[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_136":137},"routes/modules.$creator.$moduleId",{"_14":15,"_16":17,"_18":19,"_20":21},"routes/modules.$creator.$moduleId.endpoints",{"_11":12,"_13":-5},"error","Module not found","tools","module",{"_20":22,"_23":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":26,"_36":37,"_38":-5,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_57":49,"_58":59,"_60":61,"_62":63,"_64":65,"_66":67,"_68":49,"_69":70,"_71":72,"_73":74,"_75":76,"_77":78,"_79":-5,"_80":-5,"_81":82,"_83":49,"_84":-5,"_85":86,"_87":88,"_89":90,"_91":92,"_93":94,"_95":96,"_97":98},"apiUrl","https://odel.app/api","creator","aks129","moduleId","healthclawguardrails","@aks129/healthclawguardrails","displayName","HealthClawGuardrails","tagline","Guardrailed FHIR access for AI agents: PHI redaction, audit trail, step-up auth, tenant isolation","iconKey","https://avatars.githubusercontent.com/u/44978768?v=4","category","remote","status","published","visibility","public","metaDescription","deploymentType","external","workerName","bindingName","mcpConfig","{\"url\":\"https://mcp-server-production-5112.up.railway.app/mcp\",\"transport\":\"streamable-http\",\"authType\":\"headers\",\"requiredSecrets\":[{\"name\":\"X-Tenant-Id\",\"scope\":\"per-user\",\"header\":\"X-Tenant-Id\"},{\"name\":\"X-Step-Up-Token\",\"scope\":\"per-user\",\"header\":\"X-Step-Up-Token\"}]}","pricingModel","free","creatorUserId","system:external-import","createdAt",1783337812000,"updatedAt",1788777435000,"sourceRegistry","official-mcp-registry","sourceUrl","https://registry.modelcontextprotocol.io/v0/servers?search=io.github.aks129%2Fhealthclaw-guardrails","sourceVerified",true,"sourceMissingSince","importedAt","upstreamStars",30,"upstreamUpdatedAt",1788744948000,"detectedTransport","streamable-http","detectedAuthType","bearer","probeStatus","ok","lastProbedAt","githubRepoUrl","https://github.com/aks129/HealthClawGuardrails","githubRepoFullName","aks129/HealthClawGuardrails","releaseId","ext-aks129-healthclawguardrails","version","1.6.0","descriptionMarkdown","

\n\n $\"HealthClaw$ \n\n# HealthClaw Guardrails\n\n### The open-source security layer between AI agents and clinical data.\n\n*FHIR standardized how health data is structured. MCP standardized how AI connects to tools.*\n***Nobody standardized the guardrails in between. This project does.***\n\n
\n\n\n[![Release](https://img.shields.io/badge/release-v1.10.0-f97316?style=flat-square)](https://github.com/aks129/HealthClawGuardrails/releases)\n[![License](https://img.shields.io/badge/license-MIT-2dd4bf?style=flat-square)](LICENSE)\n[![CI](https://img.shields.io/github/actions/workflow/status/aks129/HealthClawGuardrails/ci.yml?branch=main&style=flat-square&label=CI&logo=github)](https://github.com/aks129/HealthClawGuardrails/actions/workflows/ci.yml)\n[![Code size](https://img.shields.io/github/languages/code-size/aks129/HealthClawGuardrails?style=flat-square&color=0ea5e9)](https://github.com/aks129/HealthClawGuardrails)\n\n\n[![Stars](https://img.shields.io/github/stars/aks129/HealthClawGuardrails?style=flat-square&logo=github&color=eab308)](https://github.com/aks129/HealthClawGuardrails/stargazers)\n[![Forks](https://img.shields.io/github/forks/aks129/HealthClawGuardrails?style=flat-square&logo=github&color=8b5cf6)](https://github.com/aks129/HealthClawGuardrails/network/members)\n[![Issues](https://img.shields.io/github/issues/aks129/HealthClawGuardrails?style=flat-square&logo=github&color=ef4444)](https://github.com/aks129/HealthClawGuardrails/issues)\n[![Contributors](https://img.shields.io/github/contributors/aks129/HealthClawGuardrails?style=flat-square&color=14b8a6)](https://github.com/aks129/HealthClawGuardrails/graphs/contributors)\n[![Last commit](https://img.shields.io/github/last-commit/aks129/HealthClawGuardrails?style=flat-square&color=64748b)](https://github.com/aks129/HealthClawGuardrails/commits/main)\n\n\n[![Tests](https://img.shields.io/badge/tests-1490%2B%20Python%20%2B%20170%20Node-22c55e?style=flat-square)](#testing)\n[![MCP tools](https://img.shields.io/badge/MCP%20tools-29-6366f1?style=flat-square&logo=anthropic)](#mcp-tools-29)\n[![FHIR](https://img.shields.io/badge/FHIR-R4%20US%20Core%20v9-0ea5e9?style=flat-square)](#fhir-version-support)\n[![Guardrail conformance](https://img.shields.io/endpoint?url=https%3A%2F%2Fapp.healthclaw.io%2Fr6%2Ffhir%2F%24conformance%3Fformat%3Dshields&style=flat-square)](#what-this-grade-means-and-what-it-doesnt)\n[![Glama score](https://glama.ai/mcp/servers/aks129/HealthClawGuardrails/badges/score.svg)](https://glama.ai/mcp/servers/aks129/HealthClawGuardrails)\n[![Python](https://img.shields.io/badge/python-3.11%2B-3776AB?style=flat-square&logo=python&logoColor=white)](pyproject.toml)\n[![Docker](https://img.shields.io/badge/docker-compose-2496ED?style=flat-square&logo=docker&logoColor=white)](#docker)\n\n
\n\n**[Quick Start](#quick-start)** · **[MCP Tools](#mcp-tools-29)** · **[Recipes](https://github.com/aks129/HealthClawGuardrails/blob/main/docs/recipes/)** · **[Roadmap](https://github.com/aks129/HealthClawGuardrails/blob/main/ROADMAP.md)** · **[Claude Plugin](#install-as-a-claude-plugin)** · **[Architecture](#what-it-does)** · **[healthclaw.io](https://healthclaw.io)** · **[Contributing](https://github.com/aks129/HealthClawGuardrails/blob/main/CONTRIBUTING.md)** · **[Dev Guide](https://github.com/aks129/HealthClawGuardrails/blob/main/docs/development.md)**\n\n

