How do I use smart-fhir?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@smart-fhir Search for Patients with family name Smith" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

de en es ja ko ru zh

smart-fhir

by swami8791

Overview Schema Related Servers Score Discussions

TypeScript

Local

smart-fhir

A connector that will not invent a patient.

tools 4 sandbox public synthetic empty search stays empty unknown id 404 PHI none

Install · Tools · How it works · Limits

Install

stdio only. After the TypeScript build, add a local connector:

name: smart-fhir
command: node
args: dist/index.js

npm install
npm run build

Env for that add (defaults, not secrets):

FHIR_ISS = https://launch.smarthealthit.org/v/r4/fhir
FHIR_VERSION = R4
FHIR_AUTH_MODE = open
FHIR_WRITE = off
FHIR_AUDIT_PATH = ./audit/audit.jsonl

Do not put secret values in the repo. No public HTTP port. Do not bind TCP.

Morning shortcut (same env)

npx -y tsx src/index.ts

See package.json scripts: install, build, test, prove.

Related MCP server: smart-mcp-server

Tools

Four tools. No create / update / delete.

Tool	Action
`smart_discover`	GET `{iss}/.well-known/smart-configuration`. Parsed JSON or explicit error. Does not invent endpoints.
`fhir_auth_status`	`{ mode, iss, fhir_version: "R4", write: "off", token_present, discovery_ok, last_error? }`. Never prints token or PEM.
`fhir_search`	GET `{iss}/{resourceType}?...` `_count` default 10, max 50. One page. Empty Bundle is returned as-is.
`fhir_read`	GET `{iss}/{resourceType}/{id}`. 404 is not found, not a made-up resource.

resourceType allowlist: Patient | Observation | Condition | MedicationRequest | Encounter. Anything else → { ok: false, error: "resourceType not in v1 allowlist" }.

How it works

FHIR_VERSION must be R4. Anything else refuses to start.

What	URL	How to read it
FHIR index (published page is R5 5.0.0)	http://hl7.org/fhir/	Official index only. Not implemented.
FHIR R4 (v1)	https://hl7.org/fhir/R4/	FHIR Release 4, 4.0.1. Resource model.
SMART App Launch 2.2.0 (STU 2.2)	https://hl7.org/fhir/smart-app-launch/	Current published SMART IG. Based on FHIR R4.
App launch + authorization	https://hl7.org/fhir/smart-app-launch/app-launch.html	Discovery, standalone/EHR launch, PKCE, token. App Launch (code+PKCE) is out of v1.
Backend Services	https://hl7.org/fhir/smart-app-launch/backend-services.html	client_credentials + private-key JWT. Implemented; unused unless env is set.

ISS allowlist (trailing slash stripped, anything else refused):

https://launch.smarthealthit.org/v/r4/fhir (default)
https://r4.smarthealthit.org
https://hapi.fhir.org/baseR4

Set FHIR_ISS to another allowlisted base to point at a later ISS. A new ISS needs a review first. Do not point this at a live EHR without that review plus a real client_id.

FHIR_AUTH_MODE	Behavior
`open` (default)	Discover, then FHIR GET without Authorization. Discovery 404 is not fatal in open (logged; continue). 401/403 FHIR → `{ ok: false, http_status, ... }`.
`bearer`	Same discovery. FHIR GET with Authorization Bearer token.
`backend_jwt`	Only if both `FHIR_CLIENT_ID` (or `SMART_CLIENT_ID`) and `FHIR_PRIVATE_KEY_PEM` exist. SMART Backend Services JWT. Missing env → refuse to start. Does not invent credentials.

App Launch (code+PKCE) is out. FHIR_REDIRECT_URI is reserved and unused.

Auth failure shape: { ok: false, http_status, issue?, error? }. Never a synthetic Patient.

FHIR_WRITE defaults off. v1 has no write tools even if someone sets on. Writes never POST AuditEvent to FHIR.

Name	Default	Notes
FHIR_ISS	default launcher R4	Must stay allowlisted
FHIR_VERSION	R4	Reject anything else
FHIR_AUTH_MODE	open	open / bearer / backend_jwt
FHIR_WRITE	off	Writes stay off in v1
FHIR_AUDIT_PATH	`/workspace/smart-fhir-mcp/audit/audit.jsonl`	Append-only JSONL; set `./audit/audit.jsonl` locally
FHIR_ACCESS_TOKEN	unset	Bearer only
FHIR_CLIENT_ID	unset	Backend Services
SMART_CLIENT_ID	unset	Alias of FHIR_CLIENT_ID
FHIR_PRIVATE_KEY_PEM	unset	Backend Services JWT
FHIR_JWKS_URL	unset	Reserved if an EHR wants JWKS
FHIR_SCOPE	five system/*.rs types	JWT mode override
FHIR_REDIRECT_URI	unset	Reserved for later App Launch

Audit lines: ts, tool, iss, mode, resourceType, id?, http_status, entry_count?. No resource body, no token, no PEM, no name/MRN query values.

Limits

R5 / R4B as default. Extra resource types. CRUD. Bulk. App Launch browser/PKCE.
Real EHR / real PHI. Production deploy. Public bind or Streamable HTTP.
momentum / fhirhydrant / Atrium / Pinecone / Medplum.
Not a medical product. Does not diagnose, treat, or store PHI.

No PHI. No live EHR.

Install Server

license - not found

quality

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

–Releases (12mo)

Commit activity

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Tools

Related MCP Servers

Healthcare FHIR MCP Server
Biology & Medicine Search AI & Machine Learning
CSOAI-ORG
A
license
Not graded
quality
B
maintenance
Enables AI applications to securely search and manage healthcare data from FHIR R4-compliant servers with built-in safety validation for AI-generated clinical observations, preventing recording of physiologically impossible values.
Updated 2 months ago (2026-06-15 14:41 UTC)
8
MIT
smart-mcp-server
Biology & Medicine AI & Machine Learning
DigitalSQR
F
license
Not graded
quality
D
maintenance
Enables AI assistants to securely interact with FHIR R4 servers for clinical decision support workflows, including PlanDefinition execution, FHIR resource management, terminology services, and Questionnaire/StructureMap transformation via Matchbox.
Updated 8 months ago (2026-01-07 14:37 UTC)
1
Healthpoint MCP Server
Biology & Medicine Location Services Search
edithatogo
A
license
A
quality
A
maintenance
Read-only MCP server for licensed Healthpoint HL7 FHIR API access.
Updated 4 days ago (2026-08-21 14:05 UTC)
10
1
Apache 2.0
practice-fusion-mcp
Biology & Medicine Databases
CDVolvik
A
license
A
quality
A
maintenance
Enables read-only FHIR access to Practice Fusion EHR to search patients, appointments, conditions, medications, and lab results.
Updated 11 days ago (2026-08-13 21:48 UTC)
13
22
3
MIT

View all related MCP servers

Related MCP Connectors

mcp
Securely access and manage FHIR healthcare data stored in Medplum.
mockmcp
Hosted MCP endpoint with realistic fake data for prototyping agents. 12 tools, no setup.
healthclaw-guardrails
Guardrailed FHIR access for AI agents: PHI redaction, audit trail, step-up auth, tenant isolation

View all MCP Connectors

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/swami8791/smart-fhir-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

smart-fhir

Install

Morning shortcut (same env)

Tools

How it works

Limits

Maintenance

Resources

Looking for Admin?

Tools

Related MCP Servers

Healthcare FHIR MCP Server

smart-mcp-server

Healthpoint MCP Server

practice-fusion-mcp

Related MCP Connectors

Latest Blog Posts

MCP directory API