Write a review

Head to head · Patient consent · October 2026 research run

Medblocks vs ROOK

ROOK scores 54.9 (C) on agent readiness against Medblocks's 52.7 (D), and leads in 4 of 7 scored categories. Medblocks leads on agent ergonomics and security & auth. Both do patient consent.

Best health record and wellness data APIs for AI agents · All 63 health comparisons

MedblocksMedblocks Inc. · HTTP API D52.7/100#773 of 1076 ROOKRookeries Development Corp. · HTTP API C54.9/100#718 of 1076

Which one, for what

Medblocks D

Best for A consumer or care app, or an assistant, that needs a patient's own records from US hospitals and payers with the patient's consent, and wants an MCP route as well as REST.

Ahead on

  • Agent ergonomics, 72 against 49
  • Security & auth, 67 against 32

Also in its favour

  • A hosted endpoint, with nothing to install

Watch for

No status page, SLA or published rate limits for the Platform API

ROOK C

Best for A wellness, insurance, corporate wellness or remote monitoring product that wants normalised wearable data pushed to its backend, with plan prices it can see up front.

Ahead on

  • Reliability, 75 against 28
  • Schema & documentation, 74 against 62

Watch for

Credentials are one client UUID and secret per environment, sent by Basic auth, with no scopes or rotation documented

Score by category

CategoryWeight this runMedblocksROOKEdge
Reliability16%202875ROOK +47
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.26274ROOK +12
Agent ergonomics13%16.27249Medblocks +23
Security & auth14%17.56732Medblocks +35
Payments & pricing10%12.52525even
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.86973ROOK +4
Transparency & trust7%8.85155ROOK +4
Negative events≤1500
TotalD 52.7/100C 54.9/100

Facts side by side

FactMedblocksROOK
KindHTTP APIHTTP API
VendorMedblocks Inc.Rookeries Development Corp.
Hosted endpointhttps://app.medblocks.com/mcpno (local only)
TransportsHTTP, Streamable HTTPHTTP
AuthOAuth or keyAPI key
PricingFreemiumPaid
x402nono
LicenceProprietary service under Medblocks' terms. The medblocks TypeScript SDK on npm carries a proprietary licence that forbids redistribution and reverse engineering. The agent skills repository has no licence fileProprietary service under ROOK's Terms and Conditions for ROOK services
Tools exposed10none
Read-only variant documentednono
llms.txtyesyes
Last release2026-09-142026-10-07
Terms last updated2026-10-052026-08-01
Privacy policy last updated2026-10-052026-05-28
Customer content may train modelsnot found in the textnot found in the text
Terms restrict automated accessyesnot found in the text
Terms restrict benchmarkingyesyes
Terms or service can change without noticeyesnot found in the text
Arbitration or class-action waivernot found in the textyes
Popularity36 npm/wknone

Verdicts

Medblocks

Patient-authorised record retrieval with a ten-tool remote MCP server, OAuth with per-capability consent, an audit entry for every call and a free plan for 1,000 active patients. No status page, no published rate limits and no idempotency keys were found, and the OpenAPI file behind the reference is not published.

ROOK

Graded on the REST API. A public OpenAPI file, a free Sandbox from the self-serve portal, published plan prices and a dated changelog. Credentials are one client UUID and secret per environment with no scopes, 429 handling isn't documented, the API is meant for occasional queries rather than bulk reads, and no SOC 2 report or security contact was found.

Before you call either

Medblocks

  1. Connect with claude mcp add --transport http medblocks https://app.medblocks.com/mcp and sign in, or send a workspace API key as a Bearer token from a backend
  2. Ask the person before calling disconnect_health_system or delete_person. Both are permanent
  3. Wait for the connection webhook or check connection status before reading records. Pulls run in the background after the patient approves
  4. Branch on error.code, not the message, and wait the Retry-After seconds on a 429
  5. Use a Sandbox workspace and the Synthetic Hospital (password demopass) for tests. Sandbox keys cannot reach production sources

ROOK

  1. Send HTTP Basic auth with client_uuid as the username and the secret key as the password, plus a User-Agent header, or the WAF returns 403
  2. Use https://api.rook-connect.review for Sandbox and https://api.rook-connect.com for production. Each has its own credentials
  3. Read health data from the data webhook. Use the API only for occasional queries, and stay under 60 requests a minute
  4. Deduplicate summaries on document_version and datetime. ROOK resends a summary with a higher document_version when it changes
  5. Call POST /api/v1/user_id/{user_id}/data_sources/revoke_auth to end a connection. Some providers take hours to stop sending data

Questions

Which is better for AI agents, Medblocks or ROOK?

ROOK scores 54.9 (C) on agent readiness against Medblocks's 52.7 (D), and leads in 4 of 7 scored categories. Medblocks leads on agent ergonomics and security & auth.

Do Medblocks and ROOK need an API key?

Medblocks takes an API key or an OAuth sign-in. ROOK needs an API key.

Can an agent call Medblocks and ROOK without installing anything?

Medblocks has a hosted endpoint at https://app.medblocks.com/mcp. No hosted endpoint is listed for ROOK.

Other comparisons with Medblocks or ROOK

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report