{ "data": { "a": { "slug": "medplum", "name": "Medplum", "vendor": "Orangebot, Inc. (dba Medplum)", "vendorUrl": "https://www.medplum.com", "kind": "http-api", "category": "health-data", "summary": "Open-source FHIR R4 server and healthcare developer platform from Orangebot, Inc. (dba Medplum). Agents reach patient records through the hosted FHIR REST API at api.medplum.com, a remote MCP server or a self-hosted copy.", "url": "https://www.anchorterminal.com/tools/medplum", "markdownUrl": "https://www.anchorterminal.com/tools/medplum.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/medplum.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/medplum.json", "repo": "https://github.com/medplum/medplum", "license": "Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service", "transports": [ "http", "streamable-http", "sse" ], "remoteUrl": "https://api.medplum.com/mcp/stream", "packages": [ { "registry": "npm", "name": "@medplum/core" } ], "auth": "oauth", "authNotes": "OAuth 2.0 and OpenID Connect. Machine clients use the client credentials grant with a ClientApplication ID and secret created on the Project Admin page, and a POST to https://api.medplum.com/oauth2/token. SMART scopes and AccessPolicy resources limit what each user, bot or client can read or write, including read-only policies. The MCP server uses OAuth with a browser login on first connect. Client assertion, token exchange, on-behalf-of and mTLS are also documented.", "pricing": "freemium", "pricingNotes": "Hosted plans on medplum.com/pricing (checked 2026-10-14). Free for prototyping, Production $2,000 a month, Premium $6,000 a month, Enterprise by contact. The paid plans include a standard BAA and MSA. Self-hosting the Apache 2.0 server is free. Whether the free plan asks for a card was not established.", "priceSummary": "$2000 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the pricing page or the repository (checked 2026-10-14).", "endpoints": [] }, "toolCount": 3, "popularity": { "githubStars": 2738, "npmWeekly": 269965, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://www.medplum.com/docs", "llmsTxt": "https://www.medplum.com/llms.txt", "registryName": "com.medplum/mcp", "capabilities": [ "health.fhir", "health.records" ], "tags": [ "hosted", "open-source", "self-hosted", "fhir", "mcp", "oauth", "smart-on-fhir", "hipaa", "soc2", "typescript", "llms-txt", "status-page" ], "lastRelease": "2026-10-08", "graded": true, "anchor": { "graded": true, "score": 68.7, "grade": "B", "agentReady": false, "rank": 216, "ranked": true, "rankOf": 1076, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 93, "payments": 25, "reliability": 75, "schema": 82, "security": 74, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": -2, "negativeNotes": [ "2026-07-24: GHSA-m44r-7c5h-m6mj, high severity. The external auth callback accepted redirect URIs that only had to start with a registered one, which could leak authorisation codes cross-origin. Patched in @medplum/core 5.1.6 and disclosed on GitHub (https://github.com/medplum/medplum/security/advisories/GHSA-m44r-7c5h-m6mj). With GHSA-ch8p-j6cm-r7w5 (2 June 2026, client secret exposure in self-hosted dynamic registration), both fixed and disclosed in public, so the deduction is small (-2)." ], "verdict": "Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.", "bestFor": "An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.", "strengths": [ "Apache 2.0 server with releases about weekly, v5.2.3 on 8 October 2026, and a written version policy", "Rate limits published per tier, with a `RateLimit` header giving remaining units and seconds to reset", "AccessPolicy resources and SMART scopes allow read-only, per-resource or per-element clients", "Official MCP server at api.medplum.com/mcp/stream, listed in the MCP registry as com.medplum/mcp, with OAuth", "99.99 per cent monthly SLA with service credits stated for the production hosted platform" ], "weaknesses": [ "The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint", "The privacy policy was last updated on 5 April 2022 and the terms on 11 April 2023", "No sub-processor list or retention periods were found", "Two high-severity auth advisories were published and patched in 2026", "Official SDK in TypeScript only" ], "agentNotes": [ "Use a ClientApplication with an AccessPolicy limited to the resources the task needs, and set `readonly` where no writes are needed", "Read the `RateLimit` header and wait for the reset time after a 429. Writes cost 100 quota points, searches 20 and reads 1", "Create patients with conditional create (`If-None-Exist`) or upsert on an identifier so a retry doesn't make a duplicate", "Pass paths to `fhir-request` relative to the FHIR R4 base, with no leading slash or `/fhir/R4` prefix", "Use `Prefer: respond-async` for large bundles. Operations inside the background job don't count against the quota" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.7 } ], "editorialScores": { "ergonomics": 73, "maintenance": 93, "payments": 25, "reliability": 75, "schema": 82, "security": 74, "transparency": 65 }, "provenanceScore": 78 }, "connect": { "install": "npm install @medplum/core", "http": "curl -X POST https://api.medplum.com/oauth2/token \\\n -H \"Content-Type: application/x-www-form-urlencoded\" \\\n -d \"grant_type=client_credentials\u0026client_id=$MY_CLIENT_ID\u0026client_secret=$MY_CLIENT_SECRET\"" }, "letme": { "capability": "https://letme.dev/health.fhir", "tool": "https://letme.dev/medplum" }, "area": "domain-data", "unitPrices": [ { "item": "Production plan", "unit": "month", "usd": 2000, "note": "Hosted, BAA included, Growth usage tier" }, { "item": "Premium plan", "unit": "month", "usd": 6000, "note": "Hosted, adds lab, medication and HL7 integrations" } ], "provenance": { "legalEntity": "Orangebot, Inc.", "domain": "medplum.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.medplum.com/terms", "privacy": "https://www.medplum.com/privacy", "statusPage": "https://status.medplum.com", "changelog": "https://github.com/medplum/medplum/releases", "securityTxt": "valid", "checked": "2026-10-14", "notes": [ "The pricing and security pages name Orangebot, Inc (dba Medplum).", "www.medplum.com/.well-known/security.txt lists security@medplum.com, a PGP key and expires 2027-02-28.", "robots.txt on api.medplum.com and status.medplum.com disallows every path for all agents, so the status history and the live OpenAPI document were not read.", "The terms of service were last updated 2023-04-11 and the privacy policy 2022-04-05.", "The domain registration date was not established." ], "score": 78 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/medplum.json", "live": { "slug": "medplum", "probe": { "target": "https://api.medplum.com/mcp/stream", "method": "get", "lastAt": "2026-10-14T09:41:57.409301454Z", "lastOk": true, "lastStatus": 401, "lastMs": 255, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 256, "p95ms24h": 389, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 17 } ] }, "vendorStatus": { "page": "https://status.medplum.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:53:23.189127499Z" }, "updatedAt": "2026-10-14T09:41:57.409301454Z" } }, "answer": "Medplum scores 68.7 (B) on agent readiness against Metriport Medical API's 50.1 (D), and leads in every scored category.", "b": { "slug": "metriport", "name": "Metriport Medical API", "vendor": "Metriport Inc.", "vendorUrl": "https://www.metriport.com", "kind": "http-api", "category": "health-data", "summary": "Metriport's Medical API retrieves a patient's records from US health information exchanges, pharmacies and labs, converts them to deduplicated FHIR, and returns them through a REST API with webhooks. Production use requires a covered entity with an NPI.", "url": "https://www.anchorterminal.com/tools/metriport", "markdownUrl": "https://www.anchorterminal.com/tools/metriport.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/metriport.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/metriport.json", "repo": "https://github.com/metriport/metriport", "license": "Proprietary hosted service under Metriport's terms of use. The source in metriport/metriport is AGPLv3, with an enterprise directory under its own licence, and the @metriport/api-sdk package on npm is MIT", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@metriport/api-sdk" } ], "auth": "api-key", "authNotes": "Every request sends a key in the `x-api-key` header to https://api.metriport.com, or https://api.sandbox.metriport.com in sandbox mode. Keys are generated in the developer dashboard after Metriport approves the account, up to two at once for rotation, each revocable at once and each with full access including destructive operations. No scopes or read-only key were found. Production access needs a covered entity with an NPI and a treatment purpose of