{ "data": { "a": { "slug": "health-gorilla", "name": "Health Gorilla", "vendor": "Health Gorilla, Inc.", "vendorUrl": "https://www.healthgorilla.com", "kind": "http-api", "category": "health-data", "summary": "Health Gorilla is a designated TEFCA QHIN whose FHIR R4 API retrieves patient records from national networks (Patient360), places lab orders and returns results, and sends ADT and clinical alerts, for organisations it onboards.", "url": "https://www.anchorterminal.com/tools/health-gorilla", "markdownUrl": "https://www.anchorterminal.com/tools/health-gorilla.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/health-gorilla.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/health-gorilla.json", "license": "Proprietary service under Health Gorilla's API Terms of Use (updated 22 January 2026), with a signed licence agreement required before production", "transports": [ "http" ], "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 credentials (client ID and secret) are issued by Health Gorilla during implementation, separately for sandbox and production. Server-to-server calls use the JWT bearer grant with an assertion signed HS256 with the client secret. User-facing apps use the authorisation code grant, and an implicit grant can be enabled. Scopes such as `system/Patient.read`, `system/Observation.write` and `patient360` are assigned at registration and cannot be self-assigned.", "pricing": "paid", "pricingNotes": "No public prices. The API Terms of Use say fees 'are determined on a case-by-case basis by our business development team', and the sandbox is requested through the contact page (checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer portal, llms.txt or the API terms (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://developer.healthgorilla.com", "llmsTxt": "https://developer.healthgorilla.com/llms.txt", "capabilities": [ "health.records", "health.fhir", "health.consent" ], "tags": [ "hosted", "health-records", "fhir", "qhin", "lab-orders", "oauth", "llms-txt", "webhooks", "status-page", "sales-led", "hitrust", "soc2" ], "lastRelease": "2026-10-14", "graded": true, "anchor": { "graded": true, "score": 59.3, "grade": "C", "agentReady": false, "rank": 583, "ranked": true, "rankOf": 1076, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 63, "payments": 5, "reliability": 58, "schema": 80, "security": 66, "transparency": 61 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "A TEFCA QHIN with a FHIR R4 API, OpenAPI fragments on every reference page, idempotency keys on POST and dated weekly release notes. Access is sales-led, with case-by-case fees, a sandbox by request and no published rate limit numbers, and the API terms allow access to be cut at any time.", "bestFor": "US providers, labs and digital health companies that need network record retrieval and lab ordering through one FHIR API with a QHIN behind it.", "strengths": [ "Designated TEFCA QHIN with Patient360 retrieval across national networks, plus lab orders and ADT alerts", "`HG-Idempotency-Key` on POST, replaying the first response and returning 409 on conflicts", "llms.txt, Markdown pages and an OpenAPI 3.1 fragment on each reference page", "Release notes dated separately for sandbox and production, the latest on 14 October 2026" ], "weaknesses": [ "No public prices. Fees are set case by case and the sandbox is requested by form", "Rate limits are enforced with no published numbers", "JWT bearer assertions are signed HS256 with the shared client secret", "The API terms allow termination or disabling of access at any time, with or without notice" ], "agentNotes": [ "Send a fresh UUID in `HG-Idempotency-Key` on every POST and reuse it only when retrying the same payload", "Poll async operations no sooner than the `Retry-After` value and treat 454 as an expired result", "Follow `link.relation=next` in Bundles rather than building offsets yourself", "Expect mocked Patient360 data in sandbox unless network connectivity is enabled for the tenant", "Log `X-HG-Request-Id` from each response for support cases" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 59.3 } ], "editorialScores": { "ergonomics": 72, "maintenance": 63, "payments": 5, "reliability": 58, "schema": 80, "security": 66, "transparency": 38 }, "provenanceScore": 83 }, "connect": { "http": "GET https://sandbox.healthgorilla.com/fhir/R4/Patient?