\n\n---\n\n> **What it is:** an open reference implementation of the FHIR × MCP guardrail layer — PHI redaction,\n> immutable audit, step-up auth, and tenant isolation — that sits between *any* AI agent and *any* FHIR\n> server. Built in the open as a community project, MIT-licensed. Not a product, not a pitch: if the\n> pattern is useful, take it; if it's wrong, tell us or fix it.\n\n**This is a community effort.** It's most useful when implementers, clinicians, and standards folks poke holes in it. Issues, PRs, and \"you got the SDC extraction wrong\" critiques are all welcome — start with **[CONTRIBUTING.md](https://github.com/aks129/HealthClawGuardrails/blob/main/CONTRIBUTING.md)** and the **[Code of Conduct](https://github.com/aks129/HealthClawGuardrails/blob/main/CODE_OF_CONDUCT.md)**.\n\n**At a glance:** v1.10.0, with 1,490+ Python and 170 Node tests across 29 MCP tools.\n**[CareAgents](https://careagents.cloud)** is the hosted consumer app: passkey sign-in, advisors, and web/Telegram/iMessage.\nTwo rails run end to end — real-world actions behind a provably out-of-band gate, and forms (`$populate` → human review → provenance PDF).\nStandards: FHIR R4 US Core v9 and R6 v6.0.0-ballot3, HL7 SDC forms, NQF 0018.\nOperations: lab interpreter (`$interpret`), care-gaps reminders (`$care-gaps`) with an embedded MCP-App view, and ChatGPT-connector `search`/`fetch`.\nConnectors: Fasten TEFCA, HealthEx, HBO, Flexpa, Epic, MEDENT, Open Wearables, SMART Health Links.\nAlso a Claude Code plugin and OpenAI/Gemini adapters.\n\n## Try it in 60 seconds — no clone, no keys\n\nThe hosted demo runs synthetic data behind the full guardrail stack:\n\n```bash\n# Watch the deployment grade its own guardrails (PHI redaction, audit, step-up, ...):\ncurl \"https://app.healthclaw.io/r6/fhir/\\$conformance?format=text\"\n```\n\nPoint any MCP client at the **public demo server** — URL `https://mcp-demo-production-ee2c.up.railway.app/mcp`,\nno key required — then ask: *\"Search my health records for lab results and explain them in plain\nlanguage.\"* The demo server is unauthenticated but hard-pinned to a synthetic demo tenant, so it can\nonly ever serve fake data. A separate **production endpoint** (`mcp-server-production-5112`) requires a\ndeployment-scoped `Authorization: Bearer ` — real records stay behind auth, always. Hosted\nconnectors cannot attach that header, so the demo URL above is the one to paste.\nOne-command installs:\n`gemini extensions install https://github.com/aks129/HealthClawGuardrails` ·\n`claude plugin marketplace add aks129/HealthClawGuardrails` ·\nskills on [ClawHub](https://clawhub.ai/aks129/skills/fhir-r6-guardrails)\n\n**Non-developer?** Step-by-step guides for Claude (web/desktop/phone), Perplexity,\nChatGPT, and Telegram — plus a 10-minute demo script — in [docs/quickstarts/](https://github.com/aks129/HealthClawGuardrails/blob/main/docs/quickstarts/README.md).\n\n**Listed in:** [Official MCP Registry](https://registry.modelcontextprotocol.io) (`io.github.aks129/healthclaw-guardrails`) ·\n[Glama](https://glama.ai/mcp/servers/aks129/HealthClawGuardrails) ([hosted connector](https://glama.ai/mcp/connectors/io.github.aks129/healthclaw-guardrails)) ·\n[ClawHub](https://clawhub.ai/aks129/skills/fhir-r6-guardrails) (14 skills) ·\nGemini CLI Extensions · agent-skills discovery at [`/.well-known/agent-skills/`](https://healthclaw.io/.well-known/agent-skills/index.json)\n\n## Release highlights\n\nFull notes live in **[Releases](https://github.com/aks129/HealthClawGuardrails/releases)**.\n\n| Version | Highlights |\n| --- | --- |\n| **v1.10.0** | **Runs in front of a real FHIR server.** The proxy now authenticates to an upstream FHIR server with its own client credential, so an agent never holds one — with a runnable [Aidbox example](https://github.com/aks129/HealthClawGuardrails/blob/main/examples/aidbox-healthclaw-guardrails/) that stands the guardrails in front of Aidbox and asserts each property rather than narrating it · **access kernel** — `r6.access` becomes the one tenant reader, step-up gate, audit call and FHIR exit, adopted blueprint by blueprint · **security**: a caller-supplied seed bundle takes the ingest gate, not the mint gate (an unauthenticated write path, found and closed) · **MCP**: an expired session returns 404, so a client re-initializes instead of failing · **demo data**: multi-year synthetic blood-pressure history and a server-rendered trend chart, with home and clinic readings modelled distinctly · a [defect catalogue](https://github.com/aks129/HealthClawGuardrails/blob/main/docs/) wired into the PR gate, and drift guards that replay the published example's own claims against the running app |\n| **v1.9.0** | **[CareAgents](https://careagents.cloud) — the hosted consumer experience**: sign up with a passkey, connect records through a pluggable connector marketplace (Fasten, Apple Health via Open Wearables, sample data), and spin up a guardrailed health agent reachable on web, Telegram, and iMessage · **advisor registry** — specialties ported from SmartHealthConnect (healthy-habits, care-completion, medication-refills, diet-exercise) as prompt-blocks over the guarded tool set, deferred ones honestly labeled · **versioned informed consent** enforced server-side (HTTP 428) before any real-record connection · **forms rail ships end-to-end** — `$populate` → per-item human review (NKA never inferred) → provenance-stamped PDF → signed expiring link · **error fidelity is conformance property seven (Grade A = 7/7)**, hardened across both MCP transports with a Python↔TypeScript drift guard · **MCP Apps** — care-gaps results embed an engine-served UI (`text/html; profile=mcp-app`) whose only fetch target is the guarded operation · security pass: fail-closed prod config, authenticated tenant reads, MCP transport auth, Alembic · SmartHealthConnect archived (skills frozen at v1.2.0; advisors are the live successors) |\n| **v1.8.0** | **Real-actions foundation** — an agent can *propose* a real-world action (call, SMS, form) but `commit` only *submits* it (HTTP 202); execution happens through a separate approval that requires a single-use step-up credential and an