{ "data": { "a": { "slug": "medplum", "name": "Medplum", "vendor": "Orangebot, Inc. (dba Medplum)", "vendorUrl": "https://www.medplum.com", "kind": "http-api", "category": "health-data", "summary": "Open-source FHIR R4 server and healthcare developer platform from Orangebot, Inc. (dba Medplum). Agents reach patient records through the hosted FHIR REST API at api.medplum.com, a remote MCP server or a self-hosted copy.", "url": "https://www.anchorterminal.com/tools/medplum", "markdownUrl": "https://www.anchorterminal.com/tools/medplum.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/medplum.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/medplum.json", "repo": "https://github.com/medplum/medplum", "license": "Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service", "transports": [ "http", "streamable-http", "sse" ], "remoteUrl": "https://api.medplum.com/mcp/stream", "packages": [ { "registry": "npm", "name": "@medplum/core" } ], "auth": "oauth", "authNotes": "OAuth 2.0 and OpenID Connect. Machine clients use the client credentials grant with a ClientApplication ID and secret created on the Project Admin page, and a POST to https://api.medplum.com/oauth2/token. SMART scopes and AccessPolicy resources limit what each user, bot or client can read or write, including read-only policies. The MCP server uses OAuth with a browser login on first connect. Client assertion, token exchange, on-behalf-of and mTLS are also documented.", "pricing": "freemium", "pricingNotes": "Hosted plans on medplum.com/pricing (checked 2026-10-14). Free for prototyping, Production $2,000 a month, Premium $6,000 a month, Enterprise by contact. The paid plans include a standard BAA and MSA. Self-hosting the Apache 2.0 server is free. Whether the free plan asks for a card was not established.", "priceSummary": "$2000 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the pricing page or the repository (checked 2026-10-14).", "endpoints": [] }, "toolCount": 3, "popularity": { "githubStars": 2738, "npmWeekly": 269965, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://www.medplum.com/docs", "llmsTxt": "https://www.medplum.com/llms.txt", "registryName": "com.medplum/mcp", "capabilities": [ "health.fhir", "health.records" ], "tags": [ "hosted", "open-source", "self-hosted", "fhir", "mcp", "oauth", "smart-on-fhir", "hipaa", "soc2", "typescript", "llms-txt", "status-page" ], "lastRelease": "2026-10-08", "graded": true, "anchor": { "graded": true, "score": 68.7, "grade": "B", "agentReady": false, "rank": 216, "ranked": true, "rankOf": 1076, "categoryRank": 1, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 73, "maintenance": 93, "payments": 25, "reliability": 75, "schema": 82, "security": 74, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": -2, "negativeNotes": [ "2026-07-24: GHSA-m44r-7c5h-m6mj, high severity. The external auth callback accepted redirect URIs that only had to start with a registered one, which could leak authorisation codes cross-origin. Patched in @medplum/core 5.1.6 and disclosed on GitHub (https://github.com/medplum/medplum/security/advisories/GHSA-m44r-7c5h-m6mj). With GHSA-ch8p-j6cm-r7w5 (2 June 2026, client secret exposure in self-hosted dynamic registration), both fixed and disclosed in public, so the deduction is small (-2)." ], "verdict": "Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.", "bestFor": "An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.", "strengths": [ "Apache 2.0 server with releases about weekly, v5.2.3 on 8 October 2026, and a written version policy", "Rate limits published per tier, with a `RateLimit` header giving remaining units and seconds to reset", "AccessPolicy resources and SMART scopes allow read-only, per-resource or per-element clients", "Official MCP server at api.medplum.com/mcp/stream, listed in the MCP registry as com.medplum/mcp, with OAuth", "99.99 per cent monthly SLA with service credits stated for the production hosted platform" ], "weaknesses": [ "The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint", "The privacy policy was last updated on 5 April 2022 and the terms on 11 April 2023", "No sub-processor list or retention periods were found", "Two high-severity auth advisories were published and