@cyanheads/pubmed-mcp-server 1.2.2 → 1.2.4

package/README.md

@@ -2,7 +2,7 @@
 
 [![TypeScript](https://img.shields.io/badge/TypeScript-^5.8.3-blue.svg)](https://www.typescriptlang.org/)
 [![Model Context Protocol](https://img.shields.io/badge/MCP%20SDK-^1.13.0-green.svg)](https://modelcontextprotocol.io/)
-[![Version](https://img.shields.io/badge/Version-1.2.2-blue.svg)](./CHANGELOG.md)
+[![Version](https://img.shields.io/badge/Version-1.2.3-blue.svg)](./CHANGELOG.md)
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 [![Status](https://img.shields.io/badge/Status-Stable-green.svg)](https://github.com/cyanheads/pubmed-mcp-server/issues)
 [![GitHub](https://img.shields.io/github/stars/cyanheads/pubmed-mcp-server?style=social)](https://github.com/cyanheads/pubmed-mcp-server)

package/dist/mcp-server/tools/fetchPubMedContent/logic.d.ts

@@ -22,17 +22,17 @@ export declare const FetchPubMedContentInputSchema: z.ZodEffects<z.ZodObject<{
     includeMeshTerms: boolean;
     includeGrantInfo: boolean;
     outputFormat: "json" | "raw_text";
-    pmids?: string[] | undefined;
     queryKey?: string | undefined;
     webEnv?: string | undefined;
-    retstart?: number | undefined;
     retmax?: number | undefined;
-}, {
+    retstart?: number | undefined;
     pmids?: string[] | undefined;
+}, {
     queryKey?: string | undefined;
     webEnv?: string | undefined;
-    retstart?: number | undefined;
     retmax?: number | undefined;
+    retstart?: number | undefined;
+    pmids?: string[] | undefined;
     detailLevel?: "abstract_plus" | "full_xml" | "medline_text" | "citation_data" | undefined;
     includeMeshTerms?: boolean | undefined;
     includeGrantInfo?: boolean | undefined;
@@ -42,17 +42,17 @@ export declare const FetchPubMedContentInputSchema: z.ZodEffects<z.ZodObject<{
     includeMeshTerms: boolean;
     includeGrantInfo: boolean;
     outputFormat: "json" | "raw_text";
-    pmids?: string[] | undefined;
     queryKey?: string | undefined;
     webEnv?: string | undefined;
-    retstart?: number | undefined;
     retmax?: number | undefined;
-}, {
+    retstart?: number | undefined;
     pmids?: string[] | undefined;
+}, {
     queryKey?: string | undefined;
     webEnv?: string | undefined;
-    retstart?: number | undefined;
     retmax?: number | undefined;
+    retstart?: number | undefined;
+    pmids?: string[] | undefined;
     detailLevel?: "abstract_plus" | "full_xml" | "medline_text" | "citation_data" | undefined;
     includeMeshTerms?: boolean | undefined;
     includeGrantInfo?: boolean | undefined;

package/dist/mcp-server/tools/fetchPubMedContent/logic.js

@@ -242,13 +242,14 @@ export async function fetchPubMedContentLogic(input, parentRequestContext) {
         }
     }
     else if (input.detailLevel === "full_xml") {
+        const articlesXml = ensureArray(eFetchResponseData?.PubmedArticleSet?.PubmedArticle || []);
+        articlesCount = articlesXml.length;
         if (input.outputFormat === "raw_text") {
+            // Note: Raw XML output is requested, but we still parse to get an accurate count.
+            // This is a trade-off for robustness over performance in this specific case.
             finalOutputText = String(eFetchResponseData);
-            articlesCount = (finalOutputText.match(/<PubmedArticle>/g) || []).length;
         }
         else {
-            const articlesXml = ensureArray(eFetchResponseData?.PubmedArticleSet?.PubmedArticle || []);
-            articlesCount = articlesXml.length;
             const foundPmidsInXml = new Set();
             const articlesPayload = articlesXml.map((articleXml) => {
                 const pmid = extractPmid(articleXml.MedlineCitation) || "unknown_pmid";

package/dist/mcp-server/tools/generatePubMedChart/logic.js

@@ -1,9 +1,3 @@
-/**
- * @fileoverview Core logic for the generate_pubmed_chart tool.
- * Generates charts from parameterized input by creating Chart.js configurations
- * and rendering them on the server using chartjs-node-canvas.
- * @module src/mcp-server/tools/generatePubMedChart/logic
- */
 import { ChartJSNodeCanvas } from "chartjs-node-canvas";
 import { z } from "zod";
 import { BaseErrorCode, McpError } from "../../../types-global/errors.js";
@@ -96,8 +90,8 @@ export async function generatePubMedChartLogic(input, parentRequestContext) {
         const groupedData = groupDataBySeries(dataValues, xField, yField, seriesField);
         datasets = Array.from(groupedData.entries()).map(([seriesName, data]) => ({
             label: seriesName,
-            data: labels.map(label => {
-                const point = data.find(p => p.x === label);
+            data: labels.map((label) => {
+                const point = data.find((p) => p.x === label);
                 return point ? point.y : null;
             }),
             // You can add backgroundColor, borderColor etc. here for styling
@@ -107,41 +101,45 @@ export async function generatePubMedChartLogic(input, parentRequestContext) {
         datasets = [
             {
                 label: yField,
-                data: labels.map(label => {
-                    const item = dataValues.find(d => d[xField] === label);
+                data: labels.map((label) => {
+                    const item = dataValues.find((d) => d[xField] === label);
                     return item ? item[yField] : null;
                 }),
             },
         ];
     }
     // For scatter and bubble charts, the data format is different
-    if (chartType === 'scatter' || chartType === 'bubble') {
+    if (chartType === "scatter" || chartType === "bubble") {
         if (seriesField) {
             const groupedData = groupDataBySeries(dataValues, xField, yField, seriesField);
             datasets = Array.from(groupedData.entries()).map(([seriesName, data]) => ({
                 label: seriesName,
-                data: data.map(point => ({
+                data: data.map((point) => ({
                     x: point.x,
                     y: point.y,
-                    r: chartType === 'bubble' && sizeField ? dataValues.find(d => d[xField] === point.x)[sizeField] : undefined
+                    r: chartType === "bubble" && sizeField
+                        ? dataValues.find((d) => d[xField] === point.x)[sizeField]
+                        : undefined,
                 })),
             }));
         }
         else {
-            datasets = [{
+            datasets = [
+                {
                     label: yField,
-                    data: dataValues.map(item => ({
+                    data: dataValues.map((item) => ({
                         x: item[xField],
                         y: item[yField],
-                        r: chartType === 'bubble' && sizeField ? item[sizeField] : undefined
+                        r: chartType === "bubble" && sizeField ? item[sizeField] : undefined,
                     })),
-                }];
+                },
+            ];
         }
     }
     const configuration = {
         type: chartType,
         data: {
-            labels: (chartType !== 'scatter' && chartType !== 'bubble') ? labels : undefined,
+            labels: chartType !== "scatter" && chartType !== "bubble" ? labels : undefined,
             datasets: datasets,
         },
         options: {
@@ -151,7 +149,9 @@ export async function generatePubMedChartLogic(input, parentRequestContext) {
                     text: title,
                 },
             },
-            scales: chartType === "pie" || chartType === "doughnut" || chartType === "polarArea"
+            scales: chartType === "pie" ||
+                chartType === "doughnut" ||
+                chartType === "polarArea"
                 ? undefined
                 : {
                     x: {

package/dist/mcp-server/tools/getPubMedArticleConnections/logic/citationFormatter.js

