Paper deep dive
CyberNeuro: A Privacy-Preserving Agentic Workbench for Cohort-Scale Neuroimage and Clinical Data Analysis
Ran Ren, Junhong Tong, Yunxi Kong, Yiyao Chen, Yucheng Li, Kunhao Zhou, Shaoqi Wang, Yuxiang Tao, Shuheng Cao, Zhihao Fan, Marissa DiPiero, Tingting Dan, Guorong Wu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 8/3/2026, 1:49:47 AM
Summary
The paper introduces CyberNeuro, a privacy-preserving, agentic workbench for cohort-scale neuroimaging and clinical data analysis. It utilizes a local LLM model named WandaMind and four dedicated agents (Planner, Validator, Dispatcher, Reporter) to automate workflows via natural language while maintaining strict local data privacy. The system improves accuracy on the NeuroBench suite from 40% to 69% and significantly reduces token usage compared to cloud-based alternatives and the NeuroClaw baseline.
Entities (11)
Relation Signals (10)
CyberNeuro → containsagent → Planner
confidence 95% · Driven by four dedicated agents (Planner, Validator, Dispatcher, and Reporter)
CyberNeuro → containsagent → Validator
confidence 95% · Driven by four dedicated agents (Planner, Validator, Dispatcher, and Reporter)
CyberNeuro → containsagent → Dispatcher
confidence 95% · Driven by four dedicated agents (Planner, Validator, Dispatcher, and Reporter)
CyberNeuro → containsagent → Reporter
confidence 95% · Driven by four dedicated agents (Planner, Validator, Dispatcher, and Reporter)
CyberNeuro → uses → WandaMind
confidence 95% · CyberNeuro, an agentic workbench with a tailored local LLM-model ('WandaMind')
CyberNeuro → improvesaccuracyon → NeuroBench
confidence 92% · On the public NeuroBench suite, CyberNeuro increases held-out domain accuracy from 40% to 69%
CyberNeuro → communicatesvia → MCP Bridge
confidence 90% · communicating via a secure MCP bridge
CyberNeuro → comparedto → NeuroClaw
confidence 90% · compared to Neuroclaw, respectively.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Despite tremendous success in neuroimaging methodology, making large-scale, high-dimensional datasets ready for AI/ML applications remains a critical operational bottleneck. Conventional workflows require extensive manual effort across metadata curation, pipeline execution, post-processing quality control, and data management, a burden that disproportionately excludes laboratories with limited manpower and computational infrastructure. To address this real-world barrier, there is an urgent need for scalable, cost-effective computational platforms that democratize advanced neuroimaging analytics and accelerate discoveries in mental health and clinical translation. Capitalizing on multi-agent LLM breakthroughs, we introduce CyberNeuro, an agentic workbench with a tailored local LLM-model ('WandaMind') for automated neuroimaging and health-data analysis. Driven by four dedicated agents (Planner, Validator, Dispatcher, and Reporter) communicating via a secure MCP bridge and a pinned execution layer, CyberNeuro enables researchers to execute complex workflows using natural language while maintaining clinical-grade data privacy. On the public NeuroBench suite, CyberNeuro increases held-out domain accuracy from 40% to 69% over the baseline model. Beyond automated metrics, the platform integrates a human-in-the-loop verification panel to ensure rigorous biomedical quality control. Across the same end-to-end 10-batch cohort workflow suite, the local WandaMind configuration completed all tasks with an estimated aggregate token count of about 10.6% using WandaMind and 61.7% using cloud providers of token usage, compared to Neuroclaw, respectively. The platform and its production-ready modules are available at this https URL.
Tags
Links
- Source: https://arxiv.org/abs/2607.28841v1
- Canonical: https://arxiv.org/abs/2607.28841v1
Trouble viewing inline? Open PDF directly →
Full Text
79,929 characters extracted from source content.
Expand or collapse full text
Advanced Computational Medicine Laboratory (ACMLab) CyberNeuro: A Privacy-Preserving Agentic Workbench for Cohort-Scale Neuroimage and Clinical Data Analysis Ran Ren 1 , Junhong Tong 1 , Yunxi Kong 1 , Yiyao Chen 1,2 , Yucheng Li 1,2 , Kunhao Zhou 1 , Shaoqi Wang 1,2 , Yuxiang Tao 1 , Shuheng Cao 1 , Zhihao Fan 1 , Marissa DiPiero 1 , Tingting Dan 1 *, and Guorong Wu 1,2 * 1 Department of Psychiatry 2 Department of Computer Science University of North Carolina at Chapel Hill *Corresponding author: tingting_dan,grwu@med.unc.edu Abstract Despite tremendous success in neuroimaging methodology, making large-scale, high-dimensional datasets ready for AI/ML applications remains a critical operational bottleneck. Conventional workflows require extensive manual effort across metadata curation, pipeline execution, post- processing quality control, and data management, a burden that disproportionately excludes laboratories with limited manpower and computational infrastructure. To address this real- world barrier, there is an urgent need for scalable, cost-effective computational platforms that democratize advanced neuroimaging analytics and accelerate discoveries in mental health and clinical translation. Capitalizing on multi-agent LLM breakthroughs, we introduce Cy- berNeuro, an agentic workbench with a tailored local LLM-model (’WandaMind’) for automated neuroimaging and health-data analysis. Driven by four dedicated agents (Planner, Validator, Dispatcher, and Reporter) communicating via a secure MCP bridge and a pinned execution layer, CyberNeuro enables researchers to execute complex workflows using natural language while maintaining clinical-grade data privacy. On the public NeuroBench suite, CyberNeuro increases held-out domain accuracy from 40% to 69% over the baseline model. Beyond automated metrics, the platform integrates a human-in-the-loop verification panel to ensure rigorous biomedical quality control. Across the same end-to-end 10-batch cohort workflow suite, the local WandaMind configuration completed all tasks with an estimated aggregate token count of about 10.6% using WandaMind and 61.7% using cloud providers of token usage, compared to Neuroclaw, respectively. The platform and its production-ready modules are available at https://wanda-cyberbench.com. 1 Introduction Modern neuroimaging studies jointly analyze structural MRI, functional MRI, diffusion MRI, clinical measurements, phenotypic variables, and behavioral data. Preparing these heterogeneous data for statistical analysis or machine learning requires multiple specialized tools, including FreeSurfer (Fischl, 2012), ANTs (Avants et al., 2011), FSL (Jenkinson et al., 2012), CIVET (Ad-Dab’bagh et al., 2006), fMRIPrep (Esteban et al., 2019), and QSIPrep (Cieslak et al., 2021). Although these tools are individually well-developed, they differ in header file conventions, runtime dependencies, coordinate systems, output formats, and interaction models. Researchers therefore spend substantial time configuring environments, moving files, verifying outputs, recovering from partial failures, and switching between modality-specific viewers. These operational costs grow with cohort size 1 arXiv:2607.28841v1 [cs.MA] 30 Jul 2026 Advanced Computational Medicine Laboratory (ACMLab) Users Standalone Worksta.on LOCAL-FIRST PRIVACY BOUNDARY Ins$tu$onal hardware No outbound network by default Egress firewall Users Interaction Layer wd Use x as input Run the dcm2bids pipeline I will run skill on dicom datasets 42_DTI, two T2 series, connectivity.zip, and mprage-T1. Done. See the results à 1) Chat Request Ask Wanda... 2) Skill Hub (workspace) QC Skill NiiVue CIVET FreeSurfer fMRIPrep QSIPrep Plots +Add/Generate Skills Native app out of the box Orchestration Layer (LLM) Validator Agent Dispatcher Agent Reporter Agent 3) Interactive Visualization Planner Agent Skill Library Memory Pill QC Skill Pipelines Visualiza$on Utilities Cross Platform keywords preferences Skill Evolution Skill Versioning Learn·Improve Meta-skill Image QC, Mo,on...... fMRIPrep, CIVET...... 3D Slicer,NiiVue ParaView...... Normativemodel ...... Specialized 7B > 4×larger model on-task ①Grounded, decontaminated data ②QLoRA· response-only (1.06% params) ③Balance act ↔refuse +21 pts on domain · 4×fewer params WandaMind 1 gold skill packages distill Meta-skill conventions templates requirements pass Meta-skill frozen candidate packages validation gates 1 schema · 2 install · 3 execution · 4 artifacts · 5 human failure report 2 refine & resubmit —until all gates pass cleanly dra6s MCP Bridge · agent controls all pipeline tools Figure 1: System architecture of CyberNeuro. The platform operates within a strict local-first privacy boundary on standalone institutional hardware, ensuring no outbound network traffic. The architecture consists of three main tiers. Interaction Layer: Integrates natural language chat requests, a Skill Hub for managing neuroimaging pipelines (e.g., FreeSurfer, fMRIPrep, CIVET), and interactive co-visualization panels. Orchestration Layer: Powered by WandaMind, a domain- specialized 7B local model, it utilizes four dedicated agents (Planner, Validator, Dispatcher, Reporter) to seamlessly control pipeline tools via the Model Context Protocol (MCP) bridge. Skill Evolution: A built-in pipeline that distills meta-skill drafts into robust, frozen skill packages through rigorous, multi-stage validation gates. Memory Pill: A memory module that retains user preferences, keywords, and cross-platform configurations to facilitate continuous learning and personalized workflow improvements. and can become a greater bottleneck than the underlying computation (Poldrack and Gorgolewski, 2019; Renton et al., 2024). Agentic assistants have begun to reduce this burden by translating natural-language requests into executable workflows. General agent research has shown how language models can interleave reasoning with actions, learn API use, and decompose requests into tool graphs (Yao et al., 2023; Schick et al., 2023; Shen et al., 2024). NeuroClaw (Wang et al., 2026), for example, provides dataset-aware orchestration, a broad skill library, runtime support, and the NeuroBench evaluation suite. The earlier CyberNeuro Assistant (Wu et al., 2026) explored multimodal language-model guidance for mental-health research. These systems demonstrate the practical promise of agentic neuroimaging. However, several system-level questions remain insufficiently