_count=50\nAuthorization: Bearer \u003caccess-token\u003e\nAccept: application/fhir+json" }, "letme": { "capability": "https://letme.dev/health.records", "tool": "https://letme.dev/health-gorilla" }, "area": "domain-data", "provenance": { "legalEntity": "Health Gorilla, Inc.", "domain": "healthgorilla.com", "domainRegistered": "2006-04-09", "endpointOnVendorDomain": true, "terms": "https://developer.healthgorilla.com/docs/terms-of-use", "privacy": "https://www.healthgorilla.com/home/privacy-policy", "statusPage": "https://status.healthgorilla.com", "changelog": "https://developer.healthgorilla.com/changelog", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The API Terms of Use (updated 22 January 2026) are between the developer and Health Gorilla, Inc., require a signed licence before production, and may be amended with or without notice.", "The privacy policy (last updated 30 August 2024) names Health Gorilla, Inc., covers the website and its platforms, gives no retention periods or sub-processors, and lists a Coral Gables, FL mailing address.", "www.healthgorilla.com/.well-known/security.txt returns the site's 404 page. A page at /home/security-txt shows a security.txt with Contact security@healthgorilla.com and Expires 2025-12-31.", "The website's Terms of Use page links an Enterprise SaaS Agreement (July 2024 version) that we did not read.", "RDAP gives healthgorilla.com a registration date of 2006-04-09." ], "score": 83 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/health-gorilla.json", "live": { "slug": "health-gorilla", "vendorStatus": { "page": "https://status.healthgorilla.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:52:42.042582907Z" }, "updatedAt": "2026-10-14T09:52:42.042582907Z" } }, "answer": "Medplum scores 68.7 (B) on agent readiness against Health Gorilla's 59.3 (C), and leads in every scored category.", "b": { "slug": "medplum", "name": "Medplum", "vendor": "Orangebot, Inc. (dba Medplum)", "vendorUrl": "https://www.medplum.com", "kind": "http-api", "category": "health-data", "summary": "Open-source FHIR R4 server and healthcare developer platform from Orangebot, Inc. (dba Medplum). Agents reach patient records through the hosted FHIR REST API at api.medplum.com, a remote MCP server or a self-hosted copy.", "url": "https://www.anchorterminal.com/tools/medplum", "markdownUrl": "https://www.anchorterminal.com/tools/medplum.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/medplum.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/medplum.json", "repo": "https://github.com/medplum/medplum", "license": "Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service", "transports": [ "http", "streamable-http", "sse" ], "remoteUrl": "https://api.medplum.com/mcp/stream", "packages": [ { "registry": "npm", "name": "@medplum/core" } ], "auth": "oauth", "authNotes": "OAuth 2.0 and OpenID Connect. Machine clients use the client credentials grant with a ClientApplication ID and secret created on the Project Admin page, and a POST to https://api.medplum.com/oauth2/token. SMART scopes and AccessPolicy resources limit what each user, bot or client can read or write, including read-only policies. The MCP server uses OAuth with a browser login on first connect. Client assertion, token exchange, on-behalf-of and mTLS are also documented.", "pricing": "freemium", "pricingNotes": "Hosted plans on medplum.com/pricing (checked 2026-10-14). Free for prototyping, Production $2,000 a month, Premium $6,000 a month, Enterprise by contact. The paid plans include a standard BAA and MSA. Self-hosting the Apache 2.0 server is free. Whether the free plan asks for a card was not established.", "priceSummary": "$2000 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the pricing page or the repository (checked 2026-10-14).", "endpoints": [] }, "toolCount": 3, "popularity": { "githubStars": 2738, "npmWeekly": 269965, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://www.medplum.com/docs", "llmsTxt": "https://www.medplum.com/llms.txt", "registryName": "com.medplum/mcp", "capabilities": [ "health.fhir", "health.records" ], "tags": [ "hosted", "open-source", "self-hosted", "fhir", "mcp", "oauth", "smart-on-fhir", "hipaa", "soc2", "typescript", "llms-txt", "status-page" ], "lastRelease": "2026-10-08", "graded": true, "anchor": { "graded": true, "score": 68.7, "grade": "B", "agentReady": false, "rank": 216, "ranked": true, "rankOf": 1076, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 93, "payments": 25, "reliability": 75, "schema": 82, "security": 74, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": -2, "negativeNotes": [ "2026-07-24: GHSA-m44r-7c5h-m6mj, high severity. The external auth callback accepted redirect URIs that only had to start with a registered one, which could leak authorisation codes cross-origin. Patched in @medplum/core 5.1.6 and disclosed on GitHub (https://github.com/medplum/medplum/security/advisories/GHSA-m44r-7c5h-m6mj). With GHSA-ch8p-j6cm-r7w5 (2 June 2026, client secret exposure in self-hosted dynamic registration), both fixed and disclosed in public, so the deduction is small (-2)." ], "verdict": "Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.", "bestFor": "An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.", "strengths": [ "Apache 2.0 server with releases about weekly, v5.2.3 on 8 October 2026, and a written version policy", "Rate limits published per tier, with a `RateLimit` header giving remaining units and seconds to reset", "AccessPolicy resources and SMART scopes allow read-only, per-resource or per-element clients", "Official MCP server at api.medplum.com/mcp/stream, listed in the MCP registry as com.medplum/mcp, with OAuth", "99.99 per cent monthly SLA with service credits stated for the production hosted platform" ], "weaknesses": [ "The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint", "The privacy policy was last updated on 5 April 2022 and the terms on 11 April 2023", "No sub-processor list or retention periods were found", "Two high-severity auth advisories were published and patched in 2026", "Official SDK in TypeScript only" ], "agentNotes": [ "Use a ClientApplication with an AccessPolicy limited to the resources the task needs, and set `readonly` where no writes are needed", "Read the `RateLimit` header and wait for the reset time after a 429. Writes cost 100 quota points, searches 20 and reads 1", "Create patients with conditional create (`If-None-Exist`) or upsert on an identifier so a retry doesn't make a duplicate", "Pass paths to `fhir-request` relative to the FHIR R4 base, with no leading slash or `/fhir/R4` prefix", "Use `Prefer: respond-async` for large bundles. Operations inside the background job don't count against the quota" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.7 } ], "editorialScores": { "ergonomics": 73, "maintenance": 93, "payments": 25, "reliability": 75, "schema": 82, "security": 74, "transparency": 65 }, "provenanceScore": 78 }, "connect": { "install": "npm install @medplum/core", "http": "curl -X POST https://api.medplum.com/oauth2/token \\\n -H \"Content-Type: application/x-www-form-urlencoded\" \\\n -d \"grant_type=client_credentials\u0026client_id=$MY_CLIENT_ID\u0026client_secret=$MY_CLIENT_SECRET\"" }, "letme": { "capability": "https://letme.dev/health.fhir", "tool": "https://letme.dev/medplum" }, "area": "domain-data", "unitPrices": [ { "item": "Production plan", "unit": "month", "usd": 2000, "note": "Hosted, BAA included, Growth usage tier" }, { "item": "Premium plan", "unit": "month", "usd": 6000, "note": "Hosted, adds lab, medication and HL7 integrations" } ], "provenance": { "legalEntity": "Orangebot, Inc.", "domain": "medplum.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.medplum.com/terms", "privacy": "https://www.medplum.com/privacy", "statusPage": "https://status.medplum.com", "changelog": "https://github.com/medplum/medplum/releases", "securityTxt": "valid", "checked": "2026-10-14", "notes": [ "The pricing and security pages name Orangebot, Inc (dba Medplum).", "www.medplum.com/.well-known/security.txt lists security@medplum.com, a PGP key and expires 2027-02-28.", "robots.txt on api.medplum.com and status.medplum.com disallows every path for all agents, so the status history and the live OpenAPI document were not read.", "The terms of service were last updated 2023-04-11 and the privacy policy 2022-04-05.", "The domain registration date was not established." ], "score": 78 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/medplum.json", "live": { "slug": "medplum", "probe": { "target": "https://api.medplum.com/mcp/stream", "method": "get", "lastAt": "2026-10-14T09:59:54.038439603Z", "lastOk": true, "lastStatus": 401, "lastMs": 262, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 256, "p95ms24h": 342, "samples24h": 20, "samples30d": 20, "days": [ { "date": "2026-10-14", "probes": 20, "ok": 20 } ] }, "vendorStatus": { "page": "https://status.medplum.