@@ -3,6 +3,7 @@
  * Fetches article details using EFetch and formats them into various citation styles.
  * @module src/mcp-server/tools/getPubMedArticleConnections/logic/citationFormatter
  */
+import Cite from "citation-js";
 import { getNcbiService } from "../../../../services/NCBI/ncbiService.js";
 import { logger, requestContextService, } from "../../../../utils/index.js";
 import { extractAuthors, extractDoi, extractJournalInfo, extractPmid, getText, } from "../../../../utils/parsing/ncbi-parsing/index.js";
@@ -12,7 +13,6 @@ export async function handleCitationFormats(input, outputData, context) {
         db: "pubmed",
         id: input.sourcePmid,
         retmode: "xml",
-        // Omitting rettype to hopefully get the fullest XML record by default
     };
     const eFetchBaseUrl = "https://eutils.ncbi.nlm.nih.gov/entrez/eutils/efetch.fcgi";
     const searchParamsString = new URLSearchParams(eFetchParams).toString();
@@ -26,264 +26,89 @@ export async function handleCitationFormats(input, outputData, context) {
         return;
     }
     const article = eFetchResult.PubmedArticleSet.PubmedArticle[0];
+    const csl = pubmedArticleToCsl(article, context);
+    const cite = new Cite(csl);
     if (input.citationStyles?.includes("ris")) {
-        outputData.citations.ris = formatAsRIS(article, context);
+        outputData.citations.ris = cite.format("ris");
     }
     if (input.citationStyles?.includes("bibtex")) {
-        outputData.citations.bibtex = formatAsBibTeX(article, context);
+        outputData.citations.bibtex = cite.format("bibtex");
     }
     if (input.citationStyles?.includes("apa_string")) {
-        outputData.citations.apa_string = formatAsAPA(article, context);
+        outputData.citations.apa_string = cite.format("bibliography", {
+            format: "text",
+            template: "apa",
+        });
     }
     if (input.citationStyles?.includes("mla_string")) {
-        outputData.citations.mla_string = formatAsMLA(article, context);
+        outputData.citations.mla_string = cite.format("bibliography", {
+            format: "text",
+            template: "mla",
+        });
     }
     outputData.retrievedCount = 1;
 }
-// --- Citation Formatting Helper Functions ---
-function formatAsRIS(article, context) {
+/**
+ * Converts an XML PubMed Article object to a CSL-JSON object.
+ * @param article The PubMed article in XML format.
+ * @param context The request context for logging.
+ * @returns A CSL-JSON object compatible with citation-js.
+ */
+function pubmedArticleToCsl(article, context) {
     const medlineCitation = article.MedlineCitation;
     const articleDetails = medlineCitation?.Article;
     const pmid = extractPmid(medlineCitation);
-    logger.debug("Formatting RIS for article", requestContextService.createRequestContext({ ...context, pmid }));
-    if (!articleDetails)
-        return "TY  - ERROR\nTI  - Article details not found\nER  - \n";
-    const authors = extractAuthors(articleDetails.AuthorList);
-    const journalInfo = extractJournalInfo(articleDetails.Journal, medlineCitation);
-    const title = getText(articleDetails.ArticleTitle);
-    const doi = extractDoi(articleDetails);
-    let risString = "TY  - JOUR\n";
-    authors.forEach((author) => {
-        if (author.lastName && author.firstName) {
-            risString += `AU  - ${author.lastName}, ${author.firstName}\n`;
-        }
-        else if (author.lastName) {
-            // Handle collective name or incomplete author
-            risString += `AU  - ${author.lastName}\n`;
-        }
+    const cslContext = requestContextService.createRequestContext({
+        ...context,
+        pmid,
     });
-    risString += `TI  - ${title || "N/A"}\n`;
-    risString += `JO  - ${journalInfo?.title || "N/A"}\n`;
-    risString += `VL  - ${journalInfo?.volume || ""}\n`;
-    risString += `IS  - ${journalInfo?.issue || ""}\n`;
-    if (journalInfo?.pages) {
-        const pages = journalInfo.pages.split("-");
-        risString += `SP  - ${pages[0] || ""}\n`;
-        if (pages.length > 1)
-            risString += `EP  - ${pages[1] || ""}\n`;
+    logger.debug("Converting PubMed XML to CSL-JSON", cslContext);
+    if (!articleDetails) {
+        logger.warning("Article details not found for CSL conversion", cslContext);
+        return { id: pmid || "unknown", title: "Article details not found" };
     }
-    risString += `PY  - ${journalInfo?.publicationDate?.year || ""}\n`;
-    if (doi)
-        risString += `DO  - ${doi}\n`;
-    if (pmid)
-        risString += `UR  - https://pubmed.ncbi.nlm.nih.gov/${pmid}\n`;
-    risString += "ER  - \n";
-    return risString;
-}
-function formatAsBibTeX(article, context) {
-    const medlineCitation = article.MedlineCitation;
-    const articleDetails = medlineCitation?.Article;
-    const pmid = extractPmid(medlineCitation);
-    logger.debug("Formatting BibTeX for article", requestContextService.createRequestContext({ ...context, pmid }));
-    if (!articleDetails)
-        return `@article{ERROR_ArticleNotFound${pmid || ""},\n  title = {Article details not found}\n}\n`;
-    const parsedAuthors = extractAuthors(articleDetails.AuthorList);
-    const journalInfo = extractJournalInfo(articleDetails.Journal, medlineCitation);
-    const title = getText(articleDetails.ArticleTitle) || "N/A";
-    const doi = extractDoi(articleDetails);
-    const authorsBibtex = parsedAuthors
-        .map((author) => {
-        if (author.lastName && author.firstName)
-            return `${author.lastName}, ${author.firstName}`;
-        if (author.lastName)
-            return `{${author.lastName}}`; // For collective names or single names
-        return "";
-    })
-        .filter(Boolean)
-        .join(" and ");
-    const year = journalInfo?.publicationDate?.year || "ND";
-    const firstAuthorLastName = parsedAuthors[0]?.lastName?.replace(/\s+/g, "") || "Unknown";
-    const bibKey = `${firstAuthorLastName}${year}`;
-    let bibtexString = `@article{${bibKey},\n`;
-    if (authorsBibtex)
-        bibtexString += `  author    = {${authorsBibtex}},\n`;
-    bibtexString += `  title     = {${title}},\n`;
-    bibtexString += `  journal   = {${journalInfo?.title || "N/A"}},\n`;
-    if (journalInfo?.publicationDate?.year)
-        bibtexString += `  year      = {${journalInfo.publicationDate.year}},\n`;
-    if (journalInfo?.volume)
-        bibtexString += `  volume    = {${journalInfo.volume}},\n`;
-    if (journalInfo?.issue)
-        bibtexString += `  number    = {${journalInfo.issue}},\n`;
-    if (journalInfo?.pages)
-        bibtexString += `  pages     = {${journalInfo.pages.replace("-", "--")}},\n`;
-    if (journalInfo?.publicationDate?.month)
-        bibtexString += `  month     = {${journalInfo.publicationDate.month.toLowerCase()}},\n`;
-    if (doi)
-        bibtexString += `  doi       = {${doi}},\n`;
-    if (pmid)
-        bibtexString += `  pmid      = {${pmid}}\n`;
-    bibtexString += `}\n`;
-    return bibtexString;
-}
-function formatAsAPA(article, context) {
-    const medlineCitation = article.MedlineCitation;
-    const articleDetails = medlineCitation?.Article;
-    const pmid = extractPmid(medlineCitation);
-    logger.debug("Formatting APA for article", requestContextService.createRequestContext({ ...context, pmid }));
-    if (!articleDetails)
-        return "Article details not found.";
-    const parsedAuthors = extractAuthors(articleDetails.AuthorList);
-    const journalInfo = extractJournalInfo(articleDetails.Journal, medlineCitation);
-    const titleText = getText(articleDetails.ArticleTitle) || "N/A";
-    const doi = extractDoi(articleDetails);
-    let authorsString = "N/A";
-    if (parsedAuthors.length > 0) {
-        if (parsedAuthors.length <= 20) {
-            authorsString = parsedAuthors
-                .map((author) => {
-                if (author.lastName && author.firstName) {