evaluated: whether a small local model can support useful end-to-end execution; whether invalid plans can be detected before consuming substantial compute; whether reported success corresponds to a valid scientific derivative; and whether execution, visual inspection, correction, and replay can be completed without repeatedly changing applications. CyberNeuro addresses these questions through a fully local, end-to-end Windows workbench (as shown in Figure 1). A four-stage orchestration pipeline converts a natural-language request into a 2 Advanced Computational Medicine Laboratory (ACMLab) validated execution graph, dispatches registered skills in pinned Windows/WSL environments, verifies the resulting artifacts, and presents the outputs through an integrated visualization and quality-control interface. CyberNeuro runs locally on the same workstation as the application. The evaluated release does not expose a cloud-model endpoint, institution-hosted model tier, remote-compute provider, or server deployment mode. Every run produces a structured receipt containing the resolved inputs, tool versions, commands, outputs, logs, validation results, and completion status. The contributions of this work involve four-fold: •An end-to-end Windows neuroimaging workbench. CyberNeuro integrates natural-language interaction, Windows/WSL runtime configuration, more than 30 processing and visualization skills, artifact inspection, interactive quality control, and reproducible reporting within a single desktop application. •A validated execution architecture. CyberNeuro separates LLM-based planning from deter- ministic contract, permission, runtime, and artifact validation. A task is reported as successful only when the expected scientific derivative is produced and passes the corresponding output checks. •A resource-efficient local agent. WandaMind adapts a 7B open-weight model to neuroimaging tool use and act-or-abstain decisions, enabling offline operation on commodity hardware while improving performance on a held-out domain benchmark. •A system-level evaluation. We compare CyberNeuro with NeuroClaw and conventional multi- tool workflows using end-to-end execution success, artifact validity, manual intervention, computational overhead, user-facing time, reproducibility, and observed outbound network traffic. Our CyberNeuro platform fundamentally transforms real-world neuroimaging workflows through three critical advantages: (1) Unprecedented time efficiency: whereas training a re- search assistant to process a standard clinical cohort conventionally requires 1–2 months, our agentic pipeline reduces the turnaround time to merely one week; (2) Strict replicability: all automated workflows are deterministically reproducible; (3) Comprehensive provenance tracking: the system records every processing detail and intermediate execution state, allowing any analysis to be seamlessly recalled and preventing knowledge loss due to personnel turnover. 2 Related Works CyberNeuro lies at the intersection of reproducible neuroimaging workflows, agentic scientific assistants, interactive quality-control systems, and institution-controlled biomedical computing. Table 1 summarizes the system-level positioning. Reproducible neuroimaging workflows. The Brain Imaging Data Structure (BIDS) (Gorgolewski et al., 2016), Nipype (Gorgolewski et al., 2011), and containerized BIDS Apps (Gorgolewski et al., 2017) have substantially improved the portability and reproducibility of neuroimaging analysis. TemplateFlow provides versioned reference spaces and atlases (Ciric et al., 2022), while Neurodesk packages a broad collection of neuroimaging applications for portable execution across 3 Advanced Computational Medicine Laboratory (ACMLab) personal workstations, HPC, and cloud environments (Renton et al., 2024). Pipelines such as fMRIPrep (Esteban et al., 2019) and QSIPrep (Cieslak et al., 2021) package complex preprocessing stages behind standardized interfaces, while FreeSurfer (Fischl, 2012), FSL (Jenkinson et al., 2012), ANTs (Avants et al., 2011), and CIVET (Ad-Dab’bagh et al., 2006) remain widely used for modality- specific analysis. These systems provide mature scientific computation, but researchers must still select compatible tools, resolve runtime dependencies, verify intermediate outputs, and connect derivatives to downstream analysis and visualization (Poldrack and Gorgolewski, 2019). CyberNeuro does not replace these tools, it registers them as validated skills and records their invocation in a common execution and provenance model. Interactive neuroimaging workbenches. Desktop environments such as 3D Slicer (Fedorov et al., 2012) and ITK-SNAP (Yushkevich et al., 2006) combine visualization with manual or model- assisted editing. MONAI Label brings learned segmentation models into interactive annotation workflows (Díaz-Pinto et al., 2024). Neuroimaging-specific systems address complementary parts of quality control: MRIQC extracts standardized image-quality measures (Esteban et al., 2017); Qoala-T predicts FreeSurfer segmentation quality (Klapwijk et al., 2019); and VisualQC, Mindcontrol, and Qrater support structured visual review (Raamana, 2023; Keshavan et al., 2018; Fernandez-Lozano et al., 2024). Their design centers on viewing, annotation, or a particular analysis family rather than natural-language orchestration across heterogeneous pipelines. CyberNeuro extends this interaction model to multi-stage workflows: processed artifacts can be opened, inspected, corrected, and returned to the execution graph without leaving the workbench. Agentic assistants for scientific and neuroimaging workflows. Tool-using language models have been studied through interleaved reasoning and acting, self-supervised API use, verbal feedback, and general tool-learning frameworks (Yao et al., 2023; Schick et al., 2023; Shinn et al., 2023; Qin et al., 2024). AgentBench and TaskBench evaluate interactive decision making, decomposition, tool selection, and parameter prediction (Liu et al., 2024; Shen et al., 2024), but primarily score agent behavior rather than the validity of domain-specific scientific derivatives. Scientific agents such as BioPlanner, ChemCrow, and Coscientist further show that domain tools and structured action spaces can support protocol planning and experimental workflows (O’Donoghue et al., 2023; Bran et al., 2024; Boiko et al., 2023). Within neuroimaging, NeuroClaw (Wang et al., 2026) is the closest existing system. It provides dataset-aware orchestration, a broad skill library, runtime support, desktop and command-line interfaces, and the evolving NeuroBench task suite (CUHK AIM Group, 2026). The earlier CyberNeuro Assistant (Wu et al., 2026) explored multimodal language-model steering for mental-health research. The present system advances this line toward an integrated workbench in which planning is connected to pre-execution validation, artifact-level verification, interactive inspection, and receipt-based replay. Local and privacy-aware biomedical computing. Federated learning, on-premises computation, and institution-hosted services provide alternatives to transferring protected biomedical data to commercial cloud infrastructure (Kaissis et al., 2020; Rieke et al., 2020). Privacy-aware multi-site neuroimaging has similarly been studied without centralizing source data (Li et al., 2020), and locally deployed LLM pipelines have been evaluated for structured clinical-information extraction (Wiest et al., 2024). CyberNeuro is complementary to these approaches: it focuses on the orchestration and interaction layers while keeping the underlying analysis tools and the default language-model runtime on institution-controlled hardware. This architecture is intended for data-use agreements 4 Advanced Computational Medicine Laboratory (ACMLab) Table 1: System-level capability comparison. Pre-val.: explicit validation before execution; Artifact val.: verification of scientific derivatives after execution; Co-viz/QC: integrated interactive visualiza- tion or editing; Local default: a bundled or documented local model is the default configuration; Replay: provenance capture sufficient for re-execution.•denotes native support,◦partial or optional support, and a blank an unsupported capability in the evaluated release. SystemAgent Runtime Pre-val. Artifact val. Co-viz/QC Local default Replay 3D Slicer (Fedorov et al., 2012)•◦•◦ Nipype / BIDS Apps (Gorgolewski et al., 2011, 2017)•◦• brainlife.io (Hayashi et al., 2024)•◦•◦• MONAI Label (Díaz-Pinto et al., 2024)◦ •◦•◦ NeuroClaw (Wang et al., 2026)• •◦•◦ CyberNeuro• • that restrict external transmission. Our evaluation provides an empirical assessment of outbound communication in the default configuration, rather than asserting a formal privacy proof. Positioning relative to NeuroClaw. NeuroClaw and CyberNeuro share the goal of making neu- roimaging workflows accessible through agentic interfaces, but emphasize different system prop- erties. NeuroClaw offers broad skill and dataset coverage. CyberNeuro emphasizes a local model as the default, deterministic pre-execution checks, post-execution artifact validation, integrated interactive quality control, and a receipt format designed for inspection and replay. We therefore compare pinned released systems at the level most relevant to adoption: which functions can be demonstrated end to end, and what practical improvement those functions provide on shared and additional workflows. Unsupported baseline capabilities are reported explicitly as feature gaps rather than mislabeled as failed runs. Capability entries in Table 1 refer to the specific releases and repository snapshots documented in Section 4. FAIR principles for research software. CyberNeuro follows the FAIR principles for research software (Barker et al., 2022) and the software-citation principles of importance, credit, unique identification, persistence, accessibility, and specificity (Smith et al., 2016). Public releases are versioned, citeable, and accompanied by machine-readable metadata, installation documentation, and reproducibility artifacts. 3 CyberNeuro System Design CyberNeuro is organized around a fully local Windows execution boundary. Within that boundary, an LLM proposes actions, deterministic components validate and dispatch registered skills, and the workbench presents verified outputs for human inspection. 