# `com.finchnode/health-records-demo` on anlyon.dev > Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX]. > No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour. - Page: https://anlyon.dev/servers/com.finchnode/health-records-demo - JSON: https://anlyon.dev/api/v1/servers/com.finchnode/health-records-demo - Version: 1.0.0 (active) - Publisher: com.finchnode (domain proven to the MCP Registry) - Runs: remote (streamable-http) - Sign-in to list tools: none - Metadata from the official MCP Registry, synced 2026-10-21T17:54:52.411Z Title and description, as the publisher wrote them: ```untrusted-server-text FinchNode Synthetic Health Records Synthetic EHR: medications, labs, conditions, allergies, immunizations, FHIR R4. No API key. ``` Scanned 2026-10-21T18:49:14.857Z over streamable-http. **14 tools: 1 change things and 13 only read.** | Group | Class | Tools | Claude Code | | --- | --- | --- | --- | | Deletes or cancels | destructive | 0 | deny | | Can't be undone | irreversible | 0 | ask | | Changes things | write | 1 | ask | | Only reads | read | 13 | allow | ## Findings No check matched anything in these tool definitions. ## Changes things (1) Creates or changes something that can be changed back. Claude Code: ask. ### `simulate_demo_connect` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text Use this to prototype the FinchNode connection journey. Returns a non-persistent synthetic session: complete for a record or behavior scenario, or the connect-cancelled or connect-failed outcome with no patient. ``` ## Only reads (13) Looks things up and changes nothing. Claude Code: allow. ### `get_demo_allergies` - The name "get_demo_allergies" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Use this to get only the allergies of baseline-adult, one of FinchNode's 12 synthetic scenarios from Northstar Health System (Synthetic) and Quillhaven Medical Group (Synthetic): Allergies and intolerances, normalized from FHIR R4 AllergyIntolerance. No account or API key. To get allergies together with other categories, call get_demo_health_record once instead of calling several of these tools. ``` ### `get_demo_conditions` - The name "get_demo_conditions" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Use this to get only the conditions of baseline-adult, one of FinchNode's 12 synthetic scenarios from Northstar Health System (Synthetic) and Quillhaven Medical Group (Synthetic): Diagnoses and problem list, normalized from FHIR R4 Condition. No account or API key. To get conditions together with other categories, call get_demo_health_record once instead of calling several of these tools. ``` ### `get_demo_demographics` - The name "get_demo_demographics" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Use this to get only the basic details (demographics) of baseline-adult, one of FinchNode's 12 synthetic scenarios from Northstar Health System (Synthetic) and Quillhaven Medical Group (Synthetic): Name, birth date, sex, contact information, normalized from FHIR R4 Patient. No account or API key. To get basic details together with other categories, call get_demo_health_record once instead of calling several of these tools. ``` ### `get_demo_encounters` - The name "get_demo_encounters" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Use this to get only the visits (encounters) of baseline-adult, one of FinchNode's 12 synthetic scenarios from Northstar Health System (Synthetic) and Quillhaven Medical Group (Synthetic): Encounters, appointments, and care teams, normalized from FHIR R4 Encounter, Appointment, CareTeam. No account or API key. To get visits together with other categories, call get_demo_health_record once instead of calling several of these tools. ``` ### `get_demo_fhir_bundle` - The name "get_demo_fhir_bundle" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Use this when a prototype or test needs the complete fictional FinchNode FHIR R4 Bundle for one scenario and its resource references. Behaviors apply to record reads only, so every scenario returns its Bundle. ``` ### `get_demo_health_record` - The name "get_demo_health_record" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Get any mix of demographics, medications, conditions, labs, vitals, allergies, immunizations, encounters in one call — prefer this over several single-category tools. Builds a record view using the authenticated API normalized data shape (schemaVersion 2). Fictional patients only; pick one with scenario. Consent and sync are simulated, with no usable change cursor. Empty categories describe the fixture only. ``` ### `get_demo_immunizations` - The name "get_demo_immunizations" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Use this to get only the immunizations of baseline-adult, one of FinchNode's 12 synthetic scenarios from Northstar Health System (Synthetic) and Quillhaven Medical Group (Synthetic): Vaccination history, normalized from FHIR R4 Immunization. No account or API key. To get immunizations together with other categories, call get_demo_health_record once instead of calling several of these tools. ``` ### `get_demo_labs` - The name "get_demo_labs" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Use this to get only the lab results (labs) of baseline-adult, one of FinchNode's 12 synthetic scenarios from Northstar Health System (Synthetic) and Quillhaven Medical Group (Synthetic): Laboratory observations and reports, normalized from FHIR R4 Observation, DiagnosticReport. No account or API key. To get lab results together with other categories, call get_demo_health_record once instead of calling several of these tools. ``` ### `get_demo_medications` - The name "get_demo_medications" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Use this to get only the medications of baseline-adult, one of FinchNode's 12 synthetic scenarios from Northstar Health System (Synthetic) and Quillhaven Medical Group (Synthetic): Active and past prescriptions, normalized from FHIR R4 MedicationRequest, MedicationDispense, MedicationAdministration. No account or API key. To get medications together with other categories, call get_demo_health_record once instead of calling several of these tools. ``` ### `get_demo_record` - The name "get_demo_record" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Legacy categorized FHIR response. Kept compatible for existing prototypes. For normalized platform-shaped data, use get_demo_health_record. Fictional patients only; pick one with scenario. ``` ### `get_demo_vitals` - The name "get_demo_vitals" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Use this to get only the vital signs (vitals) of baseline-adult, one of FinchNode's 12 synthetic scenarios from Northstar Health System (Synthetic) and Quillhaven Medical Group (Synthetic): Blood pressure, heart rate, weight, and similar measures, normalized from FHIR R4 Observation. No account or API key. To get vital signs together with other categories, call get_demo_health_record once instead of calling several of these tools. ``` ### `list_demo_scenarios` - The name "list_demo_scenarios" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text Use this first to choose a fictional scenario: 12 record, behavior (consent, rate-limit, and source-failure errors), and Connect session cases, each with its subject, categories, what it exercises, and links. Pass an id as scenario to the other demo tools. No clinical data. The controls and exercises fields describe the authenticated FinchNode sandbox; this accountless demo cannot perform them. ``` ### `search_demo_fhir` - The name "search_demo_fhir" says "search": a word for reading. Description, as the server wrote it: ```untrusted-server-text Use this to get all resources of one FHIR R4 type for one synthetic scenario's patient (baseline-adult unless patient_id names another). ``` ## Claude Code permissions For `.claude/settings.json`, assuming the server is installed as `health-records-demo`: ```json { "permissions": { "allow": [ "mcp__health-records-demo__list_demo_scenarios", "mcp__health-records-demo__get_demo_health_record", "mcp__health-records-demo__get_demo_record", "mcp__health-records-demo__get_demo_fhir_bundle", "mcp__health-records-demo__search_demo_fhir", "mcp__health-records-demo__get_demo_demographics", "mcp__health-records-demo__get_demo_medications", "mcp__health-records-demo__get_demo_conditions", "mcp__health-records-demo__get_demo_labs", "mcp__health-records-demo__get_demo_vitals", "mcp__health-records-demo__get_demo_allergies", "mcp__health-records-demo__get_demo_immunizations", "mcp__health-records-demo__get_demo_encounters" ], "ask": [ "mcp__health-records-demo__simulate_demo_connect" ], "deny": [] } } ```