-                    const initials = author.firstName
-                        .split(/\s+|-/)
-                        .map((namePart) => namePart.charAt(0).toUpperCase() + ".")
-                        .join("");
-                    return `${author.lastName}, ${initials}`;
-                }
-                if (author.lastName)
-                    return author.lastName; // Collective name
-                return "";
-            })
-                .filter(Boolean)
-                .join(", ");
-            if (parsedAuthors.length > 1) {
-                const lastCommaIndex = authorsString.lastIndexOf(", ");
-                if (lastCommaIndex !== -1) {
-                    authorsString =
-                        authorsString.substring(0, lastCommaIndex) +
-                            " & " +
-                            authorsString.substring(lastCommaIndex + 2);
-                }
-            }
-        }
-        else {
-            const first19 = parsedAuthors
-                .slice(0, 19)
-                .map((author) => {
-                if (author.lastName && author.firstName) {
-                    const initials = author.firstName
-                        .split(/\s+|-/)
-                        .map((namePart) => namePart.charAt(0).toUpperCase() + ".")
-                        .join("");
-                    return `${author.lastName}, ${initials}`;
-                }
-                if (author.lastName)
-                    return author.lastName;
-                return "";
-            })
-                .filter(Boolean)
-                .join(", ");
-            const lastAuthor = parsedAuthors[parsedAuthors.length - 1];
-            let lastAuthorString = "";
-            if (lastAuthor.lastName && lastAuthor.firstName) {
-                const initials = lastAuthor.firstName
-                    .split(/\s+|-/)
-                    .map((namePart) => namePart.charAt(0).toUpperCase() + ".")
-                    .join("");
-                lastAuthorString = `${lastAuthor.lastName}, ${initials}`;
-            }
-            else if (lastAuthor.lastName) {
-                lastAuthorString = lastAuthor.lastName;
-            }
-            authorsString = `${first19}, ..., ${lastAuthorString}`;
-        }
-    }
-    const year = journalInfo?.publicationDate?.year || "n.d.";
-    const apaTitle = titleText.charAt(0).toUpperCase() + titleText.slice(1); // APA typically sentence case for article titles.
-    const journal = journalInfo?.title || "N/A";
-    const volume = journalInfo?.volume || "";
-    const issue = journalInfo?.issue ? `(${journalInfo.issue})` : "";
-    const pages = journalInfo?.pages || "";
-    const doiLink = doi ? ` https://doi.org/${doi}` : "";
-    let apaString = `${authorsString}. (${year}). ${apaTitle}. ${journal}`;
-    if (volume)
-        apaString += `, ${volume}`;
-    if (issue)
-        apaString += issue;
-    if (pages)
-        apaString += `, ${pages}`;
-    apaString += `.${doiLink}`;
-    return apaString;
-}
-function formatAsMLA(article, context) {
-    const medlineCitation = article.MedlineCitation;
-    const articleDetails = medlineCitation?.Article;
-    const pmid = extractPmid(medlineCitation);
-    logger.debug("Formatting MLA for article", requestContextService.createRequestContext({ ...context, pmid }));
-    if (!articleDetails)
-        return "Article details not found.";
-    const parsedAuthors = extractAuthors(articleDetails.AuthorList);
+    const authors = extractAuthors(articleDetails.AuthorList);
     const journalInfo = extractJournalInfo(articleDetails.Journal, medlineCitation);
-    const titleText = getText(articleDetails.ArticleTitle);
+    const title = getText(articleDetails.ArticleTitle);
     const doi = extractDoi(articleDetails);
-    let authorsString = "N/A";
-    if (parsedAuthors.length > 0) {
-        if (parsedAuthors.length <= 2) {
-            authorsString = parsedAuthors
-                .map((author, index) => {
-                if (author.lastName && author.firstName) {
-                    return index === 0
-                        ? `${author.lastName}, ${author.firstName}`
-                        : `${author.firstName} ${author.lastName}`;
+    const cslAuthors = authors.map((author) => author.collectiveName
+        ? { literal: author.collectiveName }
+        : { family: author.lastName, given: author.firstName });
+    const dateParts = [];
+    if (journalInfo?.publicationDate?.year) {
+        dateParts.push(parseInt(journalInfo.publicationDate.year, 10));
+        if (journalInfo.publicationDate.month) {
+            // Convert month name/number to number
+            const monthNumber = new Date(`${journalInfo.publicationDate.month} 1, 2000`).getMonth();
+            if (!isNaN(monthNumber)) {
+                dateParts.push(monthNumber + 1);
+                if (journalInfo.publicationDate.day) {
+                    dateParts.push(parseInt(journalInfo.publicationDate.day, 10));
                 }
-                if (author.lastName)
-                    return author.lastName;
-                return "";
-            })
-                .filter(Boolean)
-                .join(" and ");
-        }
-        else {
-            const firstAuthor = parsedAuthors[0];
-            if (firstAuthor.lastName && firstAuthor.firstName) {
-                authorsString = `${firstAuthor.lastName}, ${firstAuthor.firstName}, et al`;
-            }
-            else if (firstAuthor.lastName) {
-                authorsString = `${firstAuthor.lastName}, et al`;
             }
         }
     }
-    const title = titleText ? `"${titleText}."` : "N/A.";
-    const journal = journalInfo?.title || "N/A";
-    let publicationDateString = journalInfo?.publicationDate?.year || "";
-    if (journalInfo?.publicationDate?.month && journalInfo.publicationDate.year) {
-        const month = journalInfo.publicationDate.month.substring(0, 3) + "."; // Abbreviate month
-        publicationDateString = `${month} ${journalInfo.publicationDate.year}`;
-        if (journalInfo.publicationDate.day) {
-            publicationDateString = `${journalInfo.publicationDate.day} ${month} ${journalInfo.publicationDate.year}`;
+    const cslData = {
+        id: pmid,
+        type: "article-journal",
+        title: title,
+        author: cslAuthors,
+        issued: {
+            "date-parts": [dateParts],
+        },
+        "container-title": journalInfo?.title,
+        volume: journalInfo?.volume,
+        issue: journalInfo?.issue,
+        page: journalInfo?.pages,
+        DOI: doi,
+        PMID: pmid,
+        URL: pmid ? `https://pubmed.ncbi.nlm.nih.gov/${pmid}` : undefined,
+    };
+    // Clean up any undefined/null properties
+    for (const key in cslData) {
+        if (cslData[key] === undefined || cslData[key] === null) {
+            delete cslData[key];
         }
     }
-    else if (journalInfo?.publicationDate?.medlineDate) {
-        publicationDateString = journalInfo.publicationDate.medlineDate;
-    }
-    const volume = journalInfo?.volume ? `vol. ${journalInfo.volume}` : "";
-    const issue = journalInfo?.issue ? `no. ${journalInfo.issue}` : "";
-    const pages = journalInfo?.pages
-        ? `pp. ${journalInfo.pages.replace("-", "–")}`
-        : ""; // en-dash for MLA
-    const accessUrl = doi
-        ? `doi:${doi}`
-        : pmid
-            ? `https://pubmed.ncbi.nlm.nih.gov/${pmid}`
-            : "";
-    let mlaString = `${authorsString}. ${title} ${journal}`;
-    if (volume)
-        mlaString += `, ${volume}`;
-    if (issue)
-        mlaString += `, ${issue}`;
-    if (publicationDateString)
-        mlaString += `, ${publicationDateString}`;
-    if (pages)
-        mlaString += `, ${pages}`;
-    mlaString += `. PubMed Central, ${accessUrl}.`; // Assuming PubMed Central or just PubMed
-    return mlaString;
+    return cslData;
 }

