Plugin

healthclaw-guardrails

HealthClaw Guardrails is the security layer between AI agents and clinical FHIR data. Every agent read passes through PHI redaction (names truncated to initials, DOBs to year, identifiers masked). Every write requires an HMAC-signed step-up token with a 5-minute TTL. Clinical writes (Condition, MedicationRequest, DiagnosticReport) return HTTP 428 until a human confirms. Every access lands in an append-only audit trail scoped by tenant. Supports FHIR R4 US Core v9 (stable) and FHIR R6 v6.0.0-ballot3 (experimental). Proxies upstream FHIR servers (HAPI, Epic sandbox, Medplum via OAuth2 client-credentials, SMART Health IT) so the same guardrails apply whether you're on local SQLite or production EHRs. Bundled skills: fhir-r6-guardrails (core MCP + 14 tools), curatr (patient-facing data-quality evaluation and correction), fasten-connect (patient-authorized EHR ingestion + TEFCA), phi-redaction (HIPAA Safe Harbor de-identification), fhir-upstream-proxy (vendor-neutral server proxy), healthex-export (portable health record export).

• Published source
• Repository

Analysed

11 October 2026

Last observed

13 October 2026

What the code does

What does this mean?

These are capabilities our static analysis found in the latest published version. They describe what the code can do, not whether it is malicious: many tools need shell access or the network to do their job. Use them to decide what to check before installing.

• Runs shell commands Code that starts system commands on the machine it runs on.
• Starts other processes Code that launches separate programs.
• Sends data to outside servers Code that posts data to network addresses.
• Evaluates code at runtime Code that builds and runs code while it executes.

Having a capability is not wrongdoing; many tools need these to do their job. It tells you what to check before you install.

This is public metadata, not a safety certification or complete assessment. Static analysis cannot establish what a tool does at runtime.