Skip to content
Agentmart
Submit a tool

Healthclaw Guardrails

Guardrailed FHIR access for AI agents: PHI redaction, audit trail, step-up auth, tenant isolation

Connector by aks129 · GitHub account verified by the MCP Registry

IndexedMITRemote (HTTP)★ 31
Write a review

Chalk Labs

Need help deploying Healthclaw Guardrails?

Chalk Labs sets up agents like this inside real teams: connected to your tools, tested on your data, with a human in the loop where it matters.

Book a call

Install

Works with Claude Code, VS Code, Cursor, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install connector/aks129-healthclaw-guardrails

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Remote endpoint

  • https://mcp-server-production-5112.up.railway.app/mcp Remote (HTTP)

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Guardrailed FHIR access for AI agents: PHI redaction, audit trail, step-up auth, tenant isolation

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 25, 2026.

Tools
24 read · 2 write · 3 delete · 1 not yet classified
Secrets
1 (API keys, tokens or passwords)
Install scripts
Nothing to install (hosted)
Runs as
Hosted (remote endpoint)

Tools by what they do 30

Read from the source code; the running server may list different tools.

Read 24 · Look things up without changing anything.

  • action_propose
  • action_status
  • care_gaps
  • context_get
  • curatr_apply_fix
  • curatr_evaluate
  • fetch
  • fhir_compiled_truth
  • fhir_get_token
  • fhir_interpret_labs
  • fhir_lastn
  • fhir_permission_evaluate
Show 12 more tools
  • fhir_propose_write
  • fhir_read
  • fhir_search
  • fhir_stats
  • fhir_subscription_topics
  • fhir_validate
  • guardrail_conformance
  • questionnaire_populate
  • rx_transfer_request
  • search
  • sources_check
  • wearables_sync_status

Write 2 · Create, change, send or run things.

  • fhir_seed
  • shl_generate

Delete 3 · Delete, drop, revoke or wipe things.

  • action_commit
  • fhir_commit_write
  • questionnaire_extract

Not yet classified 1 · We could not tell from the name and description.

  • propose_action

Secrets and settings it asks for

Secrets: values you paste in that let it act as you.

  • X-Step-Up-Token

Other settings (environment variables or headers).

  • X-Tenant-Id

Network hosts it talks to 60

  • ama-assn.org · found in code
  • api.anthropic.com · found in code
  • api.bland.ai · found in code
  • api.connect.fastenhealth.com · found in code
  • api.elevenlabs.io · found in code
  • api.github.com · found in code
  • api.healthex.io · found in code
  • api.medplum.com · found in code
  • api.openai.com · found in code
  • api.resend.com · found in code
  • api.sendblue.co · found in code
  • api.telegram.org · found in code
  • api.twilio.com · found in code
  • app.healthclaw.io · found in code
  • app.promptopinion.ai · found in code
  • apple.com · found in code
  • auth.docker.io · found in code
  • careagents-production.up.railway.app · found in code
  • careagents.cloud · found in code
  • cdn.jsdelivr.net · found in code
  • cdnjs.cloudflare.com · found in code
  • claude.ai · found in code
  • clawhub.ai · found in code
  • clinicaltables.nlm.nih.gov · found in code
  • dicom.nema.org · found in code
  • dns.google · found in code
  • elevenlabs.io · found in code
  • evil.com · found in code
  • fastenhealth.com.evil.com · found in code
  • fdasis.nlm.nih.gov · found in code
Show 30 more hosts
  • fhir-registry.smarthealthit.org · found in code
  • fhir.medent.com · found in code
  • flexpa.com · found in code
  • fonts.googleapis.com · found in code
  • ghcr.io · found in code
  • github.com · found in code
  • glama.ai · found in code
  • hapi.fhir.org · found in code
  • health-skillz.joshuamandel.com · found in code
  • healthclaw.io · found in code
  • hl7.org · found in code
  • host.docker.internal · found in code
  • loinc.org · found in code
  • mcp-demo-production-ee2c.up.railway.app · found in code
  • mcp-server-production-5112.up.railway.app · found in remote endpoint, install command, code
  • mcp.app.healthbankone.com · found in code
  • mcp.healthclaw.io · found in code
  • nahdo.org · found in code
  • nlm.nih.gov · found in code
  • oauth.app.healthbankone.com · found in code
  • open-wearables.local · found in code
  • open.epic.com · found in code
  • r4.smarthealthit.org · found in code
  • schemas.agentskills.io · found in code
  • server.fire.ly · found in code
  • snomed.info · found in code
  • t.me · found in code
  • terminology.hl7.org · found in code
  • tx.fhir.org · found in code
  • unitsofmeasure.org · found in code

