MyMedi-AI

@mymedi-ai/mcp-server

[npm version] [license: MIT] [MCP]

MCP server for DME billing and medical coding. Connect Claude, Cursor, VS Code or any MCP client to 32 tools — code lookup across a database of 90K+ ICD-10-CM, CPT and HCPCS codes, DMEPOS fee schedules, Medicare prior-authorization and face-to-face list checks, denial-code guidance and pre-submission claim checks — plus five DME billing prompts and three dataset resources. Six tools work with no API key.

PHI-free by design: the tools take codes, modifiers, dates of service and de-identified text, never patient identifiers. Apart from drawing credits for paid calls, no tool changes anything except buy_credits, which opens a Stripe checkout session (nothing is charged until checkout is completed in the browser).

Claude (web or desktop) users: on Free, Pro and Max plans, open Customize → Connectors → + Add → Add custom connector, give it a name and the URL https://mymedi-ai.com/mcp-stream, then Add → Connect. On Team and Enterprise plans an Owner adds it once under Organization settings → Connectors → Add → Custom → Web, and members then Connect it from Customize → Connectors. The endpoint is OAuth-protected: Claude registers itself and asks you to sign in to MyMedi-AI once, and the first connector sign-in comes with free starter credits. There is no API key to copy.

Quick Start

Requires Node.js 20 or later.

Install

claude mcp add mymedi-ai --env MCP_API_KEY=your-api-key -- npx -y @mymedi-ai/mcp-server

Leave out --env MCP_API_KEY=… to start with the six free tools. Other clients are under Client setup.

Get an API key (for the paid tools)

Registration is a POST request, not a web page:

curl -X POST https://mymedi-ai.com/bot-marketplace/register \  -H "Content-Type: application/json" \  -d '{"name": "my-agent"}'# → { "apiKey": "...", "credits": ..., "quickStart": { ... } }

Set the returned apiKey as MCP_API_KEY. (MYMEDI_API_KEY, the name the registration response prints, is accepted too; MCP_API_KEY wins when both are set.) A new key comes with free starter credits; the buy_credits tool adds more.

Or try a free endpoint

curl "https://mymedi-ai.com/agent/v1/demo?code=99213"

Returns basic code metadata, rate-limited to 60 requests per hour per IP.

Free tools (no API key)

Install the server without MCP_API_KEY and these work immediately (60 requests per hour per IP):

The other 26 tools need an API key (or the connector sign-in): 24 are paid — per call, or per code for code_lookup_batch, code_validate_batch and pa_exposure_report — and account_status and buy_credits are free but need the key to identify the account.

Client setup

Claude Desktop

Add to claude_desktop_config.json:

{  "mcpServers": {    "mymedi-ai": {      "command": "npx",      "args": ["-y", "@mymedi-ai/mcp-server"],      "env": {        "MCP_API_KEY": "your-api-key"      }    }  }}

Cursor

Add to .cursor/mcp.json:

{  "mcpServers": {    "mymedi-ai": {      "command": "npx",      "args": ["-y", "@mymedi-ai/mcp-server"],      "env": { "MCP_API_KEY": "your-api-key" }    }  }}

VS Code

Add to .vscode/mcp.json:

{  "servers": {    "mymedi-ai": {      "type": "stdio",      "command": "npx",      "args": ["-y", "@mymedi-ai/mcp-server"],      "env": { "MCP_API_KEY": "your-api-key" }    }  }}

Claude Code

claude mcp add mymedi-ai --env MCP_API_KEY=your-api-key -- npx -y @mymedi-ai/mcp-server

Tools (32)

Free (no API key)

Account (free — uses your sign-in or API key)

Medical coding

Prior auth and claims

Drug data

Providers and market

Clinical and public health

Prompts

Resources

Credits and billing

• The per-tool price list is published as JSON at https://mymedi-ai.com/bot-marketplace/credits/pricing.
• 1 credit = $0.001. Paid tools cost from 1 credit (code_lookup) to 250 credits (compliance_audit) per call; code_lookup_batch, code_validate_batch and pa_exposure_report are priced per code. A failed call is refunded.
• Each successful paid call's result includes a _billing field: { "creditsSpent": …, "creditsRemaining": …, "priceUSD": … }. (Over plain REST, without MCP, the same figures arrive as X-Credits-Spent / X-Credits-Remaining headers.)
• account_status shows the balance and recent transactions. buy_credits returns a Stripe checkout link — $1 buys 1,000 credits, packages run from $1 to $500 — and the credits arrive once checkout is completed.

