mcp-drugsea

MCP (Model Context Protocol) stdio server for DrugSea / Yaohai pharmaceutical databases.

The server forwards tool calls to https://db3.drugsea.cn/api with personal user token auth (Authorization: Bearer ysk_…). It covers:

• yaohai-* — cross-database catalog / search / detail / global (POST /g/mcp/yaohai/*)

• product-cn-* — already-marketed China products (search/detail via MCP on db3; facets via GET)

• reg-cn-* — CDE registration / review pipeline (search/detail via MCP on db3; facets via GET)

GitHub: github.com/kinginsun/mcp-drugsea

Installation

npm install -g @kinginsun/mcp-drugsea

Or run without installing:

npx -y @kinginsun/mcp-drugsea

Configuration

YAOHAI_MCP_TOKEN (required)

Authentication uses personal user tokens only (ysk_ + 32 hex chars). The legacy shared X-Yaohai-Api-Key header is not supported.

Obtain a token from DrugSea / Yaohai (user account settings), then:

export YAOHAI_MCP_TOKEN=ysk_your_token_here

How to get a token from DrugSea (Yaohai)

1. Open https://db.drugsea.cn in a browser.

2. Log in with WeChat QR scan (微信扫码登录).

3. Enter the personal center (个人中心).

4. In the left sidebar, click API Token.

5. Click generate token (生成 Token) and copy the result — it looks like ysk_ + 32 hex characters.

Notes:

• Each account can generate up to 10 tokens.

• A token inherits the same database permissions as its Yaohai account — if your account cannot see a database, the token cannot either. If a tool call returns a permission error, check your account's subscription/permissions on db.drugsea.cn, not the MCP client.

• Store the token in your MCP client's env (see below) or export it as YAOHAI_MCP_TOKEN. Never commit it to a repository.

On db3, direct GET list routes may return encrypted payloads; this client auto-routes product-cn-search / reg-cn-search / detail through MCP POST when the base URL contains db3.drugsea.cn.

Optional

Cursor MCP (~/.cursor/mcp.json)

{
  "mcpServers": {
    "drugsea": {
      "command": "npx",
      "args": ["-y", "@kinginsun/mcp-drugsea"],
      "env": {
        "YAOHAI_MCP_TOKEN": "ysk_your_token_here"
      }
    }
  }
}

Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "drugsea": {
      "command": "npx",
      "args": ["-y", "@kinginsun/mcp-drugsea"],
      "env": {
        "YAOHAI_MCP_TOKEN": "ysk_your_token_here"
      }
    }
  }
}

Which tools to use

Therapeutic-class queries (抗癌, 心血管, …): prefer ConditionSearch ATC_code (letter, e.g. L oncology, C cardiovascular, J anti-infectives, N nervous system). Confirm values with a facets tool when unsure.

If total > 20, summarize in chat (about 5–10 sample rows) instead of pasting the full table.

xlsx export is not implemented in this MCP (v1 returns JSON samples only).

product-cn-* and reg-cn-* list/facet/detail calls use the same routes as the website where applicable. Some deployments IP-allowlist direct GET paths. The yaohai-* tools use POST /g/mcp/yaohai/* with Bearer token auth.

Tools

Yaohai (cross-DB)

When the target database is unclear, use yaohai-catalog (filter by category / q) to pick a dbname, then yaohai-search; or use yaohai-global-search for a cross-database panorama query.

product_cn (marketed)

first_approve_date is first listing date; approve_date is latest re-registration (not first listing).

view_type: eslist (default) / list_by_drug_name / list_by_manufacture.

reg_cn (CDE review)

view_type: eslist (default) / list_by_drug_name / list_by_enterprise.

query values may be string, number, or string arrays (ConditionSearch multiple). Dates: "YYYY-MM-DD to YYYY-MM-DD". Ranges: "min to max".

Quick start for AI Agents (install, configure, test)

This section is a step-by-step playbook an AI agent (or a human) can follow to install, configure, and verify this MCP server end to end.

Prerequisites

• Node.js >= 18 (node -v)

• npm (npm -v)

• A DrugSea / Yaohai personal token (ysk_ + 32 hex chars) — see How to get a token from DrugSea (Yaohai)

Step 0 — Register the server with your MCP client

Add the server to your client config so it auto-starts. Example for Cursor (~/.cursor/mcp.json) — see Configuration for other clients:

{
  "mcpServers": {
    "drugsea": {
      "command": "npx",
      "args": ["-y", "@kinginsun/mcp-drugsea"],
      "env": {
        "YAOHAI_MCP_TOKEN": "ysk_your_token_here"
      }
    }
  }
}

Then reload MCP servers in the client (Cursor: Settings → MCP → refresh). The client should list 12 tools.

