{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "medblocks", "name": "Medblocks", "vendor": "Medblocks Inc.", "vendorUrl": "https://medblocks.com", "kind": "http-api", "category": "health-data", "summary": "Medblocks Platform lets an app or agent connect a patient's hospital, clinic and insurer records through SMART on FHIR and read them back as FHIR R4, through a REST API, a TypeScript SDK or a remote MCP server.", "url": "https://www.anchorterminal.com/tools/medblocks", "markdownUrl": "https://www.anchorterminal.com/tools/medblocks.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/medblocks.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/medblocks.json", "repo": "https://github.com/medblocks/skills", "license": "Proprietary service under Medblocks' terms. The medblocks TypeScript SDK on npm carries a proprietary licence that forbids redistribution and reverse engineering. The agent skills repository has no licence file", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://app.medblocks.com/mcp", "packages": [ { "registry": "npm", "name": "medblocks" } ], "auth": "mixed", "authNotes": "The REST API takes a workspace API key as a Bearer token (`mb_sk_sbx_` for Sandbox, `mb_sk_live_` for Production). Owners and admins mint, rotate and revoke keys in the dashboard, and the full key is shown once. The MCP server at https://app.medblocks.com/mcp also accepts OAuth from Medblocks' own authorisation server, which publishes dynamic client registration, PKCE and ten scopes (patients:read, patients:write, fhir:read and others), with a consent screen of three tick boxes. Patients authorise each hospital themselves through SMART on FHIR. A BAA is needed before production use.", "pricing": "freemium", "pricingNotes": "Free plan at $0 for up to 1,000 active patients, with patient access, synthetic sandboxes and full API access. Enterprise is $60,000 a year with no patient cap and adds backend services, clinical workflows, OCR and data structuring. A patient counts as active from the first successful FHIR pull. Upgrades go through support@medblocks.com, and requests outside the plan return 402 `billing_error` (checked 2026-10-14).", "priceSummary": "$5000 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, llms-full.txt or the billing page. A 402 status is used only for `billing_error` when a plan does not cover a feature (checked 2026-10-14).", "endpoints": [] }, "toolCount": 10, "popularity": { "githubStars": null, "npmWeekly": 36, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://medblocks.com/docs", "llmsTxt": "https://medblocks.com/docs/llms.txt", "capabilities": [ "health.records", "health.consent", "health.ehr", "health.fhir", "agent.tools" ], "tags": [ "hosted", "mcp", "oauth", "fhir", "smart-on-fhir", "typescript", "llms-txt", "free-tier", "hipaa" ], "lastRelease": "2026-09-14", "graded": true, "anchor": { "graded": true, "score": 52.7, "grade": "D", "agentReady": false, "rank": 773, "ranked": true, "rankOf": 1076, "categoryRank": 9, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 69, "payments": 25, "reliability": 28, "schema": 62, "security": 67, "transparency": 51 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 28, "points": 5.6, "reason": "Read with the hosted lines and scored on the Platform API and MCP server. No status page was found. status.medblocks.com did not answer and the docs link none (0). No readable incident history (5). No request limit for the Platform API is published. The only number is manual webhook redelivery at once a minute per event (3 of 15). 429 responses carry `Retry-After`, the SDK retries 429, 502, 503 and 504 up to three times, and webhook consumers are told to dedupe by `event.id`. No idempotency keys for writes were found, and the conventions page meant to cover idempotency is a placeholder (10 of 15). No SLA found (0). Patient access and the SDK are at 1.0 with no beta label, though the backend guides are marked a work in progress and wearables as coming soon (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 62, "points": 10.07, "reason": "The reference pages say they are generated from `openapi/medblocks.json`, but that file is not published and the usual paths on app.medblocks.com return the web app. The MCP server's tool schemas sit behind sign-in (8 of 25). llms.txt, llms-full.txt and a Markdown version of every page (10). Guides explain which of the four surfaces fits which relationship, and the MCP page describes each tool and permission (14 of 20). Typed limits such as `limit` 1 to 100 and enumerated error codes were seen. The generated reference renders its parameter tables by script, so enums and required fields could not all be confirmed (9 of 15). Code samples throughout and an error catalogue of 36 codes with HTTP status and cause (13 of 15). A dated SDK changelog marks breaking changes, and the API takes a `Version` header, but the versioning page is an unwritten placeholder (8 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 72, "points": 11.7, "reason": "Ten MCP