Environment variables

HTTP mode (--http)

The same server can run over Streamable HTTP for clients that connect by URL:

MCP_API_KEY=your-api-key npx -y @mymedi-ai/mcp-server --http# MCP HTTP server listening on http://127.0.0.1:8080/mcp

Every call through it spends the key in MCP_API_KEY, so the endpoint is guarded:

• Loopback by default. It listens on 127.0.0.1 unless MCP_HOST says otherwise.
• A token off loopback. With a non-loopback MCP_HOST (such as 0.0.0.0) the server refuses to start unless MCP_HTTP_TOKEN is set — at least 32 characters, for example openssl rand -hex 32. Clients then send Authorization: Bearer <token>; anything else gets 401. A token can be set on loopback too.
• Host check. A request must name the server as localhost, 127.0.0.1, [::1], the MCP_HOST address, or a hostname or address in MCP_ALLOWED_HOSTS; any other Host gets 403. This stops DNS-rebinding pages. With MCP_HOST=0.0.0.0 the server has no address of its own to match, so list every address clients use — the LAN IP, the Docker host's IP, a DNS name — in MCP_ALLOWED_HOSTS.
• Origin check. A request from a web page (it carries an Origin header) gets 403 unless that origin is in MCP_ALLOWED_ORIGINS, and only listed origins receive CORS headers. Desktop clients send no Origin and are unaffected.
• Limits. Bodies over 1 MiB get 413, a body that is not JSON gets a JSON-RPC parse error, sessions are capped (MCP_MAX_SESSIONS) and closed after MCP_SESSION_IDLE_MS without use, and an unknown session id gets 404 so the client starts a new session.

Serving other machines:

MCP_HOST=0.0.0.0 MCP_HTTP_TOKEN="$(openssl rand -hex 32)" MCP_ALLOWED_HOSTS=mcp.example.com,192.168.1.20 \  MCP_API_KEY=your-api-key npx -y @mymedi-ai/mcp-server --http

Put TLS (a reverse proxy) in front of it when traffic leaves the machine: the token travels in a header.

Changes in 1.7.10

No configuration changes. Every tool repeats its title in annotations.title, where the Claude Connectors Directory reads it. provider_search (taxonomy) and market_analysis (specialty) describe the specialty they take as an NPPES (NUCC) taxonomy description, such as "Pulmonary Disease" or "Orthopaedic Surgery", where a trailing * matches a prefix; the API refuses a specialty NPPES cannot match (a 400, at no cost) instead of reporting zero providers.

Changes in 1.7.9

No configuration changes. Tool descriptions say what each tool returns and when it applies; none instructs the model or names another tool. drug_enrich and pa_predict describe what the API now returns: the drug_enrich summary restates the label (the therapeutic class and the indications it lists) and no longer names alternative therapies or adds clinical notes, so the tool gives no treatment advice; the pa_predict recommendation states the CMS requirement, whatever the approval rate. Neither makes a coverage or prior-authorization determination.

Changes in 1.7.8

No configuration changes, but update to use compliance_audit: it now takes an order, and the API refuses the free-form payload that 1.7.7 and earlier send (a 400, at no cost).

Three paid tools now do what their descriptions say. compliance_audit audits one DMEPOS order's documentation — the standard written order elements, the face-to-face encounter and written order before delivery, and prior authorization — for the order's HCPCS code and date of service (now required), from true/false facts that never carry identifiers; each requirement comes back pass or fail with its citation, and the result fails when one does. It no longer runs the identifier pattern checks it used to; auditType is optional and takes only dme_order. drug_interactions returns the number of FAERS reports naming the drugs together and, for each reaction, a proportional reporting ratio with a 95% interval against each drug alone, in place of a grade by report volume; drug names are normalized to what openFDA can search (accents, curly apostrophes, ® and ™, "+" and "&", and strengths such as 0.5% or 1:100,000), and a name with fewer than two letters or digits, or with quotes or other symbols, is refused. ner_extract reads whole ICD-10-CM codes (with extensions), HCPCS Level II codes with their modifiers, and CPT codes only where a keyword marks them, each checked against the code sets; entityTypes adds HCPCS_CODE.

The code tools rank and date their answers. code_suggest ranks by relevance: it reads common abbreviations and alternate forms (CPAP, OSA, COPD, IG for immune globulin, type 2) and a typed side, sex or "without", lists the best code for each separate thing a description names first, and leaves weak matches out instead of padding the list. code_crossref returns curated linkedCodes (the DME code family, and links across code systems that cite their CMS source) and crossReferences ranked by relevanceScore, weak matches left out; an answer with no related codes is refunded. code_validate and code_validate_batch take dateOfService (or date_of_service) at the top level as well as in context, refuse a date that is not YYYY-MM-DD or two dates that differ, and report asOf, the date a code was judged for. claims_validate states what it checks — codes active on the date of service, well-formed modifiers, a date not in the future — and that it applies no NCCI edits.