patched in 2026", "Official SDK in TypeScript only" ], "agentNotes": [ "Use a ClientApplication with an AccessPolicy limited to the resources the task needs, and set `readonly` where no writes are needed", "Read the `RateLimit` header and wait for the reset time after a 429. Writes cost 100 quota points, searches 20 and reads 1", "Create patients with conditional create (`If-None-Exist`) or upsert on an identifier so a retry doesn't make a duplicate", "Pass paths to `fhir-request` relative to the FHIR R4 base, with no leading slash or `/fhir/R4` prefix", "Use `Prefer: respond-async` for large bundles. Operations inside the background job don't count against the quota" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.7 } ], "editorialScores": { "ergonomics": 73, "maintenance": 93, "payments": 25, "reliability": 75, "schema": 82, "security": 74, "transparency": 65 }, "provenanceScore": 78 }, "connect": { "install": "npm install @medplum/core", "http": "curl -X POST https://api.medplum.com/oauth2/token \\\n -H \"Content-Type: application/x-www-form-urlencoded\" \\\n -d \"grant_type=client_credentials\u0026client_id=$MY_CLIENT_ID\u0026client_secret=$MY_CLIENT_SECRET\"" }, "letme": { "capability": "https://letme.dev/health.fhir", "tool": "https://letme.dev/medplum" }, "area": "domain-data", "unitPrices": [ { "item": "Production plan", "unit": "month", "usd": 2000, "note": "Hosted, BAA included, Growth usage tier" }, { "item": "Premium plan", "unit": "month", "usd": 6000, "note": "Hosted, adds lab, medication and HL7 integrations" } ], "provenance": { "legalEntity": "Orangebot, Inc.", "domain": "medplum.com", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.medplum.com/terms", "privacy": "https://www.medplum.com/privacy", "statusPage": "https://status.medplum.com", "changelog": "https://github.com/medplum/medplum/releases", "securityTxt": "valid", "checked": "2026-10-14", "notes": [ "The pricing and security pages name Orangebot, Inc (dba Medplum).", "www.medplum.com/.well-known/security.txt lists security@medplum.com, a PGP key and expires 2027-02-28.", "robots.txt on api.medplum.com and status.medplum.com disallows every path for all agents, so the status history and the live OpenAPI document were not read.", "The terms of service were last updated 2023-04-11 and the privacy policy 2022-04-05.", "The domain registration date was not established." ], "score": 78 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/medplum.json", "live": { "slug": "medplum", "probe": { "target": "https://api.medplum.com/mcp/stream", "method": "get", "lastAt": "2026-10-14T09:41:57.409301454Z", "lastOk": true, "lastStatus": 401, "lastMs": 255, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 256, "p95ms24h": 389, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 17 } ] }, "vendorStatus": { "page": "https://status.medplum.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:53:23.189127499Z" }, "updatedAt": "2026-10-14T09:41:57.409301454Z" } }, "answer": "Medplum scores 68.7 (B) on agent readiness against Zus Health's 56.6 (C), and leads in every scored category.", "b": { "slug": "zus-health", "name": "Zus Health", "vendor": "Zus Health, Inc.", "vendorUrl": "https://www.zushealth.com", "kind": "http-api", "category": "health-data", "summary": "Zus Health assembles a patient's history from CommonWell, Carequality, Surescripts, Quest and ADT networks into the Zus Aggregated Profile, and exposes it through FHIR R4 REST, GraphQL and webhook APIs for care organisations it onboards.", "url": "https://www.anchorterminal.com/tools/zus-health", "markdownUrl": "https://www.anchorterminal.com/tools/zus-health.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/zus-health.