Files it touches

  • /dev/null
  • /tmp/e2e-careagents-allow.db
  • /tmp/e2e-careagents-allow.log
  • /tmp/e2e-careagents.db
  • /tmp/e2e-careagents.log
  • /tmp/e2e-healthclaw.db
  • Your home directory (~)

Tools (30)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • action_commitSubmit Real-World Action for Confirmationcan change or delete data

    Submit a previously proposed action for the patient's OWN out-of-band confirmation (their dashboard or Telegram) AFTER they've reviewed and verbally/textually agreed to the draft. Requires step-up authorization, supplied by the deployment as an X-Step-Up-Token header; you cannot obtain or pass it yourself. This call does NOT execute anything and never accepts or sends any 'human confirmed' flag — only the patient tapping Approve in their own out-of-band channel can trigger execution. Returns status 'awaiting_confirmation' and is terminal for your turn: do not call action_commit again for the s…

  • action_proposePropose Real-World Actionread-only

    Propose a real-world action (phone call or SMS) on the patient's behalf. Returns a draft (id + script) the patient MUST review before submitting via action_commit. Does not execute anything.

  • action_statusAction Statusread-only

    Check the status and outcome of an action (proposed/awaiting_confirmation/executing/completed/failed/needs_review/unknown/expired/declined). declined means the patient read the proposal and said no - never re-propose the same action unasked. needs_review means it ran but the outcome could not be confirmed - show the patient the evidence. unknown means the provider MAY have acted - never re-propose the same action. Use after action_commit to see whether the patient has approved yet, and to report the final result back to them.

  • care_gapsPreventive Care Gapsread-only

    Check which preventive-care screenings/immunizations a patient may be due for (blood pressure, cholesterol, colorectal/cervical/breast cancer screening, flu, diabetes A1c), from their own connected records. Decision support based on USPSTF/ACIP/ADA guidelines — not a diagnosis or directive. Response includes _meta.ui.resourceUri pointing to an embeddable review UI.

  • context_getGet Health Contextread-only

    Retrieve a pre-built context envelope with patient-centric FHIR resources. Returns bounded, policy-stamped, time-limited context.

  • curatr_apply_fixPropose Data Quality Fixread-only

    Propose data quality fixes to a FHIR resource as a 'curatr-fix' action on the action rail. Nothing changes when this is called: it returns a draft (action id) the patient must submit with action_commit and then approve out of band on their own review page; only that approval carries the fix out, once, with a linked Provenance record. The proposal is pinned to the record's current meta.versionId — pass record_version from the record you read, or omit it and the tool reads it for you — and is refused at execution if the record has changed since. Only fields the Curatr evaluator can propose are a…

  • curatr_evaluateEvaluate Data Qualityread-only

    Evaluate a FHIR resource for data quality issues. Checks coding elements against public terminology services (tx.fhir.org for SNOMED/LOINC, NLM for ICD-10-CM, RXNAV for RxNorm) and structural rules. Returns issues in plain language with patient-facing impact descriptions and resolution suggestions. Read-only — no step-up required.

  • fetchFetch Health Recordread-only

    ChatGPT-connector-compatible fetch of one FHIR resource by id ('ResourceType/id', as returned by search). Returns the full document (PHI-redacted server-side) with metadata.

