{ "data": { "a": { "slug": "medplum", "name": "Medplum", "vendor": "Orangebot, Inc. (dba Medplum)", "vendorUrl": "https://www.medplum.com", "kind": "http-api", "category": "health-data", "summary": "Open-source FHIR R4 server and healthcare developer platform from Orangebot, Inc. (dba Medplum). Agents reach patient records through the hosted FHIR REST API at api.medplum.com, a remote MCP server or a self-hosted copy.", "url": "https://www.anchorterminal.com/tools/medplum", "markdownUrl": "https://www.anchorterminal.com/tools/medplum.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/medplum.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/medplum.json", "repo": "https://github.com/medplum/medplum", "license": "Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service", "transports": [ "http", "streamable-http", "sse" ], "remoteUrl": "https://api.medplum.com/mcp/stream", "packages": [ { "registry": "npm", "name": "@medplum/core" } ], "auth": "oauth", "authNotes": "OAuth 2.0 and OpenID Connect. Machine clients use the client credentials grant with a ClientApplication ID and secret created on the Project Admin page, and a POST to https://api.medplum.com/oauth2/token. SMART scopes and AccessPolicy resources limit what each user, bot or client can read or write, including read-only policies. The MCP server uses OAuth with a browser login on first connect. Client assertion, token exchange, on-behalf-of and mTLS are also documented.", "pricing": "freemium", "pricingNotes": "Hosted plans on medplum.com/pricing (checked 2026-10-14). Free for prototyping, Production $2,000 a month, Premium $6,000 a month, Enterprise by contact. The paid plans include a standard BAA and MSA. Self-hosting the Apache 2.0 server is free. Whether the free plan asks for a card was not established.", "priceSummary": "$2000 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the pricing page or the repository (checked 2026-10-14).", "endpoints": [] }, "toolCount": 3, "popularity": { "githubStars": 2738, "npmWeekly": 269965, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://www.medplum.com/docs", "llmsTxt": "https://www.medplum.com/llms.txt", "registryName": "com.medplum/mcp", "capabilities": [ "health.fhir", "health.records" ], "tags": [ "hosted", "open-source", "self-hosted", "fhir", "mcp", "oauth", "smart-on-fhir", "hipaa", "soc2", "typescript", "llms-txt", "status-page" ], "lastRelease": "2026-10-08", "graded": true, "anchor": { "graded": true, "score": 68.7, "grade": "B", "agentReady": false, "rank": 216, "ranked": true, "rankOf": 1076, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 93, "payments": 25, "reliability": 75, "schema": 82, "security": 74, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": -2, "negativeNotes": [ "2026-07-24: GHSA-m44r-7c5h-m6mj, high severity. The external auth callback accepted redirect URIs that only had to start with a registered one, which could leak authorisation codes cross-origin. Patched in @medplum/core 5.1.6 and disclosed on GitHub (https://github.com/medplum/medplum/security/advisories/GHSA-m44r-7c5h-m6mj). With GHSA-ch8p-j6cm-r7w5 (2 June 2026, client secret exposure in self-hosted dynamic registration), both fixed and disclosed in public, so the deduction is small (-2)." ], "verdict": "Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.", "bestFor": "An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.", "strengths": [ "Apache 2.0 server with releases about weekly, v5.2.3 on 8 October 2026, and a written version policy", "Rate limits published per tier, with a `RateLimit` header giving remaining units and seconds to reset", "AccessPolicy resources and SMART scopes allow read-only, per-resource or per-element clients", "Official MCP server at api.medplum.com/mcp/stream, listed in the MCP registry as com.medplum/mcp, with OAuth", "99.99 per cent monthly SLA with service credits stated for the production hosted platform" ], "weaknesses": [ "The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint", "The privacy policy was last updated on 5 April 2022 and the terms on 11 April 2023", "No sub-processor list or retention periods were found", "Two high-severity auth advisories were published and patched in 2026", "Official SDK in TypeScript only" ], "agentNotes": [ "Use a ClientApplication with an AccessPolicy limited to the resources