{ "data": { "a": { "slug": "aidbox", "name": "Aidbox", "vendor": "Health Samurai, Inc.", "vendorUrl": "https://www.health-samurai.io/aidbox", "kind": "http-api", "category": "health-data", "summary": "FHIR R4 and R5 server on PostgreSQL from Health Samurai, run from Docker images under a free development licence or a paid production licence. Agents use each instance's FHIR REST API or its alpha MCP server.", "url": "https://www.anchorterminal.com/tools/aidbox", "markdownUrl": "https://www.anchorterminal.com/tools/aidbox.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/aidbox.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/aidbox.json", "repo": "https://github.com/Aidbox", "license": "Proprietary. Aidbox runs from Health Samurai's Docker images under a free development licence (no PHI) or a paid production licence. Examples and the Python SDK on GitHub are MIT", "transports": [ "http", "streamable-http", "sse" ], "packages": [ { "registry": "oci", "name": "healthsamurai/aidboxone" } ], "auth": "oauth", "authNotes": "Each instance has its own OAuth 2.0 server. Agents use a Client resource with the client credentials grant and POST to /auth/token, and SMART on FHIR backend services with private key JWT are supported. AccessPolicy resources decide what each client, user or operation may do, and access token lifetime is set per Client. Basic auth with the client ID and secret is also documented. The MCP endpoints are closed until an AccessPolicy opens them.", "pricing": "freemium", "pricingNotes": "Aidbox Dev is $0 for development and testing with no PHI, Aidbox Base from $1,900 a month or $19,000 a year, Enterprise by contact (health-samurai.io/price, checked 2026-10-14). A production licence runs 14 days as a trial before Health Samurai extends it. A free hosted sandbox on Google Cloud comes with an aidbox.app account. Whether sign-up asks for a card was not established.", "priceSummary": "$1900 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or pricing page (checked 2026-10-14).", "endpoints": [] }, "toolCount": 9, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://www.health-samurai.io/docs/aidbox", "llmsTxt": "https://www.health-samurai.io/docs/aidbox/llms.txt", "capabilities": [ "health.fhir", "health.records", "health.consent" ], "tags": [ "self-hosted", "fhir", "mcp", "oauth", "smart-on-fhir", "docker", "postgresql", "llms-txt", "iso27001" ], "lastRelease": "2026-10-08", "graded": true, "anchor": { "graded": true, "score": 64.2, "grade": "B", "agentReady": false, "rank": 385, "ranked": true, "rankOf": 1076, "categoryRank": 3, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 79, "maintenance": 80, "payments": 25, "reliability": 59, "schema": 77, "security": 74, "transparency": 45 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "Graded on the FHIR REST API of an Aidbox instance the owner runs. Monthly releases, two-year LTS lines, SMART on FHIR, AccessPolicy rules and AuditEvent logging are documented, and a free development licence needs no sales call. Aidbox has no rate limiting of its own, its MCP module is alpha, and no terms of service were found on the website.", "bestFor": "An organisation building its own clinical data repository, EHR or payer platform on FHIR, where an agent works against that store.", "strengths": [ "Monthly releases with dated notes, the latest 2609 on 8 October 2026, and LTS lines supported for two years", "SMART on FHIR backend services, client credentials and AccessPolicy rules per client, user or operation", "AuditEvent recording and an audit event topic that can forward to an external repository", "Free development licence and hosted sandbox, with Base pricing published from $1,900 a month", "Cosign-signed images, SBOMs per release and remediation deadlines from 7 days for critical vulnerabilities" ], "weaknesses": [ "No built-in rate limiting or brute-force protection, by the vendor's hardening page", "The MCP module is alpha, its tools take whole resources as free JSON, and no tool annotations are documented", "No terms of service or licence agreement was found on the website, and the privacy policy dates from 10 June 2021", "Closed source with no public CI and no OpenAPI document", "No public status page, security.txt or sub-processor list was found" ], "agentNotes": [ "Ask the operator for a Client with an AccessPolicy limited to the task. Don't rely on the public MCP policy, which the docs mark unsafe", "Use `If-None-Exist` on creates and conditional update on identifiers so retries don't duplicate records", "Use `_elements` and `_count` to keep responses small, and follow the Bundle's paging links", "Throttle yourself. Aidbox applies no rate limit, so a burst lands on the customer's database", "Don't load real patient data into an instance on a development licence" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.2 } ], "editorialScores": { "ergonomics": 79, "maintenance": 80, "payments": 25, "reliability": 59, "schema": 77, "security": 74, "transparency": 51 }, "provenanceScore": 39 }, "connect": { "install": "curl -JO https://aidbox.app/runme \u0026\u0026 docker compose up" }, "letme": { "capability": "https://letme.dev/health.fhir", "tool": "https://letme.dev/aidbox" }, "area": "domain-data", "unitPrices": [ { "item": "Aidbox Base licence", "unit": "month", "usd": 1900, "note": "From price, monthly billing. $19,000 a year on yearly billing" } ], "provenance": { "legalEntity": "Health Samurai, Inc.", "domain": "health-samurai.io", "domainRegistered": "", "endpointOnVendorDomain": false, "terms": "", "privacy": "https://www.health-samurai.io/legal/privacy-policy", "statusPage": "", "changelog": "https://www.health-samurai.io/docs/aidbox/overview/release-notes", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The site footer and privacy policy name Health Samurai, Inc. The privacy policy was last updated on 10 June 2021 and refers to Terms of Use that were not found.", "No terms of service or licence agreement was found at /legal or in the docs.", "www.health-samurai.io/.well-known/security.txt returns a 404 page. The supply chain page sends reports to security@health-samurai.io.", "Aidbox runs on the customer's infrastructure, so endpoints are on the customer's domain. The free sandbox runs on aidbox.app subdomains.", "No public status page was found. The domain registration date was not established." ], "score": 39 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/aidbox.json" }, "answer": "Medplum scores 68.7 (B) on agent readiness against Aidbox's 64.2 (B), and leads in 4 of 7 scored categories. Aidbox leads on agent ergonomics.", "b": { "slug": "medplum", "name": "Medplum", "vendor": "Orangebot, Inc. (dba Medplum)", "vendorUrl": "https://www.medplum.com", "kind": "http-api", "category": "health-data", "summary": "Open-source FHIR R4 server and healthcare developer platform from Orangebot, Inc. (dba Medplum). Agents reach patient records through the hosted FHIR REST API at api.medplum.com, a remote MCP server or a self-hosted copy.", "url": "https://www.anchorterminal.com/tools/medplum", "markdownUrl": "https://www.anchorterminal.com/tools/medplum.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/medplum.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/medplum.json", "repo": "https://github.com/medplum/medplum", "license": "Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service", "transports": [ "http", "streamable-http", "sse" ], "remoteUrl": "https://api.medplum.com/mcp/stream", "packages": [ { "registry": "npm", "name": "@medplum/core" } ], "auth": "oauth", "authNotes": "OAuth 2.0 and OpenID Connect. Machine clients use the client credentials grant with a ClientApplication ID and secret created on the Project Admin page, and a POST to https://api.medplum.com/oauth2/token. SMART scopes and AccessPolicy resources limit what each user, bot or client can read or write, including read-only policies. The MCP server uses OAuth with a browser login on first connect. Client assertion, token exchange, on-behalf-of and mTLS are also documented.", "pricing": "freemium", "pricingNotes": "Hosted plans on medplum.com/pricing (checked 2026-10-14). Free for prototyping, Production $2,000 a month, Premium $6,000 a month, Enterprise by contact. The paid plans include a standard BAA and MSA. Self-hosting the Apache 2.0 server is free. Whether the free plan asks for a card was not established.", "priceSummary": "$2000 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the pricing page or the repository (checked 2026-10-14).", "endpoints": [] }, "toolCount": 