io.github.cyanheads/wikidata-mcp-server
NPM · @CYANHEADS/WIKIDATA-MCP-SERVER · 2 COMPONENTS · SCANNED SEP 20
Search and fetch Wikidata entities, execute SPARQL queries, and resolve external identifiers.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 16 of 49 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability78
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2277 tokens (~227/item across 10 items; 7 tools + 3 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
- Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "wikidata_sparql_query" implies "execute" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Fail
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the io.github.cyanheads/wikidata-mcp-server server?
io.github.cyanheads/wikidata-mcp-server runs locally as an npm package, launched with npx -y @cyanheads/wikidata-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @cyanheads/wikidata-mcp-server
claude mcp add cyanheads-wikidata-mcp-server -- npx -y @cyanheads/wikidata-mcp-server
{
"mcpServers": {
"cyanheads-wikidata-mcp-server": {
"command": "npx",
"args": [
"-y",
"@cyanheads/wikidata-mcp-server"
]
}
}
} {
"servers": {
"cyanheads-wikidata-mcp-server": {
"command": "npx",
"args": [
"-y",
"@cyanheads/wikidata-mcp-server"
]
}
}
} codex mcp add cyanheads-wikidata-mcp-server -- npx -y @cyanheads/wikidata-mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"cyanheads-wikidata-mcp-server": {
"type": "local",
"command": [
"npx",
"-y",
"@cyanheads/wikidata-mcp-server"
],
"enabled": true
}
}
} openclaw mcp add cyanheads-wikidata-mcp-server --command npx --arg -y --arg @cyanheads/wikidata-mcp-server
mcp_servers:
cyanheads-wikidata-mcp-server:
command: "npx"
args: ["-y", "@cyanheads/wikidata-mcp-server"] {
"McpServers": {
"cyanheads-wikidata-mcp-server": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@cyanheads/wikidata-mcp-server"
]
}
}
} assistant mcp add cyanheads-wikidata-mcp-server -t stdio -c npx -a -y @cyanheads/wikidata-mcp-server
{
"mcpServers": {
"cyanheads-wikidata-mcp-server": {
"command": "npx",
"args": [
"-y",
"@cyanheads/wikidata-mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +27
- Stability: 0.93 → unverified ▼ security
- Injection markers: unverified → pass ▲ security
- Tool safety: Tool safety not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet. security
- Capabilities: pass → unverified ▼ functional
- Schema quality: 317 → 227 ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → 100 ▲ functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet. functional
- Package version: 0.1.18 → 0.1.19 functional
- 19 Sept 26 +13
- Stability: fail → 0.93 functional
- 9 Sept 26 +1
- Security disclosure: unverified → pass ▲ functional
- 8 Sept 26 −1
- Security disclosure: pass → unverified ▼ functional
- 6 Sept 26 −36
- Tool safety: pass → unverified ▼ security
- Stability: 0.80 → fail ▼ security
- Tool coverage: 100 → unverified ▼ functional
- 5 Sept 26 −2
- Stability: pass → 0.80 functional
- 4 Sept 26 0
- Stability: 0.97 → pass security
- 3 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@cyanheads/wikidata-mcp-server@0.1.19
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 49 packages
| Packages resolved | 49 |
|---|---|
| Stale | 16 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
wikidata_get_entity Get Wikidata Entity ~388
Fetch a Wikidata entity (item or property) by QID or PID. The fields parameter narrows the upstream fetch, not just the response — asking for labels alone costs a fraction of the whole entity, so name the fields you need. Omit fields for all data; a well-connected item is large enough to overflow, and an oversized entity returns kind: "outline" — the field categories with their byte sizes — instead of the data. Follow its retrieval_notice literally rather than picking from sections yourself — it names a fields set already measured to fit, since category sizes are additive and requesting them all would overflow again; for a category too large to deliver whole (statements or sitelinks on a major item) it names the sibling tool that can narrow it. Q-IDs (e.g. Q76) fetch items; P-IDs (e.g. P31) fetch properties from the correct endpoint automatically. Use wikidata_get_statements for deep claim traversal with label resolution, and whenever an entity's statements are large — its properties parameter selects individual P-IDs, granularity fields does not carry.
