Bag Epl Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Bag Epl Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
\U0001f1e8\U0001f1ed Part of the [Swiss Public Data MCP Portfolio](https://github.com/malkreide)
MCP Server for the Swiss BAG electronic benefits platform (ePL) \u2014 Spezialitaetenliste, GGSL, MiGeL
\U0001f1e9\U0001f1ea Deutsche Version
Demo: Claude using epl_sl_suche and epl_rechtskontext
bag-epl-mcp enables AI models to answer questions about mandatory health insurance coverage in Switzerland \u2014 in natural language, grounded in real data.
| List | Purpose | Legal basis |
|---|---|---|
| Spezialitaetenliste (SL) | Compulsory-insurance medications | KVG Art. 52 |
| GGSL | Medications for congenital disorders (IV) | IVG Anhang |
| MiGeL | Medical devices & aids | KLV Art. 20 |
Anchor query: "Is this medication covered by mandatory health insurance?" \u2192 epl_sl_suche: Live lookup in the Spezialitaetenliste (SL) → More use cases by audience →
# Clone the repository
git clone https://github.com/malkreide/bag-epl-mcp.git
cd bag-epl-mcp
# Install
pip install -e .
# or with uv:
uv pip install -e .Or with uvx (no permanent installation):
uvx bag-epl-mcp# stdio (for Claude Desktop) — default, opens no network ports
python -m bag_epl_mcp.server
# Streamable HTTP (cloud) — transport selected via env var
MCP_TRANSPORT=streamable-http MCP_HOST=0.0.0.0 MCP_PORT=8000 \
pip install -e ".[http]" && python -m bag_epl_mcp.serverTransport & host are configured exclusively via environment variables (MCP_TRANSPORT,MCP_HOST,MCP_PORT). The default isstdiobound to nothing;MCP_HOSTdefaults to127.0.0.1and should only be set to0.0.0.0inside a container/cloud environment.
Try it immediately in Claude Desktop:
"Is Methylphenidate (Ritalin) covered by mandatory health insurance?" "Which laws regulate admission to the Spezialitaetenliste?" "Is a wheelchair covered by mandatory insurance?"
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"bag-epl": {
"command": "python",
"args": ["-m", "bag_epl_mcp.server"]
}
}
}Or with uvx:
{
"mcpServers": {
"bag-epl": {
"command": "uvx",
"args": ["bag-epl-mcp"]
}
}
}Render.com (recommended):
pip install -e ".[http]"MCP_TRANSPORT=streamable-httpMCP_HOST=0.0.0.0 (required so the container accepts external traffic)MCP_PORT=8000 (or Render's $PORT)MCP_CORS_ORIGINS='["https://claude.ai"]' to extend thebrowser CORS allow-list
the tracing deps are installed — build with pip install -e ".[http,otel]" and point OTEL_EXPORTER_OTLP_ENDPOINT at your collector. Set MCP_OTEL_ENABLED=0 to disable.
python -m bag_epl_mcp.serverhttps://your-app.onrender.com/mcpSecurity note: the server exposes only public, read-only data and uses no authentication. See docs/SECURITY.md for the threat model (egress allow-list, host binding, Lethal-Trifecta assessment).| Tool | Description |
|---|---|
epl_sl_suche | Search the Spezialitaetenliste for compulsory-insurance medications |
epl_ggsl_abfrage | Check GGSL coverage for congenital disorders |
epl_migel_suche | Search the MiGeL for medical devices & aids |
epl_gesuchseingaenge | List pending SL admission requests (transparency) |
epl_rechtskontext | Legal context for coverage questions (WZW criteria) |
epl_server_info | Server status and API phase information |
| Query | Tool |
|---|---|
| "Is Ritalin covered by insurance?" | epl_sl_suche |
| "Which medications for congenital disorder GG-313?" | epl_ggsl_abfrage |
| "Is a wheelchair covered?" | epl_migel_suche |
| "Which laws regulate the SL?" | epl_rechtskontext |
Data flow (Phase 1):
bag-epl-mcp (FastMCP)
\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 MCP \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 HTTPS GET \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
\u2502 MCP Client \u2502\u25c0\u2500\u2500\u2500\u2500\u2500\u2500\u25b6\u2502 tools (read-only) \u2502\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25b6\u2502 sl.bag.admin.ch \u2502
\u2502 (Claude \u2502 stdio / \u2502 \u251c\u2500 epl_sl_suche \u2502 egress \u2502 www.bag.admin.ch \u2502
\u2502 Desktop, \u2502 Stream- \u2502 \u251c\u2500 epl_ggsl_abfrage \u2502 allow-list \u2502 www.fedlex... \u2502
\u2502 claude.ai)\u2502 able \u2502 \u251c\u2500 epl_migel_suche \u2502\u25c0\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2502 (public OGD) \u2502
\u2502 \u2502 HTTP \u2502 \u251c\u2500 epl_gesuchseingaenge \u2502 (no auth) \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
\u2502 \u2502 \u2502 \u251c\u2500 epl_rechtskontext \u2502
\u2502 \u2502 \u2502 \u2514\u2500 epl_server_info \u2502 structured JSON logs \u2192 stderr
\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 resources: epl://uebersicht \u2026 \u2502
\u2502 prompts: epl_kassenpflicht\u2026 \u2502
\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518Phase roadmap (details in docs/ROADMAP.md):
Phase 1 (current) \u2192 SL website access + structured legal info
Phase 2 (planned) \u2192 FHIR/IDMP API (BAG, ~2025/2026)
Phase 3 (vision) \u2192 MiGeL + AL via ePL-FHIR (2026/2027)The server is already useful today and will seamlessly upgrade when the BAG publishes its FHIR API.
MCP protocol version: 2025-06-18 (surfaced via epl_server_info). SDK updates are proposed monthly via Dependabot; the protocol version is reviewed on every mcp SDK bump \u2014 see the versioning policy in docs/ROADMAP.md.
limit parameters conservatively.source / provenance block (JSON) or a source-and-licence footer (Markdown) so attribution is preserved.content) and a typed structuredContent validated against a per-tool output schema, so MCP clients can consume results programmatically without parsing prose.# Unit tests (no API key required)
PYTHONPATH=src pytest tests/ -m "not live"
# Integration tests (live API calls)
pytest tests/ -m "live"See CHANGELOG.md
See CONTRIBUTING.md
MIT License \u2014 see LICENSE
Hayal Oezkan \u00b7 malkreide
<!-- mcp-name: io.github.malkreide/bag-epl-mcp -->
<!-- BEGIN GENERATED: install -->
Run via uv's uvx — no clone or manual install needed. Add to your MCP client config (mcpServers for Claude Desktop, Cursor and Windsurf; use a top-level servers key for VS Code in .vscode/mcp.json):
{
"mcpServers": {
"bag-epl-mcp": {
"command": "uvx",
"args": [
"bag-epl-mcp"
]
}
}
}<!-- END GENERATED: install -->
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.