# What is MCP, and what does a health MCP server do?

> Doctano turns the lab reports you already have into one private, source-linked health timeline, with an AI that answers from your own results.

MCP is the difference between an assistant that knows things and one that can look things up on your behalf. In health, that difference is the whole argument.

This is the Markdown version of https://doctano.com/guides/mcp-health-data. The HTML page is the canonical version.

MCP is an open protocol that lets an AI client call tools on a server and read the results, instead of relying on what fits in a pasted prompt. A health MCP server exposes a person's own health data behind an OAuth grant. Doctano runs one at app.doctano.com/api/mcp.

## The problem MCP solves

An AI assistant answers from the context it is given. For a lab report, that context has usually meant a PDF attached to a chat, or numbers copied into the prompt. Both are a snapshot. Neither is a history, and neither survives to the next conversation.

The obvious fix is to give the assistant access to the data directly. The obvious problem is that every data source has its own interface. MCP standardises the boring middle: how a client discovers what a server can do, how it calls one of those tools, how the result comes back, and how the person authorised the whole thing.

## The parts, in plain language

| Term | What it means | In Doctano |
| --- | --- | --- |
| Client | The AI product that asks for data. | ChatGPT is the only client Doctano has verified. |
| Server | The service that exposes data through defined tools. | Doctano's MCP server at `/api/mcp`. |
| Tool | One operation a client may call, with a typed input and output. | List profiles, read a marker's history, read a report, upload a report. |
| Transport | How messages travel between client and server. | Streamable HTTP over HTTPS. |
| Scope | The permission a person approved. | `health.read` or `health.write`. |
| Grant | The record that one client may use one account's data, until revoked. | Managed from Account, then Connected Apps. |

## Why health is the hard case

Most MCP servers expose something harmless: a calendar, a notes folder, a code repository. Health data changes the risk in four ways.

- **The data is identifiable.** A lab report carries a name, a date of birth, and often a patient id, alongside the results.
- **Access is per person, not per account.** One login can hold several people's timelines, and a caregiver should not be able to reach a stranger's results by guessing a profile.
- **A result needs a source.** An answer that says "your LDL is 140" is worth very little if nobody can open the report it came from.
- **Wrong answers have consequences.** A misread decimal point is not a broken calendar event.

So a health server has to be narrower than a general one. Doctano's version requires a profile for most calls and returns a profile-not-available message rather than another person's data. Results carry links back to the report. The scope decides whether writing is possible at all, and write access is limited to adding reports.

## What a health MCP server should expose

| Reasonable for a health server | Overreach |
| --- | --- |
| List the people whose data the account can access | Return data for a profile the account cannot access |
| Read a marker's values and reference ranges over time | Return a diagnosis, a treatment, or a dose |
| Read one report and link back to the original file | Expose a public URL to a report |
| Add a report to a profile the user chose | Edit, backdate, or delete a result |
| Report processing status | Manage profiles, sharing, or account settings |

## What Doctano's server actually does

With a read grant, a client can list profile names, read a health summary, fetch the latest value for each marker, search for one marker, read a marker's history, list results outside their ranges, search and read reports, and check processing status. Marker and report links carry the profile they belong to, so opening one switches the app to that person first.

With a write grant, it can also upload a report to a profile you choose, and generate an upload link for a client that cannot attach files. It cannot edit or delete a report, manage or delete profiles, or change account settings. There is no second connector URL: the same server carries both scopes, and the upload receiver uses the same write grant.

## Infrastructure, not another dashboard

A dashboard asks for your attention. A server answers a question another tool asked. The distinction matters because the alternative to a connector is not a better dashboard; it is a person pasting a PDF into a chat window at eleven at night and hoping the numbers in the reply match the paper.

Doctano still has an app, and DoctanoAI still answers inside it. The server is there so the same organised history can be queried where the question is being asked, under a permission you can see and revoke.

## Before you connect anything

- Ask what the client will do with the data it reads, and what its retention settings are.
- Grant read-only unless you actually want uploads.
- Check that the client shows you the source report behind a value, not only the value.
- Revoke the grant when you are done. A grant that is not needed is a liability.

## MCP and health data

**Is MCP the same as an API?**

No. An API is one service's own interface, with its own endpoints and conventions. MCP is a shared way for a client to discover a server's tools and call them, so the same client can work with many servers without custom code for each one.

**Does a health MCP server let an AI read all of my data?**

Only what the grant allows. In Doctano, a connection can read profiles your account can access, and it needs a profile id for most calls. The scope decides whether uploading is possible at all.

**Can an AI change or delete my results through MCP?**

In Doctano, no. Reports can be added with the write scope, but editing and deleting are not exposed to the server, and neither is profile or account management.

**Do I need MCP to use Doctano?**

No. The web app works on its own, and DoctanoAI inside the app reads your results without any connector. MCP is only for connecting an external AI client.

**Which AI clients can connect to Doctano over MCP?**

ChatGPT is the only client Doctano has verified. The server is written to the protocol, so another client that supports the same transport and OAuth flow may work, but Doctano has not tested it.

## What this is not

**Not medical care.** A connector moves data; it does not interpret it for you. Doctano and any connected assistant are informational tools, and a qualified professional decides what a result means.

## Links

- [Homepage](https://doctano.com/)
- [Lab report tracker](https://doctano.com/lab-report-tracker)
- [Connecting an AI assistant](https://doctano.com/guides/connect-ai-assistant)
- [Connect ChatGPT](https://doctano.com/guides/connect-chatgpt-to-doctano)
- [Health context for AI](https://doctano.com/guides/health-context-for-ai)
- [All guides](https://doctano.com/guides/)