| Name | Type | Req | Description |
|---|---|---|---|
| fields | array | – | Fields to include. Options: "labels", "descriptions", "aliases", "statements", "sitelinks". Narrows the upstream fetch as well as the response, so a narrow selection is markedly cheaper. Omit for all… |
| id | string | yes | Q-ID (e.g., "Q76") or P-ID (e.g., "P31"). Case-insensitive — normalized to uppercase. |
| languages | array | – | Language codes to include in labels, descriptions, and aliases (e.g., ["en", "de"]). A requested language with no label of its own falls back to the entity's multilingual ("mul") value, returned unde… |
| Name | Type | Req | Description |
|---|---|---|---|
| aliases | object | – | Map of language code to list of alias strings (e.g., {"en": ["Barack H. Obama", "President Obama"]}). |
| data_type | string | – | Property data type (e.g., "wikibase-item", "external-id"). Present on properties only. |
| descriptions | object | – | Map of language code to description string (e.g., {"en": "44th President of the United States"}). |
| error | object | – | Present when the call failed. Absent on success. |
| fieldsReturned | array | – | Which fields were requested. In outline mode these are the categories the outline covers, not data returned. |
| id | string | – | Normalized entity ID (e.g., "Q76" or "P31"). |
| kind | string | – | full — the requested field categories carry their data. outline — the entity overflowed the inline byte budget, so sections lists the categories with their byte sizes instead, and retrieval_notice na… |
| labels | object | – | Map of language code to label string (e.g., {"en": "Barack Obama", "de": "Barack Obama"}). |
| retrieval_notice | string | – | Present when kind = outline: the next call to make, and the authoritative one to follow. It names a literal fields set already measured to fit the budget, defers any category that would not fit along… |
| sections | array | – | Present when kind = outline: the entity's field categories, largest first, each with its byte size. Sizes are additive — a set of categories is only retrievable together if their total fits the budge… |
| sitelinks | object | – | Map of site code (e.g., "enwiki") to sitelink metadata with title, url, and badges fields. |
| statements | object | – | Map of property ID to array of raw statement objects. Use wikidata_get_statements for resolved claims with label resolution, and whenever this entity's statements are large — its properties parameter… |
| type | string | – | Entity type: "item" or "property". |
No examples provided.
wikidata_get_labels Get Wikidata Labels ~165
Resolve one or more QIDs or PIDs to their human-readable labels and descriptions. Lightweight — returns no claim data. Supports up to 50 IDs per call (batched automatically). Designed for the common agent pattern: receive QIDs from a SPARQL query, then humanize them.
| Name | Type | Req | Description |
|---|---|---|---|
| ids | array | yes | Q-IDs (e.g., "Q76") or P-IDs (e.g., "P31") to resolve. 1–50 IDs per call. |
| languages | array | – | BCP 47 language codes for returned labels and descriptions (e.g., ["en", "de", "fr"]). A language with no label of its own falls back to the entity's multilingual ("mul") value, returned under the re… |
| Name | Type | Req | Description |
|---|---|---|---|
| entities | object | – | Map of entity ID to labels and descriptions. IDs that were not found are absent. |
| error | object | – | Present when the call failed. Absent on success. |
| found | number | – | Count of IDs that returned data. |
| languages | array | – | The language codes that were requested. |
| notFound | array | – | IDs from the request that did not return data (not found or invalid). |
No examples provided.
wikidata_get_sitelinks Get Wikidata Sitelinks ~226
Fetch Wikipedia and Wikimedia project article URLs for a Wikidata item. A sitelink maps a site code (e.g., "enwiki") to a Wikipedia article title and URL. Major items can have 300+ sitelinks across languages. Use sites to filter to specific language editions, or wikis_only to return only Wikipedia links. Only Q-IDs (items) have sitelinks — properties (P-IDs) do not.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Q-ID of the item (e.g., "Q76"). Only items have sitelinks; properties (P-IDs) are not supported. |
| sites | array | – | Optional filter to specific site codes (e.g., ["enwiki", "frwiki", "dewiki"]). Omit to return all sitelinks. |
| wikis_only | boolean | – | When true, return only Wikipedia sitelinks (site codes ending in "wiki", e.g., "enwiki", "dewiki"). Excludes Wikisource, Wiktionary, Wikiquote, etc. |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | – | Number of sitelinks returned. |
| error | object | – | Present when the call failed. Absent on success. |
| id | string | – | The Q-ID whose sitelinks were fetched. |
| message | string | – | Informational note when no sitelinks were found. Absent when sitelinks are present. |
| sitelinks | object | – | Map of site code to sitelink metadata. Empty when the entity has no matching sitelinks. |
No examples provided.