Changes in 1.7.7

No configuration changes. Tool descriptions now match what the API returns: drug_enrich lists the label fields and the labelled LLM summary it returns, and says a failed call is refunded (the API no longer returns a model-made prior-auth likelihood or cost tier); pa_predict says its approval rate comes only from your organization's own decided prior authorizations and that payerId is a payer category; ner_extract names the patterns it matches (it extracts no drug names), and its entityTypes filter now applies; code_suggest takes up to 500 characters (the search never read more; longer text is now refused instead of silently cut); data sources are named without licence claims. The support address is [email protected].

Upgrading to 1.7.6

Breaking for remote --http deployments only. Up to 1.7.5 the HTTP mode listened on every interface, served any caller without a token and sent Access-Control-Allow-Origin: *. From 1.7.6 it listens on 127.0.0.1; to serve other machines set MCP_HOST, MCP_HTTP_TOKEN (required off loopback) and MCP_ALLOWED_HOSTS with every hostname or address clients use (with MCP_HOST=0.0.0.0 that includes LAN and Docker-host IPs); browser-based clients also need MCP_ALLOWED_ORIGINS. An unknown session id now gets 404 instead of 400. stdio installs (Claude Desktop, Cursor, VS Code, Claude Code) are unaffected.

1.7.6 also requires Node.js 20 or later (Node 18 is past end of life, and the SDK's dependencies need 20). Also in 1.7.6: the server sends its instructions at initialize; scrub-claim takes an optional dateOfService and no longer asks about medical necessity; MYMEDI_API_KEY is accepted as an alias of MCP_API_KEY; and a paid call without a key explains how to register.

SDK

For programmatic use without MCP, install the SDK:

npm install @mymedi-ai/sdk

import { MyMediAI } from '@mymedi-ai/sdk';
const client = new MyMediAI({ apiKey: 'your-api-key' });const result = await client.codeLookup('M79.3');

Data sources

• ICD-10-CM and HCPCS Level II: CMS and CDC code sets
• CPT®: from the CMS physician fee schedule (RVU) files. CPT® is a registered trademark of the American Medical Association (AMA); CPT codes and descriptions are AMA copyright.
• Fee schedules and lists: CMS DMEPOS fee schedule, Medicare physician fee schedule (RVU), the Required Prior Authorization List and the F2F/WOPD list
• Providers: CMS NPI registry (NPPES) and CMS Open Payments
• Drugs: openFDA (labels, adverse events) and NIH RxNorm
• Clinical and public health: ClinicalTrials.gov and CDC NNDSS

Troubleshooting

• 402 "payment_required" — without an API key, a paid tool answers with the registration request to send (see Get an API key); with a key, it means the credits ran out: call buy_credits. The six free tools never need a key.
• "invalid_api_key" — the key in MCP_API_KEY (or MYMEDI_API_KEY) was not recognised: check it for a typo or a missing part and restart the server, or register a new key.
• 429 on free tools — free endpoints allow 60 requests per hour per IP. Wait, or use a key and the paid equivalents.
• Connector won't connect — the hosted endpoint is https://mymedi-ai.com/mcp-stream (Streamable HTTP) and it is OAuth-protected. An unauthenticated request returns {"error":"unauthorized","error_description":"OAuth required"} — that is the endpoint working, not a fault, and a bare inspector --cli … --method tools/list shows it because it holds no token. To confirm the service is up, read the discovery document: curl -s https://mymedi-ai.com/.well-known/oauth-protected-resource names .../mcp-stream as the protected resource. Claude performs dynamic client registration and the sign-in itself.
• --http answers 401, 403 or refuses to start — see HTTP mode: send the bearer token, add the hostname to MCP_ALLOWED_HOSTS or the web origin to MCP_ALLOWED_ORIGINS, and set MCP_HTTP_TOKEN before listening off loopback.
• Code not found — lookups expect bare codes (E1390, 99213, M79.3). Denial codes accept CO-50, co50 or 50.
• Data currency — reference data follows CMS release cycles; prior-authorization and F2F/WOPD answers carry the list version they were checked against.
• Still stuck? Email [email protected] or open an issue at https://github.com/MyMedi-AI/mymedi-ai-mcp-server/issues.

Links

• API discovery (JSON)
• Free demo lookup
• Price list (JSON)
• Credits for a web or connector account
• API key registration: POST https://mymedi-ai.com/bot-marketplace/register (a request, not a page)
• Hosted connector: https://mymedi-ai.com/mcp-stream

License

MIT