Doctano runs an MCP server at app.doctano.com/api/mcp over streamable HTTP with OAuth. A compatible client can list your profiles, read biomarkers and reports, and, if you grant the write scope, upload a report. ChatGPT is the only client Doctano has verified today. Others are untested, so treat them as experimental.
This page is the technical companion to the ChatGPT setup guide. Same server, same scopes, different audience: one is written for a person clicking through a client, this one for someone deciding whether their client can talk to it at all.
What the server is
- Transport: MCP over streamable HTTP.
- Endpoint:
https://app.doctano.com/api/mcp, which is also the OAuth resource. - Authorisation: OAuth. Clients that support dynamic client registration can register themselves.
- Scopes:
health.readandhealth.write. Write is additive, so a write grant also passes the read checks. - Second entry point:
POST /api/mcp/uploadaccepts report files directly, with the same write scope.
What a client needs
| Requirement | Why it matters | Status |
|---|---|---|
| MCP over streamable HTTP | The server does not expose a stdio or local-command transport. | Required |
| OAuth authorization | Access is granted per account, not with a pasted API key. | Required |
| Dynamic client registration, or a client Doctano can register | The grant has to belong to a specific client. | Required for a self-service connection |
| Ability to attach files to a tool call | Needed for in-chat upload only. Reading works without it. | Optional |
| Ability to follow returned links | Tool results include in-app links to the report or biomarker behind a value. | Optional |
The tools behind the connection
Read tools are listed for any connection. Upload tools are listed only for a token that carries health.write, so a read-only connection does not see them at all.
| Tool | Scope | What it returns |
|---|---|---|
list_profiles | health.read | The profile names the account can access. |
get_user_profile | health.read | Account and profile details needed to choose the right person. |
get_health_summary | health.read | The latest report and flagged results for one profile. |
get_latest_biomarkers | health.read | The most recent value for each marker. |
search_biomarkers | health.read | Markers matching a query, with their codes and names. |
get_biomarker_history | health.read | All recorded values for one marker, in order. |
get_biomarker_summary | health.read | A marker's identity, code, unit, and its latest and previous values. |
get_abnormal_biomarkers | health.read | Results outside their reference range. |
search_reports | health.read | Reports for a profile, with dates and labs. |
get_report | health.read | One report with its extracted values. |
get_report_status | health.read | Whether a report is processing, processed, ready, or failed. |
get_doctano_context | health.read | The current Doctano product guide, for questions about the app itself. |
upload_report | health.write | Adds one or more files to a chosen profile. |
get_report_upload_link | health.write | An authenticated upload link with the profile preselected. |
Uploading from a client that cannot attach files
Not every client can hand a file to a tool. There are two fallbacks, and both need a write-scoped token.
- An upload link. The tool returns a signed-in upload address with the profile already chosen. The person signs in and uploads through the normal app flow.
- The HTTP receiver. A client that can send bytes posts to
https://app.doctano.com/api/mcp/uploadwith a bearer token, as multipart form data, raw binary, or a JSON body listing download URLs. Doctano fetches each URL server-side, so a temporary link never becomes the stored file address.
Limits
| Limit or code | Meaning |
|---|---|
| 50 MB per file | Matches the in-app upload limit. |
| 10 files, 100 MB total per request | Larger batches are rejected. |
| PDF, PNG, JPEG, TIFF | Checked by the file's magic bytes, not only its extension. |
| 400 | Missing or invalid profile, no files, too many files, or an unreadable body. |
| 401 and 403 | Missing or invalid token, or a token without the write scope. |
| 413 and 415 | A file or the request is too large, or the format check failed. |
| 422 and 429 | The download URL could not be fetched or every file failed, or the request was rate limited. |
Which clients are verified
ChatGPT is the only client Doctano has tested end to end, and it is the only one the setup guide covers. The server is written to the protocol, not to one vendor, but protocol support is not the same thing as a working product: clients differ in how they register, how they pass files, and how they present a scope prompt.
So the honest position is this. If your client supports the transport, the OAuth flow, and the scopes above, it may connect. Doctano has not verified it, cannot walk you through its menus, and cannot promise that a tool result will be displayed correctly. Nothing on this page is a claim that any specific untested client works.
What to check before you rely on it
- Grant the narrowest scope that answers your question. Read-only covers questions about results.
- Confirm the profile before an upload. Files in one call all go to the same profile.
- Verify important values against the original report. Extraction can be wrong.
- Revoke the grant when you are finished with it, from Account, then Connected Apps.