wikidata_get_statements Get Wikidata Statements ~293
Fetch property claims for a Wikidata entity with qualifier and reference detail. Value QIDs are resolved to human-readable labels by default. Use the properties parameter to fetch only specific P-IDs — omitting it returns every statement, and a well-connected item (a country, a major city) carries hundreds of properties: more than fits inline. An oversized set comes back as kind: "outline" — every available P-ID with its byte size, largest first — instead of the statements; re-call with the same id plus properties:[...] naming the P-IDs you want. Designed for fact verification: "what does Wikidata say about this entity's {property}?". Preferred-rank statements are the most current values.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Q-ID (e.g., "Q76") or P-ID of the entity to fetch statements for. |
| language | string | – | Language code for label resolution of QID values (e.g., "en", "de"). |
| properties | array | – | P-IDs to fetch (e.g., ["P31", "P569", "P27"]). Omit to return all properties (may be large for major items). |
| resolve_labels | boolean | – | Resolve wikibase-item value QIDs to human-readable labels via a batched label call. Set to false to skip label resolution and return raw QIDs only (faster, smaller payload). |
| Name | Type | Req | Description |
|---|---|---|---|
| error | object | – | Present when the call failed. Absent on success. |
| id | string | – | The entity ID whose statements were fetched. |
| kind | string | – | full — statements carries the claims. outline — the statement set overflowed the inline byte budget, so sections lists the P-IDs available instead; re-call with properties:[...] to retrieve specific… |
| labelsResolved | boolean | – | True when QID values were resolved to labels. False when resolve_labels was set to false. |
| propertyCount | number | – | Number of distinct properties — those returned in full mode, those offered as sections in outline mode. |
| retrieval_notice | string | – | Present when kind = outline: how to re-call for specific properties. |
| sections | array | – | Present when kind = outline: the P-IDs this entity carries statements for, largest first. Copy names into the properties input to retrieve them. |
| statementCount | number | – | Total number of statement objects across all properties. Counted before any overflow, so it reports the entity's full statement volume in both modes. |
| statements | object | – | Map of property ID to array of normalized statements. Each statement has id, rank, property, value (with type-specific fields), and optional qualifiers and references arrays. Present in full mode; om… |
No examples provided.
wikidata_resolve_external_id Resolve Wikidata External ID ~438
Look up a Wikidata entity by an external identifier such as a DOI, PubMed ID, ORCID iD, or OpenAlex ID. Returns match=<entity> on success, match=null when not found, and match=null with multipleMatches populated when a Wikidata data integrity issue causes more than one entity to claim the same external ID. Common cross-server join use cases: CrossRef DOI → Wikidata paper QID (P356), PubMed PMID → Wikidata paper QID (P698), ORCID → author QID (P496), OpenAlex ID → entity QID (P10283). The property must be one whose Wikidata data type is external-id — item-valued or media properties (e.g. P31 instance-of, P18 image) are rejected rather than returning an empty match. Known value normalization is applied automatically: surrounding whitespace is trimmed, identifier-resolver URL prefixes are stripped (https://doi.org/, https://pubmed.ncbi.nlm.nih.gov/, https://orcid.org/), DOIs are uppercased, PMID prefixes stripped, ORCID hyphens normalized.
| Name | Type | Req | Description |
|---|---|---|---|
| language | string | – | Language code for label and description in the response (e.g., "en", "de"). |
| property | string | yes | P-ID of the external identifier property, whose Wikidata data type must be external-id (e.g., "P356" for DOI, "P698" for PubMed ID, "P496" for ORCID, "P10283" for OpenAlex ID, "P345" for IMDb ID). Pr… |
| value | string | yes | The external identifier value to look up (e.g., "10.1038/nature01234" for a DOI, "32283226" for a PubMed ID, "0000-0002-1825-0097" for an ORCID). A resolver URL is accepted for DOI, PubMed, and ORCID… |
| Name | Type | Req | Description |
|---|---|---|---|
| error | object | – | Present when the call failed. Absent on success. |
| match | – | – | Matching entity, or null when no Wikidata entity claims this external identifier (including the case where multipleMatches is populated). A null match is not proof of absence — the Query Service back… |
| multipleMatches | array | – | Present when more than one Wikidata entity claims this external ID (data integrity issue). match is null when this field is present. Inspect the list and select the correct QID manually. |
| property | string | – | The P-ID used for the lookup. |
| value | string | – | The normalized value that was searched (may differ from input due to canonicalization). |
No examples provided.
wikidata_search_entities Search Wikidata Entities ~220
Search Wikidata for items or properties by text query. Returns QIDs or PIDs with labels, descriptions, and match metadata indicating whether the hit was on a label or alias. Use type="item" for real-world concepts (people, places, works) and type="property" to find predicate P-IDs. The API returns no total count — pagination is offset-based with no result ceiling indicator.