use, agreed on an intro call.", "pricing": "paid", "pricingNotes": "No public prices. metriport.com has no pricing page, the terms say some services carry a fee paid by card, wire or Stripe, and production access starts with an intro call booked from the dashboard. A sandbox with example patients opens once Metriport approves the access request, and its cost is not stated (checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation, llms.txt, the repository README or the terms (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 793, "npmWeekly": 28168, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.metriport.com/medical-api/getting-started/quickstart", "llmsTxt": "https://docs.metriport.com/llms.txt", "capabilities": [ "health.records", "health.fhir", "health.consent", "health.ehr" ], "tags": [ "hosted", "health-records", "fhir", "open-source", "agpl", "typescript", "llms-txt", "webhooks", "status-page", "sales-led", "hitrust", "soc2" ], "lastRelease": "2026-09-28", "graded": true, "anchor": { "graded": true, "score": 50.1, "grade": "D", "agentReady": false, "rank": 833, "ranked": true, "rankOf": 1076, "categoryRank": 10, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 70, "maintenance": 74, "payments": 5, "reliability": 45, "schema": 65, "security": 41, "transparency": 56 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "One network query pulls a patient's records from HIEs, pharmacies and labs and returns deduplicated FHIR, with per-operation rate limits, RFC 7807 errors and AGPLv3 source. Each API key has full access with no scopes, there are no public prices, and the sandbox opens only after Metriport approves the account.", "bestFor": "US care providers and digital health companies that need a patient's network records as FHIR with webhooks.", "strengths": [ "One asynchronous network query covers HIEs, pharmacies and labs, with a webhook as each source is merged", "Consolidated FHIR output is deduplicated and coded, with PDF or HTML record summaries", "Rate limits published per operation, and `count` up to 500 per page", "AGPLv3 source on GitHub and an MIT TypeScript SDK released on 28 September 2026" ], "weaknesses": [ "Every API key has full access, including destructive operations, with no scopes", "No public prices, and the sandbox needs Metriport's approval first", "The Fern definition covers only part of the API and no public changelog was found", "The status page renders only with JavaScript, so its history could not be read" ], "agentNotes": [ "Check the `errors` array after Start Network Query. It returns 2XX even when some sources fail", "Wait for `network-query.*` webhooks or poll Get Network Query Status before reading consolidated data, which is cached from the last query", "Send the resource's `eTag` in `If-Match` on updates to avoid overwriting newer data", "Keep patient creates under 15 a minute and network queries under 20 a minute per source", "In sandbox, create patients whose first name matches a pre-defined persona to get example records" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 50.1 } ], "editorialScores": { "ergonomics": 70, "maintenance": 74, "payments": 5, "reliability": 45, "schema": 65, "security": 41, "transparency": 43 }, "provenanceScore": 69 }, "connect": { "install": "npm install --save @metriport/api-sdk", "http": "POST https://api.sandbox.metriport.com/medical/v1/patient?facilityId=\u003cfacility-id\u003e\nx-api-key: \u003capi-key\u003e\nContent-Type: application/json" }, "letme": { "capability": "https://letme.dev/health.records", "tool": "https://letme.dev/metriport" }, "area": "domain-data", "provenance": { "legalEntity": "Metriport Inc.", "domain": "metriport.com", "domainRegistered": "2021-02-09", "endpointOnVendorDomain": true, "terms": "https://www.metriport.com/terms", "privacy": "https://www.metriport.com/privacy-policy", "statusPage": "https://status.metriport.com", "changelog": "", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The terms of use (last updated January 2024) give a registered office at 2261 Market Street #4818, San Francisco, CA 94114, forbid access 'through automated or non-human means' and the use of 'data mining, robots, or similar data gathering and extraction tools', and say the site is not built for HIPAA-regulated use. We read them as a fact and fetched only what robots.txt allows.", "The privacy policy (last updated 21 February 2023) covers website visitors and customer contacts, says data is stored in the US, and does not mention API data or PHI.", "www.metriport.com/.well-known/security.txt returns 404. SECURITY.md in the repository sends reports to GitHub's vulnerability reporting or support@metriport.com.", "No public changelog was found in the documentation or on the website.", "RDAP gives metriport.com a registration date of 2021-02-09." ], "score": 69 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/metriport.json", "live": { "slug": "metriport", "vendorStatus": { "page": "https://status.metriport.