AdaptixCore is agent-native. Your model can actually do the work — not chat about it.

20 read tools

What an agent can read today

Claims, eligibility, ERA reconciliation, billing summaries, ePCR chart state and completion gaps, credentials, scheduling, documents, operational analytics, and audit. Each read is scoped by the caller's verified permissions and tenant. A denied tool is entirely absent from tools/list — an unauthorized caller never receives the platform catalog.

5 write tools, approval-only

What an agent can write

Claim corrections, outbound messages, and patient statements. Every write is registered as SIDE_EFFECT or HIGH_RISK_SIDE_EFFECT, which forces approval and idempotency. On day one, execution is disabled at the broker: a write resolves to a pending approval and does not run. A human confirms in-app; the prepared payload then executes exactly once, keyed by the approval id.

SECRET, tokens, PHI without policy

What an agent will never see

SECRET-classified data cannot cross MCP; the registry refuses to load a contract that tries. A possible_phi tool called with PHI policy off is denied by Core with PHI_NOT_PERMITTED (an optional minimize path redacts instead of denying). S2S tokens, provider credentials, and internal secrets are never in prompt scope — they live in the broker's tenant-bound service token.

• claims.searchlivePHI

  Search active claims with live risk scoring (tier histogram + items), tenant-scoped.

• claims.getlivePHI

  Fetch a single claim's live risk profile by claim id.

• claims.get_statuslive

  Return the current payer claim-status observation for a claim.

• claims.get_submission_historytyped-unavailablePHI

  Return the submission history for a claim (837 lifecycle).

• claims.get_denial_historytyped-unavailablePHI

  Return the denial history and CARC/RARC codes for a claim.

• eligibility.get_resulttyped-unavailablePHI

  Return the latest 270/271 eligibility result for a patient.

• era.get_reconciliation_statustyped-unavailable

  Return ERA/835 remittance reconciliation status for a batch or deposit.

• billing.get_summarytyped-unavailable

  Return the tenant billing summary (AR, aging, KPIs).

• billing.get_exception_summarytyped-unavailable

  Return the tenant billing exception summary (queues, blockers, aging).

• epcr.get_chart_statuslivePHI

  Return the current state of a specific chart (draft, locked, exported, corrected).

• epcr.get_completion_gapstyped-unavailablePHI

  Return the field-level completion gaps blocking chart lock for a chart.

• epcr.get_quality_findingstyped-unavailablePHI

  Return the NEMSIS quality-validation findings attached to a chart.

• credentials.get_statustyped-unavailable

  Return the current credential status for a user (licences, certs, expirations).

• credentials.get_expiringtyped-unavailable

  Return credentials expiring inside a window (default 90 days) for the tenant.

• scheduling.get_user_scheduletyped-unavailable

  Return the caller's upcoming schedule (windowed, tenant-scoped).

• scheduling.get_open_shiftstyped-unavailable

  Return open shifts the caller is credentialed and eligible to claim.

• documents.get_statustyped-unavailable

  Return the delivery status of a generated document (statement, letter, notice).

• documents.search_authorizedtyped-unavailable

  Search documents the caller is authorized to see, tenant-scoped.

• analytics.get_operational_summarytyped-unavailable

  Return the operational summary (activity KPIs) for the tenant.

• audit.search_authorized_activitytyped-unavailable

  Search audit activity the caller is authorized to review, tenant-scoped.

Every write returns a pending-approval id and does not execute. A human approves in-app; the prepared payload then runs exactly once, keyed by the approval id. Execution is additionally gated by MCP_WRITE_EXECUTION_ENABLED, which is false on day one.

• claims.prepare_correctionClaimsPHI

  Draft a claim correction. Returns the prepared correction and a pending-approval id; does not submit.

• claims.submit_correctionClaimsPHI

  Submit a previously-prepared claim correction after human approval. Idempotent by approval id.

• communications.prepare_messageCommunicationsPHI

  Draft an outbound message. Returns the prepared payload and a pending-approval id; does not send.

• communications.send_approved_messageCommunicationsPHI

  Send a previously-prepared, human-approved message. Idempotent by approval id.

• documents.prepare_statementDocuments

  Prepare a patient statement or billing document. Returns the draft and a pending-approval id; does not deliver.

The resolve call

POST {CORE_SERVICE_URL}/api/v1/ai/policy/resolve/tool
X-Adaptix-Internal-Secret: <s2s>

-> {
     allowed,
     decision: ALLOW | DENY | APPROVAL_REQUIRED,
     reason_code,
     policy_version,
     approval_required
   }

Identity (tenant, user, scopes) comes from the verified gateway context. The resolver trusts user_has_permission computed from the caller’s verified scopes; it never reads role or tenant from tool arguments.

