--- title: "AWS Labs HealthLake: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/mcp-servers/awslabs-healthlake/ description: "Discovers HealthLake datastores and reads or manages FHIR resources, with an explicit read-only mode." --- # AWS Labs HealthLake: review, setup & limitations · Undominated.ai > Discovers HealthLake datastores and reads or manages FHIR resources, with an explicit read-only mode. [← Explore all mcp servers](/mcp-servers/) AWS DATA SERVICES / AWS Labs # AWS Labs HealthLake Discovers HealthLake datastores and reads or manages FHIR resources, with an explicit read-only mode. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/awslabs/mcp) SOURCE REVIEW Reviewed 2026-10-14 Evidence 8 linked sources Publisher AWS Labs Licence [Apache-2.0 ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/LICENSE) Revision 8840003820a7 [Read what was—and wasn’t—checked ↓](#review) “A Model Context Protocol (MCP) server for AWS HealthLake FHIR operations.” [AWS Labs · upstream description ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/healthlake-mcp-server/README.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Specialized publisher integration with documented IAM and data access boundaries. - Inspect an authorized test datastore and validate FHIR search parameters. - The catalogue does not already have src/healthlake-mcp-server/README.md. - The README separates six read operations from five blocked writes and shows that the recommended uvx line omits --readonly. ### A good fit for - Inspect an authorized test datastore and validate FHIR search parameters. - Review an import/export job status without initiating a new data transfer. - Reading an AWS HealthLake datastore from a local MCP client after adding the --readonly flag the README documents ### Weigh up before choosing - Default startup permits write handlers; this starter adds --readonly, which blocks create/update/delete and import/export initiation. - FHIR reads and patient_everything can disclose sensitive patient data. Read-only mode does not anonymize records or establish a compliant deployment. - Search results must be paginated and interpreted with resource versions; this is a data-access integration, not clinical decision validation. - The monorepo now recommends Agent Toolkit for AWS for production. This specialized local server remains documented; its leaf and root documentation were checked for deprecation. - This review did not execute the resource. - Pinning commit 8840003820a78dd018561d55c7ab12fcdd708464 does not verify transitive dependencies. - The README does not contain the word stdio. stdio is inferred from the local uvx, uv tool, and python -m examples. - The recommended command does not pass --readonly, so the five write tools are not disabled by that line. - The README says 235 tests pass and 96% coverage. Those tests were not run. The license section says Apache License, Version 2.0, which matches the repository LICENSE text. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - src/healthlake-mcp-server/README.md - src/healthlake-mcp-server/pyproject.toml - src/healthlake-mcp-server/awslabs/healthlake_mcp_server/server.py - Root README.md and LICENSE - LICENSE ### Our findings - main.py wires --readonly into the factory; ToolHandler filters registered handlers and rejects prohibited write names, with additional checks in write handlers. - The opening sentence says 11 FHIR tools. The tool list is 2 datastore tools, 4 CRUD tools, 2 search tools, and 3 job tools. The read-only tables list 6 available operations and 5 blocked operations. Those counts agree with each other. - Option 1 shows uvx awslabs.healthlake-mcp-server@latest with no --readonly. A later example is the same command with --readonly, and the blocked table names create, update, delete, and the two job-start tools. - The file does not contain stdio, sse, or streamable. Client examples are local uvx, uv tool install, python -m, and docker run without a published port. stdio is inferred from that local CLI install. ### Not established by this review - Server startup, authentication, live tool execution and security isolation were not tested. - Published package/container parity with a source revision and hosted implementation internals were not tested. - The resource was not executed and its tools were not called. - No FHIR request was sent. - Read-only mode was not tested. - The stated unit-test count and coverage were not rerun. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Connect a server deliberately. [Upstream setup instructions ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/healthlake-mcp-server/README.md) DOCUMENTED COMMAND uvx awslabs.healthlake-mcp-server@latest --readonly Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - Use a test datastore and AWS credentials limited to the required FHIR reads. - Launch with --readonly, discover the datastore, and verify its ID/region before retrieval. - Use bounded queries and review returned pagination/version context before summarizing results. ### Before you start - Python 3.10 or newer, uv/uvx and an MCP client that can launch a local stdio process. - An AWS account, configured credentials and access to the intended region and service resources. ### Documented configuration example Use the client and authentication context described in the setup guidance. Configuration formats vary between hosts. { "mcpServers": { "awslabs-healthlake": { "command": "uvx", "args": [ "awslabs.healthlake-mcp-server@latest", "--readonly" ], "env": { "AWS_PROFILE": "YOUR_RESTRICTED_PROFILE", "AWS_REGION": "us-east-1" } } } } Copy configuration ↗ ### Compatibility Python 3.10 or newer, uv/uvx and an MCP client that can launch a local stdio process. · An AWS account, configured credentials and access to the intended region and service resources. · Kiro · Cursor · VS Code ### Implementation Python · python ### Transports stdio ### AWS data services - Uses AWS credentials and SigV4 for HealthLake; write-enabled mode can modify resources and transfer data through S3 jobs. - List datastores and read or search FHIR resources - Create, update, and delete FHIR resources and start import or export jobs when --readonly is absent - Does not document an IAM user, role, group, policy, or access-key tool ### Cost model AWS service, model, query and storage charges apply; running the MCP process does not include those services. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Publisher setup, capabilities and operating boundaries ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/healthlake-mcp-server/README.md) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/healthlake-mcp-server/README.md Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports - [Pinned package and implementation ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/healthlake-mcp-server/pyproject.toml) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/healthlake-mcp-server/pyproject.toml Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports - [Pinned package and implementation ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/healthlake-mcp-server/awslabs/healthlake_mcp_server/server.py) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/healthlake-mcp-server/awslabs/healthlake_mcp_server/server.py Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports - [Pinned package and implementation ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/README.md) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/README.md Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports - [Applicable licence ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/LICENSE) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/LICENSE Supports: license - [Pinned operational implementation ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/healthlake-mcp-server/awslabs/healthlake_mcp_server/main.py) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/healthlake-mcp-server/awslabs/healthlake_mcp_server/main.py Supports: summary, install, configExample, access, limitations, bestFor, review, compatibility, transports - [HealthLake MCP README ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/healthlake-mcp-server/README.md) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/src/healthlake-mcp-server/README.md Supports: 11 FHIR tools and the --readonly split - [Repository LICENSE ↗](https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/LICENSE) Checked 2026-10-14 https://github.com/awslabs/mcp/blob/8840003820a78dd018561d55c7ab12fcdd708464/LICENSE Supports: Apache License Version 2.0 KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### AWS Labs Amazon Translate ↗ Translates text and manages document translation jobs and custom terminology with AWS Translate.](/mcp-servers/awslabs-translate/)[### AWS Labs Finch ↗ Builds and pushes container images through the local Finch CLI, with additional ECR repository support.](/mcp-servers/awslabs-finch/)[### AWS Labs HealthImaging ↗ Searches and manages medical imaging datastores, image sets and DICOM lifecycle operations.](/mcp-servers/awslabs-healthimaging/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Inspect resource evidence](/tools/) - [Choose a host](/agents/) - [Inspect reusable workflows](/skills/) - [Use Undominated data](/api/)