Skip to content
anlyon.devby Anlyon

Halaxy MCP by usefulapi

io.usefulapi/halaxyusefulapi.iostreamable-httpv1.0.0Scanned

Read Halaxy patients, appointments, slots and invoices; create patients, appointments and notes.

35 tools: 1 can delete or cancel things, 4 change things and 30 only read.

Tools: 1 delete, 0 irreversible, 4 write, 30 read.
  • Reads private data · 2
  • Reads text others write · 0
  • Can send data out · 0
  • 1 finding

Anlyon alternative

5 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

35 tools

Deletes or cancels 1Claude Code: deny
  • halaxy_update_appointment_statusWrites to the live Halaxy account.No findings

    Why it is in this group

    • The name "halaxy_update_appointment_status" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Writes to the live Halaxy account. Sets the patient's status on an appointment (shown in the Halaxy calendar), for example arrived, attended, confirmed or cancelled. "cancelled (no charge)" also sets the invoice to $0. For a group appointment pass patient_id to say whose status changes. PATCH /main/Appointment/{id}.

    Annotations the server declares

    • title: Update an appointment status
    • destructiveHint: true
    • idempotentHint: true
Changes things 4Claude Code: ask
  • halaxy_create_appointmentWrites to the live Halaxy account.No findings

    Why it is in this group

    • The name "halaxy_create_appointment" says "create": a word for a change.
    Description, as the server wrote it
    Writes to the live Halaxy account. Books an appointment for a patient with a practitioner at a clinic (the practitioner role). Halaxy also creates the invoice, clinical note and reminder. Use halaxy_find_available_appointments for free times. By default a double booking is refused (HTTP 409, nothing created). POST /main/Appointment/$book.

    Annotations the server declares

    • title: Book an appointment
    • readOnlyHint: false
    • destructiveHint: false
  • halaxy_create_clinical_noteWrites to the live Halaxy account.No findings

    Why it is in this group

    • The name "halaxy_create_clinical_note" says "create": a word for a change.
    Description, as the server wrote it
    Writes to the live Halaxy account. Adds a clinical note to a patient's record as a DRAFT (preliminary); the practitioner reviews and publishes it in Halaxy. The author is a PractitionerRole (practitioner at a clinic). Only HTML text is supported. POST /main/DocumentReference.

    Annotations the server declares

    • title: Create a draft clinical note
    • readOnlyHint: false
    • destructiveHint: false
  • halaxy_create_patientWrites to the live Halaxy account.No findings

    Why it is in this group

    • The name "halaxy_create_patient" says "create": a word for a change.
    Description, as the server wrote it
    Writes to the live Halaxy account. Creates a new patient record (always a new one: search with halaxy_list_patients first to avoid a duplicate). Pass managing_organization (the practice group id, e.g. PG-12345, from halaxy_list_organizations) if Halaxy asks for it. POST /main/Patient.

    Annotations the server declares

    • title: Create a patient
    • readOnlyHint: false
    • destructiveHint: false
  • halaxy_list_feesList or search fees (ChargeItemDefinition): the services and products a practice charges for.1 finding

    Why it is in this group

    • The name "halaxy_list_fees" says "list": a word for reading.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "halaxy_list_fees" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true}; The name "halaxy_list_fees" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    List or search fees (ChargeItemDefinition): the services and products a practice charges for. Filters combine with AND. Paged: pass next_page as page. GET /main/ChargeItemDefinition.

    Annotations the server declares

    • title: List fees
    • readOnlyHint: true
Only reads 30Show 30 read-only tools
  • halaxy_find_available_appointmentsFind free appointment times between start and end for a given duration, respecting each practitioner's online booking preferences (buffer time, lead time, advance booking limit).No findings

    Why it is in this group

    • The name "halaxy_find_available_appointments" says "find": a word for reading.
    Description, as the server wrote it
    Find free appointment times between start and end for a given duration, respecting each practitioner's online booking preferences (buffer time, lead time, advance booking limit). Narrow it with practitioner, practitioner_role or organization. GET /main/Appointment/$find.

    Annotations the server declares

    • title: Find available appointment times
    • readOnlyHint: true
  • halaxy_get_appointmentFetch an appointment with its participants and statuses (HEALTH DATA) by id.No findings

    Why it is in this group

    • The name "halaxy_get_appointment" says "get": a word for reading.
    Description, as the server wrote it
    Fetch an appointment with its participants and statuses (HEALTH DATA) by id. GET /main/Appointment/{id}.

    Annotations the server declares

    • title: Get an appointment
    • readOnlyHint: true
  • halaxy_get_coverageFetch a patient's coverage (claim details) record by id.No findings

    Why it is in this group

    • The name "halaxy_get_coverage" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a patient's coverage (claim details) record by id. GET /main/Coverage/{id}.