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:53:23.949542071Z" }, "updatedAt": "2026-10-14T08:53:23.949542071Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Orangebot, Inc. (dba Medplum)", "b": "Metriport Inc.", "name": "Vendor" }, { "a": "https://api.medplum.com/mcp/stream", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, SSE (legacy)", "b": "HTTP", "name": "Transports" }, { "a": "OAuth", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Paid", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service", "b": "Proprietary hosted service under Metriport's terms of use. The source in metriport/metriport is AGPLv3, with an enterprise directory under its own licence, and the @metriport/api-sdk package on npm is MIT", "name": "Licence" }, { "a": "3", "b": "none", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "com.medplum/mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-10-08", "b": "2026-09-28", "name": "Last release" }, { "a": "2023-04-11", "b": "2024-01-01", "name": "Terms last updated" }, { "a": "2022-04-05", "b": "2023-02-21", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "2.7k stars, 270k npm/wk", "b": "793 stars, 28k npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Medplum scores 68.7 (B) on agent readiness against Metriport Medical API's 50.1 (D), and leads in every scored category.", "question": "Which is better for AI agents, Medplum or Metriport Medical API?" }, { "answer": "Medplum uses an OAuth sign-in. Metriport Medical API needs an API key.", "question": "Do Medplum and Metriport Medical API need an API key?" }, { "answer": "Medplum has a hosted endpoint at https://api.medplum.com/mcp/stream. No hosted endpoint is listed for Metriport Medical API.", "question": "Can an agent call Medplum and Metriport Medical API without installing anything?" }, { "answer": "Yes. Medplum is open source (Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service). Metriport Medical API is open source (Proprietary hosted service under Metriport's terms of use. The source in metriport/metriport is AGPLv3, with an enterprise directory under its own licence, and the @metriport/api-sdk package on npm is MIT).", "question": "Are Medplum and Metriport Medical API open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 75 against 45", "Schema \u0026 documentation, 82 against 65", "Security \u0026 auth, 74 against 41", "Payments \u0026 pricing, 25 against 5", "Maintenance \u0026 community, 93 against 74", "Transparency \u0026 trust, 72 against 56" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.", "slug": "medplum", "watchFor": "The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint" }, { "aheadOn": null, "also": null, "goodFor": "US care providers and digital health companies that need a patient's network records as FHIR with webhooks.", "slug": "metriport", "watchFor": "Every API key has full access, including destructive operations, with no scopes" } ], "job": { "capability": "health.fhir", "name": "FHIR servers" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aidbox-vs-medplum.json", "title": "Aidbox vs Medplum", "url": "https://www.anchorterminal.com/compare/aidbox-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/aidbox-vs-metriport.json", "title": "Aidbox vs Metriport Medical API", "url": "https://www.anchorterminal.com/compare/aidbox-vs-metriport" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-particle-health.json", "title": "Medplum vs Particle Health", "url": "https://www.anchorterminal.com/compare/medplum-vs-particle-health" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-redox.json", "title": "Medplum vs Redox", "url": "https://www.anchorterminal.com/compare/medplum-vs-redox" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-rook.json", "title": "Medplum vs