@mymedi-ai/mcp-server

MCP server for DME billing and medical coding. Connect Claude, Cursor, VS Code or any MCP client to 32 tools — code lookup across a database of 90K+ ICD-10-CM, CPT and HCPCS codes, DMEPOS fee schedules, Medicare prior-authorization and face-to-face list checks, denial-code guidance and pre-submission claim checks — plus five DME billing prompts and three dataset resources. Six tools work with no API key.

PHI-free by design: the tools take codes, modifiers, dates of service and de-identified text, never patient identifiers. Apart from drawing credits for paid calls, no tool changes anything except buy_credits, which opens a Stripe checkout session (nothing is charged until checkout is completed in the browser).

Claude (web or desktop) users: Settings → Connectors → Add custom connector → paste https://mymedi-ai.com/mcp-stream. The endpoint is OAuth-protected: Claude registers itself and asks you to sign in to MyMedi-AI once, and the first connector sign-in comes with free starter credits. There is no API key to copy.

Quick Start

Requires Node.js 20 or later.

Install

claude mcp add mymedi-ai --env MCP_API_KEY=your-api-key -- npx -y @mymedi-ai/mcp-server

Leave out --env MCP_API_KEY=… to start with the six free tools. Other clients are under Client setup.

Get an API key (for the paid tools)

Registration is a POST request, not a web page:

curl -X POST https://mymedi-ai.com/bot-marketplace/register \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent"}'
# → { "apiKey": "...", "credits": ..., "quickStart": { ... } }

Set the returned apiKey as MCP_API_KEY. (MYMEDI_API_KEY, the name the registration response prints, is accepted too; MCP_API_KEY wins when both are set.) A new key comes with free starter credits; the buy_credits tool adds more.

Or try a free endpoint

curl "https://mymedi-ai.com/agent/v1/demo?code=99213"

Returns basic code metadata, rate-limited to 60 requests per hour per IP.

Free tools (no API key)

Install the server without MCP_API_KEY and these work immediately (60 requests per hour per IP):

The other 26 tools need an API key (or the connector sign-in): 24 are paid per call, and account_status and buy_credits are free but need the key to identify the account.

Client setup

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "mymedi-ai": {
      "command": "npx",
      "args": ["-y", "@mymedi-ai/mcp-server"],
      "env": {
        "MCP_API_KEY": "your-api-key"
      }
    }
  }
}

Cursor

Add to .cursor/mcp.json:

{
  "mcpServers": {
    "mymedi-ai": {
      "command": "npx",
      "args": ["-y", "@mymedi-ai/mcp-server"],
      "env": { "MCP_API_KEY": "your-api-key" }
    }
  }
}

VS Code

Add to .vscode/mcp.json:

{
  "servers": {
    "mymedi-ai": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@mymedi-ai/mcp-server"],
      "env": { "MCP_API_KEY": "your-api-key" }
    }
  }
}

Claude Code

claude mcp add mymedi-ai --env MCP_API_KEY=your-api-key -- npx -y @mymedi-ai/mcp-server

Tools (32)

Free (no API key)

Account (free — uses your sign-in or API key)

Medical coding

Prior auth and claims

Drug data

Providers and market

Clinical and public health

Prompts

Resources

Credits and billing

• The per-tool price list is published as JSON at https://mymedi-ai.com/bot-marketplace/credits/pricing.
• 1 credit = $0.001. Paid tools cost from 1 credit (code_lookup) to 250 credits (compliance_audit) per call; code_lookup_batch, code_validate_batch and pa_exposure_report are priced per code. A failed call is refunded.
• Each successful paid call's result includes a _billing field: { "creditsSpent": …, "creditsRemaining": …, "priceUSD": … }. (Over plain REST, without MCP, the same figures arrive as X-Credits-Spent / X-Credits-Remaining headers.)
• account_status shows the balance and recent transactions. buy_credits returns a Stripe checkout link — $1 buys 1,000 credits, packages run from $1 to $500 — and the credits arrive once checkout is completed.

Environment variables

HTTP mode (--http)

The same server can run over Streamable HTTP for clients that connect by URL:

MCP_API_KEY=your-api-key npx -y @mymedi-ai/mcp-server --http
# MCP HTTP server listening on http://127.0.0.1:8080/mcp

Every call through it spends the key in MCP_API_KEY, so the endpoint is guarded:

• Loopback by default. It listens on 127.0.0.1 unless MCP_HOST says otherwise.
• A token off loopback. With a non-loopback MCP_HOST (such as 0.0.0.0) the server refuses to start unless MCP_HTTP_TOKEN is set — at least 32 characters, for example openssl rand -hex 32. Clients then send Authorization: Bearer <token>; anything else gets 401. A token can be set on loopback too.
• Host check. A request must name the server as localhost, 127.0.0.1, [::1], the MCP_HOST address, or a hostname or address in MCP_ALLOWED_HOSTS; any other Host gets 403. This stops DNS-rebinding pages. With MCP_HOST=0.0.0.0 the server has no address of its own to match, so list every address clients use — the LAN IP, the Docker host's IP, a DNS name — in MCP_ALLOWED_HOSTS.
• Origin check. A request from a web page (it carries an Origin header) gets 403 unless that origin is in MCP_ALLOWED_ORIGINS, and only listed origins receive CORS headers. Desktop clients send no Origin and are unaffected.
• Limits. Bodies over 1 MiB get 413, a body that is not JSON gets a JSON-RPC parse error, sessions are capped (MCP_MAX_SESSIONS) and closed after MCP_SESSION_IDLE_MS without use, and an unknown session id gets 404 so the client starts a new session.

