# Nihr (npm · @pipeworx/mcp-nihr)

UK NIHR (National Institute for Health and Care Research) open-data MCP.

- Trust score: 81/100 (high trust)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `gateway.pipeworx.io`: 77/100, [markdown](https://verifymcp.io/servers/pipeworx-io-nihr/nihr-mcp.md), [page](https://verifymcp.io/servers/pipeworx-io-nihr/nihr-mcp)
- npm · `@pipeworx/mcp-nihr`: 81/100 (this document), [markdown](https://verifymcp.io/servers/pipeworx-io-nihr/pipeworx-mcp-nihr.md), [page](https://verifymcp.io/servers/pipeworx-io-nihr/pipeworx-mcp-nihr)

## Channel facts

- Registry: `npm`
- Package: `@pipeworx/mcp-nihr`
- Version: `0.2.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to pipeworx-io/mcp-nihr).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 59/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1584 tokens (~316/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Nihr MCP server?

Nihr runs locally as an npm package, launched with npx -y @pipeworx/mcp-nihr. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add pipeworx-io-nihr -- npx -y @pipeworx/mcp-nihr
```

### Cursor

```json
{
  "mcpServers": {
    "pipeworx-io-nihr": {
      "command": "npx",
      "args": [
        "-y",
        "@pipeworx/mcp-nihr"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "pipeworx-io-nihr": {
      "command": "npx",
      "args": [
        "-y",
        "@pipeworx/mcp-nihr"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add pipeworx-io-nihr -- npx -y @pipeworx/mcp-nihr
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "pipeworx-io-nihr": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@pipeworx/mcp-nihr"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add pipeworx-io-nihr --command npx --arg -y --arg @pipeworx/mcp-nihr
```

### Hermes

```yaml
mcp_servers:
  pipeworx-io-nihr:
    command: "npx"
    args: ["-y", "@pipeworx/mcp-nihr"]
```

### Netclaw

```json
{
  "McpServers": {
    "pipeworx-io-nihr": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@pipeworx/mcp-nihr"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add pipeworx-io-nihr -t stdio -c npx -a -y @pipeworx/mcp-nihr
```

### Other

```json
{
  "mcpServers": {
    "pipeworx-io-nihr": {
      "command": "npx",
      "args": [
        "-y",
        "@pipeworx/mcp-nihr"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 81, +16)

- [security improvement] Malware scan: unverified → pass

### 2026-11-03 (score 65, −15)

- [security regression] Malware scan: pass → unverified
- [functional] Package version: 0.2.0 → 0.2.1

### 2026-11-02 (score 80, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 79, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 78)

First indexed and scored.

## MCP tools (5)

### `nihr_search_awards` (~517 tokens)

Search UK NIHR (National Institute for Health and Care Research) health research grants by keyword over award titles and abstracts. Returns each award's project id, title, NIHR programme and funding stream, contracted organisation, award value in GBP, start and end dates, chief investigator name, and the fundingawards.nihr.ac.uk link. Filter by programme name, project status (Active, Complete, Contracted, Discontinued) and a minimum award amount; sort by award value or start date. Answers questions like "which NIHR grants fund diabetes research", "the largest active NIHR cancer awards", or "recent NIHR mental-health funding".

Input parameters:

- `funding_stream` (string): NIHR funding stream, matched as a case-insensitive substring, e.g. "Doctoral Fellowship", "Commissioned", "Researcher-led".
- `limit` (number): Max awards to return, 1-100 (default 20).
- `max_amount` (number): Only awards worth at most this many GBP.
- `min_amount` (number): Only awards worth at least this many GBP (award_amount_from_dh), e.g. 1000000 for awards of £1m and up.
- `offset` (number): Pagination offset (default 0).
- `organisation` (string): Contracted organisation, matched as a case-insensitive substring, e.g. "Oxford", "Guy's and St Thomas".
- `programme` (string): NIHR programme name, matched as a case-insensitive substring, e.g. "Health Technology Assessment", "Public Health", "Fellowships". Call nihr_awards_by_programme with no arguments to list the real pro…
- `project_status` (string): Exact award status: Active, Complete, Contracted or Discontinued.
- `query` (string): Free-text keyword or phrase, e.g. "diabetes", "antimicrobial resistance", "dementia care". Matched against award titles and, unless title_only is set, the plain-English and scientific abstracts.
- `sort_by` (string): Ordering of results (default amount_desc, biggest award first).
- `start_from` (string): Only awards starting on or after this date, YYYY-MM-DD.
- `start_to` (string): Only awards starting on or before this date, YYYY-MM-DD.
- `title_only` (boolean): Restrict the keyword match to the award title for a tighter, more on-topic result set (default false, which also searches both abstracts).

### `nihr_get_award` (~177 tokens)

Retrieve one UK NIHR award in full by its project id (either the modern form NIHR208893 or the older slash form 002/0028). Returns the plain-English abstract and the scientific abstract, award value in GBP, programme, funding stream and status, start and end dates, the contracted organisation with postcode and latitude/longitude, HRCS and UKCRC health-category coding, the fundingawards.nihr.ac.uk record link, and every named award holder with their ORCID and role. Use when an agent has an NIHR project reference and needs the detail behind it.

Input parameters:

- `project_id` (string, required): NIHR project id exactly as published, e.g. "NIHR208893", "002/0028" or "DRF-2009-02-122". Slashes are handled.

