Elfcare

No. Elfcare's MCP page states the connection can only read published results and that it cannot change records, book appointments, upload files, or modify health data. All four tool names Anthropic lists are read verbs, and the only OAuth scope the server advertises is health:read. That is an unusually specific vendor denial rather than a generic read-only claim.

Your published results. Anthropic's directory describes the permission as results from your blood tests, comments from your doctor, and MRI and CT scans. Elfcare's own page adds biomarkers, imaging results, body composition data and blood pressure. Elfcare's health check covers 80-plus blood biomarkers and a full-body MRI, so the reachable surface is a complete diagnostic record.

One scope, health:read. The server's RFC 9728 descriptor and its authorization server metadata both advertise exactly that single value, checked live on 2026-08-23. It is a named application scope rather than an identity claim, and it names a read verb, so it matches the read-only surface the vendor describes. It offers no narrower choice than all your health data.

Elfcare makes no HIPAA claim and we found no mention of a BAA. Elfcare AB is a Swedish provider and its privacy policy cites the EU GDPR as the applicable framework, listing rights of access, erasure, objection and portability. Elfcare's FAQ states it is a healthcare provider registered by IVO, the Swedish health and social care inspectorate. No data processing agreement is published for the connector.

Your own. Elfcare is a direct-to-consumer health check sold per person, and the connector authenticates against patient.elf.care with your own sign-in. Elfcare's page says access requires sign-in and consent and that you can review and disconnect connected apps from your profile. We found no documented caregiver, proxy or dependent access, so no third-party record is reachable through this connector.

No published rate and no billing tool. Elfcare sells health checks per visit rather than per API call, and its FAQ states the service is not a membership. No tool among the four carries a credit, balance, usage, quota or billing name, so an agent cannot observe spend. We found no published rate limit for the MCP endpoint either.

No, but it publishes something better shaped. Elfcare's MCP page never names get_results, get_marker_history, get_marker_info or get_image; those four names come from Anthropic's directory. Instead Elfcare publishes a list of what the connector cannot do. That constrains the surface rather than describing it, but it cannot catch a silent rename.

Treat it as context, not a diagnosis. Elfcare's own biomarker pages carry a disclaimer that results should always be discussed with a healthcare professional and that the guide is not medical advice. Elfcare's FAQ also states it does not treat disease and refers findings to specialists. An agent reading your results inherits that boundary.