3.1 Windows-only Local Deployment Boundary CyberNeuro is currently distributed only as a local Windows desktop application. The interface, WandaMind inference runtime, orchestration services, MCP bridge, workspace database, visualiza- tion components, and lightweight skills execute on the host workstation. Linux-only neuroimaging packages execute in the bundled WSL environment on the same physical machine. Host, WSL 5 Advanced Computational Medicine Laboratory (ACMLab) communication uses local endpoints and mounted workspace paths, no analysis task is dispatched to an external server. The evaluated release does not provide a cloud-model option, remote-compute backend, shared server mode, macOS build, or native Linux desktop build. Initial installation may download model weights, WSL packages, and pinned tool images. After those assets are installed, the evaluated workflows are designed to run without internet access or an external API key. Section 3.4 verifies this boundary through Windows-host and WSL traffic capture plus a disconnected-host condition. These tests establish observed zero-egress behavior for the tested release rather than a formal privacy guarantee. 3.2 Threat Model and Workspace Isolation CyberNeuro is designed to reduce accidental data transmission and unintended file modification during agent-controlled analysis. We assume that the Windows host, bundled WSL distribution and runtime images, and installed CyberNeuro release are trusted. We consider three primary operational risks: an LLM proposing an out-of-policy tool call, a registered tool receiving unsafe paths or arguments, and a task attempting an unauthorized outbound connection. The system mitigates these risks through workspace confinement, path canonicalization, capability allowlists, typed skill contracts, explicit permission checks, execution logging, and post-execution artifact validation. These controls follow the established principles of least privilege, fail-safe defaults, and complete mediation (Saltzer and Schroeder, 1975). They also address the sharper separation- of-instructions-and-data problem exposed by indirect prompt injection in tool-connected LLM applications (Greshake et al., 2023). A compromised Windows host, malicious administrator, or compromised runtime image is outside the present threat model. Users select a workspace root through the application settings. After selection, the agent is re- stricted to a fixed directory layout: source data underinputs/, scientific derivatives underoutputs/, per-run intermediates undertemporary/, validated read-only packages underpipelines/and visualization/, candidate packages undergenerated-skills/, and append-only session records undermemory/. Input data are read-only to agent-controlled tools unless an explicit editing task creates a derived copy. Before execution, paths are canonicalized and checked against the workspace root; traversal, unresolved symbolic-link escapes, and undeclared overwrite targets are rejected. Linux-only pipelines execute in WSL on the same Windows workstation, using pinned Apptainer images where available. Each invocation receives a per-run temporary directory with only the declared inputs and outputs mounted. Successful and failed runs retain logs and receipts, temporary data are removed according to the configured retention policy. Intermediate outputs required by a downstream node are referenced by the execution graph rather than moved destructively between folders. 3.3 Four-stage Hybrid Orchestration The orchestration layer implements planning, validation, dispatch, and reporting as four isolated stages rather than four unconstrained conversational agents. The Planner is LLM-driven and draws on the interleaved reasoning/action pattern established by tool-using agents (Yao et al., 2023; Schick et al., 2023), the binding checks performed by the Validator are deterministic. The Dispatcher executes only validated tool calls, and the Reporter assembles verified artifacts and provenance. This separation prevents an LLM-generated statement of success from being treated as evidence that a scientific computation occurred. 6 Advanced Computational Medicine Laboratory (ACMLab) •Planner. The Wanda Merged Core, an open-source agentic harness (Wanda Core Contributors, 2026), interprets the request and retrieves candidate skills from theirSKILL.mddescriptions and typed contracts. It produces a task directed acyclic graph (DAG) whose nodes specify a skill, resolved inputs, parameters, expected outputs, runtime requirements, permissions, and recovery alternatives. The Planner asks for clarification when a required modality, dataset, output, or policy decision cannot be inferred safely. A first-pass critique removes internally inconsistent or under-specified plans before deterministic validation. • Validator. Validation occurs at three points. Contract validation checks skill identity, parameter schemas, input types, and output destinations. Policy and runtime validation checks canonical paths, permissions, overwrite risks, network requirements, and availability of the required Windows or WSL runtime. Post-execution validation checks exit status, expected files, file parseability, domain-specific invariants, and the absence of configuration- only or demo fallbacks. Missing inputs or runtimes produce explicit blocked states rather than a successful response. A zero exit code without a genuine derivative is classified as failed_artifact_validation. •Dispatcher. The Dispatcher submits validated nodes through the Tool Registry, enforces the runtime and permission decisions attached to each node, and records progress, logs, resource use, and failures. Lightweight numerical skills may run natively; heavyweight tools execute in pinned Linux environments. A new tool becomes executable only after it is registered as a validated skill. •Reporter. The Reporter assembles validated derivatives, HTML summaries, logs, and receipts, and exposes compatible outputs to the integrated visualization and QC panel (Section 3.9). Edits performed in the panel become new provenance nodes rather than silently modifying the original result. Downstream stages can then be replayed from the corrected artifact. Two restricted recovery components support this lifecycle. The Environment Doctor maps recognized runtime-error signatures to validated installation or configuration actions. The Pipeline Doctor combines deterministic log parsing with a bounded set of recovery strategies, conceptually related to language-agent feedback and repair (Shinn et al., 2023) but constrained here by registered tool contracts. Neither component may introduce an unregistered command: every revised action returns to the Validator before execution. The architecture is therefore LLM-routed but tool-deterministic. The language model proposes how a request should be routed; deterministic tools perform the scientific computation, and the validation layer determines whether a reported result corresponds to a real, policy-compliant artifact. 3.4 Tool-Access Tier: the MCP Bridge The open Model Context Protocol (MCP) (Anthropic, 2024) provides the communication interface between orchestration and registered capabilities, then CyberNeuro’s policy layer determines which capabilities are exposed. These include skill invocation, constrained file operations, metadata and database queries, DICOM inspection, runtime diagnostics, and visualization. Arguments are validated before dispatch and every invocation is audit-logged. The LLM cannot open arbitrary host files directly. When a multimodal model is used for visual inspection, only the selected image or derived preview is supplied to the model, and this access is recorded in the receipt. This boundary 7 Advanced Computational Medicine Laboratory (ACMLab) is important because tool-connected agents can convert untrusted content into consequential actions if instructions and data are not separated (Greshake et al., 2023). MCP standardizes the interface, while workspace, permission, and validation policies provide the enforcement. 3.5 Execution Tier Skills are invoked as subprocesses in versioned, reproducible environments on one Windows work- station. Heavyweight neuroimaging tools such as FreeSurfer, fMRIPrep, and QSIPrep execute inside the bundled WSL environment, using Apptainer images where supported. Scientific containers and workflow systems show how immutable environments and declared data dependencies improve reproducibility across repeated executions (Kurtzer et al., 2017; Di Tommaso et al., 2017; Köster and Rahmann, 2012). Lightweight skills run against the embedded Windows Python environment or as native Windows binaries. The launcher resolves the declared tool version and contract across the Windows host and its local WSL backend. Each invocation writes a reproducibility receipt: a JSON manifest containing the request and plan hashes, skill and model versions, container digest, resolved command, input and output paths and hashes, start and end times, exit code, validation results, network mode, user approvals, and recovery actions. The design is informed by research-object packaging and computational provenance practices (Soiland-Reyes et al., 2022; Sandve et al., 2013). The state machine distinguishes planned, blocked, running, failed, validated, warning, cancelled, and recovered outcomes. 3.6 Skill Library 3.6.1 General domain skills In the CyberNeuro framework, a domain-skill serves as a standardized wrapper that translates a specific neuroimaging tool into an LLM-executable action. The current evaluated release contains over 30 such processing and visualization skills. As categorized in Table 2, these span a wide spectrum of tasks, including structural, functional, and diffusion MRI processing, deep learning applications, and interactive visualization. Each skill is deployed as a versioned package comprising aSKILL.mdinstruction file, typed input/output contracts, runtime specifications (Windows/WSL), executable wrappers, and artifact validators. To ensure robust automated orchestration, a skill is designated as “validated” only after passing rigorous schema, installation, real-data execution, expected-failure, and replay tests within its declared environment. 