FHIR MCP Server – helping you expose any FHIR Server or API as a MCP Server.
SaferSkills independently audited Fhir Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The FHIR MCP Server is a Model Context Protocol (MCP) server that provides seamless integration with FHIR APIs. Designed for developers, integrators, and healthcare innovators, this server acts as a bridge between modern AI/LLM tools and healthcare data, making it easy to search, retrieve, and analyze clinical information.
This video showcases the MCP server's functionality when connected to a public HAPI FHIR server. This example showcases direct interaction with an open FHIR server that does not require an authorization flow.
https://github.com/user-attachments/assets/cc6ac87e-8329-4da4-a090-2d76564a3abf
This video showcases the MCP server's capabilities within the Epic EHR ecosystem. It demonstrates the complete OAuth 2.0 Authorization Code Grant flow.
https://github.com/user-attachments/assets/96b433f1-3e53-4564-8466-65ab48d521de
read and search operations using custom FHIRPath expressions to retrieve only the fields needed for the task, reducing payload sizes.You can use the FHIR MCP Server by installing our Python package, or by cloning this repository.
To run the server, you must set FHIR_SERVER_BASE_URL.
FHIR_SERVER_BASE_URL, FHIR_SERVER_CLIENT_ID, FHIR_SERVER_CLIENT_SECRET, and FHIR_SERVER_SCOPES. Authorization is enabled by default.FHIR_SERVER_DISABLE_AUTHORIZATION to True.By default, the MCP server runs on [http://localhost:8000](http://localhost:8000), and you can customize the host and port using FHIR_MCP_HOST and FHIR_MCP_PORT.
You can set these by exporting them as environment variables like below or by creating a .env file (referencing .env.example).
export FHIR_SERVER_BASE_URL=""
export FHIR_SERVER_CLIENT_ID=""
export FHIR_SERVER_CLIENT_SECRET=""
export FHIR_SERVER_SCOPES=""
export FHIR_MCP_HOST="localhost"
export FHIR_MCP_PORT="8000" uvx fhir-mcp-server git clone <repository_url>
cd <repository_directory> uv venv
source .venv/bin/activate
uv pip sync requirements.txtOr with pip:
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txtCopy the example file and customize if needed:
cp .env.example .env uv run fhir-mcp-server#### Running the MCP Server with Docker
You can run the MCP server using Docker for a consistent, isolated environment.
>Note on Authorization: When running the MCP server locally via Docker or Docker Compose, authorization should be disabled by setting the environment variable, FHIR_SERVER_DISABLE_AUTHORIZATION=True . This would be fixed in the future releases.
docker build -t fhir-mcp-server . docker pull wso2/fhir-mcp-server:latestCopy the example environment file and edit as needed:
cp .env.example .env
# Edit .env to set your FHIR server, client credentials, etc.Alternatively, you can pass environment variables directly with -e flags or use Docker secrets for sensitive values. See the Configuration section for details on available environment variables.
docker run --env-file .env -p 8000:8000 fhir-mcp-serverThis will start the server and expose it on port 8000. Adjust the port mapping as needed.
#### Using Docker Compose with HAPI FHIR Server
For a quick setup that includes both the FHIR MCP server and a HAPI FHIR server (with PostgreSQL), use the provided docker-compose.yml. This sets up an instant development environment for testing FHIR operations.
docker-compose up -dThis command will:
FHIR_SERVER_BASE_URL set to http://hapi-r4-postgresql:8080/fhir.docker-compose down.If you need to customize OAuth or other settings, adjust the env variables in the docker-compose.yml. The compose file sets basic configuration; refer to the Configuration section for full options.
The FHIR MCP Server is designed for seamless integration with various MCP clients.
Add the following JSON block to your MCP configuration file in VS Code (> V1.104). You can do this by pressing Ctrl + Shift + P and typing MCP: Open User Configuration.