Fail-closed defaults

• Resolver timeout → DENY (POLICY_UNAVAILABLE)
• DNS or connection error → DENY
• Non-200 or malformed body → DENY
• Missing config → DENY
• No fail-open path exists in the broker

tools/list returns only the tools the caller is authorized to discover. A denied tool is absent from the catalog itself, so an unauthorized caller never learns the tool exists.

Forbidden argument keys

A tool call carrying any of these keys is rejected outright with MCP_FORBIDDEN_ARGUMENT before it reaches the resolver.

• tenant_id
• role
• is_founder
• permissions
• approval

This is not a filter. It is the shape of the boundary: identity is a property of the caller, not a property of the request.

Claude Desktop and Claude Code

Add a remote MCP server

In Claude Desktop, open Settings → Developer → Model Context Protocoland add a remote server. In Claude Code, run claude mcp add. Point either at your tenant’s broker URL.

{
  "mcpServers": {
    "adaptixcore": {
      "url": "https://mcp.<your-tenant>.adaptixcore.com/mcp",
      "auth": { "type": "oauth" }
    }
  }
}

OAuth completes in the browser against your workspace SSO. Claude sees only the tools your seat is authorized to discover.

ChatGPT (Custom Connectors)

Add AdaptixCore as an MCP connector

In ChatGPT’s Custom Connectors panel, add a new MCP server. Paste the broker URL and complete the OAuth prompt with your workspace SSO. ChatGPT will list only the tools your seat is authorized to see.

Name:        AdaptixCore
URL:         https://mcp.<your-tenant>.adaptixcore.com/mcp
Auth:        OAuth 2.1 (PKCE) via your workspace SSO
Approval:    Ask before write tools

Even with “always allow”, writes still return a pending approval — the broker owns that decision, not the client.

Bring your own agent

Any MCP 2025-06-18 client

The broker speaks MCP revision 2025-06-18over Streamable HTTP with SSE. It supports the standard initialize, tools/list, tools/call, and pingmethods. Custom SDKs, LangGraph agents, Autogen, or your own runtime all connect the same way.

GET  /mcp                     -> server info + capabilities
POST /mcp   { "method": "tools/list",  ... }
POST /mcp   { "method": "tools/call",  "params": {...} }
POST /mcp   { "method": "ping" }

Every response carries a provenance envelope: results are marked as data, not instructions. A model that treats returned bytes as a command is on its own — authorization does not consult the payload.

PHI enforcement at the boundary

SECRET data never crosses MCP (enforced at registry load and re-asserted per call). A possible_phi tool with PHI policy off is denied by Core with PHI_NOT_PERMITTED. An optional minimize path can redact PHI-looking values instead of denying, when policy allows.

Prompt-injection is out of scope for auth

Every result is wrapped with provenance metadata marking it as data, not instructions. Authorization is server-side and never a function of returned bytes; the broker processes exactly the one tool named per request, so returned text cannot trigger another tool call.

Audit and metrics without PHI

ai.mcp.tools_list.* and ai.mcp.tool_call.* audit events, and MCPToolCalls / MCPToolDenied / MCPApprovalRequired / MCPPolicyResolutionFailure metrics. None of them carry PHI, prompts, tool arguments, tool results, or tokens.

Tenant-bound S2S, not shared secrets

The broker holds no domain data. On authorization, it mints a short-lived service token whose tenant and user are inside the token, not spoofable request headers. Domain services verify the token before honoring the call.

What is live in production today

Four read adapters have real, wired implementations against verified domain endpoints: claims.search, claims.get, claims.get_status, epcr.get_chart_status. Every other read tool is registered with a typed-unavailable adapter that returns MCP_TARGET_UNAVAILABLE. The broker never fabricates a result.

What is disabled on day one

Write execution is off by default. A write tool call resolves to a pending approval and does not run. When execution is enabled, writes still require a human approval per call and are idempotent by approval id.

What Core still needs to expose

Core's resolve_external_tool_call logic exists and is unit-tested, but the HTTP route POST /api/v1/ai/policy/resolve/tool is being finalised on Core's main. Until it is wired, the broker resolves every call to DENY. That is the correct fail-closed behaviour; it is not a runtime bug.

What we will not do

We will not ship a MCP surface that pretends to reach data it cannot reach. We will not add a fail-open code path. We will not accept an identity claim the model made about itself. If any of the above ever changes for a specific tenant, it will be a signed, audited configuration change, not a code shortcut.