    Annotations the server declares

    • title: Get patient coverage
    • readOnlyHint: true
  • halaxy_get_feeFetch a fee (ChargeItemDefinition) by id.No findings

    Why it is in this group

    • The name "halaxy_get_fee" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a fee (ChargeItemDefinition) by id. GET /main/ChargeItemDefinition/{id}.

    Annotations the server declares

    • title: Get a fee
    • readOnlyHint: true
  • halaxy_get_healthcare_serviceFetch an appointment type by id.No findings

    Why it is in this group

    • The name "halaxy_get_healthcare_service" says "get": a word for reading.
    Description, as the server wrote it
    Fetch an appointment type by id. GET /main/HealthcareService/{id}.

    Annotations the server declares

    • title: Get an appointment type
    • readOnlyHint: true
  • halaxy_get_invoiceFetch an invoice by id.No findings

    Why it is in this group

    • The name "halaxy_get_invoice" says "get": a word for reading.
    Description, as the server wrote it
    Fetch an invoice by id. GET /main/Invoice/{id}.

    Annotations the server declares

    • title: Get an invoice
    • readOnlyHint: true
  • halaxy_get_invoice_lineFetch an invoice line by id.No findings

    Why it is in this group

    • The name "halaxy_get_invoice_line" says "get": a word for reading.
    Description, as the server wrote it
    Fetch an invoice line by id. GET /main/InvoiceLine/{id}.

    Annotations the server declares

    • title: Get an invoice line
    • readOnlyHint: true
  • halaxy_get_organizationFetch a practice group, clinic, funder or external practice by id.No findings

    Why it is in this group

    • The name "halaxy_get_organization" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a practice group, clinic, funder or external practice by id. GET /main/Organization/{id}.

    Annotations the server declares

    • title: Get an organization
    • readOnlyHint: true
  • halaxy_get_patientFetch a patient record (HEALTH DATA) by id.No findings

    Why it is in this group

    • The name "halaxy_get_patient" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a patient record (HEALTH DATA) by id. GET /main/Patient/{id}.

    Annotations the server declares

    • title: Get a patient
    • readOnlyHint: true
  • halaxy_get_payment_transactionFetch a payment transaction by id.No findings

    Why it is in this group

    • The name "halaxy_get_payment_transaction" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a payment transaction by id. GET /main/PaymentTransaction/{id}.

    Annotations the server declares

    • title: Get a payment transaction
    • readOnlyHint: true
  • halaxy_get_practitionerFetch a practitioner or administrator by id.No findings

    Why it is in this group

    • The name "halaxy_get_practitioner" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a practitioner or administrator by id. GET /main/Practitioner/{id}.

    Annotations the server declares

    • title: Get a practitioner
    • readOnlyHint: true
  • halaxy_get_practitioner_roleFetch a practitioner role at a clinic location by id.No findings

    Why it is in this group

    • The name "halaxy_get_practitioner_role" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a practitioner role at a clinic location by id. GET /main/PractitionerRole/{id}.

    Annotations the server declares

    • title: Get a practitioner role
    • readOnlyHint: true
  • halaxy_get_referralFetch a referral (HEALTH DATA) by id.No findings

    Why it is in this group

    • The name "halaxy_get_referral" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a referral (HEALTH DATA) by id. GET /main/Referral/{id}.

    Annotations the server declares

    • title: Get a referral
    • readOnlyHint: true
  • halaxy_get_referral_definitionFetch a referral template by id.No findings

    Why it is in this group

    • The name "halaxy_get_referral_definition" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a referral template by id. GET /main/ReferralDefinition/{id}.

    Annotations the server declares

    • title: Get a referral template
    • readOnlyHint: true
  • halaxy_get_scheduleFetch a practitioner schedule by id.No findings

    Why it is in this group

    • The name "halaxy_get_schedule" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a practitioner schedule by id. GET /main/Schedule/{id}.

    Annotations the server declares

    • title: Get a schedule
    • readOnlyHint: true
  • halaxy_get_slotFetch a time slot by id.No findings

    Why it is in this group

    • The name "halaxy_get_slot" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a time slot by id. GET /main/Slot/{id}.

    Annotations the server declares

    • title: Get a time slot
    • readOnlyHint: true
  • halaxy_list_appointmentsList or search appointments (HEALTH DATA: names the patient).No findings

    Why it is in this group

    • The name "halaxy_list_appointments" says "list": a word for reading.
    Description, as the server wrote it
    List or search appointments (HEALTH DATA: names the patient). Filters combine with AND. Paged: pass next_page as page. GET /main/Appointment.