expiry-guarded atomic claim, so the agent's own toolchain can never approve its own action (the spoofable `X-Human-Confirmed` header is gone) · **`ActionExecutor` plugin registry** — add a real-world capability behind the full guardrail rail in ~50 lines, no core changes ([extend it](https://github.com/aks129/HealthClawGuardrails/blob/main/ROADMAP.md#extending-the-action-rail)) · mandatory red-flag emergency screen; fail-loud rails (no silent simulation) · **durable execution** — attempt ledger, provider reconciliation, external-tick reaper, append-only action-event log · **reliability floor** — config preflight (`GET /r6/ops/preflight`), Postgres CI lane, MCP fetch timeouts, poller 409-storm detection, source-aware resource identity `(tenant, type, id)`, Fasten hardening + zombie-job reaper · public [ROADMAP](https://github.com/aks129/HealthClawGuardrails/blob/main/ROADMAP.md) + contributor on-ramp · fixes: upstream FHIR error fidelity, quality measures default to current year |\n| **v1.7.0** | Preventive care-gaps engine (`Patient/$care-gaps`, USPSTF/ACIP/ADA + eCQM crosswalk) · patient connect flow: identity-verified Fasten onboarding mints a webhook-gated, read-scoped 30-day agent token · prescription transfer requests (`rx_transfer_request`, Schedule II refused) — 29 MCP tools · [per-agent quickstarts](https://github.com/aks129/HealthClawGuardrails/blob/main/docs/quickstarts/) (Claude/Perplexity/ChatGPT/Telegram) · HBO export→FHIR converter + embedded-XML PHI scrubber · hardening: fail-closed webhook verify, scoped tokens, serverless write guard, live-path contract tests · clinical fixes: SNOMED diabetes detection, inclusive panic thresholds, one-sided-range honesty |\n| **v1.6.0** | Lab reference-range interpreter (`Observation/$interpret`) · NQF 0018 quality measure (`Measure/$evaluate-measure`) · [any-agent-framework adapters](https://github.com/aks129/HealthClawGuardrails/blob/main/docs/recipes/any-agent-framework.md) (OpenAI/Gemini) · [Medplum-in-front recipe](https://github.com/aks129/HealthClawGuardrails/blob/main/docs/recipes/healthclaw-in-front-of-medplum.md) · SMBP triage on 2025 AHA/ACC · ruff lint gate · all dependency advisories remediated |\n| v1.5.0 | Read-auth hardening (tenant reads authenticated, not just scoped) · HL7 SDC forms — `$populate` / `$extract` |\n| v1.4.0 | Six health-data connectors (Fasten TEFCA, HealthEx, Health Bank One, Flexpa, Epic, MEDENT) behind one guardrail stack |\n| v1.3.0 | Wearables → FHIR Observations (8 providers, LOINC/UCUM mapping, device Provenance) |\n| v1.2.0 | Compiled Truth — current state + append-only Provenance trail per resource |\n\n## What It Does\n\nThis is a **vendor-neutral guardrail proxy** that sits between any AI agent and any FHIR server. Every request passes through:\n\n- **PHI redaction** — Names truncated to initials, identifier values removed (system and type kept), addresses stripped, birth dates truncated to year\n- **Immutable audit trail** — Every read/write logged with tenant, agent, timestamp\n- **Step-up authorization** — HMAC-SHA256 tokens required for writes\n- **Human-in-the-loop** — Clinical writes blocked until a human confirms (HTTP 428); real-world actions (calls, SMS, forms) go further: `commit` only *submits*, and execution requires a **provably out-of-band** single-use approval the agent's own toolchain cannot satisfy\n- **Tenant isolation** — Every query scoped to tenant, cross-tenant access blocked\n- **Medical disclaimers** — Injected on all clinical resource reads\n- **Compiled Truth** — Current state + append-only evidence trail for every resource\n\n```text\nAI Agent ──▶ MCP Server ──▶ Guardrail Proxy ──▶ Any FHIR Server\n ↓ (HAPI, Epic,\n PHI redaction Medplum, etc.)\n Audit trail\n Step-up auth\n Human-in-the-loop\n```\n\n## Prove it: guardrail conformance\n\nThe guardrails are **verifiable, not marketing.** A runnable harness probes any\ndeployment with synthetic data and emits a scorecard across all seven properties —\nrun it against your own instance (or ours):\n\n```bash\npython scripts/guardrail_conformance.py \\\n --base-url https://app.healthclaw.io --tenant desktop-demo \\\n --step-up-token \"$(mint a token via POST /r6/fhir/internal/step-up-token)\"\n```\n\n```text\nHealthClaw Guardrail Conformance — https://app.healthclaw.io [tenant=desktop-demo]\n Grade: A (7/7 properties)\n [PASS] PHI Redaction [PASS] Human-in-the-Loop\n [PASS] Immutable Audit Trail [PASS] Tenant Isolation\n [PASS] Step-Up Authorization [PASS] Medical Disclaimers\n [PASS] Error Fidelity — A (local-fhir-only)\n```\n\nOr hit the **one-URL self-test** on any running deployment — no token needed, it\nself-tenants internally and returns 200 at Grade A (503 otherwise):\n\n```bash\ncurl \"https://app.healthclaw.io/r6/fhir/\\$conformance?format=text\"\n```\n\nThe local FHIR profile is Grade A: unsupported local-search inputs are rejected\nor reported according to `Prefer: handling`, and every failure path is audited.\nThe same harness runs against the Flask test client as a **CI baseline**\n(`tests/test_guardrail_conformance.py`). `--json` emits a machine-readable\nreport; `--mcp-url` additionally grades MCP `tools/call` error signaling as a\nseparate profile. For an authenticated MCP deployment, set `MCP_AUTH_TOKEN` or\npass `--mcp-auth-token`. Library API:\n`from r6.conformance import LiveProbeClient, ProbeContext, run_conformance`.\n\n### What this grade means (and what it doesn't)\n\nThe grade covers the **HealthClaw guardrail layer only** — a self-test of the\nseven properties against synthetic data it just created. It is **not** a HIPAA\nSecurity Rule assessment, a third-party audit, or a penetration test of your\ndeployment: infrastructure, BAAs, encryption at rest/in transit, and access\ncontrols remain the deployer's responsibility (see\n[Known Limitations](#known-limitations)). Because the harness is\ndeployment-agnostic, a third party *can* run it against any instance as one\ninput to a real assessment — it does not substitute for one. The report states\nthis scope itself in every output format.