<table> <tr><th>Streamable HTTP</th><th>STDIO</th><th>SSE</th></tr> <tr valign=top> <td>
"servers": {
"fhir": {
"type": "http",
"url": "http://localhost:8000/mcp",
}
}</td>
<td>
"servers": {
"fhir": {
"command": "uv",
"args": [
"--directory",
"/path/to/fhir-mcp-server",
"run",
"fhir-mcp-server",
"--transport",
"stdio"
],
"env": {
"FHIR_SERVER_ACCESS_TOKEN": "Your FHIR Access Token"
}
}
}</td>
<td>
"servers": {
"fhir": {
"type": "sse",
"url": "http://localhost:8000/sse",
}
}</td> </tr> </table>
Add the following JSON block to your Claude Desktop settings to connect to your local MCP server.
<table> <tr><th>Streamable HTTP</th><th>STDIO</th><th>SSE</th></tr> <tr valign=top> <td>
{
"mcpServers": {
"fhir": {
"command": "npx",
"args": [
"-y",
"mcp-remote",
"http://localhost:8000/mcp"
]
}
}
}</td> <td>
{
"mcpServers": {
"fhir": {
"command": "uv",
"args": [
"--directory",
"/path/to/fhir-mcp-server",
"run",
"fhir-mcp-server",
"--transport",
"stdio"
],
"env": {
"FHIR_SERVER_ACCESS_TOKEN": "Your FHIR Access Token"
}
}
}
}</td>
<td>
{
"mcpServers": {
"fhir": {
"command": "npx",
"args": [
"-y",
"mcp-remote",
"http://localhost:8000/sse"
]
}
}
}</td> </tr> </table>
Follow these steps to get the MCP Inspector up and running:
npx -y @modelcontextprotocol/inspector
<table> <tr><th>Streamable HTTP</th><th>STDIO</th><th>SSE</th></tr> <tr valign=top> <td>
Streamable HTTPhttp://localhost:8000/mcp</td>
<td>
STDIOuv--directory /path/to/fhir-mcp-server run fhir-mcp-server --transport stdio</td>
<td>
SSEhttp://localhost:8000/sse</td> </tr> </table>
Make sure your MCP server is already running and listening on the above endpoint.
Once connected, MCP Inspector will allow you to visualize tool invocations, inspect request/response payloads, and debug your tool implementations easily.
You can customize the behavior of the MCP server using the following command-line flags:
Sample Usages:
uv run fhir-mcp-server --transport streamable-http --log-level DEBUG
uv run fhir-mcp-server --helpMCP Server Configurations:
FHIR_MCP_HOST: The hostname or IP address the MCP server should bind to (e.g., localhost for local-only access, or 0.0.0.0 for all interfaces).FHIR_MCP_PORT: The port on which the MCP server will listen for incoming client requests (e.g., 8000).FHIR_MCP_SERVER_URL: If set, this value will be used as the server's base URL instead of generating it from host and port. Useful for custom URL configurations or when behind a proxy.FHIR_MCP_REQUEST_TIMEOUT: Timeout duration in seconds for requests from the MCP server to the FHIR server (default: 30).MCP Server OAuth2 with FHIR server Configuration (MCP Client ↔ MCP Server): These variables configure the MCP client's secure connection to the MCP server, using the OAuth2 authorization code grant flow with a FHIR server.
