Developers · ChartVoyant API
MCP server
A Model Context Protocol server, live since October 7, 2026. Point Claude Code or any MCP client that can send a header at it with your API key, and an agent can look up patients, read the chart, and work the schedule and the inbox, bound to one practice on the same audit trail as every other call.
At a glance
| Status | Live in the sandbox and in production since October 7, 2026. |
| Endpoint | Sandbox: https://demo.chartvoyant.com/api/v1/mcpProduction: https://chartvoyant.com/api/v1/mcp |
| Authentication | A ChartVoyant API key: Authorization: Bearer cvk_…. A staff session or a SMART token is not an MCP credential. OAuth sign-in for MCP is not available yet. |
| Transport | Streamable HTTP, stateless. One JSON-RPC 2.0 message per POST, answered with one JSON response. GET and DELETE return 405: there is no standalone event stream and no session. |
| Protocol versions | MCP 2026-07-28, plus 2025-11-25, 2025-06-18 and 2025-03-26 for clients that open with initialize. |
| Limits | Request bodies up to 256 KB. The REST API rate limits apply. |
| Audit | Each tool call writes an event to the practice's audit log under your key, and the key's activity trail names the method and the tool. Arguments and results stay out of both. |
Connect a client
Claude Code
claude mcp add --transport http chartvoyant https://demo.chartvoyant.com/api/v1/mcp \ --header "Authorization: Bearer $CHARTVOYANT_API_KEY"
A config file (Claude Code's .mcp.json; other clients take the same url and headers)
{
"mcpServers": {
"chartvoyant": {
"type": "http",
"url": "https://demo.chartvoyant.com/api/v1/mcp",
"headers": { "Authorization": "Bearer ${CHARTVOYANT_API_KEY}" }
}
}
}
Any HTTP client
# List the tools this key can call
curl https://demo.chartvoyant.com/api/v1/mcp \
-H "Authorization: Bearer $CHARTVOYANT_API_KEY" \
-H "Content-Type: application/json" \
-H "MCP-Protocol-Version: 2025-11-25" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Tools
The key's access level decides the tools. A read-only key that tries a write tool gets a refusal that says so.
| Who gets it | Tools |
|---|---|
| Every key | get_practice_contextsearch_patientsget_patient_overviewget_patient_chartget_observationslist_patient_notesread_noteget_procedure_planget_patient_action_noteget_schedulefind_free_slotslist_waitlistlist_casesget_caseget_fax_inboxlist_patient_orderslist_outbound_faxessearch_facilitiesget_patient_billingget_patient_billing_detaillist_claimsget_claimget_claim_ledgerget_billing_worklistlist_prior_authsget_prior_authlist_directorysearch_terminologyPractice context and today's date, patients and the chart, notes, vitals and labs, the procedure plan, the schedule and open slots, the waitlist, inbox tasks and the fax inbox, orders and outbound faxes, billing, claims and prior authorizations, the staff directory and code lookups. |
| Full-access keys add | book_appointmentreschedule_appointmentcancel_appointmentadd_to_waitlistcreate_patient_caseupdate_caselink_case_to_patientlog_action_noteScheduling and inbox work. Booking checks double-booking, closures and the practice's booking rules first, and reports a conflict instead of booking over it. |
| Never over MCP | Chart entries, notes, signatures, prescriptions and orders; faxes and patient messages; eligibility and claim-status checks; claims, payments and statements.A person does those in ChartVoyant. That keeps clinical decisions with a clinician. |
Times are practice-local. Have the agent call get_practice_context first. A timestamp such as 2026-10-08T09:00:00.000Z means 9:00 AM at the practice; the Z does not mean UTC. Money is in integer cents.
Before you connect a production key
The model sees the chart. MCP hands chart data to the AI model behind your client. With a production key that data is PHI, so you need a BAA with the model provider that covers the specific product, plan and features you use (MCP, connector and tool traffic included), terms that keep the data out of training, and the practice's written approval. A consumer chat account is never covered. Until all of that is in place, build on the sandbox.
The risk is yours, in writing. A production key used with any AI agent needs version 1.1 of the API Use Agreement, which puts the agent, its model provider and the data they receive on you.
The key stays in your own client. One key per person, kept in an environment variable or the system's credential store, on a computer your organization manages. Never in a shared or committed config file, and never pasted into the chat itself.
How to get access
- Start in the sandbox
Email info@chartvoyant.com with your project, what you are building, a technical contact and a line accepting the Sandbox Terms. Sandbox keys are usually issued the same day.
- Go to production with a practice
A production key needs a sponsoring practice that confirms the request, a signed API Use Agreement, and a BAA between you and the practice. The steps are on the developers page.
- Contact ChartVoyant support with questions
Email info@chartvoyant.com or use the support form. A person reads every request.