tools, short and task-shaped, and API list responses sized by `limit`. No read-only toolset beyond the consent tick boxes (22 of 25). Cursor paging on every list with `has_more` and `next_cursor`, plus `q` and `type` filters on the connections catalogue (17 of 20). One error envelope with a stable `code`, the failing `param`, a `request_id` and `retryAfter`, documented per code (19 of 20). No idempotency keys. `external_id_already_exists` (409) catches duplicates. The MCP page says every tool, lookups included, declares that it changes state because each call writes an audit entry, so no readOnlyHint is set (6 of 20). Few required parameters, and one official SDK, in TypeScript (8 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 67, "points": 11.73, "reason": "OAuth from Medblocks' own server with dynamic client registration, PKCE, introspection, revocation and six resource scopes, and workspace API keys that owners and admins rotate and revoke, with separate Sandbox and Production prefixes. The error list includes `insufficient_scope` for keys (30). The consent screen has a tick box for managing people and deleting data that can be left off, and members cannot create keys. Confirmation before the two destructive tools is left to the assistant (15 of 20). get_health_records returns clinical text from hospital systems, and no prompt-injection guidance was found (3 of 15). Every MCP call writes an audit entry, and the dashboard shows authorisation and pull history per patient (12 of 15). The security page says public materials list HIPAA, SOC 2 Type II, ISO 27001 and GDPR, with reports in a packet on request. No security.txt, disclosure policy or bug bounty was found (7 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 25, "points": 3.13, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public, Free at $0 and Enterprise at $60,000 a year, with no per-unit price (10). The Free plan covers 1,000 active patients with full API access, and the docs show no card step at sign-in. The dashboard sits behind a login, so the card question was not confirmed (15 of 20). A person signs in through a browser to create the workspace, and each patient approves at their hospital. Dynamic client registration lets an MCP client register itself but still needs that sign-in (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 69, "points": 6.04, "reason": "npm shows 1.2.0-dev.5 on 10 August, dev.6 on 7 September and dev.7 on 14 September 2026, and the skills repository was last pushed on 2 October (30). Three releases in the last 90 days (20). Closed service with a dated changelog and support through a Google form. We could not test whether support answers (6 of 15). One official SDK, TypeScript, whose latest tag is still 1.0.0 while the changelog documents 1.1.0 and 1.2.0. No entry in the official MCP registry (7 of 15). The SDK has no runtime dependencies and needs Node 20 or Bun 1. The source repository is private, so CI could not be seen (6 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 51, "points": 4.46, "note": "editorial 32, provenance 70", "reason": "Closed service. The SDK licence is proprietary and forbids redistribution and reverse engineering. The public terms cover the website and the Blue Button application, with no customer terms for the Platform API found (10 of 30). The privacy policy covers Medblocks Platform and the MCP server, deletes Medicare data within 7 days of a request, keeps automatically collected data up to 24 months and says nothing is used to train AI models. Other periods are 'a reasonable period' and it does not mention the BAA the docs require (12 of 30). The changelog calls out breaking changes, but no deprecation policy or notice period exists, and the versioning page is a placeholder (5 of 20). Data is processed in the United States per the privacy policy. No sub-processor list was found (5 of 20)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Ten MCP tools, short and task-shaped, and API list responses sized by `limit`. No read-only toolset beyond the consent tick boxes (22 of 25). Cursor paging on every list with `has_more` and `next_cursor`, plus `q` and `type` filters on the connections catalogue (17 of 20). One error envelope with a stable `code`, the failing `param`, a `request_id` and `retryAfter`, documented per code (19 of 20). No idempotency keys. `external_id_already_exists` (409) catches duplicates. The MCP page says every tool, lookups included, declares that it changes state because each call writes an audit entry, so no readOnlyHint is set (6 of 20). Few required parameters, and one official SDK, in TypeScript (8 of 15).", "maintenance": "npm shows 1.2.0-dev.5 on 10 August, dev.6 on 7 September and dev.7 on 14 September 2026, and the skills repository was last pushed on 2 October (30). Three releases in the last 90 days (20). Closed service with a dated changelog and support through a Google form. We could not test whether support answers (6 of 15). One official SDK, TypeScript, whose latest tag is still 1.0.0 