AI, MCP and the API

MCP clients and scripts sign in with an API key. Create one in Settings › API Keys and copy it when it's shown. Keys start with zts_, act as you, see only your data, and stop working as soon as you delete them.

The MCP server is https://healthmaxx.app/api/mcp (Streamable HTTP). Clients that accept headers, such as Claude Code (.mcp.json) and Cursor (.cursor/mcp.json), take this config:

{
  "mcpServers": {
    "healthmaxx": {
      "type": "http",
      "url": "https://healthmaxx.app/api/mcp",
      "headers": { "Authorization": "Bearer zts_your_api_key" }
    }
  }
}

The assistant first sees four tools: search_tools, describe_tool, call_tool and call_destructive_tool. It finds what it needs by search, then calls it. Deleting anything goes through call_destructive_tool, so clients can ask you first. Clients that want one tool per method can use https://healthmaxx.app/api/mcp?tools=all.

ChatGPT and Claude connectors can't send a header, so they sign in with OAuth. Add a connector with the MCP URL above, sign in to Healthmaxx if asked and choose Allow. Read-only access covers lookups; logging and changes need write access. Disconnect an app in Settings › Connected apps.

Everything MCP can do is also a REST call: POST /api/v1/<method> with the arguments as a JSON body and Authorization: Bearer zts_…. GET /api/v1 lists every method.

Reference: API docs (Swagger UI), the OpenAPI document and llms.txt, a summary written for AI agents.

The in-app chat (Alt C) answers from your data and can log for you. It runs on your own AI provider key: add one for OpenAI, Anthropic, Google Gemini, Mistral or Llama in Settings › AI Providers. Your messages and the data the chat reads go to that provider. The chat asks before it deletes anything.