the task needs, and set `readonly` where no writes are needed", "Read the `RateLimit` header and wait for the reset time after a 429. Writes cost 100 quota points, searches 20 and reads 1", "Create patients with conditional create (`If-None-Exist`) or upsert on an identifier so a retry doesn't make a duplicate", "Pass paths to `fhir-request` relative to the FHIR R4 base, with no leading slash or `/fhir/R4` prefix", "Use `Prefer: respond-async` for large bundles. Operations inside the background job don't count against the quota" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.7 } ], "editorialScores": { "ergonomics": 73, "maintenance": 93, "payments": 25, "reliability": 75, "schema": 82, "security": 74, "transparency": 65 }, "provenanceScore": 78 }, "connect": { "install": "npm install @medplum/core", "http": "curl -X POST https://api.medplum.com/oauth2/token \\\n -H \"Content-Type: application/x-www-form-urlencoded\" \\\n -d \"grant_type=client_credentials\u0026client_id=$MY_CLIENT_ID\u0026client_secret=$MY_CLIENT_SECRET\"" }, "letme": { "capability": "https://letme.dev/health.fhir", "tool": "https://letme.dev/medplum" }, "area": "domain-data", "unitPrices": [ { "item": "Production plan", "unit": "month", "usd": 2000, "note": "Hosted, BAA included, Growth usage tier" }, { "item": "Premium plan", "unit": "month", "usd": 6000, "note": "Hosted, adds lab, medication and HL7 integrations" } ], "provenance": { "legalEntity": "Orangebot, Inc.", "domain": "medplum.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.medplum.com/terms", "privacy": "https://www.medplum.com/privacy", "statusPage": "https://status.medplum.com", "changelog": "https://github.com/medplum/medplum/releases", "securityTxt": "valid", "checked": "2026-10-14", "notes": [ "The pricing and security pages name Orangebot, Inc (dba Medplum).", "www.medplum.com/.well-known/security.txt lists security@medplum.com, a PGP key and expires 2027-02-28.", "robots.txt on api.medplum.com and status.medplum.com disallows every path for all agents, so the status history and the live OpenAPI document were not read.", "The terms of service were last updated 2023-04-11 and the privacy policy 2022-04-05.", "The domain registration date was not established." ], "score": 78 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/medplum.json", "live": { "slug": "medplum", "probe": { "target": "https://api.medplum.com/mcp/stream", "method": "get", "lastAt": "2026-10-14T09:41:57.409301454Z", "lastOk": true, "lastStatus": 401, "lastMs": 255, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 256, "p95ms24h": 389, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 17 } ] }, "vendorStatus": { "page": "https://status.medplum.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:53:23.189127499Z" }, "updatedAt": "2026-10-14T09:41:57.409301454Z" } }, "answer": "Medplum scores 68.7 (B) on agent readiness against ROOK's 54.9 (C), and leads in 5 of 7 scored categories.", "b": { "slug": "rook", "name": "ROOK", "vendor": "Rookeries Development Corp.", "vendorUrl": "https://www.tryrook.io", "kind": "http-api", "category": "health-data", "summary": "ROOK Connect, from Rookeries Development Corp., collects health data from wearables and phone health stores, normalises it into sleep, physical and body summaries and events, and sends it by webhook or a REST API.", "url": "https://www.anchorterminal.com/tools/rook", "markdownUrl": "https://www.anchorterminal.com/tools/rook.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/rook.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/rook.json", "repo": "https://github.com/RookeriesDevelopment", "license": "Proprietary service under ROOK's Terms and Conditions for ROOK services", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "react-native-rook-sdk" }, { "registry": "npm", "name": "capacitor-rook-sdk" } ], "auth": "api-key", "authNotes": "A person registers an organisation in the ROOK Portal, which enables a Sandbox project, then generates a client UUID and secret key. The secret is shown once. Calls use HTTP Basic auth with the UUID as username and the secret as password. Production needs new credentials, an active plan and signed agreements. No scopes or key rotation were found. End users authorise each data source through ROOK's authoriser pages, the mobile SDKs or the ROOK