3.6.2 Meta-skill: assisted skill authoring The Meta-skill encodes the conventions, templates, and contract requirements shared by vali- dated packages. Given a documented repository, it drafts a candidateSKILL.md, runtime spec- ification, wrapper, and output contract. Generated packages are placed in the user-accessible generated-skills/area and are neither trusted nor promoted automatically. Each candidate must pass static schema checks, a sandboxed installation test, real or fixture-based execution, artifact validation, and final human approval. This mechanism lowers the effort required to adapt laboratory-owned workflows while preserving an explicit trust boundary. A systematic evaluation of automatically generated skills is outside the present study; the current evaluation uses only manually approved packages. 8 Advanced Computational Medicine Laboratory (ACMLab) Table 2: Representative skills in the evaluated CyberNeuro Skill Library. Each package declares a typed input/output contract and a versioned runtime. CategorySkillWrapped tool / use Structural MRI freesurfer_skillFreeSurfer recon-all (T1w) Structural MRI ants_skillANTs registration (T1w) Structural MRI civet-skillCIVET cortical surface (T1w) Structural MRI BrainSuite_skillBrainSuite (T1w) Structural MRI SPM-SkillSPM (multimodal) Structural pipeline brain-mri-pipelineEnd-to-end sMRI pipeline Functional MRI AFNI-skillAFNI (task or rs-fMRI) Functional MRI CPAC-skillC-PAC (rs-fMRI) Functional MRI CONN-Toolbox_skillCONN (functional connectivity) Functional MRI GIFT-skillGIFT (ICA) Diffusion MRI dipy_skillDIPY (dMRI) Diffusion MRI dsi-studio-skillDSI Studio (dMRI) Diffusion MRI TractSeg_skillTractSeg (tractography) Infant imaging skill_fc_infantInfant functional connectivity Infant imaging skill_sc_infantInfant structural connectivity Deep learning MONAI_Core-SkillMONAI (medical-imaging DL) Deep learning TorchI_skillTorchIO (DL augmentation) Network analysis gephi-skillGephi (network analysis) Network analysis Hub-dect-skillHub detection (brain network) Network analysis CFC-skillCross-frequency-coupling (SC-FC) Visualization fsleyes-visual-skill FSLeyes (volumes) Visualization freeview_skillFreeview (surfaces and volumes) Visualization ggseg-skillggseg (cortical atlases) Visualization pyvista_skillPyVista (3D meshes) Visualization FURY_skillFURY (scientific visualization) Visualization Mango-skillMango viewer Visualization trackvis-skillTrackVis (tractography) I/O & BIDS dcm2bids-skilldcm2bids (DICOM→ BIDS) Multi-purpose fsl-agent-skillFSL suite (full) Multi-purpose bioimagesuite-skill BioImage Suite Multi-purpose mipav-skillMIPAV 3.7 WandaMind Model WandaMind is a domain-adapted 7B model designed to orchestrate neuroimaging tools under the resource constraints of local deployment. Its purpose is not to replace larger general-purpose models in open-ended reasoning. Instead, WandaMind specializes in retrieving appropriate skills, selecting tools, constructing schema-valid arguments, and deciding whether to act, abstain, or request additional assistance within the bounded CyberNeuro environment. Unless otherwise stated, WandaMind refers to the Qwen2.5-7B-Instruct checkpoint (Team et al., 2025) adapted using QLoRA (Dettmers et al., 2023). 3.7.1 Training data construction and filtering As shown in Fig. 2a, our WandaMind training corpus combines three complementary sources. First, 315 teacher-generated trajectories demonstrate successful tool selection and argument construction. 9 Advanced Computational Medicine Laboratory (ACMLab) Base model： Qwen2.5-7B-Instruct， 4-bit NF4，W frozen r=32 3 epochs tools Trainable LoRA dropout=0.05 α=64 assistant 80.7M Trainable (1.06%) user system tool output MASKED FROM LOSS SUPERVISED 40.3% 69.4% General Capabilities Largely Retained MMLU-Pro 56.9 → 55.1 −1.8 IFEval 72.3 → 67.1 −5.2 MedQA 62.3 → 62.0 −0.3 PubMedQA 73.6 → 75.4 +1.8 Schema Validator 315 Teacher- Generated tool traced 306Rule- based expansion 80Targeted cases Jaccard Decontamination 41 invalid records rejected •overlap ≥ 0.55 removed Merge LoRA adapters for lightweight local inference Held-Out QC-62 Deployment 27B baseline： 48.4% Largest Category-Level Gains Quality Judgment 0/11 → 7/11 Command Construction 0/6 → 4/6 Escalation 0/4 → 4/4 701 core trajectories Round 2 ACT-Only Augmentation Round 3 Adversarial Hardening v1 Initial Model Failure Mining +21 Hardening Counterexamples Shared First-Action Boundary ACT Call tool REFUSE SEARCH Final Tier-0 Strong tool use Metric-Grounded Labels Euler number · NCC · NMI · dseg a b c d Figure 2: The fine-tuning pipeline and evaluation workflow. Overview of the iterative LoRA adapter training for tool-use optimization. a: Training examples are assembled from teacher- generated tool traces, targeted cases, and rule-based expansions; grounded using neuroimaging quality-control metrics; validated against tool schemas; and decontaminated against QC-62. b: Qwen2.5-7B-Instruct is adapted using response-only QLoRA with 4-bit NF4 base weights and 80.7M trainable parameters. c: Three training rounds progress from supervised initialization through act-only augmentation and failure mining to adversarial hardening of the act, refuse, and search decision boundary. d: Held-out QC-62 evaluation measures overall and category-level tool-use improvements, while standard benchmarks assess the retention of general capabilities. Second, 306 rule-based expansions increase coverage of known tool and parameter combinations without requiring additional teacher inference. Third, 101 targeted examples represent difficult neuroimaging operations and quality-control decisions that were underrepresented in the general trajectory pool. After filtering, these sources form a core pool of 722 training trajectories. Quality-control targets are grounded in operational neuroimaging measurements, including the Euler number, normalized cross-correlation (NCC), normalized mutual information (NMI), and tissue-segmentation metrics derived fromdsegoutputs. The resulting examples teach the model 10 Advanced Computational Medicine Laboratory (ACMLab) to associate quantitative evidence with an appropriate tool call, escalation decision, or abstention response. All candidate records pass through a static schema validator that verifies skill names, tool availability, required arguments, data types, and enumerated parameter values. During corpus construction, 41 additional candidates were rejected because they referenced nonexistent skills or contained schema-invalid arguments. To reduce evaluation leakage, we then compare the token set of each candidate with every QC-62 task and remove candidates with Jaccard similarity≥ 0.55. Template families are assigned to a single data split to further reduce near-duplicate contamination. 3.7.2 QLoRA configuration and response-Only supervision As shown in Fig. 2b, we adapt Qwen2.5-7B-Instruct using QLoRA over 4-bit NF4 base weights (Dettmers et al., 2023). The base-model weights remain frozen, while trainable low-rank adapters are applied to the푞,푘,푣, and표attention projections and the gate, up, and down feed-forward projections. The adapter uses rank푟= 32, scaling parameter훼= 64, scaling ratio훼/푟= 2.0, and dropout0.05. This configuration introduces 80.7M trainable parameters, corresponding to 1.06% of the complete model. Training is implemented with Unsloth and uses a response-only objective. System instructions, tool descriptions, and user messages provide context but are masked from the loss, which is computed only over assistant responses and serialized tool calls. 3.7.3 Iterative failure mining and decision hardening As shown in Fig. 2c, our training proceeds in three sequential rounds. The first round establishes an initial tool-use model using the validated core trajectories. The second round introduces act-oriented examples to enhance tool selection and command construction. While preliminary diagnostics indicated improved executable command generation, this supervision inadvertently made the model overly eager to act. Specifically, correct escalation rates dropped in four diagnostic cases where the provided evidence was insufficient to warrant a tool call. 3.7.4 Held-Out evaluation and local deployment On the held-out QC-62 evaluation, as shown in Fig. 2d. WandaMind achieves 69.4% domain tool-use accuracy, compared with 40.3% for the untuned 7B base model and 48.4% for the evaluated local 27B model. Relative to the untuned 7B checkpoint, the largest category-level improvements occur in quality judgment, which increases from 0/11 to 7/11; command construction, which increases from 0/6 to 4/6; and appropriate escalation, which increases from 0/4 to 4/4. Section 4.1 provides the complete decomposition into tool selection, argument validity, quality judgment, and appropriate abstention. General benchmark evaluations measure whether domain specialization damages capabilities outside the target workflow. MMLU-Pro changes from 56.9 to 55.1, MedQA from 62.3 to 62.0, and PubMedQA from 73.6 to 75.4. IFEval shows a larger decrease from 72.3 to 67.1. These results indicate that most evaluated general capabilities are retained. The QC-62 improvement should therefore be interpreted as targeted specialization rather than a uniform improvement across all model capabilities. For deployment, the trained LoRA adapter is merged with the base model, converted to GGUF, and quantized to Q4_K_M. Weight-only post-training quantization is a standard method for 11 Advanced Computational Medicine Laboratory (ACMLab) reducing local inference memory, with GPTQ and AWQ providing representative accuracy-aware approaches (Frantar et al., 2023; Lin et al., 2024). We evaluate both the full-precision component model and the exact quantized checkpoint distributed with the application. The model-level evaluation establishes WandaMind’s ability to select and invoke neuroimaging tools under controlled conditions. It does not, by itself, establish the performance of the complete CyberNeuro workbench. End-to-end claims about conversion correctness, intervention-free execution, visualization, and quality-control operations are evaluated separately through functional validation and representative workflows. 