FHIR_SERVER_CLIENT_ID: The OAuth2 client ID used to authorize MCP clients with the FHIR server.FHIR_SERVER_DISABLE_AUTHORIZATION: If set to True, disables authorization checks on the MCP server, allowing connections to publicly accessible FHIR servers.FHIR_SERVER_CLIENT_SECRET: The client secret corresponding to the FHIR client ID. Used during token exchange.FHIR_SERVER_BASE_URL: The base URL of the FHIR server (e.g., https://hapi.fhir.org/baseR4). This is used to generate tool URIs and to route FHIR requests.FHIR_SERVER_SCOPES: A space-separated list of OAuth2 scopes to request from the FHIR authorization server (e.g., user/Patient.read user/Observation.read). Add fhirUser openid to enable retrieval of user context for the get_user tool. If these two scopes are not configured, the get_user tool returns an empty result because the ID token lacks the user's FHIR resource reference.FHIR_SERVER_ACCESS_TOKEN: The access token to use for authenticating requests to the FHIR server. If this variable is set, the server will bypass the OAuth2 authorization flow and use this token directly for all requests.get_capabilities: Retrieves metadata about a specified FHIR resource type, including its supported search parameters and custom operations.type: The FHIR resource type name (e.g., "Patient", "Observation", "Encounter")search: Executes a standard FHIR search interaction on a given resource type, returning a bundle or list of matching resources.type: The FHIR resource type name (e.g., "MedicationRequest", "Condition", "Procedure").searchParam: A mapping of FHIR search parameter names to their desired values (e.g., {"family":"Simpson","birthdate":"1956-05-12"}).response_filter_fhirpaths: (Optional) An array of FHIRPath expressions (e.g., ["Patient.name", "Patient.birthDate", "Bundle.link.where(relation='next').url"]) to apply to the resources in the response bundle.read: Performs a FHIR "read" interaction to retrieve a single resource instance by its type and resource ID, optionally refining the response with search parameters or custom operations.type: The FHIR resource type name (e.g., "DiagnosticReport", "AllergyIntolerance", "Immunization").id: The logical ID of a specific FHIR resource instance.searchParam: A mapping of FHIR search parameter names to their desired values (e.g., {"device-name":"glucometer"}).operation: The name of a custom FHIR operation or extended query defined for the resource (e.g., "$everything").response_filter_fhirpaths: (Optional) An array of FHIRPath expressions (e.g., ["Patient.name", "Observation.valueQuantity"]) to filter the returned single resource (or entries when using custom operations like $everything).create: Executes a FHIR "create" interaction to persist a new resource of the specified type.type: The FHIR resource type name (e.g., "Device", "CarePlan", "Goal").payload: A JSON object representing the full FHIR resource body to be created.searchParam: A mapping of FHIR search parameter names to their desired values (e.g., {"address-city":"Boston"}).operation: The name of a custom FHIR operation or extended query defined for the resource (e.g., "$evaluate").update: Performs a FHIR "update" interaction by replacing an existing resource instance's content with the provided payload.type: The FHIR resource type name (e.g., "Location", "Organization", "Coverage").id: The logical ID of a specific FHIR resource instance.payload: The complete JSON representation of the FHIR resource, containing all required elements and any optional data.searchParam: A mapping of FHIR search parameter names to their desired values (e.g., {"patient":"Patient/54321","relationship":"father"}).operation: The name of a custom FHIR operation or extended query defined for the resource (e.g., "$lastn").delete: Execute a FHIR "delete" interaction on a specific resource instance.type: The FHIR resource type name (e.g., "ServiceRequest", "Appointment", "HealthcareService").id: The logical ID of a specific FHIR resource instance.searchParam: A mapping of FHIR search parameter names to their desired values (e.g., {"category":"laboratory","issued:"2025-05-01"}).operation: The name of a custom FHIR operation or extended query defined for the resource (e.g., "$expand").get_user: Retrieves the currently authenticated user's FHIR resource (for example the linked Patient resource) and returns a concise profile containing available demographic fields such as id, name, and birthDate.To run tests and contribute to development, install the test dependencies:
Using pip:
# Install project in development mode with test dependencies
pip install -e '.[test]'
# Or install from requirements file
pip install -r requirements-dev.txtUsing uv:
# Install development dependencies
uv sync --devThe project includes a comprehensive test suite covering all major functionality:
# Simple test runner
python run_tests.py
# Or direct pytest usage
PYTHONPATH=src python -m pytest tests/ -v --cov=src/fhir_mcp_serverUsing pytest:
pytest tests/This will discover and run all tests in the tests/ directory.
Test Features:
The test suite includes:
Coverage reports are generated in htmlcov/index.html for detailed analysis.
<!-- mcp-name: io.github.wso2/fhir-mcp-server -->
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.