App.", "pricing": "paid", "pricingNotes": "Core $399 a month for up to 750 active users, Core+ $999 for 5,000, Business $1,999 for 15,000, Enterprise custom. Add-ons cost $79 to $499 a month. A Sandbox is available before buying a plan. The standard term is 12 months with 30 days' notice to cancel (checked 2026-10-14).", "priceSummary": "$399 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI file or the pricing page (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.tryrook.io", "llmsTxt": "https://docs.tryrook.io/llms.txt", "openapi": "https://docs.tryrook.io/redocusaurus/plugin-redoc-0.yaml", "capabilities": [ "health.wearables", "health.consent", "health.fhir" ], "tags": [ "hosted", "wearables", "health-data", "api-key", "openapi", "llms-txt", "sandbox", "webhooks", "status-page", "hipaa" ], "lastRelease": "2026-10-07", "graded": true, "anchor": { "graded": true, "score": 54.9, "grade": "C", "agentReady": false, "rank": 718, "ranked": true, "rankOf": 1076, "categoryRank": 8, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 49, "maintenance": 73, "payments": 25, "reliability": 75, "schema": 74, "security": 32, "transparency": 55 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "Graded on the REST API. A public OpenAPI file, a free Sandbox from the self-serve portal, published plan prices and a dated changelog. Credentials are one client UUID and secret per environment with no scopes, 429 handling isn't documented, the API is meant for occasional queries rather than bulk reads, and no SOC 2 report or security contact was found.", "bestFor": "A wellness, insurance, corporate wellness or remote monitoring product that wants normalised wearable data pushed to its backend, with plan prices it can see up front.", "strengths": [ "OpenAPI 3.0.3 file with 29 operations and production and sandbox servers, linked from the API reference", "A self-serve portal enables a Sandbox on registration, and the pricing FAQ says it can be tested before buying a plan", "Plan prices are public, from $399 a month for 750 active users, with add-on prices listed", "Data webhooks carry an X-ROOK-HASH HMAC header and are retried on a published schedule", "Dated changelog with five entries between 25 August and 7 October 2026, and SDK LTS releases with a six-month support period" ], "weaknesses": [ "Credentials are one client UUID and secret per environment, sent by Basic auth, with no scopes or rotation documented", "Typical limits of 60 requests a minute and 10,000 a day vary by plan, and no 429 or Retry-After behaviour is documented", "No server-side SDK. The official SDKs are mobile libraries for iOS, Android, Flutter, React Native and Capacitor", "The services terms cite an SLA page that isn't linked or published, and no SOC 2 or ISO 27001 report was found", "A WAF blocks requests without a User-Agent header and parameters containing localhost or SQL-like text" ], "agentNotes": [ "Send HTTP Basic auth with client_uuid as the username and the secret key as the password, plus a User-Agent header, or the WAF returns 403", "Use https://api.rook-connect.review for Sandbox and https://api.rook-connect.com for production. Each has its own credentials", "Read health data from the data webhook. Use the API only for occasional queries, and stay under 60 requests a minute", "Deduplicate summaries on document_version and datetime. ROOK resends a summary with a higher document_version when it changes", "Call POST /api/v1/user_id/{user_id}/data_sources/revoke_auth to end a connection. Some providers take hours to stop sending data" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 54.9 } ], "editorialScores": { "ergonomics": 49, "maintenance": 73, "payments": 25, "reliability": 75, "schema": 74, "security": 32, "transparency": 52 }, "provenanceScore": 58 }, "connect": { "http": "curl https://api.rook-connect.review/api/v1/client/users/status \\\n -u \u003cclient_uuid\u003e:\u003csecret_key\u003e \\\n -H 'User-Agent: MyApp/1.0.0'" }, "letme": { "capability": "https://letme.dev/health.wearables", "tool": "https://letme.dev/rook" }, "area": "domain-data", "unitPrices": [ { "item": "Core plan, up to 750 active users", "unit": "month", "usd": 399, "note": "tryrook.io/pricing, 2026-10-14" }, { "item": "Business plan, up to 15,000 active users, all add-ons", "unit": "month", "usd": 1999, "note": "tryrook.io/pricing, 