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/zus-health.json", "license": "Proprietary service under the Zus Builder Terms of Service (last updated 11 March 2025), the Developer Sandbox Terms and the Zus Business Associate Addendum", "transports": [ "http" ], "packages": [], "auth": "oauth", "authNotes": "OAuth 2.0 bearer tokens valid for one hour. Backend systems use machine-to-machine App Clients created in the Zus app or through the Auth Service API, limited to 200 token requests an hour per client. Apps can exchange an OIDC ID token from their own identity provider for a Zus token, and integration App Clients with the Builder Data Integration role can fetch tokens for users through the proxy-token endpoint. Accounts are provisioned by Zus, with an initial admin per customer.", "pricing": "paid", "pricingNotes": "No public prices. The Builder Terms set fees in an executed Order Form or pricing list, invoiced monthly. A developer sandbox is requested through a Google Form on the docs site, and its cost is not stated (checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the documentation, llms.txt or the Builder Terms (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.zushealth.com", "llmsTxt": "https://docs.zushealth.com/llms.txt", "capabilities": [ "health.records", "health.fhir", "health.ehr", "health.consent" ], "tags": [ "hosted", "health-records", "fhir", "graphql", "oauth", "llms-txt", "webhooks", "status-page", "sla", "sales-led" ], "lastRelease": "2026-10-14", "graded": true, "anchor": { "graded": true, "score": 56.6, "grade": "C", "agentReady": false, "rank": 669, "ranked": true, "rankOf": 1076, "categoryRank": 7, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 64, "payments": 5, "reliability": 66, "schema": 77, "security": 49, "transparency": 59 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "FHIR R4 over an aggregated patient profile drawn from CommonWell, Carequality, Surescripts, Quest and ADT networks, with published rate limits, a 99.5 per cent SLA and a dated changelog. Accounts and sandboxes are provisioned by Zus on request, with no public prices, no named security certification and no SDK.", "bestFor": "US care organisations and digital health builders that want a shared, continuously refreshed patient profile in FHIR with EHR embedding.", "strengths": [ "One profile per patient from EHR, pharmacy, ADT and lab networks, shared across Zus customers treating the same patient", "Rate limits with numbers and a published 99.5 per cent SLA with credits", "Conditional writes by identifier and `Zus-If-Match` version checks for safe retries", "Dated changelog that announces changes ahead, such as the proxy-token role change on 14 October 2026" ], "weaknesses": [ "No public prices, and the sandbox is requested through a Google Form", "Four major incidents on the status page between 27 July and 13 August 2026", "No named security certification, security.txt or bug bounty", "The GraphQL API is beta and no official SDK exists" ], "agentNotes": [ "Cache the access token for its hour. More than 200 token requests an hour per App Client returns 429", "Request Patient History at most once per patient per 24 hours, and poll the job status endpoint", "Use conditional create by identifier so a retried write doesn't duplicate a resource", "Send `Zus-If-Match` with the resource's ETag on PUT and PATCH", "Set `_count` up to 500 on searches, since the default page is 10" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 56.6 } ], "editorialScores": { "ergonomics": 67, "maintenance": 64, "payments": 5, "reliability": 66, "schema": 77, "security": 49, "transparency": 46 }, "provenanceScore": 71 }, "connect": { "http": "GET https://api.sandbox.zusapi.com/fhir/Patient?_count=50\nAuthorization: Bearer \u003caccess-token\u003e" }, "letme": { "capability": "https://letme.dev/health.records", "tool": "https://letme.dev/zus-health" }, "area": "domain-data", "provenance": { "legalEntity": "Zus Health, Inc.", "domain": "zushealth.com", "domainRegistered": "2012-02-25", "endpointOnVendorDomain": false, "terms": "https://www.zushealth.com/builder-terms-of-service", "privacy": "https://www.zushealth.com/privacy-policy", "statusPage": "https://status.zusapi.com", "changelog": "https://docs.zushealth.com/changelog", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The APIs answer on zusapi.com, a separate domain from zushealth.com.", "The Builder Terms (last updated 11 March 2025) put term changes into effect 30 days after posting and BAA changes after 90 days. The Developer Sandbox Terms (22 January 2024) limit the sandbox to test data. The website lists 1 Lincoln Street, Suite 2900, Boston, MA 02111.", "The privacy policy (last updated 24 June 2026) covers the website only and names Google Analytics.", "The Builder Security Policy (11 March 2025) names no certification and makes a summary of an annual third-party audit available on request.", "www.zushealth.com/.well-known/security.txt returns 404.", "RDAP gives zushealth.com a registration date of 2012-02-25." ], "score": 71 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/zus-health.json", "live": { "slug": "zus-health", "vendorStatus": { "page": "https://status.zusapi.