3, "popularity": { "githubStars": 2738, "npmWeekly": 269965, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://www.medplum.com/docs", "llmsTxt": "https://www.medplum.com/llms.txt", "registryName": "com.medplum/mcp", "capabilities": [ "health.fhir", "health.records" ], "tags": [ "hosted", "open-source", "self-hosted", "fhir", "mcp", "oauth", "smart-on-fhir", "hipaa", "soc2", "typescript", "llms-txt", "status-page" ], "lastRelease": "2026-10-08", "graded": true, "anchor": { "graded": true, "score": 68.7, "grade": "B", "agentReady": false, "rank": 216, "ranked": true, "rankOf": 1076, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 93, "payments": 25, "reliability": 75, "schema": 82, "security": 74, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": -2, "negativeNotes": [ "2026-07-24: GHSA-m44r-7c5h-m6mj, high severity. The external auth callback accepted redirect URIs that only had to start with a registered one, which could leak authorisation codes cross-origin. Patched in @medplum/core 5.1.6 and disclosed on GitHub (https://github.com/medplum/medplum/security/advisories/GHSA-m44r-7c5h-m6mj). With GHSA-ch8p-j6cm-r7w5 (2 June 2026, client secret exposure in self-hosted dynamic registration), both fixed and disclosed in public, so the deduction is small (-2)." ], "verdict": "Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.", "bestFor": "An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.", "strengths": [ "Apache 2.0 server with releases about weekly, v5.2.3 on 8 October 2026, and a written version policy", "Rate limits published per tier, with a `RateLimit` header giving remaining units and seconds to reset", "AccessPolicy resources and SMART scopes allow read-only, per-resource or per-element clients", "Official MCP server at api.medplum.com/mcp/stream, listed in the MCP registry as com.medplum/mcp, with OAuth", "99.99 per cent monthly SLA with service credits stated for the production hosted platform" ], "weaknesses": [ "The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint", "The privacy policy was last updated on 5 April 2022 and the terms on 11 April 2023", "No sub-processor list or retention periods were found", "Two high-severity auth advisories were published and patched in 2026", "Official SDK in TypeScript only" ], "agentNotes": [ "Use a ClientApplication with an AccessPolicy limited to the resources the task needs, and set `readonly` where no writes are needed", "Read the `RateLimit` header and wait for the reset time after a 429. Writes cost 100 quota points, searches 20 and reads 1", "Create patients with conditional create (`If-None-Exist`) or upsert on an identifier so a retry doesn't make a duplicate", "Pass paths to `fhir-request` relative to the FHIR R4 base, with no leading slash or `/fhir/R4` prefix", "Use `Prefer: respond-async` for large bundles. Operations inside the background job don't count against the quota" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.7 } ], "editorialScores": { "ergonomics": 73, "maintenance": 93, "payments": 25, "reliability": 75, "schema": 82, "security": 74, "transparency": 65 }, "provenanceScore": 78 }, "connect": { "install": "npm install @medplum/core", "http": "curl -X POST https://api.medplum.com/oauth2/token \\\n -H \"Content-Type: application/x-www-form-urlencoded\" \\\n -d \"grant_type=client_credentials\u0026client_id=$MY_CLIENT_ID\u0026client_secret=$MY_CLIENT_SECRET\"" }, "letme": { "capability": "https://letme.dev/health.fhir", "tool": "https://letme.dev/medplum" }, "area": "domain-data", "unitPrices": [ { "item": "Production plan", "unit": "month", "usd": 2000, "note": "Hosted, BAA included, Growth usage tier" }, { "item": "Premium plan", "unit": "month", "usd": 6000, "note": "Hosted, adds lab, medication and HL7 integrations" } ], "provenance": { "legalEntity": "Orangebot, Inc.", "domain": "medplum.