ClinGate

MCP-Native Human-in-the-Loop Gateway for Autonomous Clinical AI Agents

ClinGate is an open-source MCP (Model Context Protocol) gateway that sits between any AI agent framework and the clinical tools it calls, classifies every action by risk in real time, and forces a human decision before anything irreversible reaches a patient record.

Architecture

The agent never talks to the real EHR/tool API directly — it only ever sees ClinGate's MCP tool surface. ClinGate proxies the actual call through to the downstream tool only after a decision (auto-clear or human approval) is reached.

 ┌────────────────────┐        MCP tool calls        ┌──────────────────────┐
 │  Agent Orchestrator │ ───────────────────────────▶ │      ClinGate        │
 │ (LangGraph/CrewAI/  │                              │   MCP Gateway Server │
 │   AutoGen/custom)   │ ◀─────────────────────────── │                       │
 └────────────────────┘     approved / blocked        └──────────┬───────────┘
                                                                   │
                                        ┌──────────────────────────┼───────────────────────────┐
                                        ▼                          ▼                           ▼
                              ┌──────────────────┐      ┌───────────────────┐       ┌────────────────────┐
                              │  Rule Engine      │      │  LLM Risk          │       │  Audit Ledger       │
                              │ (deterministic     │      │  Classifier        │       │  (SQLite, append-  │
                              │  policy DSL)       │      │ (severity + reason)│       │  only, exportable)  │
                              └──────────────────┘      └───────────────────┘       └────────────────────┘
                                        │                          │
                                        └────────────┬─────────────┘
                                                      ▼
                                          ┌───────────────────────┐
                                          │  Escalation Queue +    │
                                          │  Review Dashboard      │
                                          │  (HTML/JS)             │
                                          └───────────────────────┘

Related MCP server: promptspeak-mcp-server

Regulatory Grounding

This gateway directly addresses the human-oversight patterns expected by modern regulatory frameworks:

Quickstart

ClinGate ships as a single stack including the MCP server, the audit store, and a minimal review dashboard.

git clone https://github.com/vilsee/clingate.git
cd clingate

# Build and start the MCP server, SQLite store, and UI
docker compose up --build

• The Review Dashboard and UI is available at http://localhost:8000/.

• The MCP Server uses SSE and HTTP mounts to intercept tool calls.

Implemented Features vs Roadmap

We built ClinGate prioritizing a robust, end-to-end MVP that correctly classifies risks across real APIs.

Implemented Features (Live Today)

1. Classifier Disagreement Signal: Logs when the deterministic rule engine and the fallback LLM risk classifier would have made different decisions. This prevents silent alignment failures by highlighting edge-case behaviors to reviewers.

2. SLA Breach Failsafe: A background daemon that automatically transitions unreviewed ESCALATE items into SLA_BREACH_BLOCK if human reviewers fail to act within a defined timeframe. Actions never sit in limbo.

3. Real-Data Integrations: openFDA (drug scheduling), HAPI FHIR (patient context), and ClinicalTrials.gov (referral grounding).

Roadmap Stubs (To Be Implemented)

These features are explicitly documented as stubs in the source code to facilitate future roadmap development:

• Clinical Trials Context Matching: Query ClinicalTrials.gov and attach currently recruiting, localized trials to any blocked medication order to provide alternatives.

• FHIR Resource Validation: Validate outgoing tool arguments against active FHIR R4 profiles to ensure payload schema compliance before reaching the real system.

• Reviewer Delegation Rules: Route specific ESCALATE items to specific specialist queues rather than a global pool.

• Agent Feedback Loop: Send natural language explanations of a BLOCK decision back to the autonomous agent, giving it the opportunity to self-correct.