package/dist/mcp-server/tools/searchPubMedArticles/logic.js

@@ -99,7 +99,7 @@ export async function searchPubMedArticlesLogic(input, parentRequestContext) {
         sort: input.sortBy,
         usehistory: currentFetchBriefSummaries > 0 ? "y" : "n",
     };
-    const eSearchResponse = await ncbiService.eSearch(eSearchParams, toolLogicContext);
+    const esResult = await ncbiService.eSearch(eSearchParams, toolLogicContext);
     const eSearchBase = "https://eutils.ncbi.nlm.nih.gov/entrez/eutils/esearch.fcgi";
     const eSearchQueryStringParams = {};
     for (const key in eSearchParams) {
@@ -109,15 +109,14 @@ export async function searchPubMedArticlesLogic(input, parentRequestContext) {
     }
     const eSearchQueryString = new URLSearchParams(eSearchQueryStringParams).toString();
     const eSearchUrl = `${eSearchBase}?${eSearchQueryString}`;
-    if (!eSearchResponse || !eSearchResponse.eSearchResult) {
+    if (!esResult) {
         throw new McpError(BaseErrorCode.NCBI_PARSING_ERROR, "Invalid or empty ESearch response from NCBI.", {
             ...toolLogicContext,
-            responsePreview: sanitizeInputForLogging(JSON.stringify(eSearchResponse).substring(0, 200)),
+            responsePreview: sanitizeInputForLogging(JSON.stringify(esResult).substring(0, 200)),
         });
     }
-    const esResult = eSearchResponse.eSearchResult;
-    const pmids = esResult.IdList?.Id || [];
-    const totalFound = parseInt(esResult.Count || "0", 10);
+    const pmids = esResult.idList || [];
+    const totalFound = esResult.count || 0;
     const retrievedPmidCount = pmids.length;
     let briefSummaries = [];
     let eSummaryUrl;
@@ -127,9 +126,9 @@ export async function searchPubMedArticlesLogic(input, parentRequestContext) {
             version: "2.0",
             retmode: "xml",
         };
-        if (esResult.WebEnv && esResult.QueryKey) {
-            eSummaryParams.WebEnv = esResult.WebEnv;
-            eSummaryParams.query_key = esResult.QueryKey;
+        if (esResult.webEnv && esResult.queryKey) {
+            eSummaryParams.WebEnv = esResult.webEnv;
+            eSummaryParams.query_key = esResult.queryKey;
             eSummaryParams.retmax = currentFetchBriefSummaries;
         }
         else {

package/dist/services/NCBI/ncbiCoreApiClient.d.ts

@@ -20,5 +20,5 @@ export declare class NcbiCoreApiClient {
      * @returns A Promise resolving to the raw AxiosResponse.
      * @throws {McpError} If the request fails after all retries or an unexpected error occurs.
      */
-    makeRequest(endpoint: string, params: NcbiRequestParams, context: RequestContext, options?: NcbiRequestOptions, retries?: number): Promise<AxiosResponse>;
+    makeRequest(endpoint: string, params: NcbiRequestParams, context: RequestContext, options?: NcbiRequestOptions): Promise<AxiosResponse>;
 }