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:54:10.020449939Z" }, "updatedAt": "2026-10-14T08:54:10.020449939Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Orangebot, Inc. (dba Medplum)", "b": "Zus Health, Inc.", "name": "Vendor" }, { "a": "https://api.medplum.com/mcp/stream", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP, SSE (legacy)", "b": "HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth", "name": "Auth" }, { "a": "Freemium", "b": "Paid", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service", "b": "Proprietary service under the Zus Builder Terms of Service (last updated 11 March 2025), the Developer Sandbox Terms and the Zus Business Associate Addendum", "name": "Licence" }, { "a": "3", "b": "none", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "com.medplum/mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-10-08", "b": "2026-10-14", "name": "Last release" }, { "a": "2023-04-11", "b": "2025-03-11", "name": "Terms last updated" }, { "a": "2022-04-05", "b": "2026-06-24", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "2.7k stars, 270k npm/wk", "b": "none", "name": "Popularity" } ], "faq": [ { "answer": "Medplum scores 68.7 (B) on agent readiness against Zus Health's 56.6 (C), and leads in every scored category.", "question": "Which is better for AI agents, Medplum or Zus Health?" }, { "answer": "Both use an OAuth sign-in.", "question": "Do Medplum and Zus Health need an API key?" }, { "answer": "Medplum has a hosted endpoint at https://api.medplum.com/mcp/stream. No hosted endpoint is listed for Zus Health.", "question": "Can an agent call Medplum and Zus Health without installing anything?" }, { "answer": "Medplum is open source (Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service). No open-source release is listed for Zus Health.", "question": "Are Medplum and Zus Health open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 75 against 66", "Schema \u0026 documentation, 82 against 77", "Agent ergonomics, 73 against 67", "Security \u0026 auth, 74 against 49", "Payments \u0026 pricing, 25 against 5", "Maintenance \u0026 community, 93 against 64", "Transparency \u0026 trust, 72 against 59" ], "also": [ "A hosted endpoint, with nothing to install", "Open source" ], "goodFor": "An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.", "slug": "medplum", "watchFor": "The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint" }, { "aheadOn": null, "also": null, "goodFor": "US care organisations and digital health builders that want a shared, continuously refreshed patient profile in FHIR with EHR embedding.", "slug": "zus-health", "watchFor": "No public prices, and the sandbox is requested through a Google Form" } ], "job": { "capability": "health.fhir", "name": "FHIR servers" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aidbox-vs-medplum.json", "title": "Aidbox vs Medplum", "url": "https://www.anchorterminal.com/compare/aidbox-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/aidbox-vs-zus-health.json", "title": "Aidbox vs Zus Health", "url": "https://www.anchorterminal.com/compare/aidbox-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-metriport.json", "title": "Medplum vs Metriport Medical API", "url": "https://www.anchorterminal.com/compare/medplum-vs-metriport" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-particle-health.json", "title": "Medplum vs Particle Health", "url": "https://www.anchorterminal.com/compare/medplum-vs-particle-health" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-redox.json", "title": "Medplum vs Redox", "url": "https://www.anchorterminal.com/compare/medplum-vs-redox" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-rook.json", "title": "Medplum vs