    Annotations the server declares

    • title: List appointments
    • readOnlyHint: true
  • halaxy_list_coverageList or search patients' health fund membership and claim details (HEALTH DATA).No findings

    Why it is in this group

    • The name "halaxy_list_coverage" says "list": a word for reading.
    Description, as the server wrote it
    List or search patients' health fund membership and claim details (HEALTH DATA). Filters combine with AND. Paged: pass next_page as page. GET /main/Coverage.

    Annotations the server declares

    • title: List patient coverage (claim details)
    • readOnlyHint: true
  • halaxy_list_healthcare_servicesList or search appointment types used by the practice group, clinics and practitioners.No findings

    Why it is in this group

    • The name "halaxy_list_healthcare_services" says "list": a word for reading.
    Description, as the server wrote it
    List or search appointment types used by the practice group, clinics and practitioners. Filters combine with AND. Paged: pass next_page as page. GET /main/HealthcareService.

    Annotations the server declares

    • title: List appointment types
    • readOnlyHint: true
  • halaxy_list_invoice_linesList or search invoice lines: single fees on invoices.No findings

    Why it is in this group

    • The name "halaxy_list_invoice_lines" says "list": a word for reading.
    Description, as the server wrote it
    List or search invoice lines: single fees on invoices. Filters combine with AND. Paged: pass next_page as page. GET /main/InvoiceLine.

    Annotations the server declares

    • title: List invoice lines
    • readOnlyHint: true
  • halaxy_list_invoicesList or search invoices of the practice group.No findings

    Why it is in this group

    • The name "halaxy_list_invoices" says "list": a word for reading.
    Description, as the server wrote it
    List or search invoices of the practice group. Filters combine with AND. Paged: pass next_page as page. GET /main/Invoice.

    Annotations the server declares

    • title: List invoices
    • readOnlyHint: true
  • halaxy_list_organizationsList or search the practice group, its clinic locations, funders and external practices (practice group ids look like PG-12345).No findings

    Why it is in this group

    • The name "halaxy_list_organizations" says "list": a word for reading.
    Description, as the server wrote it
    List or search the practice group, its clinic locations, funders and external practices (practice group ids look like PG-12345). Filters combine with AND. Paged: pass next_page as page. GET /main/Organization.

    Annotations the server declares

    • title: List organizations and clinics
    • readOnlyHint: true
  • halaxy_list_patientsList or search patient records (demographics and contact details; HEALTH DATA).Reads private dataNo findings

    Why it is in this group

    • The name "halaxy_list_patients" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    Description, as the server wrote it
    List or search patient records (demographics and contact details; HEALTH DATA). Filters combine with AND. Paged: pass next_page as page. GET /main/Patient.

    Annotations the server declares

    • title: List or search patients
    • readOnlyHint: true
  • halaxy_list_payment_transactionsList or search payment transactions recorded on invoices.No findings

    Why it is in this group

    • The name "halaxy_list_payment_transactions" says "list": a word for reading.
    Description, as the server wrote it
    List or search payment transactions recorded on invoices. Filters combine with AND. Paged: pass next_page as page. GET /main/PaymentTransaction.

    Annotations the server declares

    • title: List payment transactions
    • readOnlyHint: true
  • halaxy_list_practitioner_rolesList or search practitioner roles: a practitioner's association with one clinic location (the id used when booking and for clinical notes).Reads private dataNo findings

    Why it is in this group

    • The name "halaxy_list_practitioner_roles" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "note": it reads notes.
    Description, as the server wrote it
    List or search practitioner roles: a practitioner's association with one clinic location (the id used when booking and for clinical notes). Filters combine with AND. Paged: pass next_page as page. GET /main/PractitionerRole.

    Annotations the server declares

    • title: List practitioner roles (clinic locations)
    • readOnlyHint: true
  • halaxy_list_practitionersList or search practitioners and administrators of the practice group (ids look like PR-12345).No findings

    Why it is in this group

    • The name "halaxy_list_practitioners" says "list": a word for reading.
    Description, as the server wrote it
    List or search practitioners and administrators of the practice group (ids look like PR-12345). Filters combine with AND. Paged: pass next_page as page. GET /main/Practitioner.

    Annotations the server declares

    • title: List practitioners
    • readOnlyHint: true
  • halaxy_list_referral_definitionsList or search referral templates with preset properties.No findings

    Why it is in this group

    • The name "halaxy_list_referral_definitions" says "list": a word for reading.
    Description, as the server wrote it
    List or search referral templates with preset properties. Filters combine with AND. Paged: pass next_page as page. GET /main/ReferralDefinition.