2026-10-14" } ], "provenance": { "legalEntity": "Rookeries Development Corp.", "domain": "tryrook.io", "domainRegistered": "", "endpointOnVendorDomain": false, "terms": "https://www.tryrook.io/terms-rook-connect/", "privacy": "https://www.tryrook.io/privacy-policy/", "statusPage": "https://rook.statuspage.io", "changelog": "https://rook.canny.io/changelog", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The Terms and Conditions for ROOK services (last updated August 2026) and the website terms (4 June 2026) name Rookeries Development Corp., 224 NE 59th St, Miami, FL 33137.", "The website terms forbid robots, spiders and page scraping to acquire, copy or monitor any part of the site. robots.txt on www.tryrook.io and docs.tryrook.io allows all paths, and we read public pages only.", "The API answers at api.rook-connect.com and api.rook-connect.review, which are not on tryrook.io.", "rookmotion.com, the domain in the founder's list, did not load (expired certificate). The current site is www.tryrook.io.", "www.tryrook.io/.well-known/security.txt returns 404." ], "score": 58 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/rook.json", "live": { "slug": "rook", "vendorStatus": { "page": "https://rook.statuspage.io", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:39:39.74478552Z" }, "updatedAt": "2026-10-14T09:39:39.74478552Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Orangebot, Inc. (dba Medplum)", "b": "Rookeries Development Corp.", "name": "Vendor" }, { "a": "https://api.medplum.com/mcp/stream", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, SSE (legacy)", "b": "HTTP", "name": "Transports" }, { "a": "OAuth", "b": "API key", "name": "Auth" }, { "a": "Freemium", "b": "Paid", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service", "b": "Proprietary service under ROOK's Terms and Conditions for ROOK services", "name": "Licence" }, { "a": "3", "b": "none", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "com.medplum/mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-10-08", "b": "2026-10-07", "name": "Last release" }, { "a": "2023-04-11", "b": "2026-08-01", "name": "Terms last updated" }, { "a": "2022-04-05", "b": "2026-05-28", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "2.7k stars, 270k npm/wk", "b": "none", "name": "Popularity" } ], "faq": [ { "answer": "Medplum scores 68.7 (B) on agent readiness against ROOK's 54.9 (C), and leads in 5 of 7 scored categories.", "question": "Which is better for AI agents, Medplum or ROOK?" }, { "answer": "Medplum uses an OAuth sign-in. ROOK needs an API key.", "question": "Do Medplum and ROOK need an API key?" }, { "answer": "Medplum has a hosted endpoint at https://api.medplum.com/mcp/stream. No hosted endpoint is listed for ROOK.", "question": "Can an agent call Medplum and ROOK without installing anything?" }, { "answer": "Medplum is open source (Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service). No open-source release is listed for ROOK.", "question": "Are Medplum and ROOK open source?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 82 against 74", "Agent ergonomics, 73 against 49", "Security \u0026 auth, 74 against 32", "Maintenance \u0026 community, 93 against 73", "Transparency \u0026 trust, 72 against 55" ], "also": [ "A hosted endpoint, with nothing to install", "Open source" ], "goodFor": "An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.", "slug": "medplum", "watchFor": "The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint" }, { "aheadOn": null, "also": null, "goodFor": "A wellness, insurance, corporate wellness or remote monitoring product that wants normalised wearable data pushed to its backend, with plan prices it can see up front.", "slug": "rook", "watchFor": "Credentials are one client UUID and secret per environment, sent by Basic auth, with no scopes or rotation documented" } ], "job": { "capability": "health.fhir", "name": "FHIR servers" }, "others": [ { "json": "https://www.anchorterminal.com/compare/1uphealth-vs-rook.json", "title": "1upHealth vs ROOK", "url": "https://www.anchorterminal.com/compare/1uphealth-vs-rook" }, { "json": "https://www.anchorterminal.com/compare/aidbox-vs-medplum.json", "title": "Aidbox vs Medplum", "url": "https://www.anchorterminal.com/compare/aidbox-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/aidbox-vs-rook.json", "title": "Aidbox