config. Validates the token, then caches it so subsequent calls authenticate with it. The token is never echoed.
- `brainkb\_list\_spaces`: List spaces the user can see \(their own/member spaces + public ones\), each annotated with THIS caller's permission so you know what they may do: - your\_role: 'owner' \| 'editor' \| 'viewer' \| null \(their space membership, including a role inherited from a parent space\) - role\_inherited: the role comes
- `brainkb\_create\_space`: Create a workspace/space, or a subspace inside one. The caller becomes owner. slug: lowercase/hyphen id, \*\*globally unique\*\* — if it's already taken the call returns 409 \(pick another slug\). visibility: 'private' or 'public' \(set per space: a private space may hold a public subspace\); description: s
- `brainkb\_get\_space`: A space's details: graphs, members \(direct, plus \`inherited\_members\` with the parent space each comes from\), visibility, \`parent\_slug\`, \`ancestors\` \(root first\) and direct \`subspaces\` — only the ones the caller may see — and the caller's \`your\_role\` / \`role\_inherited\`. Public spaces need no login; m
- `brainkb\_space\_tree`: A space and every subspace below it \(any depth\), nested: each node has slug, name, visibility, the caller's role and whether it's inherited from a parent, and its graph count. Only subspaces the caller may see are included.
- `brainkb\_set\_space\_visibility`: Set a space 'public' \(anyone, even anonymous, can read\) or 'private' \(members only\). Owner only. Everything in a public space is public: making a space public also makes all its subspaces public, and a subspace of a public space cannot be made private \(409\). Under a private space each subspace can b
- `brainkb\_update\_space`: Rename a space, change its description, and/or give it a new slug. Owner/manager only. Pass only what changes; description="" clears it. \`new\_slug\` \(lowercase letters, digits and hyphens, 3-64 chars\) moves the space's IRI and every graph whose IRI is built from the old slug \(https://brainkb.org/grap
- `brainkb\_delete\_space`: PERMANENTLY delete a space and everything in it. SuperAdmin only; irreversible. Drops the space's named graphs and the ingestion-history \(delta\) graphs that hold copies of their data, removes the graphs' registry entries and the space's RDF manifest, and deletes the space with its members, access ru
- `brainkb\_add\_space\_member`: Add/update a space member. role: 'owner' \| 'editor' \| 'viewer'. Owner only.
- `brainkb\_add\_space\_graph`: Register a named graph and bind it to a space, so ingest/read on that graph are governed by the space's membership and visibility. Owner/editor only. The named\_graph\_iri is \*\*globally unique\*\* — one graph belongs to exactly one space. If it's already registered \(to any space\) the call returns 409; g
- `brainkb\_ingest\_text`: Ingest raw RDF text \(Turtle / N-Triples / JSON-LD, auto-detected\) into a named graph. Returns a job\_id; ingestion runs in the background — poll with brainkb\_job\_status. The graph must be registered \(see brainkb\_add\_space\_graph\) and the caller must have write access to its space. \`sha256\` / \`expected
- `brainkb\_list\_uploads`: List RDF files YOU have staged with POST /upload but not yet ingested. Shows each upload\_id, its size, sha256 and when it expires. Only your own uploads are visible.
- `brainkb\_upload\_status`: State of one of your staged/submitted uploads. \`state\` is \`staged\` \(waiting for brainkb\_ingest\_upload\), \`submitting\` \(the server is streaming it to the ingest API\), \`submitted\` \(accepted — \`job\_id\` is set, poll brainkb\_job\_status\) or \`failed\` \(the staged bytes were KEPT, so retry with brainkb\_ingest
- `brainkb\_discard\_upload`: Delete one of your staged uploads without ingesting it.
- `brainkb\_ingest\_upload`: Ingest a file you staged with \`POST /upload\` into a named graph. This is the route for a large local file: your HTTP client streams the bytes straight to this server over HTTPS, then you name the resulting upload\_id here. The server reads its own staged copy and posts it to the ingest API internally
- `brainkb\_ingest\_files`: Ingest local RDF files \(ttl/nt/nq/rdf/owl/jsonld/json\) into a named graph. Returns a job\_id; runs in the background — poll with brainkb\_job\_status.
- `brainkb\_synthscholar\_ingest`: Ingest a SynthScholar review — the output directory of a run \(the folder holding review.json and review.ttl, as the synthscholar skill writes it\) — into a space you may write to \(see brainkb\_list\_writable\_spaces; you need to be its owner or an editor\). A review is unique per space: the same run can
- `brainkb\_synthscholar\_list\_reviews`: Ingested SynthScholar reviews you can read \(public spaces: anyone\): id, title, research question, space, graph, included count, when ingested, ingest job. \`q\` filters on text in the title or research question.