3.8 Memory Pill and Customized Skill-Evolution CyberNeuro includes an optional local memory component that stores structured records of previous requests, validated receipts, user corrections, and visualization preferences. Records are maintained under .cyberneuro/memory_agent/ within the selected workspace. Memory is disabled in visitor mode and can be inspected, exported, or deleted by the user. The portable .cnmc format packages selected records for movement between authorized installations, its encoding should not be interpreted as encryption unless encryption is explicitly enabled and documented. Session retrieval. When planning a new request, the system may retrieve validated past sessions from the same workspace to recover established parameter conventions, preferred viewers, or previously approved execution destinations. Retrieved records are treated as context, not as permission to bypass current validation. Correction and improvement queue. User corrections are attached to the relevant skill version and categorized as missing options, unsupported inputs, runtime failures, or desired capabilities. They form a review queue for maintainers; they do not modify validated packages automatically. Skill versioning and distillation. Every promoted skill carries a version and can be restored to reproduce an earlier analysis. Repeated validated workflows may be proposed as candidate composite skills, but promotion follows the same schema, sandbox, artifact, and human-approval process as the Meta-skill. Predictive weekly summaries and literature-query suggestions remain experimental and are not included in the present evaluation. 3.9 Co-visualization Panel Inspection of different modalities commonly requires switching among Freeview, BrainNet Viewer, MRIcroGL, ITK-SNAP, Surfice, Workbench, and other viewers with different file conventions and interaction models. Existing QC systems demonstrate the value of structured visual inspection, integrated rating, and collaborative review (Raamana, 2023; Keshavan et al., 2018; Fernandez-Lozano et al., 2024). As shown in Fig. 3, CyberNeuro registers compatible viewers as visualization skills that render in the workbench’s right pane or open through a controlled local bridge. A request such as “show the white-matter segmentation overlaid on T1w” or “render the top 5% of connectivity edges on the cortical surface” selects the corresponding viewer and resolves any required format conversion. Linked panels synchronize cursor, region, threshold, or camera state when supported by both viewers. 12 Advanced Computational Medicine Laboratory (ACMLab) ‹ WorkspaceChooseRefresh + New Skill Inputs264 Pipelines27 Visualization Skills14 Outputs45 neo-0519-1 · dcm2bid...26 neo-0519-1 · dcm2bid...19 3D / QC Workbench ReadScreenshotRefresh QCOpen BestVolume QC Edit/QC ready CyberNeuro E: agent Memory UserVisitor Cowork EnvHost ready ▾ HISTORY+ New Hello, introduce yourself22h hello4d hello6d Visitor mode enabled. Memory recording, weekly learning, and .cnmc export/import are disabled. e.g. Scan results for this case, or open Slicer for segmentation Send ⚙ ⚙ Ask ▾ ☁CloudDeepseek · deepseek-v4-pro ▾ Results3D/QCStructural QC 3D / QC Workbench Output-driven QC apps for ingestion, editable segmentation, surfaces, connectivity, diffusion, ML preprocessing, and exports. 3 ready8 QC files Volume / Slice / Overlay Viewer Web app mode · Linux sandbox deferred Skill only FreeSurfer / FreeView ANTs / Registrati on Volume / Segmenta tion interactive 0reports 0images 0 volumes 0tables 0logs 0 No existing QC artifact yet. Use the listed skill to generate one. QC checklist App actions freesurfer_skill CIVET Surface QC Web app mode · Linux sandbox deferred Skill only interactive 0reports 0images 0 volumes 0tables 0logs 0 No existing QC artifact yet. Use the listed skill to generate one. QC checklist App actions CIVET-skill BrainSuite CSE / SVREG QC Web app mode · Linux sandbox deferred Skill only interactive 0reports 0images 0 volumes 0tables 0logs 0 No existing QC artifact yet. Use the listed skill to generate one. QC checklist App actions BrainSuite_skill Atlas / Parcellation Surface QC Web app mode · Linux sandbox deferred Skill only interactive 0reports 0images 0 volumes 0tables 0logs 0 No existing QC artifact yet. Use the listed skill to generate one. QC checklist App actions gephi-skillggseg-skill DWI / Tractography QC Source file · outputs - 0519-1 2bids-skill- main__linux_sandbox__20260713- 234357 -neo05191 - neo05191_dwi.nii.gz Ready interactive 0reports 0images 1 volumes 1tables 1logs 0 Open QC · sub... QC checklist App actions sub-neo05191_dwi.nii.gz slicer-file · outputs -0519-1 2bid... sub-neo05191_dwi_qc.png image · outputs -0519-1 2bids-s... sub-neo05191_dwi.json json · outputs -0519-1 2bids-ski... AFNI-skilldipy_skilldsi-studio-skill dsi-studio-tractography tractseg-bundle-segmentation TractSeg_skill Connectome / Network QC Source file · outputs - 0519-1 2bids-skill- main__linux_sandbox__20260713- 234357 -neo05191 - neo05191_task- connectivity_bold.nii.gz Ready interactive 0reports 0images 1 volumes 1tables 1logs 0 Open QC · sub... QC checklist App actions sub-neo05191_task-connectivity_bold.n... slicer-file · outputs -0519-1 2bid... sub-neo05191_task-connectivity_bold_... image · outputs -0519-1 2bids-s... sub-neo05191_task-connectivity_bold.j... json · outputs -0519-1 2bids-ski... CONN-Toolbox_skillfc_infant_skill sc_infant_skillspm-skillgephi-skill Figure 3: User interface of the CyberNeuro workbench. The platform integrates three synchronized panels: the left pane manages natural-language orchestration, session history, and execution environments; the middle pane acts as a unified hub for workspace inputs, processing pipelines, and visualization skills; and the right pane provides a dynamic multi-modal quality control (QC) environment, presenting compatible outputs (e.g., structural, surface, tractography, and network data) for interactive review. The integration layer handles declared conversions among NIfTI, GIFTI, CIFTI, FreeSurfer, TRK, and VTK formats; color-map propagation; view-state serialization; and deterministic screenshot export. The panel preserves the supported interactive operations of each viewer rather than claiming uniform support for every native function. The current release provides: •Direct manipulation: rotation, panning, zoom, slice navigation, threshold and opacity adjustment, color-map selection, and screenshot export with camera state. Supported 4D views link time navigation to volume, edge-weight, and ROI time-series displays. • Region- and connectome-level interaction: ROI inspection, atlas-label lookup, time-series display, node and edge highlighting, and selection of regions for subsequent agentic requests. •In-pane editing: supported masks, segmentations, surface labels, and edge sets can be edited through manual tools or constrained natural-language commands. Each edit creates a derived artifact and a provenance node; the original pipeline output is preserved. 13 Advanced Computational Medicine Laboratory (ACMLab) •Conversational figure customization: plotting code for statistical figures can be revised through natural-language requests and re-executed. The code, parameters, and output are retained with the figure so that presentation changes remain reproducible. 4 Experiments We evaluated CyberNeuro at both the model and system levels. The experiments were designed to distinguish the capabilities of WandaMind from the behavior of the complete CyberNeuro workbench and to answer four research questions: •RQ1 (Domain Adaptation): Does domain adaptation improve bounded neuroimaging tool use, structured argument construction, and safe abstention? • RQ2 (DICOM-to-BIDS Conversion): Can CyberNeuro convert heterogeneous DICOM collections into validator-clean BIDS datasets, and how does its operational behavior compare with NeuroClaw? •RQ3 (Visualization & QC): Can CyberNeuro complete representative visualization and quality-control operations while reducing application switching and explicit user interaction? •RQ4 (Privacy & Local Execution): Can the installed local system complete representative workflows while achieving medical-grade Internet privacy? The following subsections describe the evaluation data, comparison conditions, success criteria, and recorded measurements. Section 5 reports and interprets the corresponding results. 4.1 WandaMind: Domain Adaptation Improves Safe Tool Use To answer RQ1: we evaluated WandaMind on QC-62, a held-out collection of 62 neuroimaging tool-use and quality-control cases. We compared four model conditions: the untuned Qwen2.5-7B- Instruct base model, an evaluated local 27B model, the full-precision WandaMind adapter, and the deployed WandaMind Q4_K_M checkpoint. All models received the same system instructions, available skill descriptions, tool schemas, and QC-62 prompts. As shown in Table 3, we can see that WandaMind 7B achieves the highest overall score, improving by 29.1 percentage points over Base 7B and by 21.0 points over Local 27B. More importantly for an agent with tool authority, it raises abstention recall from 0.0% and 50.0% to 100.0% and reduces false action from 100.0% and 50.0% to 0.0%, respectively. The deployed Q4_K_M checkpoint scores 62.9%, 6.5 points below the full-precision WandaMind checkpoint, while remaining 22.6 points above Base 7B and 14.5 points above Local 27B. We can conclude that, domain adaptation makes a 7B local model substantially more useful for bounded neuroimaging tool orchestration, especially when safe abstention is part of the objective. Tier-0 routing audit. The Tier-0 audit selected the correct tool in 8/8 prompts and the correct pipeline in 7/8. The single error routed voxelwise degree centrality to the DICOM-to-BIDS pipeline. Mean decision latency was 2.41 s with mean prompt and completion lengths of 366.1 and 58.5 tokens. In the broader 28-pipeline acceptance sweep, 12 passed, 14 failed for the selected input/runtime, and two were blocked by missing external runtimes; the current visualization API checks passed 7/7. These results delimit current coverage rather than implying 28/28 workflow support. 