    Annotations the server declares

    • title: List referral templates
    • readOnlyHint: true
  • halaxy_list_referralsList or search referrals from one healthcare provider to another (HEALTH DATA).No findings

    Why it is in this group

    • The name "halaxy_list_referrals" says "list": a word for reading.
    Description, as the server wrote it
    List or search referrals from one healthcare provider to another (HEALTH DATA). Filters combine with AND. Paged: pass next_page as page. GET /main/Referral.

    Annotations the server declares

    • title: List referrals
    • readOnlyHint: true
  • halaxy_list_schedulesList or search schedules: containers of bookable time slots per practitioner.No findings

    Why it is in this group

    • The name "halaxy_list_schedules" says "list": a word for reading.
    Description, as the server wrote it
    List or search schedules: containers of bookable time slots per practitioner. Filters combine with AND. Paged: pass next_page as page. GET /main/Schedule.

    Annotations the server declares

    • title: List practitioner schedules
    • readOnlyHint: true
  • halaxy_list_slotsList or search time slots of practitioner schedules (free or busy).No findings

    Why it is in this group

    • The name "halaxy_list_slots" says "list": a word for reading.
    Description, as the server wrote it
    List or search time slots of practitioner schedules (free or busy). Filters combine with AND. Paged: pass next_page as page. GET /main/Slot.

    Annotations the server declares

    • title: List time slots
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged untrusted-input or outbound.

Reads private data2
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnhalaxy_list_fees

    The server marks "halaxy_list_fees" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true}; The name "halaxy_list_fees" says "list": a word for reading.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http halaxy https://halaxy.usefulapi.io/mcp
claude mcp add --transport http halaxy https://halaxy.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__halaxy__halaxy_list_patients",
      "mcp__halaxy__halaxy_list_practitioners",
      "mcp__halaxy__halaxy_list_practitioner_roles",
      "mcp__halaxy__halaxy_list_organizations",
      "mcp__halaxy__halaxy_list_appointments",
      "mcp__halaxy__halaxy_list_schedules",
      "mcp__halaxy__halaxy_list_slots",
      "mcp__halaxy__halaxy_list_healthcare_services",
      "mcp__halaxy__halaxy_list_coverage",
      "mcp__halaxy__halaxy_list_invoices",
      "mcp__halaxy__halaxy_list_invoice_lines",
      "mcp__halaxy__halaxy_list_payment_transactions",
      "mcp__halaxy__halaxy_list_referrals",
      "mcp__halaxy__halaxy_list_referral_definitions",
      "mcp__halaxy__halaxy_get_patient",
      "mcp__halaxy__halaxy_get_practitioner",
      "mcp__halaxy__halaxy_get_practitioner_role",
      "mcp__halaxy__halaxy_get_organization",
      "mcp__halaxy__halaxy_get_appointment",
      "mcp__halaxy__halaxy_get_schedule",
      "mcp__halaxy__halaxy_get_slot",
      "mcp__halaxy__halaxy_get_healthcare_service",
      "mcp__halaxy__halaxy_get_fee",
      "mcp__halaxy__halaxy_get_coverage",
      "mcp__halaxy__halaxy_get_invoice",
      "mcp__halaxy__halaxy_get_invoice_line",
      "mcp__halaxy__halaxy_get_payment_transaction",
      "mcp__halaxy__halaxy_get_referral",
      "mcp__halaxy__halaxy_get_referral_definition",
      "mcp__halaxy__halaxy_find_available_appointments"
    ],
    "ask": [
      "mcp__halaxy__halaxy_list_fees",
      "mcp__halaxy__halaxy_create_patient",
      "mcp__halaxy__halaxy_create_appointment",
      "mcp__halaxy__halaxy_create_clinical_note"
    ],
    "deny": [
      "mcp__halaxy__halaxy_update_appointment_status"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as halaxy. Review it before you use it.

Capability tags behind 2 rules
  • mcp__halaxy__halaxy_list_patients private-data
  • mcp__halaxy__halaxy_list_practitioner_roles private-data

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/halaxy/verify?hash=a3299c39e0fd116aef363f8c794bf49dd94195f4a19c65cf375137371dfe318d" | jq -e '.changed == false'

Pinned hash a3299c39e0fd, from Oct 26, 2026, 00:26 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/halaxy/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.usefulapi/halaxy
[![anlyon.dev](https://anlyon.dev/badge/io.usefulapi/halaxy.svg)](https://anlyon.dev/servers/io.usefulapi/halaxy)

Source: MCP Registry · repository. Synced Oct 26, 2026, 00:25 UTC.