package/dist/services/NCBI/ncbiCoreApiClient.js

@@ -25,14 +25,13 @@ export class NcbiCoreApiClient {
      * @returns A Promise resolving to the raw AxiosResponse.
      * @throws {McpError} If the request fails after all retries or an unexpected error occurs.
      */
-    async makeRequest(endpoint, params, context, options = {}, retries = 0) {
+    async makeRequest(endpoint, params, context, options = {}) {
         const rawParams = {
             tool: config.ncbiToolIdentifier,
             email: config.ncbiAdminEmail,
             api_key: config.ncbiApiKey,
             ...params,
         };
-        // Filter out undefined/null values and convert others to string for URLSearchParams/request body
         const finalParams = {};
         for (const key in rawParams) {
             if (Object.prototype.hasOwnProperty.call(rawParams, key)) {
@@ -55,59 +54,64 @@ export class NcbiCoreApiClient {
         else {
             requestConfig.params = finalParams;
         }
-        try {
-            logger.debug(`Making NCBI HTTP request: ${requestConfig.method} ${requestConfig.url}`, requestContextService.createRequestContext({
-                ...context,
-                operation: "NCBI_HttpRequest",
-                endpoint,
-                method: requestConfig.method,
-                requestParams: sanitizeInputForLogging(finalParams),
-                attempt: retries + 1,
-            }));
-            const response = await this.axiosInstance(requestConfig);
-            return response;
-        }
-        catch (error) {
-            if (retries < config.ncbiMaxRetries) {
-                const retryDelay = Math.pow(2, retries) * 200; // Increased base delay for retries
-                logger.warning(`NCBI request to ${endpoint} failed. Retrying (${retries + 1}/${config.ncbiMaxRetries}) in ${retryDelay}ms...`, requestContextService.createRequestContext({
+        for (let attempt = 0; attempt <= config.ncbiMaxRetries; attempt++) {
+            try {
+                logger.debug(`Making NCBI HTTP request: ${requestConfig.method} ${requestConfig.url}`, requestContextService.createRequestContext({
                     ...context,
-                    operation: "NCBI_HttpRequestRetry",
+                    operation: "NCBI_HttpRequest",
                     endpoint,
-                    error: error.message,
-                    retryCount: retries + 1,
-                    maxRetries: config.ncbiMaxRetries,
-                    delay: retryDelay,
+                    method: requestConfig.method,
+                    requestParams: sanitizeInputForLogging(finalParams),
+                    attempt: attempt + 1,
                 }));
-                await new Promise((r) => setTimeout(r, retryDelay));
-                return this.makeRequest(endpoint, params, context, options, retries + 1);
+                const response = await this.axiosInstance(requestConfig);
+                return response;
             }
-            if (axios.isAxiosError(error)) {
-                logger.error(`Axios error during NCBI request to ${endpoint} after ${retries} retries`, error, requestContextService.createRequestContext({
+            catch (error) {
+                if (attempt < config.ncbiMaxRetries) {
+                    const retryDelay = Math.pow(2, attempt) * 200;
+                    logger.warning(`NCBI request to ${endpoint} failed. Retrying (${attempt + 1}/${config.ncbiMaxRetries}) in ${retryDelay}ms...`, requestContextService.createRequestContext({
+                        ...context,
+                        operation: "NCBI_HttpRequestRetry",
+                        endpoint,
+                        error: error.message,
+                        retryCount: attempt + 1,
+                        maxRetries: config.ncbiMaxRetries,
+                        delay: retryDelay,
+                    }));
+                    await new Promise((r) => setTimeout(r, retryDelay));
+                    continue; // Continue to the next iteration of the loop
+                }
+                // If all retries are exhausted, handle the final error
+                if (axios.isAxiosError(error)) {
+                    logger.error(`Axios error during NCBI request to ${endpoint} after ${attempt} retries`, error, requestContextService.createRequestContext({
+                        ...context,
+                        operation: "NCBI_AxiosError",
+                        endpoint,
+                        status: error.response?.status,
+                        responseData: sanitizeInputForLogging(error.response?.data),
+                    }));
+                    throw new McpError(BaseErrorCode.NCBI_SERVICE_UNAVAILABLE, `NCBI request failed: ${error.message}`, {
+                        endpoint,
+                        status: error.response?.status,
+                        details: error.response?.data
+                            ? String(error.response.data).substring(0, 500)
+                            : undefined,
+                    });
+                }
+                if (error instanceof McpError)
+                    throw error;
+                logger.error(`Unexpected error during NCBI request to ${endpoint} after ${attempt} retries`, error, requestContextService.createRequestContext({
                     ...context,
-                    operation: "NCBI_AxiosError",
+                    operation: "NCBI_UnexpectedError",
                     endpoint,
-                    status: error.response?.status,
-                    responseData: sanitizeInputForLogging(error.response?.data),
+                    errorMessage: error.message,
                 }));
-                throw new McpError(BaseErrorCode.NCBI_SERVICE_UNAVAILABLE, `NCBI request failed: ${error.message}`, {
-                    endpoint,
-                    status: error.response?.status,
-                    details: error.response?.data
-                        ? String(error.response.data).substring(0, 500)
-                        : undefined,
-                });
+                throw new McpError(BaseErrorCode.INTERNAL_ERROR, `Unexpected error communicating with NCBI: ${error.message}`, { endpoint });
             }
-            // If it's already an McpError, rethrow it (could be from a previous stage if this function is used more broadly)
-            if (error instanceof McpError)
-                throw error;
-            logger.error(`Unexpected error during NCBI request to ${endpoint} after ${retries} retries`, error, requestContextService.createRequestContext({
-                ...context,
-                operation: "NCBI_UnexpectedError",
-                endpoint,
-                errorMessage: error.message,
-            }));
-            throw new McpError(BaseErrorCode.INTERNAL_ERROR, `Unexpected error communicating with NCBI: ${error.message}`, { endpoint });
         }
+        // This line should theoretically be unreachable, but it satisfies TypeScript's need
+        // for a return path if the loop completes without returning or throwing.
+        throw new McpError(BaseErrorCode.INTERNAL_ERROR, "Request failed after all retries.", { endpoint });
     }
 }

package/dist/services/NCBI/ncbiService.d.ts

@@ -7,6 +7,7 @@
  * access PubMed data.
  * @module src/services/NCBI/ncbiService
  */
+import { ESearchResult, EFetchArticleSet } from "../../types-global/pubmedXml.js";
 import { RequestContext } from "../../utils/index.js";
 import { NcbiRequestParams, NcbiRequestOptions } from "./ncbiConstants.js";
 export declare class NcbiService {
@@ -15,9 +16,9 @@ export declare class NcbiService {
     private responseHandler;
     constructor();
     private performNcbiRequest;
-    eSearch(params: NcbiRequestParams, context: RequestContext): Promise<any>;
+    eSearch(params: NcbiRequestParams, context: RequestContext): Promise<ESearchResult>;
     eSummary(params: NcbiRequestParams, context: RequestContext): Promise<any>;
-    eFetch(params: NcbiRequestParams, context: RequestContext, options?: NcbiRequestOptions): Promise<any>;
+    eFetch(params: NcbiRequestParams, context: RequestContext, options?: NcbiRequestOptions): Promise<EFetchArticleSet>;
     eLink(params: NcbiRequestParams, context: RequestContext): Promise<any>;
     eInfo(params: NcbiRequestParams, context: RequestContext): Promise<any>;
 }

package/dist/services/NCBI/ncbiService.js

@@ -25,9 +25,21 @@ export class NcbiService {
         return this.queueManager.enqueueRequest(task, context, endpoint, params);
     }
     async eSearch(params, context) {
-        return this.performNcbiRequest("esearch", params, context, {
+        const response = await this.performNcbiRequest("esearch", params, context, {
             retmode: "xml",
         });
+        const esResult = response.eSearchResult;
+        return {
+            count: parseInt(esResult.Count, 10) || 0,
+            retmax: parseInt(esResult.RetMax, 10) || 0,
+            retstart: parseInt(esResult.RetStart, 10) || 0,
+            queryKey: esResult.QueryKey,
+            webEnv: esResult.WebEnv,
+            idList: esResult.IdList?.Id || [],
+            queryTranslation: esResult.QueryTranslation,
+            errorList: esResult.ErrorList,
+            warningList: esResult.WarningList,
+        };
     }
     async eSummary(params, context) {
         // Determine retmode based on params, default to xml

