HealthClaw GuardrailsBLOCK
Open-source guardrails between AI agents and FHIR clinical data — PHI redaction, immutable audit, step-up auth, tenant isolation. MCP server + OpenAI/Gemini adapters. A healthclaw.io project.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The open-source security layer between AI agents and clinical data.
FHIR standardized how health data is structured. MCP standardized how AI connects to tools. *Nobody standardized the guardrails in between. This project does.*
[▶ Watch the 90-second demo](https://healthclaw.io/#demo) All records are synthetic. The chat ran on a third-party model, best of four takes. No clinician has signed off yet. How it was made.
[](https://github.com/aks129/HealthClawGuardrails/releases) [](LICENSE) [](https://github.com/aks129/HealthClawGuardrails/actions/workflows/ci.yml) [](https://github.com/aks129/HealthClawGuardrails)
[](https://github.com/aks129/HealthClawGuardrails/stargazers) [](https://github.com/aks129/HealthClawGuardrails/network/members) [](https://github.com/aks129/HealthClaw
cd1e96a9a581OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add fhir-mcp-guardrails --env ACTIONS_WEBHOOK_SECRET=${ACTIONS_WEBHOOK_SECRET} --env AGENT_RUN_RECONCILE_SECRET=${AGENT_RUN_RECONCILE_SECRET} --env AIDBOX_SECRET=${AIDBOX_SECRET} --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"fhir-mcp-guardrails": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ACTIONS_WEBHOOK_SECRET": "${ACTIONS_WEBHOOK_SECRET}",
"AGENT_RUN_RECONCILE_SECRET": "${AGENT_RUN_RECONCILE_SECRET}",
"AIDBOX_SECRET": "${AIDBOX_SECRET}",
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}"
}
}
}
}Exposed tools (23)
17 read · 6 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
action_commit | write | Submit a previously proposed action for the patient |
action_propose | read | Propose a real-world action (phone call or SMS) on the patient |
context_get | read | Retrieve a pre-built context envelope with patient-centric FHIR resources. Returns bounded, policy-stamped, time-limited context. |
curatr_apply_fix | write | Propose data quality fixes to a FHIR resource as a |
fetch | read | ChatGPT-connector-compatible fetch of one FHIR resource by id ( |
fhir_commit_write | write | Commit a previously proposed write. Requires step-up authorization token. This is a destructive operation. |
fhir_get_token | write | Get a fresh step-up authorization token for write operations. Tokens expire after 5 minutes. OPERATOR TOOL: this is withheld from hosted deployments (PRIVILEGED_TOOL_NAMES), and the token it returns travels as the X-Step-Up-Token header set by the caller — it is never an argument to another tool. |
fhir_interpret_labs | read | Interpret lab Observations against reference ranges — flags each value low/normal/high/critical (HL7 v3 ObservationInterpretation) and returns clinician + consumer summaries. Decision support, not diagnosis. Read-tier. Response includes _meta.ui.resourceUri pointing to an embeddable trend timeline. |
fhir_lastn | read | Get the last N observations per code. Standard FHIR $lastn (since R4). Returns most recent observations by storage order. |
fhir_permission_evaluate | read | Evaluate R6 Permission resources for access control decisions. Returns permit/deny based on stored Permission rules. Separates access control (Permission) from consent records (Consent). |
fhir_read | read | Read a specific FHIR resource by type and ID. Supports FHIR R4 US Core v9 stable resources and FHIR R6 ballot3 experimental resources. Returns redacted resource with PHI protection. |
fhir_search | read | Search for FHIR resources. Supports FHIR R4 US Core v9 stable resources and FHIR R6 ballot3 experimental resources. Supports patient, code, status, _lastUpdated, _count, _sort parameters. Returns paginated, redacted Bundle. |
fhir_seed | read | Seed a tenant with a realistic Patient + Observations + Condition bundle for live testing. Use this at the start of a demo session to populate data. Returns created resource IDs and a ready-to-use step_up_token. |
fhir_stats | read | Compute statistics (count, min, max, mean) over numeric Observation values. Standard FHIR $stats (since R4). Only supports valueQuantity. Filter by patient and/or code. |