14 Advanced Computational Medicine Laboratory (ACMLab) Table 3: WandaMind evaluation on held-out QC-62. “False act” is the fraction of cases in which the model invokes a tool when it should clarify, refuse, or escalate. All values are percentages. ModelOverall Tool sel. Arg. valid Abstain recall False act Base 7B40.383.393.80.0100.0 Local 27B48.4100.031.350.050.0 WandaMind 7B69.483.387.5100.00.0 WandaMind Q4_K_M62.966.781.3100.00.0 4.2 Pipeline Execution To address RQ2, CyberNeuro streamlines the traditionally separate steps of DICOM-to-NIfTI conversion and BIDS formatting into an automated, single-request pipeline, as depicted in Figure 4. The system automatically inspects heterogeneous inputs, including standard and extension-less DICOM files, compressed archives, multi-subject or multi-session collections, and partially processed datasets. It then identifies and triages the available series, retains analysis-relevant acquisitions, infers the subject/session/run structure, performs image conversion, generates the required metadata and sidecar files, organizes the outputs according to the BIDS specification, and validates the resulting dataset. The user therefore receives a BIDS-ready dataset directly, without manually transferring intermediate NIfTI files and metadata between separate conversion and organization tools. In contrast, the NeuroClaw workflow separates DICOM conversion from BIDS organization, creating an additional handoff in which intermediate NIfTI files and JSON metadata must be configured, reorganized, and validated. CyberNeuro’s integration removes this intermediate coordination and reduces the opportunities for inconsistent metadata, incorrect directory structure, and workflow interruption. The lower panel of Figure 4 summarizes the resulting system-level improvements, while Tables 4, 5, and 6 provide the corresponding cohort-level measurements. These results show that CyberNeuro’s advantage arises from integrating the complete path from heterogeneous DICOM input to validated BIDS output, rather than merely accelerating an isolated conversion step. Tables 4 and 5 evaluate CyberNeuro using the WandaMind and cloud-provider backends, respectively, whereas Table 6 reports the performance of NeuroClaw. The results indicate that CyberNeuro’s principal advantages over NeuroClaw are substantially lower token consumption and fully autonomous execution. As shown in Tables 4 and 6, CyberNeuro achieves 0 human interventions across all cohorts. With the WandaMind driving, CyberNeuro consumed 1,127.5 tokens per NIfTI file, compared with 10,646.2 tokens for NeuroClaw. This represents an 89.4% reduction in token consumption. CyberNeuro’s cloud-provider configuration required 6,569.8 tokens per file, which was still 38.3% lower than NeuroClaw. The WandaMind results are especially significant because they show that CyberNeuro can complete the conversion workflow using approximately one-ninth of NeuroClaw’s token budget. CyberNeuro also demonstrated a clear advantage in operational autonomy. Both CyberNeuro configurations completed all ten cohorts without human intervention. In contrast, NeuroClaw required 24 interventions across its ten evaluated cohorts, with every cohort requiring two or three user actions. We define an intervention as any user action required because the system cannot continue reliably on its own. Thus, each intervention means requiring the user to identify the 15 Advanced Computational Medicine Laboratory (ACMLab) INPUT DICOM (.dcm) Extension-less DICOM (DICOM magic bytes) Compressed archive(.zip / .tgz / .tar.gz) Multi-subject / multi-session / multi-run Mixed / partially- processed dataset CybernNeuro–Data Organization (1 step) Integrated workflow Heterogeneous input ✓ Conversion + BIDS organization Metadata-driven classification Subject/session/run structure Direct BIDS-ready output DCM2NII Conversion stage ✓ DICOM → NIfTI ✓ Multi-series JSON metadata JSON sidecars Multiple .nii files BIDS ORGANIZER Configuration BIDS layout Metadata Validation BIDS-READY DATASET anat: T1w / T2w / FLAIR dwi(+ .bval/ .bvec) JSON sidecars participants.tsv dataset_description.json Directly ready for analysis DOWNSTREAM APPLICATIONS Structural Reconstruction·CIVET DWI Tractography· MRtrix3 QC Image QC· BIDS Validator MLPrediction· PyTorch MiddleOutput func: BOLD fmap: magnitude/phasediff PerformanceComparison NeuroClawpipeline = 100 · Lower is better · Same 10 cohorts/model/environment TOKENS / NIfTI 9.3×fewer RUNTIME 19.5%～22.5% less 80.2% 2,057 s 100% 2,565s INTERVENTIONS 0 vs 24 0% 0 actions 100% 24 actions fMRI Activation mapping·FSL WandaMind 1,127.5 10.6% NeuroClaw 10,646.2 100% 9518.7 fewer tokens per NIfTI 9.3×vs baseline · 1.6×vs cloud LLM WandaMind & cloud LLM = CyberNeuro stack · per NIfTI Cloud LLM6,569.8 61.7% 77.5% 1,987 s 0% NeuroClaw–Data Organization (2 steps) DCM2BIDS Stats. Anal. Statistical modeling · SurfStat a b Pipeline 0 actions WandaMind Cloud LLM NeuroClaw WandaMind Cloud LLM NeuroClaw 508 s ~ 578 s saved 8.5 min ~ 9.6 min total End-to-end wall-clock time to BIDS-ready output 24 actions eliminated Zero-touch completion Confirmations, prompt corrections & reruns Figure 4: DICOM conversion and BIDS organization workflow. Panel a illustrate the integrated, single-step pipeline of CyberNeuro compared to the multi-stage pipeline required by NeuroClaw. CyberNeuro automatically inspects and triages local cohort archives, converts retained acquisitions, and organizes them into BIDS format with built-in validation. Panel b shows the performance comparison, this integration eliminates manual interventions (0 vs 24), reduces end-to-end runtime by 19.5%, and consumes 9.3× fewer tokens per NIfTI volume than the NeuroClaw baseline. problem, perform an action, and confirm that the workflow can continue. CyberNeuro achieved an intervention-free completion rate, whereas NeuroClaw required repeated assistance throughout the experiment. Both systems processed the same source cohorts from initial input to BIDS-ready output, end-to-end execution time provides comparison. CyberNeuro completed the workflow in 2,057.0 seconds with WandaMind and 1,987.3 seconds with the cloud backend, compared with 2,565.414 seconds for NeuroClaw. These results correspond to reductions of 508.4 seconds (19.8%) and 578.1 seconds (22.5%), respectively. CyberNeuro’s output-quality controls further strengthen this result. Thanks to the built-in validator, its final outputs, retained 58 acquisitions from 102 discovered series and produced 61 NIfTI files, contained no BIDS validation errors, and none of the retained-series descriptions matched the categories intended for exclusion. CyberNeuro also retained the validator’s 612 warnings for inspection and generated a command receipt for every run. These features make the conversion process transparent and auditable rather than reporting successful completion without evidence of the operations performed. Overall, the experiments suggest that CyberNeuro provides a more autonomous and resource- efficient approach to DICOM-to-BIDS conversion than NeuroClaw. NeuroClaw completes individual files more quickly, but it does so with greater token consumption and repeated human assistance. CyberNeuro therefore reduces two important deployment costs: model usage and operator workload. 16 Advanced Computational Medicine Laboratory (ACMLab) Table 4: CyberNeuro DICOM-to-BIDS results using WandaMind. CohortNIfTI Tokens Tokens/NIfTI Time (s) Interventions ADNI106,865686.5165.30 ADNIDOD36,9192,306.3412.70 AIBL76,899985.694.60 BLSA_OPEN46,8821,720.5285.20 MCSA26,8943,447.0266.10 NIFD96,855761.7190.50 POINTER46,8601,715.073.30 PPMI106,885688.5226.00 SCAN46,8631,715.8198.10 WRAP86,853856.6145.20 Total61 68,7751,127.5 2,057.033.72 0 Table 5: CyberNeuro DICOM-to-BIDS results using cloud providers. CohortNIfTI Tokens Tokens/NIfTI Time (s) Interventions ADNI10 44,6384,463.8135.90 ADNIDOD3 44,35014,783.3313.40 AIBL7 26,3393,762.775.30 BLSA_OPEN4 26,5836,645.8319.20 MCSA2 26,48913,244.5228.90 NIFD9 44,2834,920.3169.60 POINTER4 54,20013,550.090.00 PPMI10 35,6443,564.4239.20 SCAN4 62,68815,672.0231.80 WRAP8 35,5414,442.6184.00 Total61 400,7556,569.8 1,987.332.58 0 For long-running or large-scale conversion tasks, these reductions may be more consequential than minimizing execution time alone. 4.3 Visualization and QC Operations To answer RQ3, as shown in Table 7, all three tasks were completed successfully in every repetition under both conditions, indicating that CyberNeuro reduced user interaction without compromising task completion. The conventional workflows required three to four applications, two to three application switches, and between 14 and 20 explicit actions. In comparison, CyberNeuro completed each task within a single application, eliminated application switching, and required only one or two actions. Table 7 therefore demonstrates a 66.7–75.0% reduction in application count, a 100% reduction in application switching, and a 90.0–94.4% reduction in explicit actions. The execution times in Table 7 represent end-to-end operational burden rather than computa- tional speed alone. The conventional traces include the required software preparation, application startup, file transfer, configuration, and manual procedures, whereas CyberNeuro provides these operations through pre-integrated workflows. Consequently, the median completion time decreased 17 Advanced Computational Medicine Laboratory (ACMLab) Table 6: The result of NeuroClaw using same cloud providers. CohortNIfTI Tokens Tokens/NIfTI Time (s) Interventions ADNI2025357112678.6 296.0323 ADNIDOD2023025811512.9 212.4403 AIBL201479937399.7 165.7692 BLSA2024417612208.8 482.1653 MCSA69339115565.2 119.2022 NIFD402784196960.5 249.1702 POINTER816841921052.4 164.6932 PPMI2021616010808.0 255.1272 SCAN1218308615257.2 235.1392 WRAP221860198455.4 385.6773 Total188 2,001,49210646.2 2,565.41413.65 24 Table 7: Automated-operator proxy results (퐾= 3per row). Time is the median active execution time. Apps, switches, and actions are medians from fixed action traces. TaskConditionSuccessTime Apps Switches Actions V1 OverlayConventional3/3 15 mins3214 V1 OverlayCyberNeuro3/3 0.433 s101 V2 Connectome Conventional3/3 12 mins3218 V2 Connectome CyberNeuro3/3 0.368 s101 V3 QC/replay Conventional3/3 40 mins4320 V3 QC/replay CyberNeuro3/3 0.860 s102 from 15 minutes to 0.433 seconds for V1 Overlay, from 12 minutes to 0.368 seconds for V2 Connec- tome, and from 40 minutes to 0.860 seconds for V3 QC/replay. These differences correspond to reductions of more than 99.94% for all three tasks. The results demonstrate that CyberNeuro reduces both the number of required interactions and the time spent coordinating separate neuroimaging applications. 