package/dist/types-global/pubmedXml.d.ts

@@ -166,6 +166,7 @@ export interface ParsedArticleAuthor {
     firstName?: string;
     initials?: string;
     affiliation?: string;
+    collectiveName?: string;
 }
 export interface ParsedArticleDate {
     dateType?: string;
@@ -348,3 +349,17 @@ export interface ESearchResultContent {
 export interface ESearchResponseContainer {
     eSearchResult: ESearchResultContent;
 }
+export interface ESearchResult {
+    count: number;
+    retmax: number;
+    retstart: number;
+    queryKey?: string;
+    webEnv?: string;
+    idList: string[];
+    queryTranslation: string;
+    errorList?: ESearchErrorList;
+    warningList?: ESearchWarningList;
+}
+export interface EFetchArticleSet {
+    articles: ParsedArticle[];
+}

package/dist/utils/internal/logger.js

@@ -35,8 +35,11 @@ const mcpToWinstonLevel = {
     alert: "error",
     emerg: "error",
 };
+// The logsPath from config is already resolved and validated by src/config/index.ts
+const resolvedLogsDir = config.logsPath;
+const isLogsDirSafe = !!resolvedLogsDir; // If logsPath is set, it's considered safe by config logic.
 /**
- * Creates the Winston console log format for interactive TTY sessions.
+ * Creates the Winston console log format.
  * @returns The Winston log format for console output.
  * @private
  */
@@ -100,45 +103,47 @@ export class Logger {
             });
             return;
         }
+        // Set initialized to true at the beginning of the initialization process.
         this.initialized = true;
         this.currentMcpLevel = level;
         this.currentWinstonLevel = mcpToWinstonLevel[level];
+        // The logs directory (config.logsPath / resolvedLogsDir) is expected to be created and validated
+        // by the configuration module (src/config/index.ts) before logger initialization.
+        // If isLogsDirSafe is true, we assume resolvedLogsDir exists and is usable.
+        // No redundant directory creation logic here.
+        const fileFormat = winston.format.combine(winston.format.timestamp(), winston.format.errors({ stack: true }), winston.format.json());
         const transports = [];
-        if (config.logOutputMode === "stdout") {
-            transports.push(new winston.transports.Console({
-                format: winston.format.combine(winston.format.timestamp(), winston.format.errors({ stack: true }), winston.format.json()),
+        const fileTransportOptions = {
+            format: fileFormat,
+            maxsize: this.LOG_FILE_MAX_SIZE,
+            maxFiles: this.LOG_MAX_FILES,
+            tailable: true,
+        };
+        if (isLogsDirSafe) {
+            transports.push(new winston.transports.File({
+                filename: path.join(resolvedLogsDir, "error.log"),
+                level: "error",
+                ...fileTransportOptions,
+            }), new winston.transports.File({
+                filename: path.join(resolvedLogsDir, "warn.log"),
+                level: "warn",
+                ...fileTransportOptions,
+            }), new winston.transports.File({
+                filename: path.join(resolvedLogsDir, "info.log"),
+                level: "info",
+                ...fileTransportOptions,
+            }), new winston.transports.File({
+                filename: path.join(resolvedLogsDir, "debug.log"),
+                level: "debug",
+                ...fileTransportOptions,
+            }), new winston.transports.File({
+                filename: path.join(resolvedLogsDir, "combined.log"),
+                ...fileTransportOptions,
             }));
         }
         else {
-            const resolvedLogsDir = config.logsPath;
-            if (resolvedLogsDir) {
-                const fileFormat = winston.format.combine(winston.format.timestamp(), winston.format.errors({ stack: true }), winston.format.json());
-                const fileTransportOptions = {
-                    format: fileFormat,
-                    maxsize: this.LOG_FILE_MAX_SIZE,
-                    maxFiles: this.LOG_MAX_FILES,
-                    tailable: true,
-                };
-                transports.push(new winston.transports.File({
-                    filename: path.join(resolvedLogsDir, "error.log"),
-                    level: "error",
-                    ...fileTransportOptions,
-                }), new winston.transports.File({
-                    filename: path.join(resolvedLogsDir, "warn.log"),
-                    level: "warn",
-                    ...fileTransportOptions,
-                }), new winston.transports.File({
-                    filename: path.join(resolvedLogsDir, "info.log"),
-                    level: "info",
-                    ...fileTransportOptions,
-                }), new winston.transports.File({
-                    filename: path.join(resolvedLogsDir, "debug.log"),
-                    level: "debug",
-                    ...fileTransportOptions,
-                }), new winston.transports.File({
-                    filename: path.join(resolvedLogsDir, "combined.log"),
-                    ...fileTransportOptions,
-                }));
+            if (process.stdout.isTTY) {
+                console.warn("File logging disabled as logsPath is not configured or invalid.");
             }
         }
         this.winstonLogger = winston.createLogger({
@@ -146,20 +151,23 @@ export class Logger {
             transports,
             exitOnError: false,
         });
+        // Configure console transport after Winston logger is created
         const consoleStatus = this._configureConsoleTransport();
         const initialContext = {
             loggerSetup: true,
             requestId: "logger-init-deferred",
             timestamp: new Date().toISOString(),
         };
+        // Removed logging of logsDirCreatedMessage as it's no longer set
         if (consoleStatus.message) {
             this.info(consoleStatus.message, initialContext);
         }
-        this.info(`Logger initialized. Mode: ${config.logOutputMode}. File logging level: ${this.currentWinstonLevel}. MCP logging level: ${this.currentMcpLevel}.`, {
+        this.initialized = true; // Ensure this is set after successful setup
+        this.info(`Logger initialized. File logging level: ${this.currentWinstonLevel}. MCP logging level: ${this.currentMcpLevel}. Console logging: ${consoleStatus.enabled ? "enabled" : "disabled"}`, {
             loggerSetup: true,
             requestId: "logger-post-init",
             timestamp: new Date().toISOString(),
-            logsPathUsed: config.logsPath,
+            logsPathUsed: resolvedLogsDir,
         });
     }
     /**
@@ -199,6 +207,7 @@ export class Logger {
         this.currentMcpLevel = newLevel;
         this.currentWinstonLevel = mcpToWinstonLevel[newLevel];
         if (this.winstonLogger) {
+            // Ensure winstonLogger is defined
             this.winstonLogger.level = this.currentWinstonLevel;
         }
         const consoleStatus = this._configureConsoleTransport();
@@ -217,12 +226,6 @@ export class Logger {
      * @private
      */
     _configureConsoleTransport() {
-        if (config.logOutputMode === "stdout") {
-            return {
-                enabled: true,
-                message: "Stdout logging is enabled by configuration.",
-            };
-        }
         if (!this.winstonLogger) {
             return {
                 enabled: false,
@@ -235,19 +238,17 @@ export class Logger {
         if (shouldHaveConsole && !consoleTransport) {
             const consoleFormat = createWinstonConsoleFormat();
             this.winstonLogger.add(new winston.transports.Console({
-                level: "debug",
+                level: "debug", // Console always logs debug if enabled
                 format: consoleFormat,
             }));
-            message =
-                "Interactive console logging enabled (level: debug, stdout is TTY).";
+            message = "Console logging enabled (level: debug, stdout is TTY).";
         }
         else if (!shouldHaveConsole && consoleTransport) {
             this.winstonLogger.remove(consoleTransport);
-            message =
-                "Interactive console logging disabled (level not debug or stdout not TTY).";
+            message = "Console logging disabled (level not debug or stdout not TTY).";
         }
         else {
-            message = "Interactive console logging status unchanged.";
+            message = "Console logging status unchanged.";
         }
         return { enabled: shouldHaveConsole, message };
     }
@@ -287,7 +288,7 @@ export class Logger {
         if (!this.ensureInitialized())
             return;
         if (mcpLevelSeverity[level] > mcpLevelSeverity[this.currentMcpLevel]) {
-            return;
+            return; // Do not log if message level is less severe than currentMcpLevel
         }
         const logData = { ...context };
         const winstonLevel = mcpToWinstonLevel[level];
@@ -303,6 +304,7 @@ export class Logger {
                 mcpDataPayload.context = context;
             if (error) {
                 mcpDataPayload.error = { message: error.message };
+                // Include stack trace in debug mode for MCP notifications, truncated for brevity
                 if (this.currentMcpLevel === "debug" && error.stack) {
                     mcpDataPayload.error.stack = error.stack.substring(0, this.MCP_NOTIFICATION_STACK_TRACE_MAX_LENGTH);
                 }
@@ -319,7 +321,7 @@ export class Logger {
                     originalLevel: level,
                     originalMessage: msg,
                     sendError: errorMessage,
-                    mcpPayload: JSON.stringify(mcpDataPayload).substring(0, 500),
+                    mcpPayload: JSON.stringify(mcpDataPayload).substring(0, 500), // Log a preview
                 };
                 this.winstonLogger.error("Failed to send MCP log notification", internalErrorContext);
             }