\n\n## Install as a Claude Plugin\n\nHealthClaw ships as a Claude Code plugin marketplace. Two plugins are available:\n\n```bash\n# Add the marketplace\nclaude plugin marketplace add aks129/HealthClawGuardrails\n\n# Install the FHIR guardrail plugin (this repo)\nclaude plugin install healthclaw-guardrails@healthclaw-marketplace\n\n# Install the personal-health companion plugin (frozen — upstream archived)\nclaude plugin install smarthealthconnect@healthclaw-marketplace\n```\n\n| Plugin | Skills | Source |\n| --- | --- | --- |\n| `healthclaw-guardrails` | curatr, fasten-connect, fhir-r6-guardrails, fhir-upstream-proxy, healthex-export, phi-redaction | [aks129/HealthClawGuardrails](https://github.com/aks129/HealthClawGuardrails) |\n| `smarthealthconnect` | care-completion, diet-exercise, healthy-habits, kids-health, medication-refills, research-monitor | [aks129/SmartHealthConnect](https://github.com/aks129/SmartHealthConnect) *(archived — skills frozen at v1.2.0; live successors are CareAgents advisors)* |\n\nEach skill is auto-discoverable — Claude loads it when your prompt matches the skill's trigger phrases (e.g. \"check my care gaps\", \"redact this bundle\", \"run Curatr on my conditions\").\n\n**Not on Claude/MCP?** The same 28 guardrailed tools run on OpenAI, Gemini, LangChain, or plain HTTP via the framework-neutral bridge in [`adapters/`](https://github.com/aks129/HealthClawGuardrails/blob/main/adapters/) — see [Recipe: run HealthClaw tools on any agent framework](https://github.com/aks129/HealthClawGuardrails/blob/main/docs/recipes/any-agent-framework.md). Guardrails stay server-side, so no framework can bypass them.\n\n## Quick Start\n\n```bash\n# Install dependencies\nuv sync\n\n# Apply deterministic database migrations\nSTEP_UP_SECRET=your-secret uv run flask --app main init-db\nSTEP_UP_SECRET=your-secret uv run flask --app main seed-demo --tenant-id desktop-demo\n\n# Run (local mode with SQLite)\nSTEP_UP_SECRET=your-secret python main.py\n\n# Run with upstream FHIR server\nFHIR_UPSTREAM_URL=https://hapi.fhir.org/baseR4 STEP_UP_SECRET=your-secret python main.py\n\n# Open browser\nopen http://localhost:5000 # Landing page with live demo\nopen http://localhost:5000/r6-dashboard # Interactive dashboard\n```\n\n### Docker\n\n```bash\ndocker-compose up -d --build\n\n# macOS note: port 5000 conflicts with AirPlay Receiver — remap with:\n# HOST_PORT=5050 docker-compose up -d --build\n\n# Services:\n# - fhir-mcp-guardrails (Flask, port 5000)\n# - agent-orchestrator (MCP server, port 3001)\n# - redis (port 6379)\n```\n\n## MCP Tools (29)\n\nTool names use underscores (not dots) for Claude Desktop / MCP client compatibility.\n\n**Read tools** (no step-up for public tenants):\n\n| Tool | Description |\n| --- | --- |\n| `context_get` | Retrieve pre-built context envelopes |\n| `fhir_read` | Read a FHIR resource (redacted) |\n| `fhir_search` | Search with patient, code, status, date filters |\n| `fhir_validate` | Structural validation |\n| `fhir_stats` | Observation statistics (count/min/max/mean) |\n| `fhir_lastn` | Most recent N observations per code |\n| `fhir_interpret_labs` | Lab reference-range interpretation (`$interpret`) — decision support, not diagnosis |\n| `care_gaps` | Preventive-care gaps (`$care-gaps`) — screenings/immunizations that may be due, from the patient's own records |\n| `guardrail_conformance` | Run the guardrail conformance self-test — graded A–F scorecard across all seven properties |\n| `fhir_permission_evaluate` | R6 Permission access control evaluation |\n| `fhir_subscription_topics` | List available SubscriptionTopics |\n| `questionnaire_populate` | SDC `$populate` — pre-fill a Questionnaire for a subject |\n| `curatr_evaluate` | Evaluate a FHIR resource for data quality issues |\n| `action_status` | Poll a real-world action (call/SMS) |\n| `search` | ChatGPT-connector-compatible search — thin wrapper over `fhir_search`, returns compact `{id, title, url}` results |\n| `fetch` | ChatGPT-connector-compatible fetch by `ResourceType/id` — thin wrapper over `fhir_read`, returns `{id, title, text, url, metadata}` |\n\n**Write tools** (require step-up token):\n\n| Tool | Description |\n| --- | --- |\n| `fhir_propose_write` | Validate + preview without committing |\n| `fhir_commit_write` | Commit with step-up auth + human-in-the-loop |\n| `questionnaire_extract` | SDC `$extract` — extract resources from a completed QuestionnaireResponse |\n| `curatr_apply_fix` | Apply patient-approved fixes with Provenance tracking |\n| `action_propose` / `action_commit` | Propose / commit a real-world phone call or SMS |\n| `rx_transfer_request` | Draft a pharmacy-transfer request call from active meds (Schedule II refused); commit via `action_commit` |\n| `shl_generate` | Generate an encrypted SMART Health Link (QR) |\n\n**Utility tools:**\n\n| Tool | Description |\n| --- | --- |\n| `fhir_get_token` | Issue a 5-minute step-up token (call before any write) |\n| `fhir_seed` | Seed a tenant with demo Patient + Observations + Condition |\n| `fhir_compiled_truth` | Current state + Provenance evidence timeline |\n\nAll tools add `_mcp_summary` with reasoning, clinical context, and limitations.