while the changelog documents 1.1.0 and 1.2.0. No entry in the official MCP registry (7 of 15). The SDK has no runtime dependencies and needs Node 20 or Bun 1. The source repository is private, so CI could not be seen (6 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). Plan prices are public, Free at $0 and Enterprise at $60,000 a year, with no per-unit price (10). The Free plan covers 1,000 active patients with full API access, and the docs show no card step at sign-in. The dashboard sits behind a login, so the card question was not confirmed (15 of 20). A person signs in through a browser to create the workspace, and each patient approves at their hospital. Dynamic client registration lets an MCP client register itself but still needs that sign-in (0).", "reliability": "Read with the hosted lines and scored on the Platform API and MCP server. No status page was found. status.medblocks.com did not answer and the docs link none (0). No readable incident history (5). No request limit for the Platform API is published. The only number is manual webhook redelivery at once a minute per event (3 of 15). 429 responses carry `Retry-After`, the SDK retries 429, 502, 503 and 504 up to three times, and webhook consumers are told to dedupe by `event.id`. No idempotency keys for writes were found, and the conventions page meant to cover idempotency is a placeholder (10 of 15). No SLA found (0). Patient access and the SDK are at 1.0 with no beta label, though the backend guides are marked a work in progress and wearables as coming soon (10).", "schema": "The reference pages say they are generated from `openapi/medblocks.json`, but that file is not published and the usual paths on app.medblocks.com return the web app. The MCP server's tool schemas sit behind sign-in (8 of 25). llms.txt, llms-full.txt and a Markdown version of every page (10). Guides explain which of the four surfaces fits which relationship, and the MCP page describes each tool and permission (14 of 20). Typed limits such as `limit` 1 to 100 and enumerated error codes were seen. The generated reference renders its parameter tables by script, so enums and required fields could not all be confirmed (9 of 15). Code samples throughout and an error catalogue of 36 codes with HTTP status and cause (13 of 15). A dated SDK changelog marks breaking changes, and the API takes a `Version` header, but the versioning page is an unwritten placeholder (8 of 15).", "security": "OAuth from Medblocks' own server with dynamic client registration, PKCE, introspection, revocation and six resource scopes, and workspace API keys that owners and admins rotate and revoke, with separate Sandbox and Production prefixes. The error list includes `insufficient_scope` for keys (30). The consent screen has a tick box for managing people and deleting data that can be left off, and members cannot create keys. Confirmation before the two destructive tools is left to the assistant (15 of 20). get_health_records returns clinical text from hospital systems, and no prompt-injection guidance was found (3 of 15). Every MCP call writes an audit entry, and the dashboard shows authorisation and pull history per patient (12 of 15). The security page says public materials list HIPAA, SOC 2 Type II, ISO 27001 and GDPR, with reports in a packet on request. No security.txt, disclosure policy or bug bounty was found (7 of 20).", "transparency": "Closed service. The SDK licence is proprietary and forbids redistribution and reverse engineering. The public terms cover the website and the Blue Button application, with no customer terms for the Platform API found (10 of 30). The privacy policy covers Medblocks Platform and the MCP server, deletes Medicare data within 7 days of a request, keeps automatically collected data up to 24 months and says nothing is used to train AI models. Other periods are 'a reasonable period' and it does not mention the BAA the docs require (12 of 30). The changelog calls out breaking changes, but no deprecation policy or notice period exists, and the versioning page is a placeholder (5 of 20). Data is processed in the United States per the privacy policy. No sub-processor list was found (5 of 20)." }, "sources": [ { "what": "docs index for agents", "url": "https://medblocks.com/docs/llms.txt", "seen": "2026-10-14" }, { "what": "full docs text", "url": "https://medblocks.com/docs/llms-full.txt", "seen": "2026-10-14" }, { "what": "MCP server", "url": "https://medblocks.com/docs/mcp.md", "seen": "2026-10-14" }, { "what": "billing and plans", "url": "https://medblocks.com/docs/billing.md", "seen": "2026-10-14" }, { "what": "API errors", "url": "https://medblocks.com/docs/reference/errors.md", "seen": "2026-10-14" }, { "what": "API conventions (placeholder)", "url": "https://medblocks.com/docs/reference/conventions.md", "seen": "2026-10-14" }, { "what": "versioning (placeholder)", "url": "https://medblocks.com/docs/reference/versioning.md", "seen": "2026-10-14" }, { "what": "SDK