MCP server
Give AI assistants access to your Medblocks Platform workspace.
The Medblocks Platform MCP server lets an AI assistant such as Claude or ChatGPT work with your workspace on your behalf. Once you connect it, the AI assistant can see who is set up in your workspace, search for hospitals and clinics, start a secure connection to your patient portals, and read the health records that come back.
MCP, the Model Context Protocol, is an open standard that lets an AI assistant call tools on an outside service. Medblocks exposes your workspace as one of those services. The server is named medblocks-platform, and it lives at https://app.medblocks.com/mcp.
When you connect, Medblocks shows a consent screen where you choose what the AI assistant can do before you approve.
Connect Claude Code
Connect the Claude Code CLI to your workspace.
Add the server
claude mcp add --transport http medblocks https://app.medblocks.com/mcpSign in
Start Claude Code, run /mcp, choose medblocks, then choose Authenticate. Your browser opens a Medblocks page. Sign in with the same account you use for the dashboard. If you are new, Medblocks creates a workspace for you automatically.
Choose what it can access
Review the consent screen, tick the capabilities you want to grant, and click Allow. Claude Code picks up the token and the tools become available.
To connect a scripted workspace without the browser sign in, pass an API key header instead.
claude mcp add --transport http medblocks https://app.medblocks.com/mcp \
--header "Authorization: Bearer mb_sk_..."Connect Codex
Connect the Codex CLI to your workspace.
Add the server
codex mcp add medblocks --url https://app.medblocks.com/mcp \
--oauth-resource https://app.medblocks.com/mcpThe --oauth-resource flag matters. The server issues a signed token only when the client asks for this resource, so without the flag the connection is rejected.
Sign in
codex mcp login medblocksYour browser opens a Medblocks page. Sign in with your dashboard account. If you are new, Medblocks creates a workspace for you automatically.
Choose what it can access
Review the consent screen, tick the capabilities you want to grant, and click Allow. Confirm the connection with codex mcp list.
Codex stores the connection in ~/.codex/config.toml. To connect a scripted workspace without the browser sign in, add the server with an API key header instead.
codex mcp add medblocks --url https://app.medblocks.com/mcp \
--header "Authorization: Bearer mb_sk_..."Connect ChatGPT and Claude
The ChatGPT and claude.ai web apps both connect with the same server URL and handle sign in and consent in the browser.
https://app.medblocks.com/mcpClaude (claude.ai and Cowork)
The same connector works for Claude on the web and for Cowork.
Add a custom connector
Choose Add custom connector. Name it Medblocks, paste https://app.medblocks.com/mcp, and click Add. Leave the optional OAuth fields blank.
Sign in and choose what it can access
Claude opens a Medblocks page. Sign in, review the consent screen, tick the capabilities you want to grant, and click Allow.
ChatGPT
Turn on developer mode
Go to Settings > Security and login > Advanced security and turn on Developer mode. This is available on paid plans. You can leave “Enforce CSP in developer mode” on. The Medblocks in-chat panel is fully self-contained and works under the stricter policy.
Enter the server URL
In the New Plugin dialog, set Connection to Server URL and paste https://app.medblocks.com/mcp. Leave Authentication on OAuth, tick “I understand and want to continue”, and click Create.
Sign in and choose what it can access
ChatGPT opens a Medblocks page. Sign in, review the consent screen, tick the capabilities you want to grant, and click Allow.
When the AI assistant sets up a connection it can show a small Medblocks panel inside the chat where you search for your health system and open its sign in. If your client does not support in-chat panels, the AI assistant sends you a plain link instead, which works the same way.
What each permission allows
When you connect, Medblocks shows a consent screen with one tick box per capability, all ticked by default. Untick any you would rather not grant. The last one covers destructive actions, so you may want to leave it off unless you need it. The AI assistant always knows who you are (your name and email) and can see your workspace, so those are granted without a prompt.
| Permission | What it allows | Default |
|---|---|---|
| Connect your healthcare facilities | Lets the AI assistant search the hospitals, clinics, and insurers you name, securely connect to them, and bring your health records into your workspace. | On |
| Read your health records | Lets the AI assistant read the health records that have been brought into your workspace. | On |
| Manage people and delete data | Lets the AI assistant add or remove people in your workspace, disconnect facilities, and delete records. Not needed for everyday use. | On |
You can grant fewer permissions than the AI assistant requests. Anything you leave off is simply unavailable to it, and you can reconnect later with a different choice.
Tools
The server exposes eight tools. The AI assistant decides which ones to call based on what you ask, and the permissions above gate what it is allowed to reach.
| Tool | What it does |
|---|---|
get_workspace_overview | Reports who you are and a summary of your workspace. A good place to start. |
list_people | Lists everyone set up in your workspace. |
search_health_systems | Searches hospitals, clinics, and insurers by name. |
connect_health_system | Creates a secure link you open to sign in to your patient portal, and adds a new person to your workspace when one is needed. |
check_connection_status | Checks how a connection is going, for a single session or for a whole person. |
get_health_records | Reads a person’s medical records from their connected health systems. |
disconnect_health_system | Stops retrieving records from one connected health system and revokes access. |
delete_person | Permanently removes a person and all their retrieved records from the workspace. |
The last two tools change or delete data, so a well-behaved AI assistant confirms with you before it runs them.
Use the server as a developer
If you are driving the server from your own code, you can skip OAuth. Send a Medblocks API key as a bearer token on every request, and the server acts as that workspace.
curl https://app.medblocks.com/mcp \
-H "Authorization: Bearer mb_sk_..."Mint the key from the dashboard under Settings > API Keys. An API key is a server-side secret, so keep it out of browser code and client bundles, the same as any other Medblocks API key. See Set up your workspace for how to create and rotate keys.
A key uses the permissions stamped on it rather than the consent scopes above. Reach for OAuth when a person is connecting their own AI assistant, and reach for a key when a backend service needs the tools.
Revoke access later
You stay in control after you connect. In the dashboard, go to Settings > MCP server. Revoke the AI assistant there and it can no longer refresh its access, and any access already issued expires within an hour. Removing the connector inside the AI assistant stops that client from calling the server as well.
Troubleshooting
Unexpected content type text/html, or “No authorization support detected.” Your client reached a web page instead of the MCP server. Check that the URL is exactly https://app.medblocks.com/mcp with no trailing path, and that you did not point the client at a plain website address. A correct URL answers an unauthenticated request with a 401 and a WWW-Authenticate header, which is what starts the sign in.
Codex rejects the connection before sign in. Include the resource flag so Codex requests a signed token, otherwise the server declines. Add the server with --oauth-resource https://app.medblocks.com/mcp as shown above.