\n\n## Guardrail Demo\n\nThe 6-step demo at `/r6/fhir/demo/agent-loop` shows the full guardrail sequence:\n\n1. **PHI Redaction** — Agent reads a patient, receives redacted data\n2. **$validate Gate** — Agent proposes an Observation, validated before write\n3. **Permission Deny** — No Permission rule exists, access denied with reasoning\n4. **Permission Permit** — Permit rule created, re-evaluation succeeds\n5. **Step-up + Human-in-the-loop** — Write requires both token and human confirmation\n6. **Commit + Audit** — Write succeeds, full audit trail generated\n\n## Comparison\n\n| Feature | This Project | AWS HealthLake MCP | Medplum MCP | Raw FHIR API |\n| --- | --- | --- | --- | --- |\n| Works with any FHIR server | Yes | HealthLake only | Medplum only | N/A |\n| PHI redaction on reads | Yes | No | No | No |\n| Immutable audit trail | Yes | CloudTrail (separate) | Partial | No |\n| Step-up auth for writes | Yes | IAM (separate) | Medplum auth | No |\n| Human-in-the-loop | Yes | No | No | No |\n| Permission $evaluate (R6) | Yes | No | No | No |\n| Setup time | 10 seconds | 30+ minutes | 15+ minutes | Varies |\n\n## FHIR Version Support\n\n| Version | Profile | Status | Resources |\n| --- | --- | --- | --- |\n| R4 | US Core v9 | **Stable** | Patient, Condition, AllergyIntolerance, Immunization, MedicationRequest, Procedure, DiagnosticReport, CarePlan, CareTeam, Goal, DocumentReference, Coverage, ServiceRequest, Location, Organization, Practitioner, PractitionerRole, RelatedPerson, Specimen, FamilyMemberHistory |\n| R6 | v6.0.0-ballot3 | Experimental | Permission, SubscriptionTopic, DeviceAlert, NutritionIntake, DeviceAssociation, NutritionProduct, Requirements, ActorDefinition |\n\nBoth R4 and R6 resources flow through the same guardrail stack (PHI redaction, audit, step-up auth, tenant isolation). R6 ballot resources may change before final release.\n\n## Testing\n\n```bash\n# Python tests (1,490+ across 90+ files; includes action-rail, SDC, quality, labs, ops, CareAgents suites)\nuv run python -m pytest tests/ -v\nuv run python -m pytest tests/test_r6_routes.py::test_name -v # single test\n\n# MCP server tests\ncd services/agent-orchestrator && npm ci && npm test\n\n# Playwright end-to-end tests (UI + API, requires Flask on :5000)\ncd e2e && npm ci && npx playwright install --with-deps chromium && npm test\ncd e2e && npm run test:headed # headed browser\ncd e2e && npm run test:ui # interactive UI mode\n```\n\n## API Endpoints\n\n| Endpoint | Method | Description |\n| --- | --- | --- |\n| `/r6/fhir/metadata` | GET | CapabilityStatement |\n| `/r6/fhir/health` | GET | Liveness probe (reports upstream status) |\n| `/r6/fhir/{type}` | POST | Create resource (requires step-up) |\n| `/r6/fhir/{type}` | GET | Search resources |\n| `/r6/fhir/{type}/{id}` | GET | Read resource (redacted) |\n| `/r6/fhir/{type}/{id}` | PUT | Update resource (requires step-up + ETag) |\n| `/r6/fhir/{type}/$validate` | POST | Validate resource |\n| `/r6/fhir/Questionnaire[/{id}]/$populate` | POST | SDC — pre-fill a QuestionnaireResponse from a subject |\n| `/r6/fhir/QuestionnaireResponse/$extract` | POST | SDC — extract a transaction Bundle (`?dryRun=true` to preview) |\n| `/r6/fhir/{type}/{id}/$deidentify` | GET | Conservative de-identification preview (expert review required) |\n| `/r6/fhir/Observation/$stats` | GET | Observation statistics |\n| `/r6/fhir/Observation/$lastn` | GET | Most recent observations |\n| `/r6/fhir/Permission/$evaluate` | POST | R6 access control evaluation |\n| `/r6/fhir/SubscriptionTopic/$list` | GET | Subscription topic discovery |\n| `/r6/fhir/Bundle/$ingest-context` | POST | Bundle ingestion + context envelope |\n| `/r6/fhir/context/{id}` | GET | Retrieve context envelope |\n| `/r6/fhir/AuditEvent` | GET | Search audit events |\n| `/r6/fhir/AuditEvent/$export` | GET | Export audit trail (NDJSON/Bundle) |\n| `/r6/fhir/demo/agent-loop` | POST | 6-step guardrail demo |\n| `/r6/fhir/oauth/*` | * | OAuth 2.1 + PKCE + SMART discovery |\n| `/r6/fhir/{type}/{id}/$curatr-evaluate` | GET | Evaluate resource data quality (Curatr) |\n| `/r6/fhir/{type}/{id}/$curatr-apply-fix` | POST | Apply patient-approved fixes with Provenance |\n\nLocal search accepts the parameters advertised by `/r6/fhir/metadata`.\nUnknown parameters default to lenient handling (a bounded\n`search.mode=\"outcome\"` warning); `Prefer: handling=strict` returns a 400\n`OperationOutcome`. Unsupported modifiers and malformed supported values always\nreturn 400. `_count=0` and `_summary=count` are count-only searches. Self links\ncontain exactly the applied, URL-encoded parameters, and audit output never\nechoes submitted filter values or arbitrary parameter names.\n\n## Upstream Proxy\n\nConnect to real FHIR servers while keeping all guardrails active:\n\n```bash\nFHIR_UPSTREAM_URL=https://hapi.fhir.org/baseR4 python main.py\n```\n\n- **Reads**: Fetched from upstream, then redacted + audited + disclaimers added\n- **Searches**: Forwarded with all query params, results redacted per entry\n- **Writes**: Validated locally first, then forwarded with step-up auth check\n- **URL rewriting**: Upstream URLs never leak to clients\n\nTested with: HAPI FHIR R4/R5, SMART Health IT, Epic Sandbox.\n\n**Put the guardrails in front of your FHIR server** — recipe for running the\nredaction + audit + step-up + human-in-the-loop stack in front of **Medplum**\n(the same pattern works for Aidbox, Google Cloud Healthcare, or any FHIR R4\nserver): [docs/recipes/healthclaw-in-front-of-medplum.md](https://github.com/aks129/HealthClawGuardrails/blob/main/docs/recipes/healthclaw-in-front-of-medplum.md).\nA repeatable integration test (`tests/test_medplum_in_front.py`) proves a\nMedplum-returned Patient comes back redacted + audited and writes are step-up\ngated before reaching Medplum.\n\n## Curatr — Patient-Owned Data Quality\n\nCuratr is a patient-facing data quality skill that evaluates FHIR health records for\ncoding issues and lets the patient decide how to resolve them.