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.medplum.com/terms", "privacy": "https://www.medplum.com/privacy", "statusPage": "https://status.medplum.com", "changelog": "https://github.com/medplum/medplum/releases", "securityTxt": "valid", "checked": "2026-10-14", "notes": [ "The pricing and security pages name Orangebot, Inc (dba Medplum).", "www.medplum.com/.well-known/security.txt lists security@medplum.com, a PGP key and expires 2027-02-28.", "robots.txt on api.medplum.com and status.medplum.com disallows every path for all agents, so the status history and the live OpenAPI document were not read.", "The terms of service were last updated 2023-04-11 and the privacy policy 2022-04-05.", "The domain registration date was not established." ], "score": 78 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/medplum.json", "live": { "slug": "medplum", "probe": { "target": "https://api.medplum.com/mcp/stream", "method": "get", "lastAt": "2026-10-14T09:41:57.409301454Z", "lastOk": true, "lastStatus": 401, "lastMs": 255, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 256, "p95ms24h": 389, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 17 } ] }, "vendorStatus": { "page": "https://status.medplum.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:53:23.189127499Z" }, "updatedAt": "2026-10-14T09:41:57.409301454Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Health Samurai, Inc.", "b": "Orangebot, Inc. (dba Medplum)", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.medplum.com/mcp/stream", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, SSE (legacy)", "b": "HTTP, Streamable HTTP, SSE (legacy)", "name": "Transports" }, { "a": "OAuth", "b": "OAuth", "name": "Auth" }, { "a": "Freemium", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary. Aidbox runs from Health Samurai's Docker images under a free development licence (no PHI) or a paid production licence. Examples and the Python SDK on GitHub are MIT", "b": "Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service", "name": "Licence" }, { "a": "9", "b": "3", "name": "Tools exposed" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "not listed", "b": "com.medplum/mcp", "name": "MCP registry" }, { "a": "2026-10-08", "b": "2026-10-08", "name": "Last release" }, { "a": "no document linked", "b": "2023-04-11", "name": "Terms last updated" }, { "a": "2021-06-10", "b": "2022-04-05", "name": "Privacy policy last updated" }, { "a": "", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "2.7k stars, 270k npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Medplum scores 68.7 (B) on agent readiness against Aidbox's 64.2 (B), and leads in 4 of 7 scored categories. Aidbox leads on agent ergonomics.", "question": "Which is better for AI agents, Aidbox or Medplum?" }, { "answer": "Both use an OAuth sign-in.", "question": "Do Aidbox and Medplum need an API key?" }, { "answer": "No hosted endpoint is listed for Aidbox. Medplum has a hosted endpoint at https://api.medplum.com/mcp/stream.", "question": "Can an agent call Aidbox and Medplum without installing anything?" }, { "answer": "No open-source release is listed for Aidbox. Medplum is open source (Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service).", "question": "Are Aidbox and Medplum open source?" } ], "goodFor": [ { "aheadOn": [ "Agent ergonomics, 79 against 73" ], "also": null, "goodFor": "An organisation building its own clinical data repository, EHR or payer platform on FHIR, where an agent works against that store.", "slug": "aidbox", "watchFor": "No built-in rate limiting or brute-force protection, by the vendor's hardening page" }, { "aheadOn": [ "Reliability, 75 against 59", "Schema \u0026 documentation, 82 against 77", "Maintenance \u0026 community, 93 against 80", "Transparency \u0026 trust, 72 against 45" ], "also": [ "A hosted endpoint, with nothing to install", "Open source" ], "goodFor": "An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.", "slug": "medplum", "watchFor": "The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint" } ], "job": { "capability": "health.fhir", "name": "FHIR servers" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aidbox-vs-health-gorilla.json", "title": "Aidbox vs Health Gorilla", "url": "https://www.anchorterminal.com/compare/aidbox-vs-health-gorilla" }, { "json": "https://www.anchorterminal.com/compare/aidbox-vs-medblocks.json", "title": "Aidbox vs Medblocks", "url": "https://www.anchorterminal.com/compare/aidbox-vs-medblocks" }, { "json": "https://www.anchorterminal.com/compare/aidbox-vs-metriport.json", "title": "Aidbox vs Metriport Medical API", "url": "https://www.anchorterminal.com/compare/aidbox-vs-metriport" }, { "json": "https://www.anchorterminal.com/compare/aidbox-vs-particle-health.json", "title": "Aidbox