changelog", "url": "https://medblocks.com/docs/reference/changelog.md", "seen": "2026-10-14" }, { "what": "workspace and API keys", "url": "https://medblocks.com/docs/workspace.md", "seen": "2026-10-14" }, { "what": "sandboxes", "url": "https://medblocks.com/docs/sandboxes.md", "seen": "2026-10-14" }, { "what": "security and compliance", "url": "https://medblocks.com/docs/security-and-compliance.md", "seen": "2026-10-14" }, { "what": "patient authorisation", "url": "https://medblocks.com/docs/patient-access/authorization.md", "seen": "2026-10-14" }, { "what": "pagination", "url": "https://medblocks.com/docs/patient-access/get-the-data/pagination.md", "seen": "2026-10-14" }, { "what": "build with AI", "url": "https://medblocks.com/docs/build-with-ai.md", "seen": "2026-10-14" }, { "what": "OAuth server metadata", "url": "https://app.medblocks.com/.well-known/oauth-authorization-server", "seen": "2026-10-14" }, { "what": "unauthenticated MCP and API requests (401 with WWW-Authenticate and error envelope)", "url": "https://app.medblocks.com/mcp", "seen": "2026-10-14" }, { "what": "health endpoint", "url": "https://app.medblocks.com/health", "seen": "2026-10-14" }, { "what": "terms", "url": "https://medblocks.com/terms", "seen": "2026-10-14" }, { "what": "privacy policy", "url": "https://medblocks.com/privacy-policy", "seen": "2026-10-14" }, { "what": "npm package", "url": "https://registry.npmjs.org/medblocks", "seen": "2026-10-14" }, { "what": "SDK licence", "url": "https://unpkg.com/medblocks@1.0.0/LICENSE", "seen": "2026-10-14" }, { "what": "agent skills repository", "url": "https://github.com/medblocks/skills", "seen": "2026-10-14" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=medblocks", "seen": "2026-10-14" }, { "what": "domain registration", "url": "https://rdap.verisign.com/com/v1/domain/medblocks.com", "seen": "2026-10-14" } ], "openQuestions": [ "unchecked: the OpenAPI file `openapi/medblocks.json` named on every reference page. It is not at the obvious public paths, and the reference renders its schemas by script", "unchecked: the MCP tool definitions and annotations, which need a signed-in session. The tool list is from the docs page", "unchecked: whether workspace sign-up asks for a card, and what permissions an API key can carry. The dashboard is behind a login", "unchecked: SOC 2 Type II and ISO 27001 reports. The docs cite 'public Medblocks materials' and offer a security packet on request", "The billing page lists wearable device sync in the Free plan, while the wearables page says support is coming soon", "The founder's lead put Medblocks among health platforms. It is also a services and training company, and the graded product is Medblocks Platform, its patient-access API and MCP server" ] }, "negative": 0, "verdict": "Patient-authorised record retrieval with a ten-tool remote MCP server, OAuth with per-capability consent, an audit entry for every call and a free plan for 1,000 active patients. No status page, no published rate limits and no idempotency keys were found, and the OpenAPI file behind the reference is not published.", "bestFor": "A consumer or care app, or an assistant, that needs a patient's own records from US hospitals and payers with the patient's consent, and wants an MCP route as well as REST.", "strengths": [ "Remote MCP server with ten tools, OAuth with dynamic client registration and a consent screen that can leave destructive actions off", "Free plan for up to 1,000 active patients and a Synthetic Hospital sandbox with seeded FHIR R4 patients", "One error envelope with 36 stable codes, a `param` field, a request ID and `Retry-After` on 429", "Every MCP tool call writes an audit entry, and the dashboard shows authorisation and pull history per patient", "llms.txt, llms-full.txt and a Markdown copy of every docs page, plus agent skills for Claude Code, Codex and Cursor" ], "weaknesses": [ "No status page, SLA or published rate limits for the Platform API", "No idempotency keys were found, and the API conventions and versioning pages are unwritten placeholders", "The OpenAPI file the reference is generated from is not published", "Only one SDK, in TypeScript, with npm's latest tag still at 1.0.0 while the changelog documents 1.2.0", "The public terms cover the website and Blue Button app, and no sub-processor list or customer terms for the API were found" ], "agentNotes": [ "Connect with `claude mcp add --transport http medblocks https://app.medblocks.com/mcp` and sign in, or send a workspace API key as a Bearer token from a backend", "Ask the person before calling `disconnect_health_system` or `delete_person`. Both are permanent", "Wait for the connection webhook or check connection status before reading records. Pulls run in the background after the patient approves", "Branch on `error.code`, not the message, and wait the `Retry-After` seconds on a 429", "Use a Sandbox workspace and the Synthetic Hospital (password `demopass`) for tests. Sandbox keys cannot reach production sources" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 52.7 } ], "editorialScores": { "ergonomics": 