ClinicMarketIQ Public Data

io.github.evgeniy-yudinPublished by GitHub account evgeniy-yudinv0.1.0Updated Oct 27, 2026

Read-only U.S. healthcare dataset metadata, schemas, immutable downloads, and checksums.

VerifiedStreamable HTTPWeb executableFiles & StorageData & Analytics

Overview

AI-generated overview

Read-only remote MCP server for discovering ClinicMarketIQ public U.S. healthcare datasets: catalog search, metadata, schemas, download URLs and checksum…

What you can do
  • List and search public dataset families by ID, slug, name or publisher
  • Fetch a dataset's canonical machine index with provenance and manifest pointer
  • Retrieve declared JSON schemas from a dataset's immutable manifest
  • Get direct download URLs, sizes, formats and declared SHA-256 values
  • Compare a caller-supplied SHA-256 digest against the declared one
When to use it
Useful when an assistant needs to find, inspect or verify public U.S. healthcare dataset releases from ClinicMarketIQ before downloading them, for example to check schemas or confirm a file's checksum.
Requirements
A remote Streamable HTTP endpoint; no authentication, API keys or environment variables are declared. The server itself needs no local runtime; the README's Node.js requirement applies only to running the Worker locally.
Before you install
All tools are read-only and the server never proxies dataset bytes, so files must be downloaded directly from ClinicMarketIQ. The endpoint is unauthenticated and stateless, with rate limiting left to Cloudflare rules. Metadata is discovery information only and does not imply clinical advice or permission to reuse third-party data.

Installation

In SourceWeft

  1. Open ClinicMarketIQ Public Data in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.evgeniy-yudin%2Fclinicmarketiq-public-data/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "clinicmarketiq-public-data": {
      "type": "http",
      "url": "https://clinicmarketiq-public-mcp.rotgar-fizkl.workers.dev/mcp"
    }
  }
}

README

ClinicMarketIQ public MCP Worker

Minimal stateless, read-only remote MCP server for discovery of ClinicMarketIQ public datasets. It exposes Streamable HTTP at /mcp and a process-only health response at /healthz.

This directory is intentionally self-contained. The reviewed build is deployed at https://clinicmarketiq-public-mcp.rotgar-fizkl.workers.dev/mcp; the canonical setup page is https://clinicmarketiq.com/mcp/. External MCP Registry publication is tracked by server.json.

Tools

ToolPurpose
list_datasetsPage through compact public catalog summaries.
search_datasetsSearch dataset ID, slug, name, and publisher.
get_dataset_metadataFetch a dataset's canonical public machine index.
get_schemaFollow the immutable manifest and return its declared JSON schema(s).
get_download_urlReturn direct immutable artifact URLs, sizes, formats, and SHA-256 values; never proxy file bytes.
verify_checksumCompare a caller-provided SHA-256 value with the digest declared in canonical metadata. It does not re-download and hash large artifacts.

The Worker proxies small canonical JSON documents from https://clinicmarketiq.com rather than copying release metadata into the server bundle. Every derived URL is restricted to that exact origin and an allowlisted public path. Dataset bytes are never fetched by the MCP server.

Local verification

Requires Node.js 22.18+ or 24.11+ (odd-numbered Node releases are not supported by the pinned Vitest toolchain).

sh
npm installnpm run typesnpm run checknpm testnpm run dry-run

Start locally with npm run dev, then connect an MCP client or the MCP Inspector to http://localhost:8787/mcp. npm run dry-run bundles and validates the Worker but does not deploy it.

Security and operational boundaries

  • All six tools are annotated read-only, non-destructive, and idempotent.
  • The server uses Cloudflare's stateless createMcpHandler; there is no Durable Object, KV, D1, session store, or write-capable binding.
  • Upstream fetches use a fixed origin, reject redirects, require JSON, have an 8-second timeout, and stream into bounded buffers. Catalog, index, manifest, and schema documents have separate size ceilings.
  • Catalog routes, release IDs, dataset IDs, slugs, manifest URLs, schema names, download URLs, encodings, and SHA-256 values are validated before being returned or followed.
  • MCP request bodies are streamed into a bounded 64 KiB buffer and rejected above that limit, including chunked requests without Content-Length. A matching Cloudflare WAF body-size rule should reject abuse before Worker CPU is consumed.
  • Browser Origin and endpoint Host validation are provided by the MCP handler. Before adding a custom domain, configure exact allowedHostnames, allowedOriginHostnames, and CORS origins; do not use wildcard origin bypasses for the public unauthenticated route.
  • No authentication is required because every exposed action reads already-public metadata. If tools later expose non-public data or costly computation, add OAuth/Cloudflare Access and per-tool authorization before release.
  • No request bodies, dataset queries, artifact URLs, or auth tokens are logged. Structured error logs contain only method, path, and a bounded error message.

Rate limiting

This Worker is stateless, so it does not pretend to enforce a reliable per-client counter in isolate memory. Before external registration, attach a Cloudflare rate-limiting rule to the exact /mcp route (for example, by verified client identity when OAuth exists, otherwise IP plus a conservative burst/window), and add a WAF rule for malformed or oversized requests. Monitor 429 rate, upstream error rate, CPU time, and subrequest volume before increasing limits.

The public metadata origin should also retain its own cache and abuse controls. Do not turn get_download_url into a byte proxy: clients should download immutable artifacts directly from ClinicMarketIQ so CDN controls and checksums remain authoritative.

Deployment and registration gate

Before changing, redeploying, or registering a new version of this server externally:

  1. Re-run npm run types, npm run check, npm test, and npm run dry-run from a clean checkout.
  2. Confirm the current https://clinicmarketiq.com/catalog.json and at least one dataset machine index, immutable manifest, schema, and download URL return the expected content types and release ID.
  3. Choose the final Worker/custom-domain hostname and configure exact MCP Host/Origin policy.
  4. Add route-level WAF and rate-limiting rules, then test 413/429 behavior.
  5. Perform an independent YMYL/privacy/rights review. This server is discovery infrastructure and must not imply that metadata is clinical advice, all-payer coverage, or permission to reuse third-party data.
  6. Deploy to a non-production environment, validate with the MCP Inspector, and only then decide whether to register the endpoint with external clients.

References

Source: mcp/README.md at commit 4180e84

Tools

6

list_datasets

List ClinicMarketIQ datasets

List public ClinicMarketIQ dataset families from the canonical catalog. Returns metadata summaries, not observation rows.

Parameterslimitoffset

search_datasets

Search ClinicMarketIQ datasets

Search public dataset family IDs, names, slugs, and publishers in the canonical ClinicMarketIQ catalog.

Parameterslimitqueryrequired

get_dataset_metadata

Get dataset metadata

Fetch the canonical public machine index for one ClinicMarketIQ dataset family, including provenance-facing download metadata and immutable manifest pointer.

Parametersdatasetrequired

get_schema

Get dataset schema

Fetch schema JSON declared by a dataset's immutable public manifest. If schema_name is omitted, returns all declared schemas (currently capped at 10).

Parametersdatasetrequiredschema_name

get_download_url

Get immutable download URL

Return canonical direct download URLs and declared SHA-256 values for a public dataset. This tool never proxies the dataset bytes.

Parametersgroupformatdatasetrequired

verify_checksum

Verify a declared checksum

Compare a caller-provided SHA-256 digest with the canonical digest declared in the public dataset machine index. This bounded check does not download or re-hash large artifact bytes.

Parameterssha256requireddatasetrequiredfilenamerequired

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.