  • fhir_commit_writeCommit FHIR Writecan change or delete data

    Commit a previously proposed write. Requires step-up authorization token. This is a destructive operation.

  • fhir_compiled_truthCompiled Truth Timelineread-only

    Return the current best understanding of a FHIR resource plus the append-only evidence trail (Provenance entries) of how it got there. Use this before presenting resource-specific facts to a patient — surfaces curation_state and quality_score so the agent can say not just WHAT the record says but WHY it says it. Redacted, audited. Response includes _meta.ui.resourceUri pointing to an embeddable review UI.

  • fhir_get_tokenMint Step-Up Tokenread-only

    Get a fresh step-up authorization token for write operations. Tokens expire after 5 minutes. OPERATOR TOOL: this is withheld from hosted deployments (PRIVILEGED_TOOL_NAMES), and the token it returns travels as the X-Step-Up-Token header set by the caller — it is never an argument to another tool.

  • fhir_interpret_labsInterpret Lab Resultsread-only

    Interpret lab Observations against reference ranges — flags each value low/normal/high/critical (HL7 v3 ObservationInterpretation) and returns clinician + consumer summaries. Decision support, not diagnosis. Read-tier. Response includes _meta.ui.resourceUri pointing to an embeddable trend timeline.

  • fhir_lastnLatest Observationsread-only

    Get the last N observations per code. Standard FHIR $lastn (since R4). Returns most recent observations by storage order.

  • fhir_permission_evaluateEvaluate Access Permissionread-only

    Evaluate R6 Permission resources for access control decisions. Returns permit/deny based on stored Permission rules. Separates access control (Permission) from consent records (Consent).

  • fhir_propose_writePropose FHIR Writeread-only

    Propose a write — validates the resource and returns a preview. Does NOT commit. Write tier: step-up authorization is required and is supplied by the deployment as an X-Step-Up-Token header. You cannot obtain or pass it yourself. If it is absent this returns requires_step_up; tell the patient authorization is needed rather than attempting another route.

Show 15 more tools
  • fhir_readRead FHIR Resourceread-only

    Read a specific FHIR resource by type and ID. Supports FHIR R4 US Core v9 stable resources and FHIR R6 ballot3 experimental resources. Returns redacted resource with PHI protection.

  • fhir_searchSearch FHIR Resourcesread-only

    Search for FHIR resources. Supports FHIR R4 US Core v9 stable resources and FHIR R6 ballot3 experimental resources. Supports patient, code, status, _lastUpdated, _count, _sort parameters. Returns paginated, redacted Bundle.

  • fhir_seedSeed Demo Data

    Seed a tenant with a realistic Patient + Observations + Condition bundle for live testing. Use this at the start of a demo session to populate data. Returns created resource IDs and a ready-to-use step_up_token.

  • fhir_statsObservation Statisticsread-only

    Compute statistics (count, min, max, mean) over numeric Observation values. Standard FHIR $stats (since R4). Only supports valueQuantity. Filter by patient and/or code.

  • fhir_subscription_topicsList Subscription Topicsread-only

    List available SubscriptionTopics for event-driven subscriptions. R6 moves topic-based subscriptions toward Normative. Agents discover what events they can subscribe to.

  • fhir_validateValidate FHIR Resourceread-only

    Validate a proposed FHIR R6 resource against structural rules. Returns OperationOutcome.

  • guardrail_conformanceGuardrail Conformance Scorecardread-only

    Run the guardrail conformance self-test on the connected HealthClaw deployment and return the graded scorecard across seven guardrail properties: PHI redaction, immutable audit, step-up auth, human-in-the-loop, tenant isolation, medical disclaimers, and error fidelity. Uses synthetic data only. Set fresh=true to force a new run instead of the cached result.

  • propose_action

    Present a phone call script, text message, or form to the patient for review before it is executed. Use when you have all details needed.

  • questionnaire_extractExtract Form Data to FHIRcan change or delete data

    SDC $extract — extract FHIR resources from a completed QuestionnaireResponse into a transaction Bundle. Write tier; requires step-up authorization, including for dry_run=true previews.