package/dist/utils/parsing/ncbi-parsing/pubmedArticleStructureParser.js

@@ -14,6 +14,10 @@ export function extractAuthors(authorListXml) {
         return [];
     const authors = ensureArray(authorListXml.Author);
     return authors.map((auth) => {
+        const collectiveName = getText(auth.CollectiveName);
+        if (collectiveName) {
+            return { collectiveName };
+        }
         let affiliation = "";
         const affiliations = ensureArray(auth.AffiliationInfo);
         if (affiliations.length > 0) {

package/dist/utils/security/idGenerator.d.ts

@@ -85,6 +85,7 @@ export declare class IdGenerator {
      * @param id - The ID string to validate.
      * @param entityType - The expected entity type of the ID.
      * @param options - Optional parameters used during generation for validation consistency.
+     *                  The `charset` from these options will be used for validation.
      * @returns `true` if the ID is valid, `false` otherwise.
      */
     isValid(id: string, entityType: string, options?: IdGenerationOptions): boolean;
@@ -112,7 +113,9 @@ export declare class IdGenerator {
     getEntityType(id: string, separator?: string): string;
     /**
      * Normalizes an entity ID to ensure the prefix matches the registered case
-     * and the random part is uppercase.
+     * and the random part is uppercase. Note: This assumes the charset characters
+     * have a meaningful uppercase version if case-insensitivity is desired for the random part.
+     * For default charset (A-Z0-9), this is fine. For custom charsets, behavior might vary.
      * @param id - The ID to normalize (e.g., "proj_a6b3j0").
      * @param separator - The separator used in the ID. Defaults to `IdGenerator.DEFAULT_SEPARATOR`.
      * @returns The normalized ID (e.g., "PROJ_A6B3J0").

package/dist/utils/security/idGenerator.js

@@ -60,10 +60,18 @@ export class IdGenerator {
      * @returns The generated random string.
      */
     generateRandomString(length = IdGenerator.DEFAULT_LENGTH, charset = IdGenerator.DEFAULT_CHARSET) {
-        const bytes = randomBytes(length);
         let result = "";
-        for (let i = 0; i < length; i++) {
-            result += charset[bytes[i] % charset.length];
+        // Determine the largest multiple of charset.length that is less than or equal to 256
+        // This is the threshold for rejection sampling to avoid bias.
+        const maxValidByteValue = Math.floor(256 / charset.length) * charset.length;
+        while (result.length < length) {
+            const byteBuffer = randomBytes(1); // Get one random byte
+            const byte = byteBuffer[0];
+            // If the byte is within the valid range (i.e., it won't introduce bias),
+            // use it to select a character from the charset. Otherwise, discard and try again.
+            if (byte < maxValidByteValue) {
+                result += charset[byte % charset.length];
+            }
         }
         return result;
     }
@@ -101,16 +109,21 @@ export class IdGenerator {
      * @param id - The ID string to validate.
      * @param entityType - The expected entity type of the ID.
      * @param options - Optional parameters used during generation for validation consistency.
+     *                  The `charset` from these options will be used for validation.
      * @returns `true` if the ID is valid, `false` otherwise.
      */
     isValid(id, entityType, options = {}) {
         const prefix = this.entityPrefixes[entityType];
-        const { length = IdGenerator.DEFAULT_LENGTH, separator = IdGenerator.DEFAULT_SEPARATOR, } = options;
+        const { length = IdGenerator.DEFAULT_LENGTH, separator = IdGenerator.DEFAULT_SEPARATOR, charset = IdGenerator.DEFAULT_CHARSET, // Use charset from options or default
+         } = options;
         if (!prefix) {
             return false;
         }
-        // Assumes default charset characters (uppercase letters and digits) for regex.
-        const pattern = new RegExp(`^${this.escapeRegex(prefix)}${this.escapeRegex(separator)}[A-Z0-9]{${length}}$`);
+        // Build regex character class from the charset
+        // Escape characters that have special meaning inside a regex character class `[]`
+        const escapedCharsetForClass = charset.replace(/[[\]\\^-]/g, "\\$&");
+        const charsetRegexPart = `[${escapedCharsetForClass}]`;
+        const pattern = new RegExp(`^${this.escapeRegex(prefix)}${this.escapeRegex(separator)}${charsetRegexPart}{${length}}$`);
         return pattern.test(id);
     }
     /**
@@ -153,7 +166,9 @@ export class IdGenerator {
     }
     /**
      * Normalizes an entity ID to ensure the prefix matches the registered case
-     * and the random part is uppercase.
+     * and the random part is uppercase. Note: This assumes the charset characters
+     * have a meaningful uppercase version if case-insensitivity is desired for the random part.
+     * For default charset (A-Z0-9), this is fine. For custom charsets, behavior might vary.
      * @param id - The ID to normalize (e.g., "proj_a6b3j0").
      * @param separator - The separator used in the ID. Defaults to `IdGenerator.DEFAULT_SEPARATOR`.
      * @returns The normalized ID (e.g., "PROJ_A6B3J0").
@@ -164,6 +179,8 @@ export class IdGenerator {
         const registeredPrefix = this.entityPrefixes[entityType];
         const idParts = id.split(separator);
         const randomPart = idParts.slice(1).join(separator);
+        // Consider if randomPart.toUpperCase() is always correct for custom charsets.
+        // For now, maintaining existing behavior.
         return `${registeredPrefix}${separator}${randomPart.toUpperCase()}`;
     }
 }