vs Particle Health", "url": "https://www.anchorterminal.com/compare/aidbox-vs-particle-health" }, { "json": "https://www.anchorterminal.com/compare/aidbox-vs-redox.json", "title": "Aidbox vs Redox", "url": "https://www.anchorterminal.com/compare/aidbox-vs-redox" }, { "json": "https://www.anchorterminal.com/compare/aidbox-vs-rook.json", "title": "Aidbox vs ROOK", "url": "https://www.anchorterminal.com/compare/aidbox-vs-rook" }, { "json": "https://www.anchorterminal.com/compare/aidbox-vs-terra.json", "title": "Aidbox vs Terra API", "url": "https://www.anchorterminal.com/compare/aidbox-vs-terra" }, { "json": "https://www.anchorterminal.com/compare/aidbox-vs-zus-health.json", "title": "Aidbox vs Zus Health", "url": "https://www.anchorterminal.com/compare/aidbox-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-metriport.json", "title": "Medplum vs Metriport Medical API", "url": "https://www.anchorterminal.com/compare/medplum-vs-metriport" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-particle-health.json", "title": "Medplum vs Particle Health", "url": "https://www.anchorterminal.com/compare/medplum-vs-particle-health" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-redox.json", "title": "Medplum vs Redox", "url": "https://www.anchorterminal.com/compare/medplum-vs-redox" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-rook.json", "title": "Medplum vs ROOK", "url": "https://www.anchorterminal.com/compare/medplum-vs-rook" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-terra.json", "title": "Medplum vs Terra API", "url": "https://www.anchorterminal.com/compare/medplum-vs-terra" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-zus-health.json", "title": "Medplum vs Zus Health", "url": "https://www.anchorterminal.com/compare/medplum-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/1uphealth-vs-aidbox.json", "title": "1upHealth vs Aidbox", "url": "https://www.anchorterminal.com/compare/1uphealth-vs-aidbox" }, { "json": "https://www.anchorterminal.com/compare/1uphealth-vs-medplum.json", "title": "1upHealth vs Medplum", "url": "https://www.anchorterminal.com/compare/1uphealth-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-medplum.json", "title": "Health Gorilla vs Medplum", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/medblocks-vs-medplum.json", "title": "Medblocks vs Medplum", "url": "https://www.anchorterminal.com/compare/medblocks-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/aidbox-vs-validic.json", "title": "Aidbox vs Validic Inform", "url": "https://www.anchorterminal.com/compare/aidbox-vs-validic" } ], "scores": [ { "aidbox": 59, "by": 16, "edge": "medplum", "key": "reliability", "medplum": 75, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "aidbox": 77, "by": 5, "edge": "medplum", "key": "schema", "medplum": 82, "name": "Schema \u0026 documentation", "weight": 13 }, { "aidbox": 79, "by": 6, "edge": "aidbox", "key": "ergonomics", "medplum": 73, "name": "Agent ergonomics", "weight": 13 }, { "aidbox": 74, "by": 0, "edge": "", "key": "security", "medplum": 74, "name": "Security \u0026 auth", "weight": 14 }, { "aidbox": 25, "by": 0, "edge": "", "key": "payments", "medplum": 25, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "aidbox": 80, "by": 13, "edge": "medplum", "key": "maintenance", "medplum": 93, "name": "Maintenance \u0026 community", "weight": 7 }, { "aidbox": 45, "by": 27, "edge": "medplum", "key": "transparency", "medplum": 72, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Medplum scores 68.7 (B) on agent readiness against Aidbox's 64.2 (B), and leads in 4 of 7 scored categories. Aidbox leads on agent ergonomics. Both do fhir servers.", "verdicts": { "aidbox": "Graded on the FHIR REST API of an Aidbox instance the owner runs. Monthly releases, two-year LTS lines, SMART on FHIR, AccessPolicy rules and AuditEvent logging are documented, and a free development licence needs no sales call. Aidbox has no rate limiting of its own, its MCP module is alpha, and no terms of service were found on the website.", "medplum": "Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/aidbox-vs-medplum", "json": "https://www.anchorterminal.com/compare/aidbox-vs-medplum.