\n\n```text\n1. Patient connects data → HealthClaw Guardrails deidentifies and loads it\n2. OpenClaw calls curatr.evaluate → checks codes against live terminology APIs\n3. Issues presented in plain language with impact and fix suggestions\n4. Patient approves fixes → curatr.apply_fix updates resource + creates Provenance\n5. Optional: generate a structured correction request for the source provider\n```\n\n**What Curatr checks on a Condition:**\n\n| Check | Service | Example |\n| --- | --- | --- |\n| Deprecated code system | Local lookup (no network) | ICD-9-CM → critical |\n| ICD-10-CM code validity | NLM Clinical Tables API | Invalid code → warning |\n| SNOMED CT / LOINC validity | tx.fhir.org (HL7 public) | Unknown code → warning |\n| RxNorm drug code | RXNAV API (NLM) | Missing RXCUI → warning |\n| Display name accuracy | Cross-checked with canonical term | Mismatch → suggestion |\n| Missing required fields | Structural | No clinicalStatus → warning |\n\nEvery fix creates a linked **Provenance** resource recording patient intent, field\nchanges, and agent attribution. All changes are audited in the immutable trail.\n\n**OpenClaw skill:** `skills/curatr/SKILL.md`\n\n## SMART Health Links (Kill the Clipboard)\n\nPatient-controlled encrypted record sharing via QR code, implemented on top of\n**[jmandel/kill-the-clipboard-skill](https://github.com/jmandel/kill-the-clipboard-skill)**\n(MIT, pinned `fa0020d`) — credit Josh Mandel. HealthClaw governs what enters the\nbundle (step-up auth, profiles, guardrails, audit trail); KTC governs sharing\n(zero-knowledge server-side storage, SHL STU 1 protocol, revocation, in-browser\nviewer).\n\n**What it does:** The `shl_generate` MCP tool (Write group, step-up required)\nfetches the patient's guardrailed FHIR bundle, encrypts it client-side in the MCP\nserver (the SHL server never sees plaintext), uploads ciphertext, and returns:\n\n- `shlink` — the `shlink:/` URI to encode in a QR (an encrypted pointer, not data)\n- `viewer_link` — browser URL for clinic staff\n- `manage_link` — patient-only revocation + access-log URL\n\n**Security:** The QR encodes only the encrypted pointer. PHI never appears in the\nQR image. The SHL server stores only ciphertext + `sha256(auth_token)`. Persona\nhard rule: see `skills/share-health-qr/SKILL.md` — never direct-encode PHI into\nQR images (incident 2026-06-12).\n\n### Quick Start (local)\n\n```bash\n# Start the SHL storage server (profile `shl`)\ndocker-compose --profile shl up -d\n\n# Tell the MCP server where the SHL server lives\n# Add to services/agent-orchestrator/.env or export:\nexport SHL_SERVER_URL=http://localhost:8000\n```\n\nWithout `SHL_SERVER_URL`, `shl_generate` returns an explicit simulation stub\n(`simulated: true`) — never a fake link.\n\n### Railway Deploy\n\n```bash\n# 1. Add the SHL service\nrailway add --service shl-server\n\n# 2. Attach a persistent volume (SQLite lives here)\nrailway service shl-server && railway volume add --mount-path /data\n\n# 3. Configure the SHL server\nrailway variables --service shl-server \\\n --set BASE_URL= \\\n --set DB_PATH=/data/db.sqlite\n\n# 4. Expose a public domain\nrailway domain --service shl-server\n\n# 5. Deploy — MUST run from the shl-server directory\ncd services/shl-server && railway up --service shl-server\n\n# 6. Wire the MCP server to the SHL server\nrailway variables --service mcp-server \\\n --set SHL_SERVER_URL=\n```\n\n> **Caveat 1 — deploy from the right directory:** The repo-root `railway.toml`\n> targets the Flask Dockerfile. If you run `railway up --service shl-server`\n> from the repo root, Railway uses the wrong Dockerfile and the deploy fails.\n> Always `cd services/shl-server` first — that directory has its own\n> `railway.toml` that points to the correct image.\n>\n> **Caveat 2 — watchPatterns skip:** A service that inherited `watchPatterns`\n> from the root config may silently skip Dockerfile-only deploys (no source\n> file changes detected). The per-service `railway.toml` in `services/shl-server/`\n> overrides this after the first successful build. If deploys are skipped, force\n> one with `railway up --service shl-server` from the shl-server directory.\n>\n> **Caveat 3 — simulation mode:** Without `SHL_SERVER_URL` on the MCP server,\n> `shl_generate` returns `{ simulated: true, note: \"SHL_SERVER_URL not\n> configured — returned stub.\" }`. Personas surface this note verbatim and\n> never improvise an alternative.\n\n**OpenClaw skill:** `skills/share-health-qr/SKILL.md`\n\n## R6-Specific Resources (Experimental)\n\nThese resources are part of the FHIR R6 ballot3 specification and may change before final release.\n\n| Resource | What's New in R6 |\n| --- | --- |\n| Permission | Access control (separate from Consent), `$evaluate` operation |\n| SubscriptionTopic | Restructured pub/sub (introduced R5, maturing R6) |\n| DeviceAlert | ISO/IEEE 11073 device alarms |\n| NutritionIntake | Dietary consumption tracking |\n| DeviceAssociation | Device-patient relationships |\n| NutritionProduct | Nutritional product definitions |\n| Requirements | Functional requirements tracking |\n| ActorDefinition | Actor role definitions |\n\n## US Core v9 R4 Resources (Stable)\n\nStandard FHIR R4 resources conforming to US Core Implementation Guide v9.\nThese are widely deployed in US healthcare and stable for production use.