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:53:23.189127499Z" }, "updatedAt": "2026-10-14T09:59:54.038439603Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Health Gorilla, Inc.", "b": "Orangebot, Inc. (dba Medplum)", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.medplum.com/mcp/stream", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP, Streamable HTTP, SSE (legacy)", "name": "Transports" }, { "a": "OAuth", "b": "OAuth", "name": "Auth" }, { "a": "Paid", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service under Health Gorilla's API Terms of Use (updated 22 January 2026), with a signed licence agreement required before production", "b": "Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service", "name": "Licence" }, { "a": "none", "b": "3", "name": "Tools exposed" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "not listed", "b": "com.medplum/mcp", "name": "MCP registry" }, { "a": "2026-10-14", "b": "2026-10-08", "name": "Last release" }, { "a": "no date given", "b": "2023-04-11", "name": "Terms last updated" }, { "a": "2024-08-30", "b": "2022-04-05", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "2.7k stars, 270k npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Medplum scores 68.7 (B) on agent readiness against Health Gorilla's 59.3 (C), and leads in every scored category.", "question": "Which is better for AI agents, Health Gorilla or Medplum?" }, { "answer": "Both use an OAuth sign-in.", "question": "Do Health Gorilla and Medplum need an API key?" }, { "answer": "No hosted endpoint is listed for Health Gorilla. Medplum has a hosted endpoint at https://api.medplum.com/mcp/stream.", "question": "Can an agent call Health Gorilla and Medplum without installing anything?" }, { "answer": "No open-source release is listed for Health Gorilla. Medplum is open source (Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service).", "question": "Are Health Gorilla and Medplum open source?" } ], "goodFor": [ { "aheadOn": null, "also": null, "goodFor": "US providers, labs and digital health companies that need network record retrieval and lab ordering through one FHIR API with a QHIN behind it.", "slug": "health-gorilla", "watchFor": "No public prices. Fees are set case by case and the sandbox is requested by form" }, { "aheadOn": [ "Reliability, 75 against 58", "Security \u0026 auth, 74 against 66", "Payments \u0026 pricing, 25 against 5", "Maintenance \u0026 community, 93 against 63", "Transparency \u0026 trust, 72 against 61" ], "also": [ "A hosted endpoint, with nothing to install", "Open source" ], "goodFor": "An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.", "slug": "medplum", "watchFor": "The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint" } ], "job": { "capability": "health.records", "name": "Patient record retrieval" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aidbox-vs-health-gorilla.json", "title": "Aidbox vs Health Gorilla", "url": "https://www.anchorterminal.com/compare/aidbox-vs-health-gorilla" }, { "json": "https://www.anchorterminal.com/compare/aidbox-vs-medplum.json", "title": "Aidbox vs Medplum", "url": "https://www.anchorterminal.com/compare/aidbox-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-rook.json", "title": "Health Gorilla vs ROOK", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-rook" }, { "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-terra.json", "title": "Health Gorilla vs Terra API", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-terra" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-metriport.json", "title": "Medplum vs Metriport Medical