Open reference implementation · MIT License · Community project

The guardrail layer between AI agents and clinical data

FHIR standardised health data. MCP standardised how AI connects to tools. Nobody standardised the guardrails in between — so we built a shared, open reference for that layer. See it working in CareAgents: sign in with your face, connect your records, and spin up a health agent that reads them, with redaction, audit, and human sign-off enforced server-side.

Try CareAgents → Explore the live dashboard

Building on it? It is MIT-licensed — use it, fork it, send a PR.

MCP tools

FHIR resource types

Tests passing

Guardrail layers

How it works

Every request passes through six layers

When an AI agent reaches clinical data through HealthClaw, each request is validated, redacted, authorised, and recorded before anything touches the FHIR server.

PHI Redacted

Names, addresses and dates of birth stripped before the agent sees data.

$validate Gate

Structural validation before any write proposal.

Permission Eval

R6 Permission $evaluate, denying by default.

HMAC Step-up

Signed token with a 128-bit nonce and a five-minute TTL.

Human Gate

Clinical writes stay blocked until a person confirms.

Audit Trail

An immutable, append-only record of every action.

PHI redaction

The agent never sees raw patient data

Applied on every read path: direct reads, search results, upstream proxy responses, and context envelopes. Agents work with de-identified data by default.

Stored in FHIR server

name Maria Elena Rivera

mrn MRN-2026-4471

phone 617-555-0198

address 123 Clinical Ave, Boston MA 02101

dob 1985-03-15

Delivered to the AI agent

name M. E. Rivera

mrn ***4471

phone [Redacted]

address Boston, MA

dob 1985

See it in action

Watch HealthClaw guard a live agent

A three-minute showcase built for the PromptOpinion Agents Assemble Challenge, plus a five-minute deep dive for engineers who want the architecture story.

Three-minute demo · Devpost submission

Agents Assemble Challenge showcase

An AI agent calls HealthClaw FHIR tools; you see PHI redaction, audit emission, and the synthetic-data disclaimer fire in real time.

Five-minute deep dive

Architecture and SHARP-on-MCP walkthrough

How HealthClaw forwards SMART-on-FHIR tokens via SHARP headers, applies the guardrail stack, and stays compatible with any EHR, with the code paths called out.

Where to use it

Pick your chat surface. HealthClaw is the same underneath.

HealthClaw is the data and guardrail layer. Three gateways are wired in today; all three call the same MCP server, get the same redacted responses, and emit the same audit trail. Compare them on the wiki.

PromptOpinion Marketplace Open access

HealthClaw on PromptOpinion

Published as both a Superpower (MCP server, 16 tools) and an Agent (Clinical Reviewer). Add it to a workspace, pick a model, and start chatting in the browser — synthetic Grover Keeling demo data preloaded.

Devpost: Agents Assemble
SHARP-on-MCP

Open the agent listing →

Hermes (Nous Research) Self-improving

Multi-gateway chat that learns

Telegram, Discord, Slack, WhatsApp, Signal, CLI and HTTP. A native MCP client. Skills get better as you use them; the ten HealthClaw skills ship as starting points.

./hermes/install.sh
agentskills.io

Hermes quick start →

OpenClaw Telegram

One bot, fixed commands, zero ambiguity

The original integration. A Telegram bot with slash commands (/conditions, /labs, /curatr, /approve). Best when you want exactly one chat channel and predictable behaviour.

docker-compose --profile openclaw up

OpenClaw setup →

Need raw MCP — Claude Desktop, MCP Inspector, or your own client? Point it at https://mcp-demo-production-ee2c.up.railway.app/mcp. No credential needed, and it is pinned server-side to the synthetic desktop-demo tenant, so it only ever serves fake data.

Compiled truth

See what your record says now, and why it says that.

Every other health tool shows you data. HealthClaw shows you the trail. One FHIR operation, one MCP tool, one review surface — built on the primitive every PHR is missing: current state plus append-only evidence.

One primitive

GET /$compiled-truth

Returns a FHIR Parameters bundle: the redacted current resource, its curation state, quality score, and the full Provenance timeline, newest first. Nothing hidden.

One MCP tool

fhir_compiled_truth

Agents call this before making resource-specific claims. Responses carry _meta.ui.resourceUri, an embeddable review surface, instead of a wall of chat-text fine print.

One review surface

MCP App · native HTML

The same evidence rendered for a person: what changed, who proposed it, what you approved, and when. Backed by R6 Provenance.

# agent reads the compiled truth before answering
curl -H "X-Tenant-Id: your-tenant" \
     https://healthclaw.io/r6/fhir/Condition/<id>/$compiled-truth

# or via MCP from Claude Desktop
> fhir_compiled_truth(resource_type="Condition", resource_id="<id>")

Built for

Three paths, one guardrail stack

Whether you are building an AI health agent, managing your own health data, or evaluating compliance infrastructure, HealthClaw meets you where you are.