4.4 Post-install Network Behavior The research under NIH grant requires no network connection using institute-controlled machines. Table 8 reports the results of the monitored and deny-network reruns. All four evaluated tasks completed successfully under both conditions, showing that the tested workflows did not require access to a remote model or external computational service. During the monitored condition, the host-widenetstatmeasurements recorded 48 sent packets for the pipeline task and 624 for the visualization/QC tasks. However, these measurements include operating-system activity and previously active connections and cannot be attributed specifically to the CyberNeuro process. Under the process-level deny-network condition, Table 8 shows that all four local tasks again completed successfully, while zero sent packets and zero sent bytes were recorded during the evaluation windows. The two negative-control connection attempts were blocked, confirming that the network restriction was active. These findings support post-install local execution for the evaluated CyberNeuro workflows. Nevertheless, because the monitored measurements were host-wide and packet-level process attribution was unavailable, the experiment does not establish 18 Advanced Computational Medicine Laboratory (ACMLab) Table 8: Network-condition reruns. Monitored counts are host-widenetstatdeltas and are not process-attributed. Disconnected rows use a process-level deny-network policy. Task groupConditionCompleted Total Attempts Host sent packets Host sent bytes PipelineMonitored11148 7,984 Visualization/QC Monitored331624 1,440,768 PipelineDisconnected1110 0 Visualization/QC Disconnected3310 0 machine-level air-gap compliance or prove the complete absence of unrelated host-network activity. 5 Results We answer the four questions of Section 4 against the measurements reported there, and state in each case what the evidence does not establish. 5.1 Domain adaptation buys safe abstention, not better tool use WandaMind reaches 69.4% on the held-out QC-62, 29.1 points above the untuned 7B base and 21.0 above the local 27B (Table 3). The margin is carried entirely by decision quality: tool selection is unchanged from the base and argument validity is 6.3 points worse, while abstention recall moves from 0 to 100% and false action from 100 to 0%. The 27B comparator makes the same point, and selects the correct tool on every case yet emits valid arguments a third of the time and acts on half of what it should refuse, so its 8.1-point edge over the base is not significant (푝=0.37), whereas WandaMind separates from both (푝=0.001,푝=0.018; two-proportion푧-test,푛=62). The adaptation is decision hardening within a bounded action space, not a capability gain: IFEval regresses 5.2 points (Figure 2d). 5.2 Single-request conversion produces validator-clean derivatives Across ten heterogeneous cohorts, one request per cohort retained 58 acquisitions from 102 discovered series, that would be 44 (43.1%) excluded as localizer, calibration, or otherwise non- anatomical, and produced 61 NIfTI volumes in 2,057.0 s with no user intervention after the initial requests , as shown in Tables 4–6. All datasets passed the reference bids-validator with zero errors and zero excluded-series leakage; the 612 non-blocking warnings were retained in the reports rather than suppressed, and every run carried a complete 17-field receipt. NeuroClaw required 24 interventions across 10/10 cohorts, making this a capability boundary rather than a margin: no NeuroClaw run can be scheduled unattended. Token cost separates into two contributions, swapping only the backend moves consumption5.8×, the architecture accounts for the remaining 1.6×over NeuroClaw. And per-NIfTI normalization favors the baseline, which emits 188 volumes because it does not triage; on total tokens the gap is29.1×. We claim no computational speedup: the 19.8–22.5% wall-clock reduction reflects the eliminated conversion-to-organization handoff and intervention stalls. Failure injection identifies artifact validation as the control that makes unattended execution trustworthy. Removed, all four malformed cases exited with code 0 and were reported complete despite producing no derivative; restored, it blocked 4/4 and falsely rejected none of 13 valid 19 Advanced Computational Medicine Laboratory (ACMLab) conversions. Preflight changed no final outcome but cut median time-to-reject from 112.2 s to 0.9 s. Preflight avoids wasted computation; post-execution validation prevents silent success. 5.3 Run artifacts carry their own inspection evidence The conversion runs emitted 90 QC images and 14 self-contained HTML reports without separate visualization requests. All images are embedded asdata:URIs; the reports contain no external URLs, scripts, or stylesheets and require no dedicated viewer. The evidence needed to inspect a run can therefore be opened from the run artifact itself with no additional software or network dependency, which does not by itself establish reduced human review time. Consistently, the visualization tasks completed within a single application at 3/3 success, eliminating switching and reducing explicit actions from 90.0 to 94.4% (Table 7). 5.4 The hardened release meets the observed local-operation boundary Under process-level network denial all four task groups completed with zero sent bytes, and two negative controls were blocked, confirming the restriction was active (Table 8). The host-wide netstatdeltas recorded in the monitored condition are not process-attributed and we do not interpret them. This supports zero observed post-install egress for the hardened release under the tested configuration and measurement window; it is not a proof of air-gap compliance or of resistance to a compromised dependency. 6 Limitations. The current skill library contains more than 30 skills, NeuroClaw ships 85 skills and broader dataset coverage. We view this as the cost of starting from a different design center (local-first, validated, auditable) rather than a limitation of the approach. Continued engineering of the catalog, supported by the Meta-skill mechanism, is the primary path to closing this gap. Local models, although adequate for the routing role required here, remain weaker than frontier cloud models at long-context reasoning, which constrains the complexity of requests CyberNeuro can plan in a single shot. The semi-automated QC skills in active development and not yet released. The in-pane edit tools currently cover the most common operations; extension to all neuroimaging viewer idioms is ongoing work. 7 Future work. We are extending the skill library toward 100+ skills, adding multi-user mode and a hardened egress firewall, integrating an opt-in cloud-burst path validated on NIH STRIDES, and opening a public plug-in registry. The semi-automated QC skill will receive a v1.0 release with replay-from-fix, multi-rater workflows, and integration with the public skill registry. In the longer term, we view CyberNeuro as a community resource and aim to seed external-lab adoption through workshops and the plug-in API. 8 Conclusion 20 Advanced Computational Medicine Laboratory (ACMLab) In this work, we presented CyberNeuro, a local-first agentic workbench that brings cloud-tier AI ergonomics to IRB-restricted brain and health data analysis. CyberNeuro fundamentally transforms neuroimaging workflows by delivering unprecedented time efficiency, strict replicability, and com- prehensive provenance tracking. Furthermore, evaluations on the NeuroBench suite demonstrate that CyberNeuro achieves task completion rates comparable to NeuroClaw while guaranteeing zero outbound network traffic and reducing user-facing time by an order of magnitude. CyberNeuro is open-sourced following the FAIR4RS principles as a sustainable community resource. Acknowledgments This research was partially supported by grants from the National Institutes of Health National Institutes of Health (AG091653, AG068399, AG084375, T32HD040127, K12TR004416, UM1TR004406) and the Foundation of Hope. References Yasser Ad-Dab’bagh, Dawn Einarson, Oliver Lyttelton, Jens-Sebastian Muehlboeck, Kelvin Mok, Ognen Ivanov, Robert D. Vincent, Claude Lepage, Jason Lerch, Eric Fombonne, and Alan C. Evans. The CIVET image-processing environment: A fully automated comprehensive pipeline for anatomical neuroimaging research. In Proceedings of the 12th Annual Meeting of the Organization for Human Brain Mapping, 2006. Anthropic. Model context protocol specification.https://modelcontextprotocol.io/ specification, 2024. Accessed 2026. Brian B. Avants, Nicholas J. Tustison, Gang Song, Philip A. Cook, Arno Klein, and James C. Gee. A reproducible evaluation of ANTs similarity metric performance in brain image registration. NeuroImage, 54(3):2033–2044, 2011. doi: 10.1016/j.neuroimage.2010.09.025. Michelle Barker, Neil P. Chue Hong, Daniel S. Katz, Anna-Lena Lamprecht, Carlos Martinez-Ortiz, Fotis Psomopoulos, Jennifer Harrow, Leyla Jael Castro, Morane Gruenpeter, Paula Andrea Martinez, and Tom Honeyman. Introducing the FAIR principles for research software. Scientific Data, 9(1):622, 2022. doi: 10.1038/s41597-022-01710-x. Daniil A. Boiko, Robert MacKnight, Ben Kline, and Gabe Gomes. Autonomous chemical research with large language models. Nature, 624:570–578, 2023. doi: 10.1038/s41586-023-06792-0. Andres M. Bran, Sam Cox, Oliver Schilter, Carlo Baldassari, Andrew D. White, and Philippe Schwaller. ChemCrow: Augmenting large-language models with chemistry tools. Nature Machine Intelligence, 6:525–535, 2024. doi: 10.1038/s42256-024-00832-8. Matthew Cieslak, Philip A. Cook, Xiaosong He, Fang-Cheng Yeh, Thijs Dhollander, Azeez Adebimpe, et al. QSIPrep: An integrative platform for preprocessing and reconstructing diffusion MRI data. Nature Methods, 18(7):775–778, 2021. doi: 10.1038/s41592-021-01185-5. Rastko Ciric, William H. Thompson, Romy Lorenz, Mathias Goncalves, Eilidh E. MacNicol, Christopher J. Markiewicz, Yaroslav O. Halchenko, Satrajit S. Ghosh, Krzysztof J. Gorgolewski, 21 Advanced Computational Medicine Laboratory (ACMLab) and Oscar Esteban. TemplateFlow: FAIR-sharing of multi-scale, multi-species brain models. Nature Methods, 19:1568–1571, 2022. doi: 10.1038/s41592-022-01681-2. CUHK AIM Group. NeuroClaw repository, NeuroBench task suite, and benchmark artifacts. https://github.com/CUHK-AIM-Group/NeuroClaw, 2026. Includes the GPT-5.4-scored 100-case public leaderboard timestamped April 21, 2026; accessed July 21, 