{
  "markdown": "# @oktopeak/intakeq-mcp\n\n> ### Built by [Oktopeak](https://oktopeak.com/?utm_source=github&utm_medium=readme&utm_campaign=intakeq-mcp&utm_content=top-byline) — AI transformation & automation for healthcare practices\n> **Digital transformation for healthcare and legal businesses.** We build AI integrations, workflow automation, and custom software your practice owns outright — including this connector. → [Book a 30-min call](https://calendly.com/office-oktopeak/30min?utm_source=github&utm_medium=readme&utm_campaign=intakeq-mcp&utm_content=top-byline-call)\n\nIntakeQ/PracticeQ MCP connector for Claude. Gives Claude access to your\nIntakeQ scheduling, intake forms, treatment notes, invoices, and client records\nthrough the [Model Context Protocol](https://modelcontextprotocol.io/).\n\nEvery PHI read and write is logged locally in compliance with HIPAA §164.312(b).\n\n---\n\n## ⚠️ Before you connect this to real patient data\n\nTwo things must be in place before PHI flows through this connector:\n\n1. **IntakeQ BAA** — IntakeQ/PracticeQ includes a Business Associate Agreement.\n   Sign it in your IntakeQ account (Settings → HIPAA) before going live.\n   This is one of IntakeQ's strengths: the BAA is self-serve and included in all plans.\n\n2. **Anthropic enterprise tier with ZDR** — With hosted Claude + MCP, PHI goes to\n   Anthropic for inference. The defensible claim is **training-disabled + Zero Data\n   Retention under enterprise + BAA** — not data locality. \"Access\" (the model\n   processed it) is the exposure, not just retention.\n   Sign up for Anthropic enterprise and request a BAA before using this with real patients.\n\n**What this connector does:**\n- Brokers authenticated calls to the IntakeQ REST API\n- Logs every PHI read and write to `~/.intakeq-mcp/audit.log` (HIPAA §164.312(b))\n- Stores your API key encrypted (AES-256-GCM) locally — no PHI content stored (audit entries contain only access-trail identifiers)\n\n---\n\n## Installation\n\n```bash\nnpm install -g @oktopeak/intakeq-mcp\n```\n\n## Claude Desktop configuration\n\n```json\n{\n  \"mcpServers\": {\n    \"intakeq\": {\n      \"command\": \"intakeq-mcp\"\n    }\n  }\n}\n```\n\n## Authentication\n\nGenerate your API key in IntakeQ: **Settings → Integrations → Developer API**\n\nThen tell Claude:\n> \"Set my IntakeQ API key to [your-key]\"\n\nOr use the MCP tool directly: `set_api_key`\n\n## Tools\n\n| Tool | Description | R/W |\n|------|-------------|-----|\n| `set_api_key` | Store IntakeQ API key | W |\n| `auth_status` | Verify API connection | R |\n| `clear_api_key` | Remove stored key | W |\n| `list_clients` | Search/list clients | R |\n| `get_client` | Single client profile | R |\n| `list_practitioners` | All practitioners in the account | R |\n| `list_services` | Services configured in the account | R |\n| `list_locations` | Locations configured in the account | R |\n| `list_appointments` | Appointments by client/date | R |\n| `get_appointment` | Single appointment | R |\n| `create_appointment` | Book appointment | W |\n| `update_appointment` | Reschedule/update | W |\n| `list_intake_forms` | Submitted intake forms | R |\n| `get_form` | Full form with answers | R |\n| `list_questionnaire_templates` | Available form templates | R |\n| `send_intake_form` | Send form to client | W |\n| `list_notes` | Treatment notes (read-only in IntakeQ API) | R |\n| `get_note` | Full note | R |\n| `list_invoices` | Client invoices | R |\n| `get_invoice` | Single invoice | R |\n| `list_files` | Client file metadata | R |\n| `audit_export` | Export HIPAA audit trail | R |\n\n> **Tip:** call `list_practitioners`, `list_services`, and `list_locations` before `create_appointment` to obtain valid IDs required by that tool.\n\n## MCP Resources\n\n| Resource URI | Description |\n|---|---|\n| `intakeq://compliance-notice` | HIPAA compliance notice — BAA requirements and what the connector logs |\n| `intakeq://auth-status` | Live authentication status (JSON) |\n\n## HIPAA Audit Log\n\nEvery PHI read and write is appended to `~/.intakeq-mcp/audit.log` (JSONL format).\nEach entry records: timestamp, session ID, machine IP, tool name, arguments (sanitized),\noutcome, practitioner ID, client ID, and result count.\n\nExport the audit log at any time: ask Claude to run `audit_export`.\n\n**Audit logging is fail-open.** If the log file can't be written (disk full, permissions),\nthe tool call still completes rather than blocking clinical work — the failure is written\nto stderr with an `[audit-log-failure]` prefix so it can be monitored/alerted on. If you\nneed a hard guarantee that PHI access is never left unlogged, monitor process stderr for\nthat prefix in your deployment.