ROOK", "url": "https://www.anchorterminal.com/compare/medplum-vs-rook" }, { "json": "https://www.anchorterminal.com/compare/medplum-vs-terra.json", "title": "Medplum vs Terra API", "url": "https://www.anchorterminal.com/compare/medplum-vs-terra" }, { "json": "https://www.anchorterminal.com/compare/1uphealth-vs-medplum.json", "title": "1upHealth vs Medplum", "url": "https://www.anchorterminal.com/compare/1uphealth-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/1uphealth-vs-zus-health.json", "title": "1upHealth vs Zus Health", "url": "https://www.anchorterminal.com/compare/1uphealth-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-medplum.json", "title": "Health Gorilla vs Medplum", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/health-gorilla-vs-zus-health.json", "title": "Health Gorilla vs Zus Health", "url": "https://www.anchorterminal.com/compare/health-gorilla-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/medblocks-vs-medplum.json", "title": "Medblocks vs Medplum", "url": "https://www.anchorterminal.com/compare/medblocks-vs-medplum" }, { "json": "https://www.anchorterminal.com/compare/medblocks-vs-zus-health.json", "title": "Medblocks vs Zus Health", "url": "https://www.anchorterminal.com/compare/medblocks-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/metriport-vs-zus-health.json", "title": "Metriport Medical API vs Zus Health", "url": "https://www.anchorterminal.com/compare/metriport-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/particle-health-vs-zus-health.json", "title": "Particle Health vs Zus Health", "url": "https://www.anchorterminal.com/compare/particle-health-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/rook-vs-zus-health.json", "title": "ROOK vs Zus Health", "url": "https://www.anchorterminal.com/compare/rook-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/terra-vs-zus-health.json", "title": "Terra API vs Zus Health", "url": "https://www.anchorterminal.com/compare/terra-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/validic-vs-zus-health.json", "title": "Validic Inform vs Zus Health", "url": "https://www.anchorterminal.com/compare/validic-vs-zus-health" }, { "json": "https://www.anchorterminal.com/compare/redox-vs-zus-health.json", "title": "Redox vs Zus Health", "url": "https://www.anchorterminal.com/compare/redox-vs-zus-health" } ], "scores": [ { "by": 9, "edge": "medplum", "key": "reliability", "medplum": 75, "name": "Reliability", "weight": 16, "zus-health": 66 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 5, "edge": "medplum", "key": "schema", "medplum": 82, "name": "Schema \u0026 documentation", "weight": 13, "zus-health": 77 }, { "by": 6, "edge": "medplum", "key": "ergonomics", "medplum": 73, "name": "Agent ergonomics", "weight": 13, "zus-health": 67 }, { "by": 25, "edge": "medplum", "key": "security", "medplum": 74, "name": "Security \u0026 auth", "weight": 14, "zus-health": 49 }, { "by": 20, "edge": "medplum", "key": "payments", "medplum": 25, "name": "Payments \u0026 pricing", "weight": 10, "zus-health": 5 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 29, "edge": "medplum", "key": "maintenance", "medplum": 93, "name": "Maintenance \u0026 community", "weight": 7, "zus-health": 64 }, { "by": 13, "edge": "medplum", "key": "transparency", "medplum": 72, "name": "Transparency \u0026 trust", "weight": 7, "zus-health": 59 } ], "summary": "Medplum scores 68.7 (B) on agent readiness against Zus Health's 56.6 (C), and leads in every scored category. Both do fhir servers.", "verdicts": { "medplum": "Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.", "zus-health": "FHIR R4 over an aggregated patient profile drawn from CommonWell, Carequality, Surescripts, Quest and ADT networks, with published rate limits, a 99.5 per cent SLA and a dated changelog. Accounts and sandboxes are provisioned by Zus on request, with no public prices, no named security certification and no SDK." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/medplum-vs-zus-health", "json": "https://www.anchorterminal.com/compare/medplum-vs-zus-health.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/medplum-vs-zus-health.md", "slim": "https://www.anchorterminal.com/compare/medplum-vs-zus-health.min.md" }, "markdown": "Medplum scores 68.7 (B) on agent readiness against Zus Health's 56.6 (C), and leads in every scored category. Both do fhir servers.