ROOK", "url": "https://www.anchorterminal.com/compare/medplum-vs-rook" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-terra.json", "title": "Medplum vs Terra API", "url": "https://www.anchorterminal.com/compare/medplum-vs-terra" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-zus-health.json", "title": "Medplum vs Zus Health", "url": "https://www.anchorterminal.com/compare/medplum-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/metriport-vs-rook.json", "title": "Metriport Medical API vs ROOK", "url": "https://www.anchorterminal.com/compare/metriport-vs-rook" }, { "json": "https://www.anchorterminal.com/compare/metriport-vs-terra.json", "title": "Metriport Medical API vs Terra API", "url": "https://www.anchorterminal.com/compare/metriport-vs-terra" }, { "json": "https://www.anchorterminal.com/compare/1uphealth-vs-medplum.json", "title": "1upHealth vs Medplum", "url": "https://www.anchorterminal.com/compare/1uphealth-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/1uphealth-vs-metriport.json", "title": "1upHealth vs Metriport Medical API", "url": "https://www.anchorterminal.com/compare/1uphealth-vs-metriport" }, { "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-medplum.json", "title": "Health Gorilla vs Medplum", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-metriport.json", "title": "Health Gorilla vs Metriport Medical API", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-metriport" }, { "json": "https://www.anchorterminal.com/compare/medblocks-vs-medplum.json", "title": "Medblocks vs Medplum", "url": "https://www.anchorterminal.com/compare/medblocks-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/medblocks-vs-metriport.json", "title": "Medblocks vs Metriport Medical API", "url": "https://www.anchorterminal.com/compare/medblocks-vs-metriport" }, { "json": "https://www.anchorterminal.com/compare/metriport-vs-particle-health.json", "title": "Metriport Medical API vs Particle Health", "url": "https://www.anchorterminal.com/compare/metriport-vs-particle-health" }, { "json": "https://www.anchorterminal.com/compare/metriport-vs-redox.json", "title": "Metriport Medical API vs Redox", "url": "https://www.anchorterminal.com/compare/metriport-vs-redox" }, { "json": "https://www.anchorterminal.com/compare/metriport-vs-zus-health.json", "title": "Metriport Medical API vs Zus Health", "url": "https://www.anchorterminal.com/compare/metriport-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/metriport-vs-validic.json", "title": "Metriport Medical API vs Validic Inform", "url": "https://www.anchorterminal.com/compare/metriport-vs-validic" } ], "scores": [ { "by": 30, "edge": "medplum", "key": "reliability", "medplum": 75, "metriport": 45, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 17, "edge": "medplum", "key": "schema", "medplum": 82, "metriport": 65, "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 3, "edge": "medplum", "key": "ergonomics", "medplum": 73, "metriport": 70, "name": "Agent ergonomics", "weight": 13 }, { "by": 33, "edge": "medplum", "key": "security", "medplum": 74, "metriport": 41, "name": "Security \u0026 auth", "weight": 14 }, { "by": 20, "edge": "medplum", "key": "payments", "medplum": 25, "metriport": 5, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 19, "edge": "medplum", "key": "maintenance", "medplum": 93, "metriport": 74, "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 16, "edge": "medplum", "key": "transparency", "medplum": 72, "metriport": 56, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Medplum scores 68.7 (B) on agent readiness against Metriport Medical API's 50.1 (D), and leads in every scored category. Both do fhir servers.", "verdicts": { "medplum": "Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.", "metriport": "One network query pulls a patient's records from HIEs, pharmacies and labs and returns deduplicated FHIR, with per-operation rate limits, RFC 7807 errors and AGPLv3 source. Each API key has full access with no scopes, there are no public prices, and the sandbox opens only after Metriport approves the account." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/medplum-vs-metriport", "json": "https://www.anchorterminal.com/compare/medplum-vs-metriport.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/medplum-vs-metriport.md", "slim": "https://www.anchorterminal.com/compare/medplum-vs-metriport.min.md" }, "markdown": "Medplum scores 68.7 (B) on agent readiness against Metriport Medical API's 50.1 (D), and leads in every scored category. Both do fhir servers.