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/aidbox-vs-medplum.md", "slim": "https://www.anchorterminal.com/compare/aidbox-vs-medplum.min.md" }, "markdown": "Medplum scores 68.7 (B) on agent readiness against Aidbox's 64.2 (B), and leads in 4 of 7 scored categories. Aidbox leads on agent ergonomics. Both do fhir servers.\n\n- Aidbox: grade B, 64.2/100, rank #385 of 1076. Markdown https://www.anchorterminal.com/tools/aidbox.md · JSON https://www.anchorterminal.com/api/v1/tools/aidbox.json\n- Medplum: grade B, 68.7/100, rank #216 of 1076. Markdown https://www.anchorterminal.com/tools/medplum.md · JSON https://www.anchorterminal.com/api/v1/tools/medplum.json\n- Best health record and wellness data APIs for AI agents: https://www.anchorterminal.com/best/health-data/index.md\n- All 63 health comparisons: https://www.anchorterminal.com/compare/health-data/index.md\n\n## Which one, for what\n\n### Aidbox (B)\n\nGood for: An organisation building its own clinical data repository, EHR or payer platform on FHIR, where an agent works against that store.\n\nAhead on:\n- Agent ergonomics, 79 against 73\n\nWatch for: No built-in rate limiting or brute-force protection, by the vendor's hardening page\n\n### Medplum (B)\n\nGood for: An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.\n\nAhead on:\n- Reliability, 75 against 59\n- Schema \u0026 documentation, 82 against 77\n- Maintenance \u0026 community, 93 against 80\n- Transparency \u0026 trust, 72 against 45\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Open source\n\nWatch for: The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint\n\n\n## Score by category\n\n| Category | Weight | Aidbox | Medplum | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 59 | 75 | Medplum +16 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 77 | 82 | Medplum +5 |\n| Agent ergonomics | 13% (16.2 this run) | 79 | 73 | Aidbox +6 |\n| Security \u0026 auth | 14% (17.5 this run) | 74 | 74 | even |\n| Payments \u0026 pricing | 10% (12.5 this run) | 25 | 25 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 80 | 93 | Medplum +13 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 45 | 72 | Medplum +27 |\n| Negative events | ≤15 | 0 | -2 | |\n| **Total** | | **64.2 · B** | **68.7 · B** | |\n\n## Facts side by side\n\n| Fact | Aidbox | Medplum |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Health Samurai, Inc. | Orangebot, Inc. (dba Medplum) |\n| Hosted endpoint | no (local only) | `https://api.medplum.com/mcp/stream` |\n| Transports | HTTP, Streamable HTTP, SSE (legacy) | HTTP, Streamable HTTP, SSE (legacy) |\n| Auth | OAuth | OAuth |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Proprietary. Aidbox runs from Health Samurai's Docker images under a free development licence (no PHI) or a paid production licence. Examples and the Python SDK on GitHub are MIT | Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service |\n| Tools exposed | 9 | 3 |\n| Read-only variant documented | no | yes |\n| llms.txt | yes | yes |\n| MCP registry | not listed | `com.medplum/mcp` |\n| Last release | 2026-10-08 | 2026-10-08 |\n| Terms last updated | no document linked | 2023-04-11 |\n| Privacy policy last updated | 2021-06-10 | 2022-04-05 |\n| Customer content may train models | | not found in the text |\n| Terms restrict automated access | | not found in the text |\n| Terms restrict benchmarking | | not found in the text |\n| Terms or service can change without notice | | yes |\n| Arbitration or class-action waiver | | yes |\n| Popularity | none | 2.7k stars, 270k npm/wk |\n\n## Verdicts\n\n**Aidbox.** Graded on the FHIR REST API of an Aidbox instance the owner runs. Monthly releases, two-year LTS lines, SMART on FHIR, AccessPolicy rules and AuditEvent logging are documented, and a free development licence needs no sales call. Aidbox has no rate limiting of its own, its MCP module is alpha, and no terms of service were found on the website.\n\n**Medplum.** Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.