API", "url": "https://www.anchorterminal.com/compare/medplum-vs-metriport" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-particle-health.json", "title": "Medplum vs Particle Health", "url": "https://www.anchorterminal.com/compare/medplum-vs-particle-health" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-redox.json", "title": "Medplum vs Redox", "url": "https://www.anchorterminal.com/compare/medplum-vs-redox" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-rook.json", "title": "Medplum vs ROOK", "url": "https://www.anchorterminal.com/compare/medplum-vs-rook" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-terra.json", "title": "Medplum vs Terra API", "url": "https://www.anchorterminal.com/compare/medplum-vs-terra" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-zus-health.json", "title": "Medplum vs Zus Health", "url": "https://www.anchorterminal.com/compare/medplum-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/1uphealth-vs-health-gorilla.json", "title": "1upHealth vs Health Gorilla", "url": "https://www.anchorterminal.com/compare/1uphealth-vs-health-gorilla" }, { "json": "https://www.anchorterminal.com/compare/1uphealth-vs-medplum.json", "title": "1upHealth vs Medplum", "url": "https://www.anchorterminal.com/compare/1uphealth-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-medblocks.json", "title": "Health Gorilla vs Medblocks", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-medblocks" }, { "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-metriport.json", "title": "Health Gorilla vs Metriport Medical API", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-metriport" }, { "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-particle-health.json", "title": "Health Gorilla vs Particle Health", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-particle-health" }, { "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-redox.json", "title": "Health Gorilla vs Redox", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-redox" }, { "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-zus-health.json", "title": "Health Gorilla vs Zus Health", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/medblocks-vs-medplum.json", "title": "Medblocks vs Medplum", "url": "https://www.anchorterminal.com/compare/medblocks-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-validic.json", "title": "Health Gorilla vs Validic Inform", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-validic" } ], "scores": [ { "by": 17, "edge": "medplum", "health-gorilla": 58, "key": "reliability", "medplum": 75, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 2, "edge": "medplum", "health-gorilla": 80, "key": "schema", "medplum": 82, "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 1, "edge": "medplum", "health-gorilla": 72, "key": "ergonomics", "medplum": 73, "name": "Agent ergonomics", "weight": 13 }, { "by": 8, "edge": "medplum", "health-gorilla": 66, "key": "security", "medplum": 74, "name": "Security \u0026 auth", "weight": 14 }, { "by": 20, "edge": "medplum", "health-gorilla": 5, "key": "payments", "medplum": 25, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 30, "edge": "medplum", "health-gorilla": 63, "key": "maintenance", "medplum": 93, "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 11, "edge": "medplum", "health-gorilla": 61, "key": "transparency", "medplum": 72, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Medplum scores 68.7 (B) on agent readiness against Health Gorilla's 59.3 (C), and leads in every scored category. Both do patient record retrieval.", "verdicts": { "health-gorilla": "A TEFCA QHIN with a FHIR R4 API, OpenAPI fragments on every reference page, idempotency keys on POST and dated weekly release notes. Access is sales-led, with case-by-case fees, a sandbox by request and no published rate limit numbers, and the API terms allow access to be cut at any time.", "medplum": "Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/health-gorilla-vs-medplum", "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-medplum.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/health-gorilla-vs-medplum.md", "slim": "https://www.anchorterminal.com/compare/health-gorilla-vs-medplum.min.md" }, "markdown": "Medplum scores 68.7 (B) on agent readiness against Health Gorilla's 59.3 (C), and leads in every scored category. Both do patient record retrieval.