| Name | Type | Req | Description |
|---|---|---|---|
| language | string | – | BCP 47 language code for returned labels and descriptions (e.g., "en", "de", "zh"). |
| limit | integer | – | Maximum number of results to return. Range: 1–50. |
| offset | integer | – | Pagination offset. Start at 0; increment by limit to page through results. |
| query | string | yes | Search terms to match against entity labels, aliases, and descriptions. |
| type | string | – | Entity type to search. Use "item" for Q-IDs (people, places, concepts) or "property" for P-IDs (predicates). |
| Name | Type | Req | Description |
|---|---|---|---|
| cap | number | – | The limit parameter in effect. |
| effectiveQuery | string | – | The search query that was executed. |
| error | object | – | Present when the call failed. Absent on success. |
| language | string | – | The language used for label and description display. |
| notice | string | – | Recovery hint when results are empty — echoes filters and suggests how to broaden. Absent when results are present. |
| results | array | – | Ranked list of matching entities. Empty when no results found. |
| searchType | string | – | The entity type that was searched ("item" or "property"). |
| shown | number | – | Number of results returned on this page. |
| truncated | boolean | – | True when results were capped at the limit. The Wikidata search API returns no total count — use offset pagination to retrieve more. |
No examples provided.
wikidata_sparql_query Wikidata SPARQL Query ~328
Execute a SPARQL SELECT query against the Wikidata Query Service. Full graph power: multi-hop traversals, aggregations, subqueries, OPTIONAL, FILTER, UNION, BIND. Standard Wikidata prefixes (wd:, wdt:, p:, ps:, pq:, wikibase:, bd:) are auto-injected. The wikibase:label SERVICE is also auto-injected when language is set and the query includes ?<var>Label variables — so you can use ?itemLabel without writing the boilerplate. Hard server timeout is 60s; use LIMIT to keep queries fast. Bindings use the SPARQL 1.1 JSON format: each value is { type, value, "xml:lang"? }. Use wikidata_get_labels to humanize QID results from this tool.
| Name | Type | Req | Description |
|---|---|---|---|
| language | string | – | Language for the wikibase:label SERVICE (e.g., "en", "de"). Controls the language of ?<var>Label variables. Set to "" to suppress label SERVICE injection. |
| query | string | yes | SPARQL SELECT query. Must be a SELECT query (not CONSTRUCT/DESCRIBE/ASK). Standard prefixes (wd:, wdt:, p:, ps:, pq:, wikibase:, bd:) are injected automatically. Example: SELECT ?item ?itemLabel WHER… |
| timeout | integer | – | Client-side timeout in seconds (1–55). Capped at 55s — the Wikidata server hard limit is 60s. |
| Name | Type | Req | Description |
|---|---|---|---|
| error | object | – | Present when the call failed. Absent on success. |
| notice | string | – | Recovery hint when no results returned — suggests checking query logic or broadening filters. Absent on non-empty results. |
| results | array | – | Array of result bindings. Each row maps variable names to binding objects with { type, value, "xml:lang"?, datatype? } fields. |
| totalCount | number | – | Number of result rows returned. |
| truncated | boolean | – | True when the row count equals 10,000 — the Wikidata/Blazegraph server-side cap — indicating the result set was likely truncated. False otherwise. Add a LIMIT clause to avoid hitting the cap. Note: t… |
| variables | array | – | Variable names returned by the SELECT clause. |
No examples provided.
What is the io.github.cyanheads/wikidata-mcp-server server?
io.github.cyanheads/wikidata-mcp-server is listed in the public MCP registry as io.github.cyanheads/wikidata-mcp-server. Search and fetch Wikidata entities, execute SPARQL queries, and resolve external identifiers. This page covers its npm package (@cyanheads/wikidata-mcp-server).
Is the io.github.cyanheads/wikidata-mcp-server server safe to use?
io.github.cyanheads/wikidata-mcp-server scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.cyanheads/wikidata-mcp-server server expose?
io.github.cyanheads/wikidata-mcp-server exposes 7 tools: wikidata_search_entities, wikidata_get_entity, wikidata_get_labels, wikidata_get_statements, wikidata_get_sitelinks, and 2 more. Their descriptions and schemas cost roughly 2,058 tokens of context every time the server is loaded.
Is the io.github.cyanheads/wikidata-mcp-server server still maintained?
io.github.cyanheads/wikidata-mcp-server is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.cyanheads/wikidata-mcp-server server under?
io.github.cyanheads/wikidata-mcp-server declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.