Healthclaw MCP Server

Guardrailed FHIR access for AI agents: PHI redaction, audit trail, step-up auth, tenant isolation. That is what the healthclaw mcp server brings to an AI assistant: the same capability, reachable through the Model Context Protocol rather than a separate app or dashboard.

The short version

The hosted demo runs synthetic data behind the full guardrail stack:

• PHI redaction — — Names truncated to initials, identifiers masked, addresses stripped, birth dates truncated to year
• Immutable audit trail — — Every read/write logged with tenant, agent, timestamp
• Step-up authorization — — HMAC-SHA256 tokens required for writes
• Tenant isolation — — Every query scoped to tenant, cross-tenant access blocked
• Medical disclaimers — — Injected on all clinical resource reads
• Compiled Truth — — Current state + append-only evidence trail for every resource

Getting it running

Because this one is hosted, setup is mostly authentication — you point your client at the endpoint and approve access. Nothing runs on your machine, so there is no runtime to keep patched.

The tools it exposes

The server publishes 14 tools. What each one is for:

• context_get — Retrieve pre-built context envelopes
• fhir_read — Read a FHIR resource (redacted)
• fhir_search — Search with patient, code, status, date filters
• fhir_validate — Structural validation
• fhir_stats — Observation statistics (count/min/max/mean)
• fhir_lastn — Most recent N observations per code
• fhir_interpret_labs — Lab reference-range interpretation ($interpret) — decision support, not diagnosis
• care_gaps — Preventive-care gaps ($care-gaps) — screenings/immunizations that may be due, from the patient's own records
• guardrail_conformance — Run the guardrail conformance self-test — graded A–F scorecard across all seven properties
• fhir_permission_evaluate — R6 Permission access control evaluation
• fhir_subscription_topics — List available SubscriptionTopics
• questionnaire_populate — SDC $populate — pre-fill a Questionnaire for a subject

What it needs from you

Configuration is passed through the environment: MCP_AUTH_TOKEN, STEP_UP_SECRET, FHIR_UPSTREAM_URL. Treat anything key-shaped as a real credential — scope it to the minimum the server needs, and rotate it if it ever lands in a shared config.

Things to watch

• Your data travels to the provider's service, so the usual questions apply about what you send and what they retain.
• With 14 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Healthclaw.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• Keep per-call confirmation enabled while you learn its behaviour; it is the cheapest safeguard you have.

How it compares

Plenty of developer tooling servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Healthclaw's toolset — context_get, fhir_read, fhir_search and 11 more — is a fair guide to whether it matches your workflow. It is maintained by aks129; worth a glance at recent repository activity before you build anything load-bearing on it.

SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.