# Medplum (slim)

> Open-source FHIR R4 server and healthcare developer platform from Orangebot, Inc. (dba Medplum). Agents reach patient records through the hosted FHIR REST API at api.medplum.com, a remote MCP server or a self-hosted copy.

- Full: https://www.anchorterminal.com/tools/medplum.md (~6,550 tokens) · this version ~1,480 tokens · JSON https://www.anchorterminal.com/tools/medplum.json · canonical https://www.anchorterminal.com/tools/medplum
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · Updated: 2026-10-14

**B · 68.7/100 · rank #216 of 1076 · #1 in Health records & wellness data · not agent-ready · confidence medium**


Assessment: Graded on the hosted FHIR API at api.medplum.com. Rate limits, a `RateLimit` header and a 99.99 per cent SLA are published, AccessPolicy resources allow read-only clients, and an official MCP server sits in the registry. Its main tool can delete records with no annotation, the status page could not be read, and the privacy policy dates from 2022.

## Facts

- Kind: HTTP API · vendor: Orangebot, Inc. (dba Medplum) · category: Health records & wellness data · legal entity: Orangebot, Inc. · provenance 78/100
- Endpoint: `https://api.medplum.com/mcp/stream` (HTTP, Streamable HTTP, SSE (legacy))
- Auth: OAuth · pricing: Freemium · x402: no · licence: Apache 2.0 for the server, SDKs and apps in medplum/medplum. The hosted service at api.medplum.com runs under Medplum's terms of service
- Probe metrics: not measured yet (probes haven't run)
- API: FHIR R4 REST at https://api.medplum.com/fhir/R4, with batch and transaction bundles, async bundles (`Prefer: respond-async`), Bulk FHIR export, GraphQL and custom operations. An OpenAPI 3.1 document is generated by the server (packages/server/src/openapi.ts)
- MCP server: https://api.medplum.com/mcp/stream (Streamable HTTP) and /mcp/sse. Tools fhir-request, search and fetch. OAuth. Registry name com.medplum/mcp
- Rate limits: Per IP per minute, login 5, auth 160, other endpoints 6,000 (free) or 60,000 (paid). FHIR quota points, read 1, search 20, history 10, create, update, patch or delete 100, with a project total of ten times the per-user limit
- SLA: 99.99 per cent monthly for the production hosted platform, with service credits defined in the customer agreement
- Plans: Free, Production $2,000 a month, Premium $6,000 a month, Enterprise by contact. Self-hosted Community free
- Versions: Semver, majors yearly in Q4 with one year active and one year maintenance, patches about weekly. Security patches for critical issues within 7 days and high within 14
- Certifications: SOC 2 Type II (report on request), standard BAA on paid plans
- Prices: Production plan $2000 per month (plan); Premium plan $6000 per month (plan)

- Scores: Reliability 75, Performance pending, Schema & documentation 82, Agent ergonomics 73, Security & auth 74, Payments & pricing 25, Task success pending, Maintenance & community 93, Transparency & trust 72 · negative events -2 · total over the 7 assessed categories
- Why: Reliability, Read with the hosted lines and scored on the hosted FHIR API at api.medplum.com, which is what an agent would call. · Schema & documentation, The server generates an OpenAPI 3.1 document (packages/server/src/openapi.ts) and publishes a FHIR CapabilityStatement. · Agent ergonomics, FHIR `_count`, `_elements`, `_summary` and `_include` size responses (22 of 25). · Security & auth, OAuth 2.0 with client credentials, SMART scopes, client assertion, token exchange and mTLS. · Payments & pricing, Read with the hosted rubric, since the hosted service is what an agent would call. · Maintenance & community, v5.2.3 tagged on 8 October 2026 (30). · Transparency & trust, Apache 2.0 source for the server (30).
- Sources: 18, open questions: 5, both in the full twin
- Capabilities: health.fhir, health.records
- JSON: https://www.anchorterminal.com/api/v1/tools/medplum.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/medplum.svg` or a link to https://www.anchorterminal.com/tools/medplum from a page on medplum.com or one of its subdomains, or the README of github.com/medplum/medplum, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Use a ClientApplication with an AccessPolicy limited to the resources the task needs, and set `readonly` where no writes are needed
2. Read the `RateLimit` header and wait for the reset time after a 429. Writes cost 100 quota points, searches 20 and reads 1
3. Create patients with conditional create (`If-None-Exist`) or upsert on an identifier so a retry doesn't make a duplicate
4. Pass paths to `fhir-request` relative to the FHIR R4 base, with no leading slash or `/fhir/R4` prefix
5. Use `Prefer: respond-async` for large bundles. Operations inside the background job don't count against the quota

## Connect

```bash
npm install @medplum/core
```

```bash
curl -X POST https://api.medplum.com/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=$MY_CLIENT_ID&client_secret=$MY_CLIENT_SECRET"
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/medplum

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Aidbox | B | 64.2 | health.fhir, health.records | https://www.anchorterminal.com/tools/aidbox.min.md |
| Health Gorilla | C | 59.3 | health.records, health.fhir | https://www.anchorterminal.com/tools/health-gorilla.min.md |
| Redox | C | 58.3 | health.fhir, health.records | https://www.anchorterminal.com/tools/redox.min.md |
| Zus Health | C | 56.6 | health.records, health.fhir | https://www.anchorterminal.com/tools/zus-health.min.md |
| Medblocks | D | 52.7 | health.records, health.fhir | https://www.anchorterminal.com/tools/medblocks.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)