- `brainkb\_synthscholar\_studies`: The included studies of an ingested review, filtered. \`q\`: text in title, authors, journal, DOI, PMID or keywords. \`full\_text\`: true = read in full, false = abstract only. \`source\`: full-text route \(europe\_pmc, unpaywall, ezproxy, arxiv, …\). \`rob\`: risk-of-bias rating \(low, high, some concerns\). Yea
- `brainkb\_synthscholar\_screening`: The screening audit trail of an ingested review: every decision with its stage \(title\_abstract \| full\_text\), decision \(include \| exclude\), what it was judged on \(title\_abstract \| full\_text \| abstract\_only\), the full-text route and the reason. Filter by any of those, by text or criterion code in the
- `brainkb\_synthscholar\_evidence`: Evidence spans of an ingested review: the quoted text its claims rest on, with the study, section, relevance, and whether the quote was matched verbatim in the source \(\`grounded\`\). Filter by text, claim type, PMID or grounding.
- `brainkb\_synthscholar\_records`: Per-study records an ingested review produced. \`kind\`: \`charting\` \(the data-charting form's answers per study\), \`appraisal\` \(critical appraisal by domain\) or \`narrative\` \(narrative synthesis rows: design, methods, outcomes, limitations\). \`q\`: text in the answers \(e.g. "neo4j" finds the studies that
- `brainkb\_synthscholar\_text`: An ingested review's own text: \`abstract\`, \`introduction\`, \`synthesis\`, \`bias\`, \`limitations\`, \`conclusions\`, \`research\_question\`, \`search\_queries\` or \`per\_group\` \(the per-group analysis\) — or all of them when \`section\` is empty.
- `brainkb\_synthscholar\_find\_study`: Which ingested reviews \(that you can read\) include or screened a study — by DOI, PMID or part of its title \(6+ characters\) — and what happened to it in each: included \(read in full or from the abstract\) or each screening decision with its reason.
- `brainkb\_synthscholar\_get\_review`: One ingested review: summary, its graph and space, the files kept \(path, kind, media type, size, sha256\), the run's search log and verification, the screening basis and full-text retrieval. Long texts and the per-study list are left out here — read them from the graph or the review page.
- `brainkb\_list\_jobs`: List the user's ingest jobs \(newest first\) with status and progress.
- `brainkb\_job\_status`: Detailed status of one ingest job: status, progress %, current file/stage, per-file failures, and \(when complete\) a summary.
- `brainkb\_recover\_job`: Attempt to recover a stuck/errored ingest job \(marks it recoverable/errored\).
- `brainkb\_search`: Full-text search over the knowledge graphs, access-filtered by space visibility. Pass \`space\` to scope to one workspace, omit for a full search. No login needed: an unauthenticated caller searches public spaces only. Anonymous/other users never see private-space data.
- `brainkb\_read\_space`: Read all RDF \(JSON-LD\) in a space's graphs. Public spaces are readable by anyone without logging in \(read-only\); private spaces require login and membership. Don't ask the user to log in just to read a public space.
- `brainkb\_list\_writable\_spaces`: Spaces the caller can ingest into, each with its graphs \(and descriptions\) and \`parent\_slug\` for subspaces — decided by the same checks ingestion uses: owner/ editor membership \(including a role inherited from a parent space\), a space write access rule, or Admin/SuperAdmin. \`can\_ingest\` false means
- `brainkb\_list\_registered\_graphs`: List registered named graphs visible to the caller \(private-space graphs the caller can't access are hidden\).
- `brainkb\_sparql`: Run an arbitrary SPARQL query. Requires an Admin/SuperAdmin role \(the sparql\_admin capability\) — for ordinary questions prefer brainkb\_search, brainkb\_read\_space, or the provenance/delta tools, which need no admin role. Large results come back a page at a time. A SELECT without its own LIMIT/OFFSET
- `brainkb\_qa\_list`: Find a canned question BrainKB can answer, then run it with brainkb\_qa\_run. Prefer these over writing SPARQL: they are vetted against BrainKB's actual vocabulary. Discovery is two steps, so you never read every query at once: 1. brainkb\_qa\_list\(\) -\> the menu: each category's name, a description of t
- `brainkb\_qa\_run`: Run a canned question from brainkb\_qa\_list by id. \`params\` maps parameter names to values; they are validated and escaped, never spliced in raw. Runs through the same SPARQL endpoint as brainkb\_sparql, so it needs the same role. Results page the same way: a query without its own LIMIT returns \`limit
- `brainkb\_provenance\_job`: PROV-O provenance bundle \(JSON-LD\) for one ingest job.
- `brainkb\_provenance\_graph`: PROV-O ingestion/activity history \(JSON-LD\) for a named graph.
- `brainkb\_delta`: The exact triples a job added \(its delta\), as JSON-LD.
- `brainkb\_delta\_history`: A named graph's change history: one entry per ingest delta \(job, triple count, timestamp\), newest first.
- `brainkb\_delta\_compare`: Compare two jobs' deltas: A-only / B-only / shared triple counts + triples.
