# Aidbox (slim)

> FHIR R4 and R5 server on PostgreSQL from Health Samurai, run from Docker images under a free development licence or a paid production licence. Agents use each instance's FHIR REST API or its alpha MCP server.

- Full: https://www.anchorterminal.com/tools/aidbox.md (~5,750 tokens) · this version ~1,430 tokens · JSON https://www.anchorterminal.com/tools/aidbox.json · canonical https://www.anchorterminal.com/tools/aidbox
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-14

**B · 64.2/100 · rank #385 of 1076 · #3 in Health records & wellness data · not agent-ready · confidence medium**


Assessment: Graded on the FHIR REST API of an Aidbox instance the owner runs. Monthly releases, two-year LTS lines, SMART on FHIR, AccessPolicy rules and AuditEvent logging are documented, and a free development licence needs no sales call. Aidbox has no rate limiting of its own, its MCP module is alpha, and no terms of service were found on the website.

## Facts

- Kind: HTTP API · vendor: Health Samurai, Inc. · category: Health records & wellness data · legal entity: Health Samurai, Inc. · provenance 39/100
- Local only (HTTP, Streamable HTTP, SSE (legacy)): oci `healthsamurai/aidboxone`
- Auth: OAuth · pricing: Freemium · x402: no · licence: Proprietary. Aidbox runs from Health Samurai's Docker images under a free development licence (no PHI) or a paid production licence. Examples and the Python SDK on GitHub are MIT
- Probe metrics: not measured yet (probes haven't run)
- API: FHIR R4 and R5 REST at <aidbox-base-url>/fhir, plus SQL on FHIR, GraphQL, Bulk Data, Subscriptions and terminology operations. Errors as FHIR OperationOutcome
- MCP server: Alpha since 2505, at <aidbox-base-url>/mcp (Streamable HTTP since 2606) and /sse. Nine tools, read, create, update, conditional update, patch, conditional patch, delete, search and validate. Enabled with `module.mcp.server-enabled`
- Licences: Development licence free, no PHI. Production licence per dataset, 14-day trial then extended by Health Samurai. Education licences on request
- Plans: Aidbox Dev $0, Aidbox Base from $1,900 a month or $19,000 a year with PHI allowed, Aidbox Enterprise by contact
- Releases: YYMM.minor, monthly, with edge, latest and stable channels. LTS 2605, 2512 and 2507 supported, 2410 ends October 2026
- Security: Cosign-signed images, SBOM per release, Trivy scans, remediation within 7 days for critical and 30 for high. Reports to security@health-samurai.io. ISO 27001:2022 claimed
- Not implemented: Rate limiting, brute-force protection, HSTS and some security headers, per the hardening page
- Prices: Aidbox Base licence $1900 per month (plan)

- Scores: Reliability 59, Performance pending, Schema & documentation 77, Agent ergonomics 79, Security & auth 74, Payments & pricing 25, Task success pending, Maintenance & community 80, Transparency & trust 45 · total over the 7 assessed categories
- Why: Reliability, Read with the local-software lines, because production Aidbox runs on the customer's infrastructure from Health Samurai's Docker images and… · Schema & documentation, No OpenAPI document was found. · Agent ergonomics, `_elements`, `_count`, `_total` and `_summary` size responses (22 of 25). · Security & auth, Each instance runs its own OAuth 2.0 server with client credentials, authorisation code, token exchange and SMART backend services with priv… · Payments & pricing, Read with the hosted rubric, because Aidbox is licensed software with a price rather than free software. · Maintenance & community, Release 2609 published on 8 October 2026 (30). · Transparency & trust, Closed source, and no terms of service or licence agreement was found on the website or in the docs.
- Sources: 17, open questions: 5, both in the full twin
- Capabilities: health.fhir, health.records, health.consent
- JSON: https://www.anchorterminal.com/api/v1/tools/aidbox.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/aidbox.svg` or a link to https://www.anchorterminal.com/tools/aidbox from a page on health-samurai.io or one of its subdomains, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Ask the operator for a Client with an AccessPolicy limited to the task. Don't rely on the public MCP policy, which the docs mark unsafe
2. Use `If-None-Exist` on creates and conditional update on identifiers so retries don't duplicate records
3. Use `_elements` and `_count` to keep responses small, and follow the Bundle's paging links
4. Throttle yourself. Aidbox applies no rate limit, so a burst lands on the customer's database
5. Don't load real patient data into an instance on a development licence

## Connect

```bash
curl -JO https://aidbox.app/runme && docker compose up
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/aidbox

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Health Gorilla | C | 59.3 | health.records, health.fhir, health.consent | https://www.anchorterminal.com/tools/health-gorilla.min.md |
| Zus Health | C | 56.6 | health.records, health.fhir, health.consent | https://www.anchorterminal.com/tools/zus-health.min.md |
| Medblocks | D | 52.7 | health.records, health.consent, health.fhir | https://www.anchorterminal.com/tools/medblocks.min.md |
| Metriport Medical API | D | 50.1 | health.records, health.fhir, health.consent | https://www.anchorterminal.com/tools/metriport.min.md |
| 1upHealth | D | 46.8 | health.records, health.fhir, health.consent | https://www.anchorterminal.com/tools/1uphealth.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)