Medplum Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Medplum Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server that provides access to Medplum FHIR healthcare data. It enables Claude and other MCP clients to read, search, and query FHIR resources from one or more Medplum environments.
The server exposes 5 MCP tools:
| Tool | Description |
|---|---|
fhir_get_environments | List available Medplum environments and the default |
fhir_get_resource_types | List supported FHIR resource types and their search parameters |
fhir_read | Read a single FHIR resource by type and ID |
fhir_search | Search for FHIR resources with query parameters |
fhir_read_history | Get version history of a resource |
npm install @ncodeuy/medplum-mcpSet one environment variable per field, using the pattern MEDPLUM_PROJECT_<NAME>_<FIELD>:
# Required
MEDPLUM_PROJECT_STAGING_CLIENT_ID=staging-client-id
MEDPLUM_PROJECT_STAGING_CLIENT_SECRET=staging-secret
# Optional (defaults to https://api.medplum.com/)
MEDPLUM_PROJECT_STAGING_BASE_URL=https://staging.example.com/
MEDPLUM_PROJECT_STAGING_PROJECT_ID=proj-staging
# Add more projects by changing the name segment
MEDPLUM_PROJECT_PRODUCTION_CLIENT_ID=prod-client-id
MEDPLUM_PROJECT_PRODUCTION_CLIENT_SECRET=prod-secret
# Optional — defaults to the first project found
MEDPLUM_DEFAULT_PROJECT=staging<details> <summary>Alternative: JSON configuration</summary>
You can also use the MEDPLUM_PROJECTS environment variable with a JSON object:
MEDPLUM_PROJECTS='{
"staging": {
"baseUrl": "https://staging.example.com/",
"clientId": "staging-client-id",
"clientSecret": "staging-secret",
"projectId": "proj-staging"
},
"production": {
"clientId": "prod-client-id",
"clientSecret": "prod-secret"
}
}'Flat env vars take priority when both are set.
</details>
Add the server to your Claude Desktop configuration (claude_desktop_config.json):
{
"mcpServers": {
"medplum": {
"command": "npx",
"args": ["@ncodeuy/medplum-mcp"],
"env": {
"MEDPLUM_PROJECT_DEFAULT_CLIENT_ID": "your-client-id",
"MEDPLUM_PROJECT_DEFAULT_CLIENT_SECRET": "your-client-secret"
}
}
}
}Add the server to your Claude Code MCP settings:
claude mcp add medplum \
-e MEDPLUM_PROJECT_DEFAULT_CLIENT_ID=your-client-id \
-e MEDPLUM_PROJECT_DEFAULT_CLIENT_SECRET=your-client-secret \
-- npx @ncodeuy/medplum-mcp# Install dependencies
npm install
# Type check
npm run typecheck
# Run tests
npm test
# Build
npm run build
# Run the server locally
node ./dist/index.jsISC
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.