
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
bach-openfda
Advanced tools
MCP server for OpenFDA Drug Label API - enables AI agents to query FDA drug information
一个用于查询 FDA 药物标签信息的 MCP(Model Context Protocol)服务器,专为药物不良反应智能体设计。
无需安装,直接在 Cursor / Cherry Studio 的 MCP 配置中使用:
{
"mcpServers": {
"openfda": {
"command": "npx",
"args": ["-y", "bach-openfda"]
}
}
}
保存配置后重启,npx 会自动从 npm 下载并运行最新版本的 bach-openfda。
包地址: https://www.npmjs.com/package/bach-openfda
搜索 FDA 药物标签,支持复杂查询语法。
参数:
search (string): 搜索查询,如 "aspirin", "openfda.brand_name:tylenol"count (string): 按字段统计结果skip (number): 跳过记录数(分页)limit (number): 返回记录数限制 (1-1000)获取特定药物的不良反应信息。
参数:
drug_name (string, 必需): 药物名称limit (number): 返回记录数限制 (1-100)获取药物的警告和注意事项。
参数:
drug_name (string, 必需): 药物名称limit (number): 返回记录数限制 (1-100)获取药物的适应症和用法信息。
参数:
drug_name (string, 必需): 药物名称limit (number): 返回记录数限制 (1-100)# 安装依赖
npm install
# 开发模式运行
npm run dev
# 构建
npm run build
# 生产模式运行
npm start
# 更新系统
sudo apt update && sudo apt upgrade -y
# 安装Node.js 18+
curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash -
sudo apt-get install -y nodejs
# 验证安装
node --version
npm --version
# 创建项目目录
mkdir -p ~/mcp-servers/openfda
cd ~/mcp-servers/openfda
# 上传项目文件(使用scp或git clone)
# 方法1: 使用git
git clone <your-repo-url> .
# 方法2: 使用scp从本地上传
# scp -r /path/to/mcp-openfda/* user@your-server:~/mcp-servers/openfda/
# 安装依赖
npm install
# 构建项目
npm run build
# 测试运行
npm start
# 全局安装PM2
sudo npm install -g pm2
# 创建PM2配置文件
cat > ecosystem.config.js << 'EOF'
module.exports = {
apps: [{
name: 'mcp-openfda',
script: 'dist/index.js',
cwd: '/home/ubuntu/mcp-servers/openfda',
instances: 1,
autorestart: true,
watch: false,
max_memory_restart: '1G',
env: {
NODE_ENV: 'production'
}
}]
}
EOF
# 启动服务
pm2 start ecosystem.config.js
# 设置开机自启
pm2 startup
pm2 save
# 查看状态
pm2 status
pm2 logs mcp-openfda
# 如果需要通过网络访问,可以配置nginx反向代理
sudo apt install nginx
# 创建nginx配置
sudo tee /etc/nginx/sites-available/mcp-openfda << 'EOF'
server {
listen 80;
server_name your-domain.com; # 替换为你的域名或IP
location / {
proxy_pass http://localhost:3000; # 如果MCP服务器监听3000端口
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_cache_bypass $http_upgrade;
}
}
EOF
# 启用站点
sudo ln -s /etc/nginx/sites-available/mcp-openfda /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl restart nginx
在客户端机器上创建 SSH 隧道:
# 创建SSH隧道,将本地端口转发到服务器
ssh -L 3000:localhost:3000 user@your-server-ip
# 然后在MCP客户端配置中使用 localhost:3000
如果需要通过网络直接访问,需要修改 MCP 服务器以支持网络传输:
// 在src/index.ts中添加网络传输支持
import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
// 替换stdio传输为网络传输
const transport = new SSEServerTransport("/message", response);
# 创建Dockerfile
cat > Dockerfile << 'EOF'
FROM node:18-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY dist/ ./dist/
COPY src/ ./src/
EXPOSE 3000
CMD ["npm", "start"]
EOF
# 构建和运行
docker build -t mcp-openfda .
docker run -d -p 3000:3000 --name mcp-openfda-server mcp-openfda
在 Claude Desktop 的配置文件中添加:
{
"mcpServers": {
"openfda": {
"command": "node",
"args": ["/path/to/mcp-openfda/dist/index.js"],
"env": {}
}
}
}
{
"mcpServers": {
"openfda": {
"command": "ssh",
"args": [
"user@your-server-ip",
"cd ~/mcp-servers/openfda && node dist/index.js"
],
"env": {}
}
}
}
// 搜索阿司匹林的信息
await searchDrugLabels({
search: "aspirin",
limit: 5,
});
// 获取布洛芬的不良反应
await getDrugAdverseReactions("ibuprofen", 3);
// 查询泰诺的警告信息
await getDrugWarnings("tylenol", 2);
# PM2日志
pm2 logs mcp-openfda
# 系统日志
sudo journalctl -u nginx -f
MIT License
FAQs
MCP server for OpenFDA Drug Label API - enables AI agents to query FDA drug information
We found that bach-openfda demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.