Serving other machines:

MCP_HOST=0.0.0.0 MCP_HTTP_TOKEN="$(openssl rand -hex 32)" MCP_ALLOWED_HOSTS=mcp.example.com,192.168.1.20 \
  MCP_API_KEY=your-api-key npx -y @mymedi-ai/mcp-server --http

Put TLS (a reverse proxy) in front of it when traffic leaves the machine: the token travels in a header.

Upgrading to 1.7.6

Breaking for remote --http deployments only. Up to 1.7.5 the HTTP mode listened on every interface, served any caller without a token and sent Access-Control-Allow-Origin: *. From 1.7.6 it listens on 127.0.0.1; to serve other machines set MCP_HOST, MCP_HTTP_TOKEN (required off loopback) and MCP_ALLOWED_HOSTS with every hostname or address clients use (with MCP_HOST=0.0.0.0 that includes LAN and Docker-host IPs); browser-based clients also need MCP_ALLOWED_ORIGINS. An unknown session id now gets 404 instead of 400. stdio installs (Claude Desktop, Cursor, VS Code, Claude Code) are unaffected.

1.7.6 also requires Node.js 20 or later (Node 18 is past end of life, and the SDK's dependencies need 20). Also in 1.7.6: the server sends its instructions at initialize; scrub-claim takes an optional dateOfService and no longer asks about medical necessity; MYMEDI_API_KEY is accepted as an alias of MCP_API_KEY; and a paid call without a key explains how to register.

SDK

For programmatic use without MCP, install the SDK:

npm install @mymedi-ai/sdk

import { MyMediAI } from '@mymedi-ai/sdk';

const client = new MyMediAI({ apiKey: 'your-api-key' });
const result = await client.codeLookup('M79.3');

Data sources

• ICD-10-CM and HCPCS Level II: CMS and CDC code sets
• CPT®: from the CMS physician fee schedule (RVU) files. CPT® is a registered trademark of the American Medical Association (AMA); CPT codes and descriptions are AMA copyright.
• Fee schedules and lists: CMS DMEPOS fee schedule, Medicare physician fee schedule (RVU), the Required Prior Authorization List and the F2F/WOPD list
• Providers: CMS NPI registry (NPPES) and CMS Open Payments
• Drugs: openFDA (labels, adverse events) and NIH RxNorm
• Clinical and public health: ClinicalTrials.gov and CDC NNDSS

Troubleshooting

• 402 "payment_required" — without an API key, a paid tool answers with the registration request to send (see Get an API key); with a key, it means the credits ran out: call buy_credits. The six free tools never need a key.
• "invalid_api_key" — the key in MCP_API_KEY (or MYMEDI_API_KEY) was not recognised: check it for a typo or a missing part and restart the server, or register a new key.
• 429 on free tools — free endpoints allow 60 requests per hour per IP. Wait, or use a key and the paid equivalents.
• Connector won't connect — the hosted endpoint is https://mymedi-ai.com/mcp-stream (Streamable HTTP) and it is OAuth-protected. An unauthenticated request returns {"error":"unauthorized","error_description":"OAuth required"} — that is the endpoint working, not a fault, and a bare inspector --cli … --method tools/list shows it because it holds no token. To confirm the service is up, read the discovery document: curl -s https://mymedi-ai.com/.well-known/oauth-protected-resource names .../mcp-stream as the protected resource. Claude performs dynamic client registration and the sign-in itself.
• --http answers 401, 403 or refuses to start — see HTTP mode: send the bearer token, add the hostname to MCP_ALLOWED_HOSTS or the web origin to MCP_ALLOWED_ORIGINS, and set MCP_HTTP_TOKEN before listening off loopback.
• Code not found — lookups expect bare codes (E1390, 99213, M79.3). Denial codes accept CO-50, co50 or 50.
• Data currency — reference data follows CMS release cycles; prior-authorization and F2F/WOPD answers carry the list version they were checked against.
• Still stuck? Email support@mymedi-ai.com or open an issue at https://github.com/MyMedi-AI/mymedi-ai-mcp-server/issues.

Links

• API discovery (JSON)
• Free demo lookup
• Price list (JSON)
• Credits for a web or connector account
• API key registration: POST https://mymedi-ai.com/bot-marketplace/register (a request, not a page)
• Hosted connector: https://mymedi-ai.com/mcp-stream

License

MIT