\n\n- Medplum: grade B, 68.7/100, rank #216 of 1076. Markdown https://www.anchorterminal.com/tools/medplum.md · JSON https://www.anchorterminal.com/api/v1/tools/medplum.json\n- Zus Health: grade C, 56.6/100, rank #669 of 1076. Markdown https://www.anchorterminal.com/tools/zus-health.md · JSON https://www.anchorterminal.com/api/v1/tools/zus-health.json\n- Best health record and wellness data APIs for AI agents: https://www.anchorterminal.com/best/health-data/index.md\n- All 63 health comparisons: https://www.anchorterminal.com/compare/health-data/index.md\n\n## Which one, for what\n\n### Medplum (B)\n\nGood for: An agent working inside a digital health company's own FHIR store, reading and writing patients, observations and appointments under a BAA.\n\nAhead on:\n- Reliability, 75 against 66\n- Schema \u0026 documentation, 82 against 77\n- Agent ergonomics, 73 against 67\n- Security \u0026 auth, 74 against 49\n- Payments \u0026 pricing, 25 against 5\n- Maintenance \u0026 community, 93 against 64\n- Transparency \u0026 trust, 72 against 59\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Open source\n\nWatch for: The MCP `fhir-request` tool can delete or overwrite any resource the token allows, with no readOnlyHint or destructiveHint\n\n### Zus Health (C)\n\nGood for: US care organisations and digital health builders that want a shared, continuously refreshed patient profile in FHIR with EHR embedding.\n\nWatch for: No public prices, and the sandbox is requested through a Google Form\n\n\n## Score by category\n\n| Category | Weight | Medplum | Zus Health | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 75 | 66 | Medplum +9 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 82 | 77 | Medplum +5 |\n| Agent ergonomics | 13% (16.2 this run) | 73 | 67 | Medplum +6 |\n| Security \u0026 auth | 14% (17.5 this run) | 74 | 49 | Medplum +25 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 25 | 5 | Medplum +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 93 | 64 | Medplum +29 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 72 | 59 | Medplum +13 |\n| Negative events | ≤15 | -2 | 0 | |\n| **Total** | | **68.7 · B** | **56.6 · C** | |\n\n## Facts side by side\n\n| Fact | Medplum | Zus Health |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Orangebot, Inc. (dba Medplum) | Zus Health, Inc. |\n| Hosted endpoint | `https://api.medplum.com/mcp/stream` | no (local only) |\n| Transports | HTTP, Streamable HTTP, SSE (legacy) | HTTP |\n| Auth | OAuth | OAuth |\n| Pricing | Freemium | Paid |\n| x402 | no | no |\n| Licence | Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service | Proprietary service under the Zus Builder Terms of Service (last updated 11 March 2025), the Developer Sandbox Terms and the Zus Business Associate Addendum |\n| Tools exposed | 3 | none |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| MCP registry | `com.medplum/mcp` | not listed |\n| Last release | 2026-10-08 | 2026-10-14 |\n| Terms last updated | 2023-04-11 | 2025-03-11 |\n| Privacy policy last updated | 2022-04-05 | 2026-06-24 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | yes | not found in the text |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 2.7k stars, 270k npm/wk | none |\n\n## Verdicts\n\n**Medplum.** Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.\n\n**Zus Health.** FHIR R4 over an aggregated patient profile drawn from CommonWell, Carequality, Surescripts, Quest and ADT networks, with published rate limits, a 99.5 per cent SLA and a dated changelog. Accounts and sandboxes are provisioned by Zus on request, with no public prices, no named security certification and no SDK.