AI Agent Developer

Ship HIPAA-safe agents in minutes, not months.

29 MCP tools — drop into Claude Desktop, or any framework via the OpenAI and Gemini adapters
Fill and extract forms the standard way, with HL7 SDC $populate and $extract
One-line Claude Code install
Works with any FHIR server (HAPI, Epic, Medplum, AWS)
PHI redaction, audit and step-up auth with zero config

Quick start →

Patient / Consumer

See what is wrong with your health data, and fix it.

Curatr checks records against live medical code databases
Plain-language explanations of coding errors and their impact
You approve every fix, with a full provenance trail
Connect 1,000+ EHR systems via Fasten Connect
Wearable data (Garmin, Oura, Polar, Whoop, Fitbit) via Open Wearables

Try Curatr →

Health System / Payer

Evaluate the guardrails before an agent goes near patient or member data.

Vendor-neutral proxy that works with your existing FHIR stack
Tenant isolation, append-only audit, OAuth 2.1 with PKCE
Human-in-the-loop for clinical writes (the HTTP 428 pattern)
Care-gap evaluation that shows its reasoning and records who approved it
The gaps are published too: no SOC 2, no BAA, and redaction is not an Expert Determination

Read the security posture →

Claude Code plugin

Install HealthClaw skills into Claude Code in one line

The healthclaw-marketplace hosts two plugins that ship as auto-discoverable Claude Code skills. Add the marketplace once, install either plugin, and Claude invokes the right skill whenever your prompt matches its triggers — no manual tool wiring.

// add the marketplace (once)
$ claude plugin marketplace add aks129/HealthClawGuardrails

// install the guardrail plugin (FHIR + MCP + Curatr + Fasten Connect)
$ claude plugin install healthclaw-guardrails@healthclaw-marketplace

// or skip the install — hosted consumer app
$ open https://careagents.cloud

Plugin

healthclaw-guardrails

FHIR agent guardrails and EHR integration.

fhir-r6-guardrails — 29 MCP tools, PHI redaction, step-up auth, audit
curatr — data-quality evaluation and patient-approved fixes
fasten-connect — EHR and TEFCA ingestion
phi-redaction — conservative de-identification preview
fhir-upstream-proxy — HAPI, Epic, Medplum
healthex-export — portable FHIR bundle export

Hosted app

careagents

Hosted personal health agents, with advisors built in.

healthy-habits — vitals, sleep and activity trends
care-completion — preventive care-gap follow-through
medication-refills — refill windows and projections
diet-exercise — activity and nutrition coaching
Passkey sign-in, on web, Telegram and iMessage
Every answer through the guardrail layer, with no PHI stored

Open CareAgents →

Marketplace manifest: .claude-plugin/marketplace.json · Skills authored against Anthropic's Skill Authoring Guide.

Curatr — patient data quality

Your health data is full of errors. Now you can fix them.

Curatr evaluates FHIR resources against live public terminology services, explains issues in plain language, and lets you approve fixes with full provenance tracking.

Issue classes Curatr detects and the source it checks against
Severity	Issue	Checked against
critical	Deprecated ICD-9	Local lookup
warning	Invalid ICD-10-CM	NLM Clinical Tables
warning	Unknown SNOMED CT	tx.fhir.org
warning	Missing RxNorm	RxNav API
info	Display mismatch	Cross-check
warning	Missing fields	Structural

Every approved fix creates a linked Provenance resource recording patient intent, field changes, and agent attribution, written to the immutable audit trail. No black-box corrections.

Comparison

Vendor-neutral by design

HealthClaw works with any FHIR server. The guardrails are the product, not the data layer.

HealthClaw compared with AWS HealthLake, Medplum MCP and raw FHIR
Capability	HealthClaw	AWS HealthLake	Medplum MCP	Raw FHIR
Any FHIR server	yes	no	no	—
PHI redaction on reads	yes	no	no	no
Immutable audit trail	yes	separate	partial	no
Step-up auth for writes	yes	separate	built-in	no
Human-in-the-loop	yes	no	no	no
R6 Permission $evaluate	yes	no	no	no
Setup time	10 sec	30+ min	15+ min	varies

Get started

Running in ten seconds

No accounts. No API keys. No cloud setup. Clone, install, run.

# install + run in 10 seconds
uv sync
STEP_UP_SECRET=your-secret python main.py

# or with Docker
docker-compose up -d --build

# connect to your FHIR server
FHIR_UPSTREAM_URL=https://hapi.fhir.org/baseR4 python main.py