vs ROOK", "url": "https://www.anchorterminal.com/compare/aidbox-vs-rook" }, { "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-rook.json", "title": "Health Gorilla vs ROOK", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-rook" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-metriport.json", "title": "Medplum vs Metriport Medical API", "url": "https://www.anchorterminal.com/compare/medplum-vs-metriport" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-particle-health.json", "title": "Medplum vs Particle Health", "url": "https://www.anchorterminal.com/compare/medplum-vs-particle-health" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-redox.json", "title": "Medplum vs Redox", "url": "https://www.anchorterminal.com/compare/medplum-vs-redox" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-terra.json", "title": "Medplum vs Terra API", "url": "https://www.anchorterminal.com/compare/medplum-vs-terra" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-zus-health.json", "title": "Medplum vs Zus Health", "url": "https://www.anchorterminal.com/compare/medplum-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/metriport-vs-rook.json", "title": "Metriport Medical API vs ROOK", "url": "https://www.anchorterminal.com/compare/metriport-vs-rook" }, { "json": "https://www.anchorterminal.com/compare/particle-health-vs-rook.json", "title": "Particle Health vs ROOK", "url": "https://www.anchorterminal.com/compare/particle-health-vs-rook" }, { "json": "https://www.anchorterminal.com/compare/redox-vs-rook.json", "title": "Redox vs ROOK", "url": "https://www.anchorterminal.com/compare/redox-vs-rook" }, { "json": "https://www.anchorterminal.com/compare/1uphealth-vs-medplum.json", "title": "1upHealth vs Medplum", "url": "https://www.anchorterminal.com/compare/1uphealth-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-medplum.json", "title": "Health Gorilla vs Medplum", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/medblocks-vs-medplum.json", "title": "Medblocks vs Medplum", "url": "https://www.anchorterminal.com/compare/medblocks-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/medblocks-vs-rook.json", "title": "Medblocks vs ROOK", "url": "https://www.anchorterminal.com/compare/medblocks-vs-rook" }, { "json": "https://www.anchorterminal.com/compare/rook-vs-zus-health.json", "title": "ROOK vs Zus Health", "url": "https://www.anchorterminal.com/compare/rook-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/rook-vs-terra.json", "title": "ROOK vs Terra API", "url": "https://www.anchorterminal.com/compare/rook-vs-terra" }, { "json": "https://www.anchorterminal.com/compare/rook-vs-validic.json", "title": "ROOK vs Validic Inform", "url": "https://www.anchorterminal.com/compare/rook-vs-validic" } ], "scores": [ { "by": 0, "edge": "", "key": "reliability", "medplum": 75, "name": "Reliability", "rook": 75, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 8, "edge": "medplum", "key": "schema", "medplum": 82, "name": "Schema \u0026 documentation", "rook": 74, "weight": 13 }, { "by": 24, "edge": "medplum", "key": "ergonomics", "medplum": 73, "name": "Agent ergonomics", "rook": 49, "weight": 13 }, { "by": 42, "edge": "medplum", "key": "security", "medplum": 74, "name": "Security \u0026 auth", "rook": 32, "weight": 14 }, { "by": 0, "edge": "", "key": "payments", "medplum": 25, "name": "Payments \u0026 pricing", "rook": 25, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 20, "edge": "medplum", "key": "maintenance", "medplum": 93, "name": "Maintenance \u0026 community", "rook": 73, "weight": 7 }, { "by": 17, "edge": "medplum", "key": "transparency", "medplum": 72, "name": "Transparency \u0026 trust", "rook": 55, "weight": 7 } ], "summary": "Medplum scores 68.7 (B) on agent readiness against ROOK's 54.9 (C), and leads in 5 of 7 scored categories. Both do fhir servers.", "verdicts": { "medplum": "Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.", "rook": "Graded on the REST API. A public OpenAPI file, a free Sandbox from the self-serve portal, published plan prices and a dated changelog. Credentials are one client UUID and secret per environment with no scopes, 429 handling isn't documented, the API is meant for occasional queries rather than bulk reads, and no SOC 2 report or security contact was found." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/medplum-vs-rook", "json": "https://www.anchorterminal.com/compare/medplum-vs-rook.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/medplum-vs-rook.md", "slim": "https://www.anchorterminal.com/compare/medplum-vs-rook.min.md" }, "markdown": "Medplum scores 68.7 (B) on agent readiness against ROOK's 54.9 (C), and leads in 5 of 7 scored categories. Both do fhir servers.\n\n- Medplum: grade B, 68.7/100, rank #216 of 1076. Markdown https://www.anchorterminal.com/tools/medplum.md · JSON https://www.anchorterminal.com/api/v1/tools/medplum.json\n- ROOK: grade C, 54.9/100, rank #718 of 1076. Markdown https://www.anchorterminal.com/tools/rook.md · JSON https://www.anchorterminal.com/api/v1/tools/rook.json\n- Best health record and wellness data APIs for AI agents: https://www.anchorterminal.com/best/health-data/index.md\n- All 63 health comparisons: https://www.anchorterminal.com/compare/health-data/index.md\n\n## Which one, for what\n\n### Medplum (B)\n\nGood for: An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.\n\nAhead on:\n- Schema \u0026 documentation, 82 against 74\n- Agent ergonomics, 73 against 49\n- Security \u0026 auth, 74 against 32\n- Maintenance \u0026 community, 93 against 73\n- Transparency \u0026 trust, 72 against 55\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Open source\n\nWatch for: The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint\n\n### ROOK (C)\n\nGood for: A wellness, insurance, corporate wellness or remote monitoring product that wants normalised wearable data pushed to its backend, with plan prices it can see up front.\n\nWatch for: Credentials are one client UUID and secret per environment, sent by Basic auth, with no scopes or rotation documented\n\n\n## Score by category\n\n| Category | Weight | Medplum | ROOK | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 75 | 75 | even |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 82 | 74 | Medplum +8 |\n| Agent ergonomics | 13% (16.2 this run) | 73 | 49 | Medplum +24 |\n| Security \u0026 auth | 14% (17.5 this run) | 74 | 32 | Medplum +42 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 25 | 25 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 93 | 73 | Medplum +20 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 72 | 55 | Medplum +17 |\n| Negative events | ≤15 | -2 | 0 | |\n| **Total** | | **68.7 · B** | **54.9 · C** | |\n\n## Facts side by side\n\n| Fact | Medplum | ROOK |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Orangebot, Inc. (dba Medplum) | Rookeries Development Corp. |\n| Hosted endpoint | `https://api.medplum.com/mcp/stream` | no (local only) |\n| Transports | HTTP, Streamable HTTP, SSE (legacy) | HTTP |\n| Auth | OAuth | API key |\n| Pricing | Freemium | Paid |\n| x402 | no | no |\n| Licence | Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service | Proprietary service under ROOK's Terms and Conditions for ROOK services |\n| Tools exposed | 3 | none |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| MCP registry | `com.medplum/mcp` | not listed |\n| Last release | 2026-10-08 | 2026-10-07 |\n| Terms last updated | 2023-04-11 | 2026-08-01 |\n| Privacy policy last updated | 2022-04-05 | 2026-05-28 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | yes |\n| Terms or service can change without notice | yes | not found in the text |\n| Arbitration or class-action waiver | yes | yes |\n| Popularity | 2.7k stars, 270k npm/wk | none |\n\n## Verdicts\n\n**Medplum.** Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.\n\n**ROOK.** Graded on the REST API. A public OpenAPI file, a free Sandbox from the self-serve portal, published plan prices and a dated changelog. Credentials are one client UUID and secret per environment with no scopes, 429 handling isn't documented, the API is meant for occasional queries rather than bulk reads, and no SOC 2 report or security contact was found.