Write a review

Head to head · FHIR servers · October 2026 research run

Aidbox vs Medblocks

Aidbox scores 64.2 (B) on agent readiness against Medblocks's 52.7 (D), and leads in 5 of 7 scored categories. Medblocks leads on transparency & trust. Both do fhir servers.

Best health record and wellness data APIs for AI agents · All 63 health comparisons

AidboxHealth Samurai, Inc. · HTTP API B64.2/100#385 of 1076 MedblocksMedblocks Inc. · HTTP API D52.7/100#773 of 1076

Which one, for what

Aidbox B

Best for An organisation building its own clinical data repository, EHR or payer platform on FHIR, where an agent works against that store.

Ahead on

  • Reliability, 59 against 28
  • Schema & documentation, 77 against 62
  • Agent ergonomics, 79 against 72
  • Security & auth, 74 against 67
  • Maintenance & community, 80 against 69

Watch for

No built-in rate limiting or brute-force protection, by the vendor's hardening page

Medblocks D

Best for A consumer or care app, or an assistant, that needs a patient's own records from US hospitals and payers with the patient's consent, and wants an MCP route as well as REST.

Ahead on

  • Transparency & trust, 51 against 45

Also in its favour

  • A hosted endpoint, with nothing to install

Watch for

No status page, SLA or published rate limits for the Platform API

Score by category

CategoryWeight this runAidboxMedblocksEdge
Reliability16%205928Aidbox +31
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.27762Aidbox +15
Agent ergonomics13%16.27972Aidbox +7
Security & auth14%17.57467Aidbox +7
Payments & pricing10%12.52525even
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.88069Aidbox +11
Transparency & trust7%8.84551Medblocks +6
Negative events≤1500
TotalB 64.2/100D 52.7/100

Facts side by side

FactAidboxMedblocks
KindHTTP APIHTTP API
VendorHealth Samurai, Inc.Medblocks Inc.
Hosted endpointno (local only)https://app.medblocks.com/mcp
TransportsHTTP, Streamable HTTP, SSE (legacy)HTTP, Streamable HTTP
AuthOAuthOAuth or key
PricingFreemiumFreemium
x402nono
LicenceProprietary. Aidbox runs from Health Samurai's Docker images under a free development licence (no PHI) or a paid production licence. Examples and the Python SDK on GitHub are MITProprietary service under Medblocks' terms. The medblocks TypeScript SDK on npm carries a proprietary licence that forbids redistribution and reverse engineering. The agent skills repository has no licence file
Tools exposed910
Read-only variant documentednono
llms.txtyesyes
Last release2026-10-082026-09-14
Terms last updatedno document linked2026-10-05
Privacy policy last updated2021-06-102026-10-05
Customer content may train modelsnot found in the text
Terms restrict automated accessyes
Terms restrict benchmarkingyes
Terms or service can change without noticeyes
Arbitration or class-action waivernot found in the text
Popularitynone36 npm/wk

Verdicts

Aidbox

Graded on the FHIR REST API of an Aidbox instance the owner runs. Monthly releases, two-year LTS lines, SMART on FHIR, AccessPolicy rules and AuditEvent logging are documented, and a free development licence needs no sales call. Aidbox has no rate limiting of its own, its MCP module is alpha, and no terms of service were found on the website.

Medblocks

Patient-authorised record retrieval with a ten-tool remote MCP server, OAuth with per-capability consent, an audit entry for every call and a free plan for 1,000 active patients. No status page, no published rate limits and no idempotency keys were found, and the OpenAPI file behind the reference is not published.

Before you call either

Aidbox

  1. Ask the operator for a Client with an AccessPolicy limited to the task. Don't rely on the public MCP policy, which the docs mark unsafe
  2. Use If-None-Exist on creates and conditional update on identifiers so retries don't duplicate records
  3. Use _elements and _count to keep responses small, and follow the Bundle's paging links
  4. Throttle yourself. Aidbox applies no rate limit, so a burst lands on the customer's database
  5. Don't load real patient data into an instance on a development licence

Medblocks

  1. Connect with claude mcp add --transport http medblocks https://app.medblocks.com/mcp and sign in, or send a workspace API key as a Bearer token from a backend
  2. Ask the person before calling disconnect_health_system or delete_person. Both are permanent
  3. Wait for the connection webhook or check connection status before reading records. Pulls run in the background after the patient approves
  4. Branch on error.code, not the message, and wait the Retry-After seconds on a 429
  5. Use a Sandbox workspace and the Synthetic Hospital (password demopass) for tests. Sandbox keys cannot reach production sources

Questions

Which is better for AI agents, Aidbox or Medblocks?

Aidbox scores 64.2 (B) on agent readiness against Medblocks's 52.7 (D), and leads in 5 of 7 scored categories. Medblocks leads on transparency & trust.

Do Aidbox and Medblocks need an API key?

Aidbox uses an OAuth sign-in. Medblocks takes an API key or an OAuth sign-in.

Can an agent call Aidbox and Medblocks without installing anything?

No hosted endpoint is listed for Aidbox. Medblocks has a hosted endpoint at https://app.medblocks.com/mcp.

Other comparisons with Aidbox or Medblocks

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report