72, "maintenance": 69, "payments": 25, "reliability": 28, "schema": 62, "security": 67, "transparency": 32 }, "provenanceScore": 70 }, "connect": { "install": "npm install medblocks", "http": "curl https://app.medblocks.com/patients -H \"Authorization: Bearer $MEDBLOCKS_API_KEY\" -H \"Content-Type: application/json\"", "claudeCode": "claude mcp add --transport http medblocks https://app.medblocks.com/mcp" }, "letme": { "capability": "https://letme.dev/health.records", "tool": "https://letme.dev/medblocks" }, "notable": [ "The remote MCP server `medblocks-platform` has ten tools, from search_health_systems and connect_health_system to get_health_records and delete_person, and every call writes a private audit entry (https://medblocks.com/docs/mcp)", "The consent screen has one tick box each for connecting facilities, reading records and managing people and deleting data, and access already issued expires within an hour of revocation (https://medblocks.com/docs/mcp)", "Every non-2xx response uses one envelope with `type`, `code`, `param`, `request_id` and `doc_url`, and the errors page lists 36 stable codes with their HTTP status (https://medblocks.com/docs/reference/errors)", "The Free plan covers 1,000 active patients at $0, and Enterprise is $60,000 a year (https://medblocks.com/docs/billing)", "A Synthetic Hospital in Sandbox workspaces has pre-seeded FHIR R4 patients and accepts an uploaded patient bundle (https://medblocks.com/docs/sandboxes)", "The API conventions and versioning pages are placeholders that say they are being written, and the wearables page says support is coming soon (https://medblocks.com/docs/reference/conventions)" ], "area": "domain-data", "details": [ { "label": "Surfaces", "value": "REST API at https://app.medblocks.com (patients, patient sessions, connections, records, webhooks, launch context), TypeScript SDK `medblocks`, remote MCP server at https://app.medblocks.com/mcp, agent skills in medblocks/skills" }, { "label": "MCP tools", "value": "get_workspace_overview, list_workspaces, list_people, search_health_systems, choose_health_systems, connect_health_system, check_connection_status, get_health_records, disconnect_health_system, delete_person" }, { "label": "Credentials", "value": "Workspace API keys with `mb_sk_sbx_` and `mb_sk_live_` prefixes, created and revoked by owners and admins. OAuth 2 at https://app.medblocks.com/api/auth with dynamic client registration, authorisation code, client credentials and refresh grants, introspection and revocation, and scopes patients:read, patients:write, patient_sessions:read, patient_sessions:write, connections:read and fhir:read" }, { "label": "Record sources", "value": "Patient access through SMART on FHIR to Epic, Oracle Health (Cerner), athenahealth, eClinicalWorks, MEDITECH, CMS Blue Button, Aetna and UnitedHealthcare. Clinician launch, backend services and CommonWell network access are documented, the backend guides as a work in progress" }, { "label": "Paging and errors", "value": "Cursor paging with `limit` from 1 to 100 (default 10) and `starting_after`. Error envelope with `type`, `code`, `message`, `param`, `request_id` and `doc_url`. The SDK retries 429, 502, 503 and 504 up to three times and honours `Retry-After`" }, { "label": "Webhooks", "value": "Signed with a `Medblocks-Signature` header, retried with backoff on non-2xx, endpoints auto-disabled after retries run out, manual redelivery limited to once a minute per event" }, { "label": "Compliance", "value": "The security page says public materials list HIPAA, SOC 2 Type II, ISO 27001 and GDPR, and that commercial plans include BAA support. Reports come in a security packet on request" } ], "unitPrices": [ { "item": "Enterprise plan, uncapped patients", "unit": "month", "usd": 5000, "note": "$60,000 a year per the billing page, shown here as a monthly equivalent" } ], "provenance": { "legalEntity": "Medblocks Inc.", "domain": "medblocks.com", "domainRegistered": "2005-11-04", "endpointOnVendorDomain": true, "terms": "https://medblocks.com/terms", "privacy": "https://medblocks.com/privacy-policy", "statusPage": "", "changelog": "https://medblocks.com/docs/reference/changelog", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The terms, last updated 5 October 2026, name Medblocks Inc., a Delaware corporation, at 100 Front Street, Suite 400 #122, Worcester, MA 01608, and cover the website and the CMS Blue Button application. No separate customer terms for the Platform API were found.", "The terms forbid using robots, scripts or scrapers to access the site. We read public pages and recorded that clause.", "The privacy policy, last updated 5 October 2026, covers the Medblocks applications including Medblocks Platform and the MCP server, and says no data is used to train AI models.", "medblocks.com/.well-known/security.txt returns 404. status.medblocks.com did not answer and no status page was linked from the docs.", "RDAP for medblocks.com gives a registration date of 2005-11-04." ], "score": 70, "checks": [ { "check": "Legal entity named", "value": "Medblocks Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "medblocks.com, registered 2005-11-04 (20 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "app.medblocks.