### `nihr_awards_by_organisation` (~276 tokens)

Total up UK NIHR health research funding held by a university, NHS trust or company. Give any part of the institution name and get back the number of NIHR awards, the summed award value in GBP, the distinct organisation-name variants that matched, a breakdown by programme, and the individual awards with their values and dates. Answers "how much NIHR money does Imperial College hold", "how many NIHR awards has Guy's and St Thomas won", and institutional league-table comparisons.

Input parameters:

- `limit` (number): Max individual awards to list, 1-100 (default 20). The totals always cover every match, not just the listed page.
- `min_amount` (number): Only count and list awards worth at least this many GBP.
- `offset` (number): Pagination offset for the listed awards (default 0).
- `organisation` (string, required): Institution name or fragment, matched as a case-insensitive substring of contracted_organisation, e.g. "Imperial", "University of Leeds", "Manchester University NHS Foundation Trust".
- `project_status` (string): Restrict to one status: Active, Complete, Contracted or Discontinued.
- `start_from` (string): Only awards starting on or after this date, YYYY-MM-DD — useful for "funding won since 2020".

### `nihr_award_holders` (~293 tokens)

Find the researchers named on UK NIHR awards by personal name or ORCID identifier. Returns each matching award holder with their ORCID, their role on the award (Chief Investigator, Joint Lead Applicant or Award Holder) and the NIHR project ids they hold, so an agent can pivot straight into nihr_get_award for the grant detail. Answers "which NIHR grants does Professor X hold", "who is the chief investigator on this NIHR award", and ORCID-to-grant lookups across 12,644 award-holder records.

Input parameters:

- `involvement_type` (string): Restrict to one role: "Chief Investigator", "Joint Lead Applicant" or "Award Holder".
- `limit` (number): Max award holders to return, 1-100 (default 20).
- `name` (string): Researcher name or any part of it, e.g. "Hajat", "Emma Bland". Titles such as Professor and Dr are part of the stored name and may be included or omitted.
- `offset` (number): Pagination offset (default 0).
- `orcid` (string): ORCID identifier in full, e.g. "0000-0002-3086-362X".
- `project_id` (string): NIHR project id, e.g. "NIHR208893" or "002/0028", to list everyone named on that one award.

### `nihr_awards_by_programme` (~269 tokens)

Break UK NIHR funding down by programme or funding stream: award counts, total value in GBP, mean award size and the date range of awards in each. Called with no arguments it lists every NIHR programme that actually exists with its totals, which is the way to discover valid programme names before filtering elsewhere. Answers "which NIHR programme spends the most", "how many awards has the Health Technology Assessment programme made", and "what NIHR fellowship schemes exist and how big are they".

Input parameters:

- `filter` (string): Only include groups whose name contains this case-insensitive substring, e.g. "Fellowship", "Public Health", "Global".
- `group_by` (string): Field to aggregate on (default "programme"). "funding_stream" is the finer-grained scheme name; "programme_type" splits Research from Career Development.
- `limit` (number): Max groups to return, 1-100 (default 30).
- `project_status` (string): Restrict the aggregation to one status: Active, Complete, Contracted or Discontinued.
- `sort_by` (string): Ordering of the groups (default total_desc, biggest spend first).
- `start_from` (string): Only aggregate awards starting on or after this date, YYYY-MM-DD.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/pipeworx-io-nihr/pipeworx-mcp-nihr#diagnostics

## Score history

- 2026-11-05: 81
- 2026-11-04: 81
- 2026-11-03: 65
- 2026-11-02: 80
- 2026-11-01: 79
- 2026-10-31: 79
- 2026-10-30: 78
- 2026-10-29: 78

## Common questions

### What is the Nihr MCP server?

Nihr is an MCP server listed in the public MCP registry as io.github.pipeworx-io/nihr. UK NIHR (National Institute for Health and Care Research) open-data MCP. This page covers its npm package (@pipeworx/mcp-nihr).

### Is the Nihr MCP server safe to use?

Nihr scores 81 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Nihr MCP server expose?

Nihr exposes 5 tools: nihr_search_awards, nihr_get_award, nihr_awards_by_organisation, nihr_award_holders, nihr_awards_by_programme. Their descriptions and schemas cost roughly 1,532 tokens of context every time the server is loaded.

### Is the Nihr MCP server still maintained?

Nihr is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Nihr MCP server under?

Nihr declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

### What did VerifyMCP test on the Nihr MCP server?

VerifyMCP ran 16 checks on Nihr, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- npm package: https://www.npmjs.com/package/@pipeworx/mcp-nihr
- Socket report: https://socket.dev/npm/package/@pipeworx/mcp-nihr
- Repository: https://github.com/pipeworx-io/mcp-nihr
- Website: https://pipeworx.io/packs/nihr
- Changelog RSS feed: https://verifymcp.io/servers/pipeworx-io-nihr/pipeworx-mcp-nihr.xml
- Changelog JSON feed: https://verifymcp.io/servers/pipeworx-io-nihr/pipeworx-mcp-nihr/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/pipeworx-io-nihr/pipeworx-mcp-nihr.json
- HTML version of this page: https://verifymcp.io/servers/pipeworx-io-nihr/pipeworx-mcp-nihr