\n\n## Before you call either\n\n### Aidbox\n\n1. Ask the operator for a Client with an AccessPolicy limited to the task. Don't rely on the public MCP policy, which the docs mark unsafe\n2. Use `If-None-Exist` on creates and conditional update on identifiers so retries don't duplicate records\n3. Use `_elements` and `_count` to keep responses small, and follow the Bundle's paging links\n4. Throttle yourself. Aidbox applies no rate limit, so a burst lands on the customer's database\n5. Don't load real patient data into an instance on a development licence\n\n### Medplum\n\n1. Use a ClientApplication with an AccessPolicy limited to the resources the task needs, and set `readonly` where no writes are needed\n2. Read the `RateLimit` header and wait for the reset time after a 429. Writes cost 100 quota points, searches 20 and reads 1\n3. Create patients with conditional create (`If-None-Exist`) or upsert on an identifier so a retry doesn't make a duplicate\n4. Pass paths to `fhir-request` relative to the FHIR R4 base, with no leading slash or `/fhir/R4` prefix\n5. Use `Prefer: respond-async` for large bundles. Operations inside the background job don't count against the quota\n\n## Questions\n\n### Which is better for AI agents, Aidbox or Medplum?\n\nMedplum scores 68.7 (B) on agent readiness against Aidbox's 64.2 (B), and leads in 4 of 7 scored categories. Aidbox leads on agent ergonomics.\n\n### Do Aidbox and Medplum need an API key?\n\nBoth use an OAuth sign-in.\n\n### Can an agent call Aidbox and Medplum without installing anything?\n\nNo hosted endpoint is listed for Aidbox. Medplum has a hosted endpoint at https://api.medplum.com/mcp/stream.\n\n### Are Aidbox and Medplum open source?\n\nNo open-source release is listed for Aidbox. Medplum is open source (Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/aidbox-vs-medplum.json, and with the fewest tokens: https://www.anchorterminal.com/compare/aidbox-vs-medplum.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"aidbox\", \"b\": \"medplum\"}`. From a terminal: `anchor compare aidbox medplum`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/aidbox.json and https://www.anchorterminal.com/api/v1/tools/medplum.json\n\n## Other comparisons with Aidbox or Medplum\n\n- [Aidbox vs Health Gorilla](https://www.anchorterminal.com/compare/aidbox-vs-health-gorilla.md)\n- [Aidbox vs Medblocks](https://www.anchorterminal.com/compare/aidbox-vs-medblocks.md)\n- [Aidbox vs Metriport Medical API](https://www.anchorterminal.com/compare/aidbox-vs-metriport.md)\n- [Aidbox vs Particle Health](https://www.anchorterminal.com/compare/aidbox-vs-particle-health.md)\n- [Aidbox vs Redox](https://www.anchorterminal.com/compare/aidbox-vs-redox.md)\n- [Aidbox vs ROOK](https://www.anchorterminal.com/compare/aidbox-vs-rook.md)\n- [Aidbox vs Terra API](https://www.anchorterminal.com/compare/aidbox-vs-terra.md)\n- [Aidbox vs Zus Health](https://www.anchorterminal.com/compare/aidbox-vs-zus-health.md)\n- [Medplum vs Metriport Medical API](https://www.anchorterminal.com/compare/medplum-vs-metriport.md)\n- [Medplum vs Particle Health](https://www.anchorterminal.com/compare/medplum-vs-particle-health.md)\n- [Medplum vs Redox](https://www.anchorterminal.com/compare/medplum-vs-redox.md)\n- [Medplum vs ROOK](https://www.anchorterminal.com/compare/medplum-vs-rook.md)\n- [Medplum vs Terra API](https://www.anchorterminal.com/compare/medplum-vs-terra.md)\n- [Medplum vs Zus Health](https://www.anchorterminal.com/compare/medplum-vs-zus-health.md)\n- [1upHealth vs Aidbox](https://www.anchorterminal.com/compare/1uphealth-vs-aidbox.md)\n- [1upHealth vs Medplum](https://www.anchorterminal.com/compare/1uphealth-vs-medplum.md)\n- [Health Gorilla vs Medplum](https://www.anchorterminal.com/compare/health-gorilla-vs-medplum.md)\n- [Medblocks vs Medplum](https://www.anchorterminal.com/compare/medblocks-vs-medplum.md)\n- [Aidbox vs Validic Inform](https://www.anchorterminal.com/compare/aidbox-vs-validic.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Aidbox vs Medplum", "url": "" } ], "description": "Medplum scores 68.7 (B) to Aidbox's 64.2 (B) for fhir servers. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Aidbox B 64.2", "Medplum B 68.7", "scores" ], "h1": "Aidbox vs Medplum", "image": "https://www.anchorterminal.com/assets/og/compare-aidbox-vs-medplum.png", "path": "/compare/aidbox-vs-medplum", "published": "2026-10-01", "section": "tools", "title": "Aidbox vs Medplum for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-10-14", "url": "https://www.anchorterminal.com/compare/aidbox-vs-medplum" }, "tokens": { "markdown": 2350, "slim": 730 }, "version": 1 }