Step 1 — Install (optional, for local/CLI use)

Either run via npx on demand (no install needed), or install globally / from source:

# Option A: run without installing (what the MCP configs above do)
npx -y @kinginsun/mcp-drugsea

# Option B: global install
npm install -g @kinginsun/mcp-drugsea
npm ls -g @kinginsun/mcp-drugsea

# Option C: from source (when developing)
git clone https://github.com/kinginsun/mcp-drugsea.git
cd mcp-drugsea
npm install
npm run build

Step 2 — Configure the token

export YAOHAI_MCP_TOKEN=ysk_your_token_here

For MCP client usage, put the token in the client config env instead (Step 0). Sanity-check the format:

node -e "console.log(/^ysk_[0-9a-f]{32}$/i.test(process.env.YAOHAI_MCP_TOKEN) ? 'token format OK' : 'token format BAD')"

Step 3 — Smoke test over stdio (JSON-RPC)

The server speaks MCP over stdio. The recommended handshake sequence is initialize → notifications/initialized → request. Run this outside the package source directory (or use node dist/index.js inside it):

printf '%s\n' \
  '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"smoke","version":"1.0"}}}' \
  '{"jsonrpc":"2.0","method":"notifications/initialized"}' \
  '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' \
  | YAOHAI_MCP_TOKEN=$YAOHAI_MCP_TOKEN npx -y @kinginsun/mcp-drugsea \
  | tail -1 | node -e "let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{const m=JSON.parse(d);console.log('tools:',m.result.tools.length)})"

Expected: tools: 12.

One-liner variant without the handshake (also works with this server):

echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' \
  | YAOHAI_MCP_TOKEN=ysk_your_token_here npx -y @kinginsun/mcp-drugsea

Step 4 — Test real tool calls

# Catalog lookup (no external DB data needed)
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"yaohai-catalog","arguments":{"q":"医保"}}}' \
  | YAOHAI_MCP_TOKEN=ysk_your_token_here npx -y @kinginsun/mcp-drugsea

# China marketed products search
echo '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"product-cn-search","arguments":{"query":{"drug_name":"阿司匹林"},"limit":3}}}' \
  | YAOHAI_MCP_TOKEN=ysk_your_token_here npx -y @kinginsun/mcp-drugsea

# Global panorama search
echo '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"yaohai-global-search","arguments":{"q":"阿司匹林","limit":3}}}' \
  | YAOHAI_MCP_TOKEN=ysk_your_token_here npx -y @kinginsun/mcp-drugsea

Expected: each response has "isError":false and non-empty content.

Step 5 — Full 12-tool suite (from source)

git clone https://github.com/kinginsun/mcp-drugsea.git
cd mcp-drugsea
npm install && npm run build
YAOHAI_MCP_TOKEN=ysk_your_token_here node scripts/test-all-tools.mjs

Expected final line: --- Summary: 12 passed, 0 failed / 12 tool calls ---.

Step 6 — Verify inside the MCP client

After reloading MCP servers in the client, ask the agent:

1. "List the drugsea tools" → should see 12 tools.

2. "Search 阿司匹林 in product-cn" → should return rows with total > 0.

3. "Global search: PD-1" → should return panorama results without error.

Troubleshooting

Manual stdio test

echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' \
  | YAOHAI_MCP_TOKEN=ysk_your_token_here node dist/index.js

echo '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"yaohai-catalog","arguments":{"q":"医保"}}}' \
  | YAOHAI_MCP_TOKEN=ysk_your_token_here node dist/index.js

echo '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"product-cn-search","arguments":{"query":{"drug_name":"阿司匹林"},"limit":3}}}' \
  | YAOHAI_MCP_TOKEN=ysk_your_token_here node dist/index.js

Releasing (maintainers)

publish.sh releases the package to npm (which is what makes npx -y @kinginsun/mcp-drugsea work). It syncs src/index.ts's PACKAGE_VERSION with package.json, builds clean, audits the tarball for leaked tokens, runs the 12-tool suite, commits + tags, then publishes and pushes.

npm login                # once, with rights on the @kinginsun scope
./publish.sh --dry-run   # full rehearsal, no side effects
./publish.sh --minor     # real release (0.2.1 → 0.3.0)
./publish.sh --help      # all flags (--major, --version, --otp, --skip-tests, --note, --no-push)

The suite needs a live token: publish.sh probes the API first and, on rejection, reports it as a credential problem rather than a code regression. If you rotated YAOHAI_MCP_TOKEN, run unset YAOHAI_MCP_TOKEN first so the new .env value isn't shadowed by a stale exported one.

Requirements

• Node.js >= 18.0.0

License

MIT