\n\n## HTTP transport\n\nThe server runs in **stdio mode** by default. To run as an HTTP server (e.g. for multi-user or remote deployments):\n\n```bash\nMCP_API_KEY=your-secret TRANSPORT=http PORT=3000 intakeq-mcp\n```\n\nThe MCP endpoint is at `/mcp`, gated by a required Bearer token (`MCP_API_KEY`). **The\nserver refuses to start in HTTP mode without `MCP_API_KEY` set**, since an unauthenticated\nendpoint would expose every PHI tool to anyone who can reach the port. To explicitly opt\ninto an unauthenticated endpoint for local development only, set `MCP_ALLOW_NO_AUTH=true` —\nnever do this with real patient data.\n\nHTTP transport does not terminate TLS itself. Run it behind a reverse proxy (nginx, Caddy,\nyour cloud provider's load balancer, etc.) that terminates HTTPS — otherwise the Bearer\ntoken and all PHI in transit are sent in plaintext on the network.\n\nEach HTTP session maintains its own API key in memory — the `set_api_key` tool scopes the key to the session and never writes it to the shared disk file. Sessions are garbage-collected after 24 hours.\n\nHealth check: `GET /health` → `{ \"ok\": true, \"sessions\": <count> }`\n\n## Environment variables\n\n| Variable | Default | Description |\n|---|---|---|\n| `INTAKEQ_API_KEY` | — | Fallback API key for CI / headless use (prefer the `set_api_key` tool) |\n| `INTAKEQ_API_BASE` | `https://intakeq.com/api/v1` | Override the IntakeQ API base URL |\n| `TRANSPORT` | `stdio` | Transport mode: `stdio` or `http` |\n| `PORT` | `3000` | HTTP server port (HTTP mode only) |\n| `MCP_BASE_URL` | `http://127.0.0.1:3000` | Base URL printed in HTTP startup logs |\n| `MCP_API_KEY` | — | Bearer token to gate the HTTP `/mcp` endpoint. **Required** in HTTP mode unless `MCP_ALLOW_NO_AUTH=true` |\n| `MCP_ALLOW_NO_AUTH` | — | Set to `true` to explicitly allow HTTP mode without `MCP_API_KEY` (local dev only) |\n\n## Rate limiting\n\nIntakeQ enforces ~10 requests/minute. The connector retries automatically on HTTP 429 (up to 3 attempts, with back-off delays of 10 s / 20 s / 30 s). After 3 failures the error is surfaced rather than hanging indefinitely.\n\n## Not yet covered\n\n- Insurance claims / CMS-1500 write\n- Webhooks\n- Bulk operations\n- Creating treatment notes (not available in IntakeQ API)\n\n## Other open-source connectors by Oktopeak\n\nSame architecture (encrypted key storage, audit logging, rate limiting), different platforms:\n\n- **[Clio MCP](https://github.com/oktopeak/clio-mcp)** — Claude + Clio practice management (`@oktopeak/clio-mcp`)\n- **[MyCase MCP](https://github.com/oktopeak/mycase-mcp)** — Claude + MyCase legal practice management (`@oktopeak/mycase-mcp`)\n- **[Filevine MCP](https://github.com/oktopeak/filevine-mcp)** — Claude + Filevine practice management (`@oktopeak/filevine-mcp`)\n\n## Supporting this project\n\nThis connector is free, MIT licensed, and maintained by [Oktopeak](https://oktopeak.com). It always will be — we don't take donations. If it saved you time, the things that actually help:\n\n- **Star this repo.** It is genuinely how other firms find it.\n- **Tell another firm** running IntakeQ.\n- **[Leave a review](https://clutch.co/profile/oktopeak)** if we helped you directly.\n- Need it deployed, extended, or maintained for your firm? **[Commercial support](https://oktopeak.com/services/healthcare-ai-integration/)** — that is what funds the free work.\n- **Practice-wide deployment:** rolling Claude + this connector out to a whole practice (Claude Cowork, multi-user, security review)? See [Firm Deployment](https://oktopeak.com/services/firm-deployment/?utm_source=github&utm_medium=readme&utm_campaign=intakeq-mcp&utm_content=firm-deployment).\n\n## Who we are\n\n**[Oktopeak](https://oktopeak.com/?utm_source=github&utm_medium=readme&utm_campaign=intakeq-mcp&utm_content=who-we-are) — digital transformation for healthcare and law firms.**\n\nWe're a 7-person in-house product team building AI solutions for regulated industries: AI integrations, workflow automation, and custom software our clients own outright. We maintain four open-source MCP connectors — [Clio](https://github.com/oktopeak/clio-mcp), [MyCase](https://github.com/oktopeak/mycase-mcp), [Filevine](https://github.com/oktopeak/filevine-mcp), and IntakeQ — and deploy them inside real practices with scoped credentials, audit logs, and workflows built around how your team actually works.\n\n- 🌐 [oktopeak.com](https://oktopeak.com/?utm_source=github&utm_medium=readme&utm_campaign=intakeq-mcp&utm_content=who-we-are)\n- 📅 [Book a 30-min call](https://calendly.com/office-oktopeak/30min?utm_source=github&utm_medium=readme&utm_campaign=intakeq-mcp&utm_content=who-we-are-call)\n- ✉️ office@oktopeak.com — security reports welcome\n- 💼 [LinkedIn](https://www.linkedin.com/company/oktopeak-tech)\n",
  "bytes": 9313,
  "sha": "e5be718fc35eae9cfad69dde36b2b53c240ab4685db17c0eb4a7cd161fb0ee39",
  "repo_slug": "oktopeak/intakeq",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_oktopeak_intakeq_mcp_bd4e06bf/readme"
}