\n\n- Health Gorilla: grade C, 59.3/100, rank #583 of 1076. Markdown https://www.anchorterminal.com/tools/health-gorilla.md · JSON https://www.anchorterminal.com/api/v1/tools/health-gorilla.json\n- Medplum: grade B, 68.7/100, rank #216 of 1076. Markdown https://www.anchorterminal.com/tools/medplum.md · JSON https://www.anchorterminal.com/api/v1/tools/medplum.json\n- Best health record and wellness data APIs for AI agents: https://www.anchorterminal.com/best/health-data/index.md\n- All 63 health comparisons: https://www.anchorterminal.com/compare/health-data/index.md\n\n## Which one, for what\n\n### Health Gorilla (C)\n\nGood for: US providers, labs and digital health companies that need network record retrieval and lab ordering through one FHIR API with a QHIN behind it.\n\nWatch for: No public prices. Fees are set case by case and the sandbox is requested by form\n\n### Medplum (B)\n\nGood for: An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.\n\nAhead on:\n- Reliability, 75 against 58\n- Security \u0026 auth, 74 against 66\n- Payments \u0026 pricing, 25 against 5\n- Maintenance \u0026 community, 93 against 63\n- Transparency \u0026 trust, 72 against 61\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Open source\n\nWatch for: The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint\n\n\n## Score by category\n\n| Category | Weight | Health Gorilla | Medplum | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 58 | 75 | Medplum +17 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 80 | 82 | Medplum +2 |\n| Agent ergonomics | 13% (16.2 this run) | 72 | 73 | Medplum +1 |\n| Security \u0026 auth | 14% (17.5 this run) | 66 | 74 | Medplum +8 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 5 | 25 | Medplum +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 63 | 93 | Medplum +30 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 61 | 72 | Medplum +11 |\n| Negative events | ≤15 | 0 | -2 | |\n| **Total** | | **59.3 · C** | **68.7 · B** | |\n\n## Facts side by side\n\n| Fact | Health Gorilla | Medplum |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Health Gorilla, Inc. | Orangebot, Inc. (dba Medplum) |\n| Hosted endpoint | no (local only) | `https://api.medplum.com/mcp/stream` |\n| Transports | HTTP | HTTP, Streamable HTTP, SSE (legacy) |\n| Auth | OAuth | OAuth |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | Proprietary service under Health Gorilla's API Terms of Use (updated 22 January 2026), with a signed licence agreement required before production | Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service |\n| Tools exposed | none | 3 |\n| Read-only variant documented | no | yes |\n| llms.txt | yes | yes |\n| MCP registry | not listed | `com.medplum/mcp` |\n| Last release | 2026-10-14 | 2026-10-08 |\n| Terms last updated | no date given | 2023-04-11 |\n| Privacy policy last updated | 2024-08-30 | 2022-04-05 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | yes | not found in the text |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | none | 2.7k stars, 270k npm/wk |\n\n## Verdicts\n\n**Health Gorilla.** A TEFCA QHIN with a FHIR R4 API, OpenAPI fragments on every reference page, idempotency keys on POST and dated weekly release notes. Access is sales-led, with case-by-case fees, a sandbox by request and no published rate limit numbers, and the API terms allow access to be cut at any time.\n\n**Medplum.** Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.\n\n## Before you call either\n\n### Health Gorilla\n\n1. Send a fresh UUID in `HG-Idempotency-Key` on every POST and reuse it only when retrying the same payload\n2. Poll async operations no sooner than the `Retry-After` value and treat 454 as an expired result\n3. Follow `link.relation=next` in Bundles rather than building offsets yourself\n4. Expect mocked Patient360 data in sandbox unless network connectivity is enabled for the tenant\n5. Log `X-HG-Request-Id` from each response for support cases\n\n### Medplum\n\n1. Use a ClientApplication with an AccessPolicy limited to the resources the task needs, and set `readonly` where no writes are needed\n2. Read the `RateLimit` header and wait for the reset time after a 429. Writes cost 100 quota points, searches 20 and reads 1\n3. Create patients with conditional create (`If-None-Exist`) or upsert on an identifier so a retry doesn't make a duplicate\n4. Pass paths to `fhir-request` relative to the FHIR R4 base, with no leading slash or `/fhir/R4` prefix\n5. Use `Prefer: respond-async` for large bundles. Operations inside the background job don't count against the quota\n\n## Questions\n\n### Which is better for AI agents, Health Gorilla or Medplum?