  • questionnaire_populatePre-fill Health Formread-only

    SDC $populate — pre-fill a Questionnaire for a subject. Returns a QuestionnaireResponse. Read tier; mints a tenant token for non-public tenants.

  • rx_transfer_requestRequest Prescription Transferread-only

    Draft a prescription-transfer request: assembles the patient's active medications and stages a phone call to the RECEIVING pharmacy asking it to pull the prescriptions from the current pharmacy (how US transfers actually work). Schedule II medications are refused (never transferable — new prescription required). Returns a draft the patient MUST review; submit with action_commit for the patient's own out-of-band confirmation after they explicitly agree — action_commit does not execute the call itself.

  • searchSearch Health Recordsread-only

    ChatGPT-connector-compatible search over the tenant's FHIR records. Query is a FHIR search string (e.g. 'Observation?code=4548-4' or 'Patient?name=smith'); bare resource type works too. Returns compact results: id, title, url. Reads are PHI-redacted and audit-logged server-side.

  • shl_generateGenerate SMART Health Link

    Generate a SMART Health Link (shlink:/ QR payload) sharing the patient's record with a clinic. Fetches the guardrailed share-bundle from HealthClaw (step-up required — supplied by the deployment as an X-Step-Up-Token header), encrypts it client-side (the SHL server never sees plaintext), uploads ciphertext, and returns the shlink URI, viewer link, and the patient's private manage link. ALWAYS get the patient's explicit consent before generating, and deliver the manage link ONLY to the patient.

  • sources_checkCheck Data Sourcesread-only

    Survey ALL connected health data sources (Fasten, HealthEx, Health Bank One, MEDENT, Flexpa, Epic/Health Skillz, wearables) at once — returns each source's connection status and the patient's record counts by type. Use when the patient asks what's connected or to check for data across services.

  • wearables_sync_statusWearables Sync Statusread-only

    List wearable connections (Garmin, Oura, Polar, Suunto, Whoop, Fitbit, Strava, Ultrahuman) for a tenant, with last sync time, observation count, and status. Use this to tell a patient what's connected, when data last arrived, and surface a connection-management UI (via _meta.ui.resourceUri) so they can connect more providers. Data flows into HealthClaw as FHIR Observations with LOINC codes — agents read it via fhir_search like any other Observation.

Signals

Stars
31
Forks
12
Open issues
58
Last commit
Oct 23, 2026 (12 days ago)
Last release
Oct 16, 2026 (19 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name
io.github.aks129/healthclaw-guardrails
Version
1.6.0
Auth
API key
License
MIT
Repository
github.com/aks129/HealthClawGuardrails
Website
healthclaw.io
First seen
Oct 24, 2026
Last checked
Nov 1, 2026
Source
Official MCP Registrygithub-graphql

Done for you

Rather not set it up yourself?

Chalk Labs scopes, builds and runs agents for your team: the task audit, the eval harness, the integrations and the weekly ops report. Fixed scope, priced before we start.

See how we build AI agents →Read the case studies

Chalk Labs is a two-founder AI and growth studio. We build AI agents, CRMs and MVPs for Web3 and AI companies, and have shipped 50+ product and token launches.

launches shipped
50+
launches shipped
media placements
500+
media placements
founders on every account
2
founders on every account

Press we've placed: Forbes · CoinDesk · Decrypt · Cointelegraph · The Block

Rahil Jain, Co-founder, Chalk Labs. Ex-Goldman Sachs engineer. You talk to the person who builds it.

Get Healthclaw Guardrails running in your business

Tell us what you want to automate. A founder replies within one working day with a plan, not a pitch deck.

Goes to the Chalk Labs founders, not the newsletter. Privacy

Need help deploying Healthclaw Guardrails?

CallGet help
Cite this page

Healthclaw Guardrails MCP server. Agent Mart. https://agentmart.dev/connectors/aks129-healthclaw-guardrails (last updated 2026-11-01)