\n\nAllergyIntolerance, Immunization, MedicationRequest, Medication, MedicationDispense,\nProcedure, DiagnosticReport, CarePlan, CareTeam, Goal, DocumentReference,\nLocation, Organization, Practitioner, PractitionerRole, RelatedPerson,\nCoverage, ServiceRequest, Specimen, FamilyMemberHistory\n\n## Environment Variables\n\n| Variable | Required | Default | Description |\n| --- | --- | --- | --- |\n| `STEP_UP_SECRET` | Production | — | HMAC-SHA256 signing secret |\n| `FHIR_UPSTREAM_URL` | No | — | Upstream FHIR server (enables proxy mode) |\n| `SQLALCHEMY_DATABASE_URI` | Production | `sqlite:///mcp_server.db` | Database connection |\n| `SESSION_SECRET` | No | (dev key) | Flask session secret |\n| `READ_AUTH_ENABLED` | Production | `false` | Require tenant-bound credentials on protected reads |\n| `PUBLIC_TENANTS` | Production | — | Explicit comma-separated synthetic/demo tenant allowlist |\n| `REDIS_URL` | Production | — | Shared nonce, OAuth, rate-limit, and worker state |\n| `MCP_AUTH_TOKEN` | HTTP MCP | — | Bearer credential required by MCP HTTP transports |\n| `MCP_PUBLIC_DEMO` | No | `false` | Run an **unauthenticated** MCP server hard-pinned to a synthetic demo tenant (the public keyless demo). Never set on a server that reaches real tenants |\n| `MCP_DEMO_TENANT` | No | `desktop-demo` | Synthetic tenant the demo server is pinned to when `MCP_PUBLIC_DEMO` is set |\n| `FHIR_UPSTREAM_TIMEOUT` | No | 15 | Upstream request timeout (seconds) |\n| `FHIR_LOCAL_BASE_URL` | No | — | Local URL for response URL rewriting |\n\nDatabase DDL is never run during WSGI import. Run `flask --app main init-db`\nbefore each release; it applies the locked Alembic revisions. Operators adopting\nAlembic on an existing v1.8.0 Postgres deployment must follow the\n[database migration runbook](https://github.com/aks129/HealthClawGuardrails/blob/main/docs/runbooks/database-migrations.md) to verify and\nstamp the compatibility baseline before upgrading.\n\n## Project Structure\n\n```text\nmain.py Flask app entry point\napp.py Web UI routes (landing, dashboard)\nr6/\n routes.py R6 FHIR REST Blueprint (1,732 lines)\n models.py R6Resource, ContextEnvelope, AuditEventRecord\n validator.py FHIR R6 structural validation\n redaction.py PHI redaction (names, identifiers, addresses, DOB, telecom)\n audit.py Immutable AuditEvent recording\n stepup.py HMAC-SHA256 step-up token management\n oauth.py OAuth 2.1 + PKCE + SMART-on-FHIR discovery\n health_compliance.py Disclaimers, HITL, de-identification preview, audit export\n context_builder.py Bundle ingestion + context envelopes\n rate_limit.py Per-tenant rate limiting\n fhir_proxy.py Upstream FHIR server proxy with URL rewriting\n curatr.py Curatr data quality engine (terminology lookups + fix application)\nservices/agent-orchestrator/\n src/index.ts MCP server (Streamable HTTP + SSE)\n src/tools.ts 12 tool definitions + executor (incl. curatr.evaluate, curatr.apply_fix)\ne2e/ Playwright end-to-end tests\ntemplates/ Jinja2 (landing page, dashboard)\nstatic/ CSS + JS for interactive dashboard\nskills/curatr/ Curatr OpenClaw skill definition\ntests/ 266 pytest tests (8 files, incl. test_us_core_r4.py)\n```\n\n## Personal FHIR data store — patient import flow\n\nThis walkthrough shows how to go from a raw HealthEx export to querying your\nown records through Claude Code's MCP tools.\n\n### 1. Start the stack\n\n```bash\nuv sync\nuv run python main.py # Flask on :5000\ncd services/agent-orchestrator && npm ci && npm start # MCP on :3001\n```\n\n### 2. Import your HealthEx / Flexpa / generic FHIR bundle\n\n```bash\n# Dry-run first to preview without writing\npython scripts/import_healthex.py \\\n --bundle-file ~/Downloads/my-records.json \\\n --dry-run\n\n# Real import — prints context_id on success\npython scripts/import_healthex.py \\\n --bundle-file ~/Downloads/my-records.json \\\n --tenant-id my-patient \\\n --step-up-secret \"$STEP_UP_SECRET\"\n```\n\n### 3. Connect Claude Code via MCP\n\n`.mcp.json` in this repo auto-configures Claude Code when you open the project.\nUpdate `X-Tenant-ID` to match your `--tenant-id`:\n\n```json\n{\n \"mcpServers\": {\n \"healthclaw-local\": {\n \"type\": \"http\",\n \"url\": \"http://localhost:3001/mcp\",\n \"headers\": { \"X-Tenant-ID\": \"my-patient\" }\n }\n }\n}\n```\n\nThen in Claude Code:\n\n```text\nUse fhir_search to find all my Conditions\nUse context_get with context_id to get my full context envelope\nUse curatr_evaluate on Condition/ to check data quality\n```\n\n### 4. Set up Fasten Connect (optional)\n\n```bash\n# .env additions\nFASTEN_PUBLIC_KEY=\nFASTEN_PRIVATE_KEY=\nFASTEN_WEBHOOK_SECRET=\nFASTEN_CURATR_SCAN=true # auto-run Curatr after each import\n```\n\nRecords arrive via webhook at `/r6/fasten/webhook` and are stored under the\npatient's canonical tenant ID.\n\n### 5. Deidentify for sharing\n\n```bash\n# De-identification preview (not a legal Safe Harbor determination)\ncurl -H \"X-Tenant-ID: my-patient\" \\\n http://localhost:5000/r6/fhir/Patient/pt-1/\\$deidentify\n\n# Patient-controlled (preserves birthDate, strips institutional identifiers)\ncurl -H \"X-Tenant-ID: my-patient\" \\\n \"http://localhost:5000/r6/fhir/Patient/pt-1/\\$deidentify?mode=patient-controlled&patient_id=my-patient\"\n```\n\n### 6. Telegram bot (optional)\n\n```bash\nTELEGRAM_BOT_TOKEN= TENANT_ID=my-patient \\\nFHIR_BASE_URL=http://localhost:5000/r6/fhir \\\npython openclaw/bot.py\n```\n\nCommands: `/health`, `/conditions`, `/labs`, `/curatr`, `/curatr fix`, `/approve`.\n\nOr via Docker Compose:\n\n```bash\ndocker-compose --profile openclaw up -d\n```\n\n### 7. Use Medplum as the backing FHIR store (optional)\n\nSet in `.env` (leave `FHIR_UPSTREAM_URL` empty):\n\n```bash\nMEDPLUM_BASE_URL=https://api.medplum.com/fhir/R4\nMEDPLUM_CLIENT_ID=\nMEDPLUM_CLIENT_SECRET=\n```\n\nAll guardrails apply to Medplum responses identically to local SQLite mode.\nAccess tokens are cached in Redis (key `medplum:access_token`; falls back to\nin-process cache when Redis is unavailable).\n\n---\n\n## Known Limitations\n\n- **The conformance grade is a self-test of the guardrail layer, not a HIPAA\n assessment or third-party audit** — see\n [What this grade means](#what-this-grade-means-and-what-it-doesnt)\n- Local mode: JSON blob storage with table-scan search (no indexed fields)\n- **Redaction is HIPAA Safe-Harbor-*style* field redaction** (demographics), **not Expert Determination**. It's a compensating control that removes identifier-class fields (identifier values are removed outright, not truncated); it is not a legal de-identification determination. Production de-id rigor (profile-specific recursive allowlists, an Expert-Determination path) is on the [roadmap](https://github.com/aks129/HealthClawGuardrails/blob/main/ROADMAP.md) ([#112](https://github.com/aks129/HealthClawGuardrails/blob/main/../../issues/112)).