\n\n- Medplum: grade B, 68.7/100, rank #216 of 1076. Markdown https://www.anchorterminal.com/tools/medplum.md · JSON https://www.anchorterminal.com/api/v1/tools/medplum.json\n- Metriport Medical API: grade D, 50.1/100, rank #833 of 1076. Markdown https://www.anchorterminal.com/tools/metriport.md · JSON https://www.anchorterminal.com/api/v1/tools/metriport.json\n- Best health record and wellness data APIs for AI agents: https://www.anchorterminal.com/best/health-data/index.md\n- All 63 health comparisons: https://www.anchorterminal.com/compare/health-data/index.md\n\n## Which one, for what\n\n### Medplum (B)\n\nGood for: An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.\n\nAhead on:\n- Reliability, 75 against 45\n- Schema \u0026 documentation, 82 against 65\n- Security \u0026 auth, 74 against 41\n- Payments \u0026 pricing, 25 against 5\n- Maintenance \u0026 community, 93 against 74\n- Transparency \u0026 trust, 72 against 56\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint\n\n### Metriport Medical API (D)\n\nGood for: US care providers and digital health companies that need a patient's network records as FHIR with webhooks.\n\nWatch for: Every API key has full access, including destructive operations, with no scopes\n\n\n## Score by category\n\n| Category | Weight | Medplum | Metriport Medical API | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 75 | 45 | Medplum +30 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 82 | 65 | Medplum +17 |\n| Agent ergonomics | 13% (16.2 this run) | 73 | 70 | Medplum +3 |\n| Security \u0026 auth | 14% (17.5 this run) | 74 | 41 | Medplum +33 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 25 | 5 | Medplum +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 93 | 74 | Medplum +19 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 72 | 56 | Medplum +16 |\n| Negative events | ≤15 | -2 | 0 | |\n| **Total** | | **68.7 · B** | **50.1 · D** | |\n\n## Facts side by side\n\n| Fact | Medplum | Metriport Medical API |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Orangebot, Inc. (dba Medplum) | Metriport Inc. |\n| Hosted endpoint | `https://api.medplum.com/mcp/stream` | no (local only) |\n| Transports | HTTP, Streamable HTTP, SSE (legacy) | HTTP |\n| Auth | OAuth | API key |\n| Pricing | Freemium | Paid |\n| x402 | no | no |\n| Licence | Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service | Proprietary hosted service under Metriport's terms of use. The source in metriport/metriport is AGPLv3, with an enterprise directory under its own licence, and the @metriport/api-sdk package on npm is MIT |\n| Tools exposed | 3 | none |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| MCP registry | `com.medplum/mcp` | not listed |\n| Last release | 2026-10-08 | 2026-09-28 |\n| Terms last updated | 2023-04-11 | 2024-01-01 |\n| Privacy policy last updated | 2022-04-05 | 2023-02-21 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | yes |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | yes | yes |\n| Popularity | 2.7k stars, 270k npm/wk | 793 stars, 28k npm/wk |\n\n## Verdicts\n\n**Medplum.** Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.\n\n**Metriport Medical API.** One network query pulls a patient's records from HIEs, pharmacies and labs and returns deduplicated FHIR, with per-operation rate limits, RFC 7807 errors and AGPLv3 source. Each API key has full access with no scopes, there are no public prices, and the sandbox opens only after Metriport approves the account.\n\n## Before you call either\n\n### Medplum\n\n1. Use a ClientApplication with an AccessPolicy limited to the resources the task needs, and set `readonly` where no writes are needed\n2. Read the `RateLimit` header and wait for the reset time after a 429. Writes cost 100 quota points, searches 20 and reads 1\n3. Create patients with conditional create (`If-None-Exist`) or upsert on an identifier so a retry doesn't make a duplicate\n4. Pass paths to `fhir-request` relative to the FHIR R4 base, with no leading slash or `/fhir/R4` prefix\n5. Use `Prefer: respond-async` for large bundles. Operations inside the background job don't count against the quota\n\n### Metriport Medical API\n\n1. Check the `errors` array after Start Network Query. It returns 2XX even when some sources fail\n2. Wait for `network-query.