\n\n## Before you call either\n\n### Medplum\n\n1. Use a ClientApplication with an AccessPolicy limited to the resources the task needs, and set `readonly` where no writes are needed\n2. Read the `RateLimit` header and wait for the reset time after a 429. Writes cost 100 quota points, searches 20 and reads 1\n3. Create patients with conditional create (`If-None-Exist`) or upsert on an identifier so a retry doesn't make a duplicate\n4. Pass paths to `fhir-request` relative to the FHIR R4 base, with no leading slash or `/fhir/R4` prefix\n5. Use `Prefer: respond-async` for large bundles. Operations inside the background job don't count against the quota\n\n### ROOK\n\n1. Send HTTP Basic auth with client_uuid as the username and the secret key as the password, plus a User-Agent header, or the WAF returns 403\n2. Use https://api.rook-connect.review for Sandbox and https://api.rook-connect.com for production. Each has its own credentials\n3. Read health data from the data webhook. Use the API only for occasional queries, and stay under 60 requests a minute\n4. Deduplicate summaries on document_version and datetime. ROOK resends a summary with a higher document_version when it changes\n5. Call POST /api/v1/user_id/{user_id}/data_sources/revoke_auth to end a connection. Some providers take hours to stop sending data\n\n## Questions\n\n### Which is better for AI agents, Medplum or ROOK?\n\nMedplum scores 68.7 (B) on agent readiness against ROOK's 54.9 (C), and leads in 5 of 7 scored categories.\n\n### Do Medplum and ROOK need an API key?\n\nMedplum uses an OAuth sign-in. ROOK needs an API key.\n\n### Can an agent call Medplum and ROOK without installing anything?\n\nMedplum has a hosted endpoint at https://api.medplum.com/mcp/stream. No hosted endpoint is listed for ROOK.\n\n### Are Medplum and ROOK open source?\n\nMedplum is open source (Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service). No open-source release is listed for ROOK.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/medplum-vs-rook.json, and with the fewest tokens: https://www.anchorterminal.com/compare/medplum-vs-rook.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"medplum\", \"b\": \"rook\"}`. From a terminal: `anchor compare medplum rook`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/medplum.json and https://www.anchorterminal.com/api/v1/tools/rook.json\n\n## Other comparisons with Medplum or ROOK\n\n- [1upHealth vs ROOK](https://www.anchorterminal.com/compare/1uphealth-vs-rook.md)\n- [Aidbox vs Medplum](https://www.anchorterminal.com/compare/aidbox-vs-medplum.md)\n- [Aidbox vs ROOK](https://www.anchorterminal.com/compare/aidbox-vs-rook.md)\n- [Health Gorilla vs ROOK](https://www.anchorterminal.com/compare/health-gorilla-vs-rook.md)\n- [Medplum vs Metriport Medical API](https://www.anchorterminal.com/compare/medplum-vs-metriport.md)\n- [Medplum vs Particle Health](https://www.anchorterminal.com/compare/medplum-vs-particle-health.md)\n- [Medplum vs Redox](https://www.anchorterminal.com/compare/medplum-vs-redox.md)\n- [Medplum vs Terra API](https://www.anchorterminal.com/compare/medplum-vs-terra.md)\n- [Medplum vs Zus Health](https://www.anchorterminal.com/compare/medplum-vs-zus-health.md)\n- [Metriport Medical API vs ROOK](https://www.anchorterminal.com/compare/metriport-vs-rook.md)\n- [Particle Health vs ROOK](https://www.anchorterminal.com/compare/particle-health-vs-rook.md)\n- [Redox vs ROOK](https://www.anchorterminal.com/compare/redox-vs-rook.md)\n- [1upHealth vs Medplum](https://www.anchorterminal.com/compare/1uphealth-vs-medplum.md)\n- [Health Gorilla vs Medplum](https://www.anchorterminal.com/compare/health-gorilla-vs-medplum.md)\n- [Medblocks vs Medplum](https://www.anchorterminal.com/compare/medblocks-vs-medplum.md)\n- [Medblocks vs ROOK](https://www.anchorterminal.com/compare/medblocks-vs-rook.md)\n- [ROOK vs Zus Health](https://www.anchorterminal.com/compare/rook-vs-zus-health.md)\n- [ROOK vs Terra API](https://www.anchorterminal.com/compare/rook-vs-terra.md)\n- [ROOK vs Validic Inform](https://www.anchorterminal.com/compare/rook-vs-validic.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Medplum vs ROOK", "url": "" } ], "description": "Medplum scores 68.7 (B) to ROOK's 54.9 (C) for fhir servers. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Medplum B 68.7", "ROOK C 54.9", "scores" ], "h1": "Medplum vs ROOK", "image": "https://www.anchorterminal.com/assets/og/compare-medplum-vs-rook.png", "path": "/compare/medplum-vs-rook", "published": "2026-10-01", "section": "tools", "title": "Medplum vs ROOK for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-10-14", "url": "https://www.anchorterminal.com/compare/medplum-vs-rook" }, "tokens": { "markdown": 2350, "slim": 680 }, "version": 1 }