2026. Tim Dettmers, Artidoro Pagnoni, Ari Holtzman, and Luke Zettlemoyer. QLoRA: Efficient finetuning of quantized LLMs. In Advances in Neural Information Processing Systems, volume 36, pages 10088–10115, 2023. Paolo Di Tommaso, Maria Chatzou, Evan W. Floden, Pablo Prieto Barja, Emilio Palumbo, and Cedric Notredame. Nextflow enables reproducible computational workflows. Nature Biotechnology, 35: 316–319, 2017. doi: 10.1038/nbt.3820. Andrés Díaz-Pinto, Sachidanand Alle, Alvin Ihsani, et al. MONAI Label: A framework for AI- assisted interactive labeling of 3d medical images. Medical Image Analysis, 95:103207, 2024. doi: 10.1016/j.media.2024.103207. Oscar Esteban, Daniel Birman, Marie Schaer, Oluwasanmi O. Koyejo, Russell A. Poldrack, and Krzysztof J. Gorgolewski. MRIQC: Advancing the automatic prediction of image quality in MRI from unseen sites. PLOS ONE, 12(9):e0184661, 2017. doi: 10.1371/journal.pone.0184661. Oscar Esteban, Christopher J. Markiewicz, Ross W. Blair, Craig A. Moodie, A. Ilkay Isik, Asier Erramuzpe, et al. fMRIPrep: A robust preprocessing pipeline for functional MRI. Nature Methods, 16(1):111–116, 2019. doi: 10.1038/s41592-018-0235-4. Andriy Fedorov, Reinhard Beichel, Jayashree Kalpathy-Cramer, Julien Finet, Jean-Christophe Fillion- Robin, Sonia Pujol, et al. 3D Slicer as an image computing platform for the quantitative imaging network. Magnetic Resonance Imaging, 30(9):1323–1341, 2012. doi: 10.1016/j.mri.2012.05.001. Sofia Fernandez-Lozano, Mahsa Dadar, Cassandra Morrison, et al. QRATER: A collaborative and centralized imaging quality control web-based application. Aperture Neuro, 4, 2024. doi: 10.52294/001c.118616. Bruce Fischl. FreeSurfer. NeuroImage, 62(2):774–781, 2012. doi: 10.1016/j.neuroimage.2012.01.021. Elias Frantar, Saleh Ashkboos, Torsten Hoefler, and Dan Alistarh. GPTQ: Accurate post-training quantization for generative pre-trained transformers. In International Conference on Learning Representations, 2023. URL https://openreview.net/forum?id=tcbBPnfwxS. Krzysztof Gorgolewski, Christopher D. Burns, Cindee Madison, Dav Clark, Yaroslav O. Halchenko, Michael L. Waskom, and Satrajit S. Ghosh. Nipype: A flexible, lightweight and extensible neuroimaging data processing framework in python. Frontiers in Neuroinformatics, 5:13, 2011. doi: 10.3389/fninf.2011.00013. Krzysztof J. Gorgolewski, Tibor Auer, Vince D. Calhoun, R. Cameron Craddock, Samir Das, Eugene A. Duff, et al. The brain imaging data structure, a format for organizing and describing outputs of neuroimaging experiments. Scientific Data, 3:160044, 2016. doi: 10.1038/sdata.2016.44. 22 Advanced Computational Medicine Laboratory (ACMLab) Krzysztof J. Gorgolewski, Fidel Alfaro-Almagro, Tibor Auer, et al. BIDS Apps: Improving ease of use, accessibility, and reproducibility of neuroimaging data analysis methods. PLOS Computational Biology, 13(3):e1005209, 2017. doi: 10.1371/journal.pcbi.1005209. Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security, pages 79–90, 2023. doi: 10.1145/3605764.3623985. Soichi Hayashi, Ben Caron, Anibal S. Heinsfeld, et al. brainlife.io: A decentralized and open- source cloud platform to support neuroscience research. Nature Methods, 21:809–813, 2024. doi: 10.1038/s41592-024-02237-2. Mark Jenkinson, Christian F. Beckmann, Timothy E. J. Behrens, Mark W. Woolrich, and Stephen M. Smith. FSL. NeuroImage, 62(2):782–790, 2012. doi: 10.1016/j.neuroimage.2011.09.015. Georgios A. Kaissis, Marcus R. Makowski, Daniel Ruckert, and Rickmer F. Braren. Secure, privacy- preserving and federated machine learning in medical imaging. Nature Machine Intelligence, 2(6): 305–311, 2020. doi: 10.1038/s42256-020-0186-1. Anisha Keshavan, Esha Datta, Ian M. McDonough, Christopher R. Madan, Katherine Jordan, and Roland G. Henry. Mindcontrol: A web application for brain segmentation quality control. NeuroImage, 170:365–372, 2018. doi: 10.1016/j.neuroimage.2017.03.055. Eduard T. Klapwijk, Femke van de Kamp, Mara van der Meulen, Sabine Peters, and Lara M. Wierenga. Qoala-T: A supervised-learning tool for quality control of freesurfer segmented MRI data. NeuroImage, 189:116–129, 2019. doi: 10.1016/j.neuroimage.2019.01.014. Johannes Köster and Sven Rahmann. Snakemake—a scalable bioinformatics workflow engine. Bioinformatics, 28(19):2520–2522, 2012. doi: 10.1093/bioinformatics/bts480. Gregory M. Kurtzer, Vanessa Sochat, and Michael W. Bauer. Singularity: Scientific containers for mobility of compute. PLOS ONE, 12(5):e0177459, 2017. doi: 10.1371/journal.pone.0177459. Xiaoxiao Li, Yufeng Gu, Nicha Dvornek, Lawrence H. Staib, Pamela Ventola, and James S. Duncan. Multi-site fMRI analysis using privacy-preserving federated learning and domain adaptation: ABIDE results. Medical Image Analysis, 65:101765, 2020. doi: 10.1016/j.media.2020.101765. Ji Lin, Jiaming Tang, Haotian Tang, Shang Yang, Wei-Ming Chen, Wei-Chen Wang, Guangxuan Xiao, Xingyu Dang, Chuang Gan, and Song Han. AWQ: Activation-aware weight quantization for LLM compression and acceleration. In Proceedings of Machine Learning and Systems, volume 6, pages 87–100, 2024. Xiao Liu, Hao Yu, Hanchen Zhang, Yifan Xu, Xuanyu Lei, Hanyu Lai, Yu Gu, Hangliang Ding, Kaiwen Men, Kejuan Yang, Shudan Zhang, Xiang Deng, Aohan Zeng, Zhengxiao Du, Chenhui Zhang, Sheng Shen, Tianjun Zhang, Yu Su, Huan Sun, Minlie Huang, Yuxiao Dong, and Jie Tang. AgentBench: Evaluating LLMs as agents. In International Conference on Learning Representations, 2024. URL https://openreview.net/forum?id=zAdUB0aCTQ. 23 Advanced Computational Medicine Laboratory (ACMLab) Odhran O’Donoghue, Aleksandar Shtedritski, Simon Ging, et al. BioPlanner: Automatic evaluation of LLMs on protocol planning in biology. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 2676–2694, 2023. doi: 10.18653/v1/2023.emnlp-main.162. Russell A. Poldrack and Krzysztof J. Gorgolewski. The past, present, and future of the brain imaging data structure (BIDS). Annual Review of Biomedical Data Science, 2:119–138, 2019. doi: 10.1146/annurev-biodatasci-072018-021000. Yujia Qin, Shengding Hu, Yankai Lin, Weize Chen, Ning Ding, Ganqu Cui, Zheni Zeng, Xuanhe Zhou, Yufei Huang, Chaojun Xiao, et al. Tool learning with foundation models. ACM Computing Surveys, 57(4), 2024. doi: 10.1145/3704435. Pradeep Reddy Raamana. VisualQC: Software development kit for medical and neu- roimaging quality control and assurance. Aperture Neuro, 3, 2023. doi: 10.52294/ e130fcd2-ce83-4222-856d-c82022013a50. Alexander I. Renton et al. Neurodesk: An accessible, flexible and portable data analy- sis environment for reproducible neuroimaging. Nature Methods, 21:804–808, 2024. doi: 10.1038/s41592-023-02145-x. Nicola Rieke, Jonny Hancox, Wenqi Li, Fausto Milletari, Holger R. Roth, Shadi Albarqouni, Spyridon Bakas, Mathieu N. Galtier, Bennett A. Landman, Klaus Maier-Hein, Sebastien Ourselin, Micah Sheller, Ronald M. Summers, Andrew Trask, Daguang Xu, Maximilian Baust, and M. Jorge Cardoso. The future of digital health with federated learning. npj Digital Medicine, 3:119, 2020. doi: 10.1038/s41746-020-00323-1. Jerome H. Saltzer and Michael D. Schroeder. The protection of information in computer systems. Proceedings of the IEEE, 63(9):1278–1308, 1975. doi: 10.1109/PROC.1975.9939. Geir Kjetil Sandve, Anton Nekrutenko, James Taylor, and Eivind Hovig. Ten simple rules for reproducible computational research. PLOS Computational Biology, 9(10):e1003285, 2013. doi: 10.1371/journal.pcbi.1003285. Timo Schick, Jane Dwivedi-Yu, Roberto Dessi, Roberta Raileanu, Maria Lomeli, Eric Hambro, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. Toolformer: Language models can teach themselves to use tools. In Advances in Neural Information Processing Systems, volume 36, pages 68539–68551, 2023. Yiqing Shen, Kaitao Song, Xu Tan, Dongsheng Li, Weiming Lu, and Yueting Zhuang. TaskBench: Benchmarking large language models for task automation. In Advances in Neural Information Processing Systems, volume 37, 2024. Noah Shinn, Federico Cassano, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao. Reflexion: Language agents with verbal reinforcement learning. In Advances in Neural Information Processing Systems, volume 36, pages 8634–8652, 2023. Arfon M. Smith, Daniel S. Katz, Kyle E. Niemeyer, and FORCE11 Software Citation Working Group. Software citation principles. PeerJ Computer Science, 2:e86, 2016. doi: 10.7717/peerj-cs.86. 24 Advanced Computational Medicine Laboratory (ACMLab) Stian Soiland-Reyes, Peter Sefton, Mercè Crosas, Leyla Jael Castro, Frederik Coppens, José M. Fernández, Daniel Garijo, Björn Grüning, Marco La Rosa, Simone Leo, Eoghan Ó Carragáin, Marc Portier, Ana Trisovic, RO-Crate Community, Paul Groth, and Carole Goble. Packaging Research Artefacts with RO-Crate. Data Science, 5(2):97–138, 2022. doi: 10.3233/DS-210053. Qwen Team et al. Qwen2.5 technical report. arXiv preprint arXiv:2412.15115, 2025. doi: 10.48550/ arXiv.2412.15115. Wanda Core Contributors. Wanda merged core: An open agentic harness for local tool-using assistants. https://github.com/MEKOMIKU/c-haha, 2026. Merged c-haha agentic core. Cheng Wang, Zhibin He, Zhihao Peng, Shengyuan Liu, Yufan Hu, Carl Yang, Lifang He, Lichao Sun, Xiang Li, and Yixuan Yuan. NeuroClaw technical report. arXiv preprint arXiv:2604.24696, 2026. doi: 10.48550/arXiv.2604.24696. URL https://arxiv.org/abs/2604.24696. Isabelle C. Wiest, David Ferber, Jian Zhu, et al. Privacy-preserving large language models for structured medical information retrieval. npj Digital Medicine, 7:257, 2024. doi: 10.1038/ s41746-024-01233-2. Guorong Wu, Ziquan Wei, Shuheng Cao, Xiyun Hu, and Tingting Dan. CyberNeuro Assistant: The Next-Generation Platform for Mental Health Research. Google MedGemma Impact Challenge writeup, Kaggle, 2026. kaggle.com/competitions/med-gemma-impact-challenge/writeups/new- writeup-1770305204789; acmlab.github.io/brain-network-chart/. Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. ReAct: Synergizing reasoning and acting in language models. In International Conference on Learning Representations, 2023. URL https://openreview.net/forum?id=WE_vluYUL-X. Paul A. Yushkevich, Joseph Piven, Heather Cody Hazlett, Rachel Gimpel Smith, Sean Ho, James C. Gee, and Guido Gerig. User-guided 3D active contour segmentation of anatomical structures: Significantly improved efficiency and reliability. NeuroImage, 31(3):1116–1128, 2006. doi: 10.1016/ j.neuroimage.2006.01.015. 25