*` webhooks or poll Get Network Query Status before reading consolidated data, which is cached from the last query\n3. Send the resource's `eTag` in `If-Match` on updates to avoid overwriting newer data\n4. Keep patient creates under 15 a minute and network queries under 20 a minute per source\n5. In sandbox, create patients whose first name matches a pre-defined persona to get example records\n\n## Questions\n\n### Which is better for AI agents, Medplum or Metriport Medical API?\n\nMedplum scores 68.7 (B) on agent readiness against Metriport Medical API's 50.1 (D), and leads in every scored category.\n\n### Do Medplum and Metriport Medical API need an API key?\n\nMedplum uses an OAuth sign-in. Metriport Medical API needs an API key.\n\n### Can an agent call Medplum and Metriport Medical API without installing anything?\n\nMedplum has a hosted endpoint at https://api.medplum.com/mcp/stream. No hosted endpoint is listed for Metriport Medical API.\n\n### Are Medplum and Metriport Medical API open source?\n\nYes. Medplum is open source (Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service). Metriport Medical API is open source (Proprietary hosted service under Metriport's terms of use. The source in metriport/metriport is AGPLv3, with an enterprise directory under its own licence, and the @metriport/api-sdk package on npm is MIT).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/medplum-vs-metriport.json, and with the fewest tokens: https://www.anchorterminal.com/compare/medplum-vs-metriport.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"medplum\", \"b\": \"metriport\"}`. From a terminal: `anchor compare medplum metriport`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/medplum.json and https://www.anchorterminal.com/api/v1/tools/metriport.json\n\n## Other comparisons with Medplum or Metriport Medical API\n\n- [Aidbox vs Medplum](https://www.anchorterminal.com/compare/aidbox-vs-medplum.md)\n- [Aidbox vs Metriport Medical API](https://www.anchorterminal.com/compare/aidbox-vs-metriport.md)\n- [Medplum vs Particle Health](https://www.anchorterminal.com/compare/medplum-vs-particle-health.md)\n- [Medplum vs Redox](https://www.anchorterminal.com/compare/medplum-vs-redox.md)\n- [Medplum vs ROOK](https://www.anchorterminal.com/compare/medplum-vs-rook.md)\n- [Medplum vs Terra API](https://www.anchorterminal.com/compare/medplum-vs-terra.md)\n- [Medplum vs Zus Health](https://www.anchorterminal.com/compare/medplum-vs-zus-health.md)\n- [Metriport Medical API vs ROOK](https://www.anchorterminal.com/compare/metriport-vs-rook.md)\n- [Metriport Medical API vs Terra API](https://www.anchorterminal.com/compare/metriport-vs-terra.md)\n- [1upHealth vs Medplum](https://www.anchorterminal.com/compare/1uphealth-vs-medplum.md)\n- [1upHealth vs Metriport Medical API](https://www.anchorterminal.com/compare/1uphealth-vs-metriport.md)\n- [Health Gorilla vs Medplum](https://www.anchorterminal.com/compare/health-gorilla-vs-medplum.md)\n- [Health Gorilla vs Metriport Medical API](https://www.anchorterminal.com/compare/health-gorilla-vs-metriport.md)\n- [Medblocks vs Medplum](https://www.anchorterminal.com/compare/medblocks-vs-medplum.md)\n- [Medblocks vs Metriport Medical API](https://www.anchorterminal.com/compare/medblocks-vs-metriport.md)\n- [Metriport Medical API vs Particle Health](https://www.anchorterminal.com/compare/metriport-vs-particle-health.md)\n- [Metriport Medical API vs Redox](https://www.anchorterminal.com/compare/metriport-vs-redox.md)\n- [Metriport Medical API vs Zus Health](https://www.anchorterminal.com/compare/metriport-vs-zus-health.md)\n- [Metriport Medical API vs Validic Inform](https://www.anchorterminal.com/compare/metriport-vs-validic.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Medplum vs Metriport Medical API", "url": "" } ], "description": "Medplum scores 68.7 (B) to Metriport Medical's 50.1 (D) for fhir servers. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Medplum B 68.7", "Metriport Medical API D 50.1", "scores" ], "h1": "Medplum vs Metriport Medical API", "image": "https://www.anchorterminal.com/assets/og/compare-medplum-vs-metriport.png", "path": "/compare/medplum-vs-metriport", "published": "2026-10-01", "section": "tools", "title": "Medplum vs Metriport Medical for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-10-14", "url": "https://www.anchorterminal.com/compare/medplum-vs-metriport" }, "tokens": { "markdown": 2450, "slim": 730 }, "version": 1 }