\n\nMedplum scores 68.7 (B) on agent readiness against Health Gorilla's 59.3 (C), and leads in every scored category.\n\n### Do Health Gorilla and Medplum need an API key?\n\nBoth use an OAuth sign-in.\n\n### Can an agent call Health Gorilla and Medplum without installing anything?\n\nNo hosted endpoint is listed for Health Gorilla. Medplum has a hosted endpoint at https://api.medplum.com/mcp/stream.\n\n### Are Health Gorilla and Medplum open source?\n\nNo open-source release is listed for Health Gorilla. Medplum is open source (Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/health-gorilla-vs-medplum.json, and with the fewest tokens: https://www.anchorterminal.com/compare/health-gorilla-vs-medplum.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"health-gorilla\", \"b\": \"medplum\"}`. From a terminal: `anchor compare health-gorilla medplum`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/health-gorilla.json and https://www.anchorterminal.com/api/v1/tools/medplum.json\n\n## Other comparisons with Health Gorilla or Medplum\n\n- [Aidbox vs Health Gorilla](https://www.anchorterminal.com/compare/aidbox-vs-health-gorilla.md)\n- [Aidbox vs Medplum](https://www.anchorterminal.com/compare/aidbox-vs-medplum.md)\n- [Health Gorilla vs ROOK](https://www.anchorterminal.com/compare/health-gorilla-vs-rook.md)\n- [Health Gorilla vs Terra API](https://www.anchorterminal.com/compare/health-gorilla-vs-terra.md)\n- [Medplum vs Metriport Medical API](https://www.anchorterminal.com/compare/medplum-vs-metriport.md)\n- [Medplum vs Particle Health](https://www.anchorterminal.com/compare/medplum-vs-particle-health.md)\n- [Medplum vs Redox](https://www.anchorterminal.com/compare/medplum-vs-redox.md)\n- [Medplum vs ROOK](https://www.anchorterminal.com/compare/medplum-vs-rook.md)\n- [Medplum vs Terra API](https://www.anchorterminal.com/compare/medplum-vs-terra.md)\n- [Medplum vs Zus Health](https://www.anchorterminal.com/compare/medplum-vs-zus-health.md)\n- [1upHealth vs Health Gorilla](https://www.anchorterminal.com/compare/1uphealth-vs-health-gorilla.md)\n- [1upHealth vs Medplum](https://www.anchorterminal.com/compare/1uphealth-vs-medplum.md)\n- [Health Gorilla vs Medblocks](https://www.anchorterminal.com/compare/health-gorilla-vs-medblocks.md)\n- [Health Gorilla vs Metriport Medical API](https://www.anchorterminal.com/compare/health-gorilla-vs-metriport.md)\n- [Health Gorilla vs Particle Health](https://www.anchorterminal.com/compare/health-gorilla-vs-particle-health.md)\n- [Health Gorilla vs Redox](https://www.anchorterminal.com/compare/health-gorilla-vs-redox.md)\n- [Health Gorilla vs Zus Health](https://www.anchorterminal.com/compare/health-gorilla-vs-zus-health.md)\n- [Medblocks vs Medplum](https://www.anchorterminal.com/compare/medblocks-vs-medplum.md)\n- [Health Gorilla vs Validic Inform](https://www.anchorterminal.com/compare/health-gorilla-vs-validic.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Health Gorilla vs Medplum", "url": "" } ], "description": "Medplum scores 68.7 (B) to Health Gorilla's 59.3 (C) for patient record retrieval. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Health Gorilla C 59.3", "Medplum B 68.7", "scores" ], "h1": "Health Gorilla vs Medplum", "image": "https://www.anchorterminal.com/assets/og/compare-health-gorilla-vs-medplum.png", "path": "/compare/health-gorilla-vs-medplum", "published": "2026-10-01", "section": "tools", "title": "Health Gorilla vs Medplum for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-10-14", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-medplum" }, "tokens": { "markdown": 2350, "slim": 680 }, "version": 1 }