\n\n## Before you call either\n\n### Medplum\n\n1. Use a ClientApplication with an AccessPolicy limited to the resources the task needs, and set `readonly` where no writes are needed\n2. Read the `RateLimit` header and wait for the reset time after a 429. Writes cost 100 quota points, searches 20 and reads 1\n3. Create patients with conditional create (`If-None-Exist`) or upsert on an identifier so a retry doesn't make a duplicate\n4. Pass paths to `fhir-request` relative to the FHIR R4 base, with no leading slash or `/fhir/R4` prefix\n5. Use `Prefer: respond-async` for large bundles. Operations inside the background job don't count against the quota\n\n### Zus Health\n\n1. Cache the access token for its hour. More than 200 token requests an hour per App Client returns 429\n2. Request Patient History at most once per patient per 24 hours, and poll the job status endpoint\n3. Use conditional create by identifier so a retried write doesn't duplicate a resource\n4. Send `Zus-If-Match` with the resource's ETag on PUT and PATCH\n5. Set `_count` up to 500 on searches, since the default page is 10\n\n## Questions\n\n### Which is better for AI agents, Medplum or Zus Health?\n\nMedplum scores 68.7 (B) on agent readiness against Zus Health's 56.6 (C), and leads in every scored category.\n\n### Do Medplum and Zus Health need an API key?\n\nBoth use an OAuth sign-in.\n\n### Can an agent call Medplum and Zus Health without installing anything?\n\nMedplum has a hosted endpoint at https://api.medplum.com/mcp/stream. No hosted endpoint is listed for Zus Health.\n\n### Are Medplum and Zus Health open source?\n\nMedplum is open source (Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service). No open-source release is listed for Zus Health.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/medplum-vs-zus-health.json, and with the fewest tokens: https://www.anchorterminal.com/compare/medplum-vs-zus-health.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"medplum\", \"b\": \"zus-health\"}`. From a terminal: `anchor compare medplum zus-health`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/medplum.json and https://www.anchorterminal.com/api/v1/tools/zus-health.json\n\n## Other comparisons with Medplum or Zus Health\n\n- [Aidbox vs Medplum](https://www.anchorterminal.com/compare/aidbox-vs-medplum.md)\n- [Aidbox vs Zus Health](https://www.anchorterminal.com/compare/aidbox-vs-zus-health.md)\n- [Medplum vs Metriport Medical API](https://www.anchorterminal.com/compare/medplum-vs-metriport.md)\n- [Medplum vs Particle Health](https://www.anchorterminal.com/compare/medplum-vs-particle-health.md)\n- [Medplum vs Redox](https://www.anchorterminal.com/compare/medplum-vs-redox.md)\n- [Medplum vs ROOK](https://www.anchorterminal.com/compare/medplum-vs-rook.md)\n- [Medplum vs Terra API](https://www.anchorterminal.com/compare/medplum-vs-terra.md)\n- [1upHealth vs Medplum](https://www.anchorterminal.com/compare/1uphealth-vs-medplum.md)\n- [1upHealth vs Zus Health](https://www.anchorterminal.com/compare/1uphealth-vs-zus-health.md)\n- [Health Gorilla vs Medplum](https://www.anchorterminal.com/compare/health-gorilla-vs-medplum.md)\n- [Health Gorilla vs Zus Health](https://www.anchorterminal.com/compare/health-gorilla-vs-zus-health.md)\n- [Medblocks vs Medplum](https://www.anchorterminal.com/compare/medblocks-vs-medplum.md)\n- [Medblocks vs Zus Health](https://www.anchorterminal.com/compare/medblocks-vs-zus-health.md)\n- [Metriport Medical API vs Zus Health](https://www.anchorterminal.com/compare/metriport-vs-zus-health.md)\n- [Particle Health vs Zus Health](https://www.anchorterminal.com/compare/particle-health-vs-zus-health.md)\n- [ROOK vs Zus Health](https://www.anchorterminal.com/compare/rook-vs-zus-health.md)\n- [Terra API vs Zus Health](https://www.anchorterminal.com/compare/terra-vs-zus-health.md)\n- [Validic Inform vs Zus Health](https://www.anchorterminal.com/compare/validic-vs-zus-health.md)\n- [Redox vs Zus Health](https://www.anchorterminal.com/compare/redox-vs-zus-health.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Medplum vs Zus Health", "url": "" } ], "description": "Medplum scores 68.7 (B) to Zus Health's 56.6 (C) for fhir servers. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Medplum B 68.7", "Zus Health C 56.6", "scores" ], "h1": "Medplum vs Zus Health", "image": "https://www.anchorterminal.com/assets/og/compare-medplum-vs-zus-health.png", "path": "/compare/medplum-vs-zus-health", "published": "2026-10-01", "section": "tools", "title": "Medplum vs Zus Health for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-10-14", "url": "https://www.anchorterminal.com/compare/medplum-vs-zus-health" }, "tokens": { "markdown": 2350, "slim": 730 }, "version": 1 }