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 4 of the 7 things a reader expects, and has 3 clauses that cost points", "points": 1.4, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 6 of the 8 things a reader expects", "points": 8.5, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://medblocks.com/terms", "state": "read", "readAt": "2026-10-14", "statedDate": "2026-10-05", "words": 1851, "points": 1.4, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: October 05, 2026", "says": "Last updated 2026-10-05" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "These Terms and Conditions and any dispute arising out of or relating to them are governed by the laws of the State of Delaware, United States, without regard to its conflict of laws principles.", "says": "The law of the State of Delaware" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": false }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": false }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "We will alert you about any changes by updating the “Last updated” date of these Terms and Conditions, and you waive any right to receive specific notice of each such change.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "You agree that you will not attempt to access Medicare data that is not your own or that you are not authorized to access, and that you will not use Medicare data obtained through the Application for any unlawful purpose." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "Use automated systems (robots, scripts, scrapers).", "costsPoints": true }, { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "Compete with us or use Site content commercially.", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "We will alert you about any changes by updating the “Last updated” date of these Terms and Conditions, and you waive any right to receive specific notice of each such change.", "costsPoints": true } ], "notes": [ { "date": "2026-10-14", "text": "Medblocks excludes liability for all damages, direct ones included, with lost profits and data named.", "quote": "We are not liable for any direct, indirect, incidental, consequential, or punitive damages, including lost profits or data." }, { "date": "2026-10-14", "text": "Using buying or purchasing agents is listed among the prohibited activities.", "quote": "Use buying or purchasing agents." }, { "date": "2026-10-14", "text": "The licence granted covers access and use of the Site for personal, non-commercial use only.", "quote": "If eligible to use the Site, you are granted a limited license to access and use the Site for your personal, non-commercial use." } ] }, { "kind": "privacy", "url": "https://medblocks.com/privacy-policy", "state": "read", "readAt": "2026-10-14", "statedDate": "2026-10-05", "words": 2763, "points": 8.5, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: October 05, 2026", "says": "Last updated 2026-10-05" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "It explains what information we collect, how we use and share it, and the choices you have." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "Automatically collected data is retained for up to 24 months and then stored in aggregate form.", "says": "Names a period of 24 months" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "and with trusted service providers who work on our behalf under strict confidentiality." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "You obtain your Medicare data through the CMS Blue Button API by exercising your individual right to access your own health information and directing it to Medblocks." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have connected your records through a magic link sent by an organization, you can disconnect and permanently delete your data at any time through the Delete your data page or by contacting privacy@medblocks.com, as described under “Your Choices and Controlling Your Information” below.", "says": "privacy@medblocks.com" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": false } ], "notes": [ { "date": "2026-10-14", "text": "Records reach a connected AI client only through the MCP server after the user consents, and Medblocks says it uses no data to train AI models.", "quote": "We do not use any data to train AI models, and we do not share any data with AI providers ourselves." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/medblocks.json", "live": { "slug": "medblocks", "probe": { "target": "https://app.medblocks.com/mcp", "method": "get", "lastAt": "2026-10-14T09:41:57.376112052Z", "lastOk": true, "lastStatus": 401, "lastMs": 317, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 317, "p95ms24h": 463, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 17 } ] }, "updatedAt": "2026-10-14T09:41:57.376112052Z" } } }