package/dist/utils/security/rateLimiter.d.ts

@@ -28,10 +28,6 @@ export interface RateLimitEntry {
 /**
  * A generic rate limiter class using an in-memory store.
  * Controls frequency of operations based on unique keys.
- *
- * @scalability Note: This is an in-memory store. For horizontal scaling across
- * multiple processes or machines, this state would need to be moved to a shared,
- * distributed store like Redis or a database.
  */
 export declare class RateLimiter {
     private config;

package/dist/utils/security/rateLimiter.js

@@ -9,10 +9,6 @@ import { logger, requestContextService } from "../index.js";
 /**
  * A generic rate limiter class using an in-memory store.
  * Controls frequency of operations based on unique keys.
- *
- * @scalability Note: This is an in-memory store. For horizontal scaling across
- * multiple processes or machines, this state would need to be moved to a shared,
- * distributed store like Redis or a database.
  */
 export class RateLimiter {
     /**

package/dist/utils/security/sanitization.d.ts

@@ -148,6 +148,17 @@ export declare class Sanitization {
      * Sanitizes input for logging by redacting sensitive fields.
      * Creates a deep clone and replaces values of fields matching `this.sensitiveFields`
      * (case-insensitive substring match) with "[REDACTED]".
+     *
+     * It uses `structuredClone` if available for a high-fidelity deep clone.
+     * If `structuredClone` is not available (e.g., in older Node.js environments),
+     * it falls back to `JSON.parse(JSON.stringify(input))`. This fallback has limitations:
+     * - `Date` objects are converted to ISO date strings.
+     * - `undefined` values within objects are removed.
+     * - `Map`, `Set`, `RegExp` objects are converted to empty objects (`{}`).
+     * - Functions are removed.
+     * - `BigInt` values will throw an error during `JSON.stringify` unless a `toJSON` method is provided.
+     * - Circular references will cause `JSON.stringify` to throw an error.
+     *
      * @param input - The input data to sanitize for logging.
      * @returns A sanitized (deep cloned) version of the input, safe for logging.
      *   Returns original input if not object/array, or "[Log Sanitization Failed]" on error.

package/dist/utils/security/sanitization.js

@@ -204,8 +204,11 @@ export class Sanitization {
             })) {
                 throw new Error("Invalid URL format or protocol not in allowed list.");
             }
-            if (trimmedInput.toLowerCase().startsWith("javascript:")) {
-                throw new Error("JavaScript pseudo-protocol is not allowed in URLs.");
+            const lowercasedInput = trimmedInput.toLowerCase();
+            if (lowercasedInput.startsWith("javascript:") ||
+                lowercasedInput.startsWith("data:") ||
+                lowercasedInput.startsWith("vbscript:")) {
+                throw new Error("Disallowed pseudo-protocol (javascript:, data:, or vbscript:) in URL.");
             }
             return trimmedInput;
         }
@@ -377,6 +380,17 @@ export class Sanitization {
      * Sanitizes input for logging by redacting sensitive fields.
      * Creates a deep clone and replaces values of fields matching `this.sensitiveFields`
      * (case-insensitive substring match) with "[REDACTED]".
+     *
+     * It uses `structuredClone` if available for a high-fidelity deep clone.
+     * If `structuredClone` is not available (e.g., in older Node.js environments),
+     * it falls back to `JSON.parse(JSON.stringify(input))`. This fallback has limitations:
+     * - `Date` objects are converted to ISO date strings.
+     * - `undefined` values within objects are removed.
+     * - `Map`, `Set`, `RegExp` objects are converted to empty objects (`{}`).
+     * - Functions are removed.
+     * - `BigInt` values will throw an error during `JSON.stringify` unless a `toJSON` method is provided.
+     * - Circular references will cause `JSON.stringify` to throw an error.
+     *
      * @param input - The input data to sanitize for logging.
      * @returns A sanitized (deep cloned) version of the input, safe for logging.
      *   Returns original input if not object/array, or "[Log Sanitization Failed]" on error.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyanheads/pubmed-mcp-server",
-  "version": "1.2.2",
+  "version": "1.2.4",
   "description": "A Model Context Protocol (MCP) server enabling AI agents to intelligently search, retrieve, and analyze biomedical literature from PubMed via NCBI E-utilities. Built on the mcp-ts-template for robust, production-ready performance.",
   "main": "dist/index.js",
   "files": [
@@ -32,31 +32,32 @@
     "inspector": "mcp-inspector --config mcp.json --server pubmed-mcp-server"
   },
   "dependencies": {
-    "@hono/node-server": "^1.14.4",
-    "@modelcontextprotocol/sdk": "^1.13.0",
+    "@hono/node-server": "^1.15.0",
+    "@modelcontextprotocol/sdk": "^1.15.0",
     "@types/jsonwebtoken": "^9.0.10",
-    "@types/node": "^24.0.3",
+    "@types/node": "^24.0.10",
     "@types/sanitize-html": "^2.16.0",
     "@types/validator": "13.15.2",
     "axios": "^1.10.0",
+    "chart.js": "^4.5.0",
+    "chartjs-node-canvas": "^5.0.0",
     "chrono-node": "^2.8.3",
+    "citation-js": "^0.7.20",
     "dotenv": "^16.5.0",
     "fast-xml-parser": "^5.2.5",
-    "hono": "^4.8.2",
+    "hono": "^4.8.4",
     "jose": "^6.0.11",
     "jsonwebtoken": "^9.0.2",
-    "openai": "^5.6.0",
+    "openai": "^5.8.2",
     "partial-json": "^0.1.7",
     "sanitize-html": "^2.17.0",
     "tiktoken": "^1.0.21",
     "ts-node": "^10.9.2",
     "typescript": "^5.8.3",
     "validator": "13.15.15",
-    "chart.js": "^4.5.0",
-    "chartjs-node-canvas": "^5.0.0",
     "winston": "^3.17.0",
     "winston-transport": "^4.9.0",
-    "zod": "^3.25.67"
+    "zod": "^3.25.74"
   },
   "keywords": [
     "mcp",
@@ -98,7 +99,8 @@
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "js-yaml": "^4.1.0",
-    "prettier": "^3.5.3",
-    "typedoc": "^0.28.5"
+    "patch-package": "^8.0.0",
+    "prettier": "^3.6.2",
+    "typedoc": "^0.28.7"
   }
 }