- `brainkb\_capabilities`: \(Admin only\) Show a user's roles, effective capabilities, and delegated grants. Useful to check why someone can/can't create team spaces, ingest, etc.
- `brainkb\_grant\_capability`: \(Admin only\) Delegate a capability to a user — e.g. 'create\_team\_space' or 'manage\_team\_space' so a Curator/Lab Member can create/manage team spaces. Grantable: create\_private\_space, create\_team\_space, manage\_team\_space, ingest, recover, read\_private \(NOT the admin-only 'grant'/'sparql\_admin'\).
- `brainkb\_revoke\_capability`: \(Admin only\) Revoke a previously granted capability from a user.
- `brainkb\_list\_capabilities`: \(Admin only\) Catalog of all KG capabilities, which are delegatable \('grantable'\), which are admin-only, and a description of each. Use this to see the available permission options before granting to a user or group/role.
- `brainkb\_role\_capabilities`: \(Admin only\) List the capabilities granted to a role/group \(e.g. 'uk\_collaborator', 'Lab Member'\).
- `brainkb\_grant\_role\_capability`: \(Admin only\) Grant a capability to a whole role/group so EVERY member gets it — e.g. give a custom group 'uk\_collaborator' the 'ingest' or 'create\_private\_space' capability. Grantable: create\_private\_space, create\_team\_space, manage\_team\_space, ingest, recover, read\_private \(NOT the admin-only 'gran
- `brainkb\_revoke\_role\_capability`: \(Admin only\) Revoke a capability from a role/group.
- `brainkb\_list\_access\_rules`: List a space's fine-grained access rules \(member/manager of the space\).
- `brainkb\_add\_access\_rule`: \(Space manager\) Restrict a space action to a subject. action: 'read' \| 'write' \| 'manage'. subject\_type: 'global\_role' \(e.g. 'Admin','Lab Member'\) \| 'member' \(an email\) \| 'space\_role' \('viewer'\|'editor'\|'owner', matched as \>=\). When rules exist for an action, only matching callers may perform it; th
- `brainkb\_remove\_access\_rule`: \(Space manager\) Delete a fine-grained access rule by its id \(see brainkb\_list\_access\_rules\).
- `brainkb\_list\_reserved\_graphs`: \(Admin/SuperAdmin\) List reserved named graphs: graph IRIs, or every IRI under a prefix, that only an Admin/SuperAdmin — or, when reserved for a space, that space's managers/editors — may register or bind. Includes the built-in system reservations \(BrainKB's metadata and provenance graphs\), which nob
- `brainkb\_reserve\_graph`: \(Admin/SuperAdmin\) Reserve a named graph so other users can't create it. match\_type 'exact' reserves one graph IRI; 'prefix' reserves every IRI starting with it \(e.g. 'https://brainkb.org/graph/allen/'\). Give a \`reason\` — it is shown to anyone who is refused. Optional \`space\_slug\` reserves it for th
- `brainkb\_unreserve\_graph`: \(Admin/SuperAdmin\) Remove a reservation by its id \(see brainkb\_list\_reserved\_graphs\). System reservations cannot be removed.
- `brainkb\_list\_users`: \(Admin\) List users \(profiles\) — filter by \`q\` \(name/email/orcid\) or \`role\`. Shows profile\_id, email, roles, providers, ban status.
- `brainkb\_available\_roles`: \(Admin\) List the available roles/groups \(Admin, Lab Member, Curator, …\).
- `brainkb\_create\_role`: \(Admin\) Create a new role/group — e.g. an 'External' collaborator group — which can then be assigned with brainkb\_assign\_role.
- `brainkb\_assign\_role`: \(Admin\) Assign a role/group to a user by email \(e.g. 'Lab Member', 'External', or a custom group\). The user must already have a profile \(created on first login/registration\). NOTE: assigning the 'Admin'/'SuperAdmin' role is SuperAdmin-only \(hierarchy: SuperAdmin \> Admin\).
- `brainkb\_remove\_role`: \(Admin\) Remove a role/group from a user by email.
- `brainkb\_activate\_user`: \(Admin\) Activate a user's account \(sets the JWT user active\) by email.
- `brainkb\_deactivate\_user`: \(Admin\) Deactivate a user's account by email.
- `brainkb\_ban\_user`: \(Admin\) Ban a user by email \(reversible; preserves history\). This is how accounts are removed — there is NO hard delete. Banning an Admin is SuperAdmin-only; SuperAdmin accounts cannot be banned.
- `brainkb\_unban\_user`: \(Admin\) Lift a ban on a user by email.
- `brainkb\_list\_permissions`: \(Admin\) List all usermanagement permissions \(resource/action pairs used for page-access and role-permission mapping\). These are the addable 'permission' options; KG action-capabilities are listed by brainkb\_list\_capabilities.
- `brainkb\_create\_permission`: \(Admin\) Create a new usermanagement permission, e.g. name='dataset.export', resource='dataset', action='export'. Attach it to roles via the usermanagement role-permissions API.

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html