\n- **Validation is structural**, not full StructureDefinition/profile conformance or terminology binding. What's demonstrated is the guardrail *contract* (redact + audit + step-up + human-confirm + tenant isolation + error fidelity), not production validation depth — that's tracked in [#112](https://github.com/aks129/HealthClawGuardrails/blob/main/../../issues/112).\n- SubscriptionTopic stored but notifications not dispatched\n- Clinical FHIR writes gate human-in-the-loop with a header flag (`X-Human-Confirmed`), not cryptographic confirmation — a compensating control for the demo, not proof a human acted. Real-world actions (phone/SMS/etc.) no longer use that header: `commit` only submits the action for out-of-band approval (202 `awaiting_confirmation`), and the patient's Approve tap consumes a single-use `ActionConfirmation` credential server-side before anything executes.\n- OAuth endpoints are for discovery/SMART advertisement; route enforcement is via step-up + read-auth tokens, and the auto-approve authorize flow is limited to public/demo tenants (no per-user consent screen)\n- No historical versioning (version_id increments but old versions not retrievable)\n- Upstream proxy: no response caching, no cross-version translation\n- **Security is config-dependent — production requires** `READ_AUTH_ENABLED=true` (authenticate non-public reads), `INTERNAL_TOKEN_MINT_SECRET` (gate token mint/seed for non-public tenants; fail-closed in prod when unset), `PUBLIC_TENANTS` limited to synthetic demo tenants, a real `SESSION_SECRET`/`STEP_UP_SECRET`, and https-only upstreams\n- Step-up tokens are valid for multiple writes within their 5-min TTL (not single-use); irreversible actions rely on state-machine idempotency (guarded `WHERE status='proposed'` claim) rather than nonce consumption\n\n## Contributing — this is a community effort\n\nHealthClaw Guardrails is developed in the open as a shared reference, not a commercial product.\nThe guardrail layer between AI agents and clinical data only gets trustworthy if a lot of people\nwith different vantage points pressure-test it. We especially want:\n\n- **Implementers** building FHIR × MCP integrations — tell us where the patterns break in the real world.\n- **Clinicians & compliance folks** — challenge the redaction profiles, audit model, and the documented HIPAA postures.\n- **Standards people** (HL7 / SDC / SMART) — tell us where we've diverged from the spec, especially on `$populate`/`$extract`.\n- **Anyone** — open an issue, file a \"you got this wrong,\" or send a PR.\n\nStart here: **[CONTRIBUTING.md](https://github.com/aks129/HealthClawGuardrails/blob/main/CONTRIBUTING.md)** · **[Roadmap](https://github.com/aks129/HealthClawGuardrails/blob/main/ROADMAP.md)** · **[Dev Guide](https://github.com/aks129/HealthClawGuardrails/blob/main/docs/development.md)** · **[Code of Conduct](https://github.com/aks129/HealthClawGuardrails/blob/main/CODE_OF_CONDUCT.md)** · **[CHANGELOG.md](https://github.com/aks129/HealthClawGuardrails/blob/main/CHANGELOG.md)** · **[Security policy](https://github.com/aks129/HealthClawGuardrails/blob/main/SECURITY.md)**\n\nGood first contributions are labeled in the issue tracker. Contributions are DCO-signed (`git commit -s`) under the [MIT license](https://github.com/aks129/HealthClawGuardrails/blob/main/LICENSE) — see [LICENSING.md](https://github.com/aks129/HealthClawGuardrails/blob/main/LICENSING.md) for the project's licensing posture going forward.\n\n### Community\n\n- **[GitHub Discussions](https://github.com/aks129/HealthClawGuardrails/discussions)** — questions, ideas, show-and-tell.\n- **[good first issues](https://github.com/aks129/HealthClawGuardrails/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22)** — scoped, ~15-minute-to-start contributions.\n- Building on OpenClaw or Hermes? The skills are on [ClawHub](https://clawhub.ai/aks129/skills/fhir-r6-guardrails); the MCP server is in the [Hermes catalog](https://github.com/NousResearch/hermes-agent/pull/59221).\n\n## License\n\nMIT — free to use, fork, and build on. See [LICENSE](https://github.com/aks129/HealthClawGuardrails/blob/main/LICENSE).\n","changelogMarkdown","videoKey","requiredSecretsJson","[{\"name\":\"X-Tenant-Id\",\"scope\":\"per-user\",\"header\":\"X-Tenant-Id\"},{\"name\":\"X-Step-Up-Token\",\"scope\":\"per-user\",\"header\":\"X-Step-Up-Token\"}]","publishedAt","priceCents","trialDays",0,"iconType","image","upstream",{"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132},"requiredSecrets",[113,114],"tags",[101,102,103,104,105,106,107,108,109,110,111,112],"assets",[],"stats",{"_99":86,"_100":86},"ratingAvg","reviewCount","agent-skills","agents","ai-agents","fhir","gemini-cli-extension","health-data","healthai","healthcare","hipaa","phi-redaction","security","smart-on-fhir",{"_115":120,"_117":118,"_119":120},{"_115":116,"_117":118,"_119":116},"name","X-Step-Up-Token","scope","per-user","header","X-Tenant-Id","topics",[101,102,103,104,105,106,107,108,109,133,134,135,110,111,112],"license","MIT","language","Python","registryName","io.github.aks129/healthclaw-guardrails","homepage","https://healthclaw.io","packages",[],"mcp","mcp-server","model-context-protocol","ENV",{"_138":139,"_140":141,"_142":143},"ENVIRONMENT","production","TURNSTILE_SITE_KEY","0x4AAAAAAB8-rEI2gNDf_QhU","SENTRY_DSN","https://45fd1229f78089d5c3ee78be128030e1@o4510583261757440.ingest.de.sentry.io/4510584253448272"]