fhir_subscription_topics | read | List available SubscriptionTopics for event-driven subscriptions. R6 moves topic-based subscriptions toward Normative. Agents discover what events they can subscribe to. |
fhir_validate | read | Validate a proposed FHIR R6 resource against structural rules. Returns OperationOutcome. |
questionnaire_extract | read | SDC $extract — extract FHIR resources from a completed QuestionnaireResponse into a transaction Bundle. Write tier; requires step-up authorization, including for dry_run=true previews. |
questionnaire_populate | read | SDC $populate — pre-fill a Questionnaire for a subject. Returns a QuestionnaireResponse. Read tier; mints a tenant token for non-public tenants. |
rx_transfer_request | write | Draft a prescription-transfer request: assembles the patient |
search | read | ChatGPT-connector-compatible search over the tenant |
shl_generate | read | Generate a SMART Health Link (shlink:/ QR payload) sharing the patient |
sources_check | read | Survey ALL connected health data sources (Fasten, HealthEx, Health Bank One, MEDENT, Flexpa, Epic/Health Skillz, wearables) at once — returns each source |
wearables_sync_status | write | List wearable connections (Garmin, Oura, Polar, Suunto, Whoop, Fitbit, Strava, Ultrahuman) for a tenant, with last sync time, observation count, and status. Use this to tell a patient what |
Trust audit
BLOCKgrade F · trust 31/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (12 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
client cannot bypass the guardrails. **Fix before anything else on this page.**
module = __import__(import_path, fromlist=[attr])
print(token)
print(_inventory_line(base, args.tenant, token), flush=True)
print(_inventory_line(base, args.tenant, token), flush=True)
print(f"patient MRN: {patient_mrn or '(not in token — querying without filter)'}", file=sys.stderr)callback_url = f'{base}/wearables/oauth/callback'redirect_uri=callback_url,
f"http://127.0.0.1:{port}/healthz")if ! grep -q "proxy_pass http://127.0.0.1:8600" "$CFG"; then
proxy_pass http://127.0.0.1:8600;
if curl -sf http://127.0.0.1:8600/healthz >/dev/null; then
curl -sf http://127.0.0.1:8600/healthz && echo
"μmol/L": "umol/L"}
SQLALCHEMY_DATABASE_URI: postgresql://postgres:postgres@localhost:5432/test
MIGRATION_TEST_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test
CARE_TEST_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test
export SCRATCH="postgresql://postgres:rehearse@localhost:55432/postgres"
kwargs = _engine_kwargs("postgresql://u:p@db:5432/care", monkeypatch)SECRET = 'test-mint-secret-659-not-real'
SECRET = "brief-voice-test-secret"
SECRET = "sb-test-signing-secret"
token = 'synthetic-test-credential'
SECRET = 'mint-secret-shared-with-careagents'
.health-context.yaml
Gates applied: instruction_override, no_behavioural_pass.
cd1e96a9a581full audit observations/trust-audit/mcp-server/aks129__healthclaw-guardrails.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | cd1e96a9a581 | BLOCK | F | 31 | first audit |
Questions
What is the HealthClaw Guardrails MCP server?
Open-source guardrails between AI agents and FHIR clinical data — PHI redaction, immutable audit, step-up auth, tenant isolation. MCP server + OpenAI/Gemini adapters. A healthclaw.io project.
What tools does HealthClaw Guardrails expose?
23 in total: 17 read-only, 6 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is HealthClaw Guardrails safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (31/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does HealthClaw Guardrails need?
It reads ACTIONS_WEBHOOK_SECRET, AGENT_RUN_RECONCILE_SECRET, AIDBOX_SECRET, ANTHROPIC_API_KEY, BLAND_AI_API_KEY, BLAND_API_KEY, CAREAGENTS_MINT_SECRET, DASHBOARD_TOKEN_TTL_HOURS, FASTEN_PRIVATE_KEY, FASTEN_PUBLIC_KEY, FASTEN_WEBHOOK_SECRET and FHIR_UPSTREAM_CLIENT_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does HealthClaw Guardrails run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as fhir-mcp-guardrails at 2.0.0.
How current is this page?
The grade is for one exact copy of the source (cd1e96a9a581), read on 2026-10-08. The repository is watched and re-audited when it changes.