Two MCP servers — this page is the family one

LovedOne Family MCP

A household key lets an agent read that family's loved ones, members, and inbox. It cannot list another family, and it cannot act as a vendor. Providers use Sandwich Soft MCP with a different key.

This product

LovedOne Family MCP

api.lovedone.app/mcp/v1

Mint keys at Settings → MCP API keys on this site.

The other product

Sandwich Soft MCP

api.lovedone.app/mcp/vendor/v1

One provider key → that agency's client roster. A family key on the vendor URL returns 403 WRONG_SURFACE.

Provider MCP docs

Connect

{
  "mcpServers": {
    "lovedone-family": {
      "url": "https://api.lovedone.app/mcp/v1",
      "headers": {
        "Authorization": "Bearer sk-sand-..."
      }
    }
  }
}

Family tools

  • ping

    Smoke-test tool. Returns pong plus the authenticated caller's uid, tenant, and auth method. No PHI. No side effects.

  • get_user_profile

    Returns the signed-in user's Sandwich profile: uid, email, tenant type, and any linked family workspace.

  • list_loved_ones

    Lists loved ones in the caller's family workspace: id, name, and Family Inbox address. Does not return date of birth or medications.

  • list_family_members

    Lists people on the caller's family workspace (role, relationship, invite status). Emails are PII — do not log them in third-party agent traces if you can avoid it.

  • list_inbox_messages

    Lists recent messages in one loved one's Family Inbox (subject, sender, category, preview). Does not return HTML bodies. Scope: the caller's family workspace only. PHI may be present in subjects and previews.

  • get_inbox_message

    Returns one Family Inbox message as plaintext (no HTML). Requires messageId from list_inbox_messages. Rejected if the message is not in the caller's workspace. Treat bodyText as potentially PHI.

  • list_care_events

    Returns recent care events for the caller's family workspace. Optionally scope to a single lovedOneId; otherwise aggregates across all loved ones on the workspace. Limit is 1-50 and is applied per loved one when aggregating.

Provider tools (not on this server)

  • ping
  • get_agency_profile
  • list_clients
  • get_client
  • list_visits
  • add_visit_note
  • list_invoices

Health data, vault, SOC 2

Inbox subjects and bodies can be PHI (appointments, labs, EOBs). Tools return plaintext, never raw HTML. API keys are stored as SHA-256 hashes; every call writes an append-only mcp_audit_log row (tool name, caller, timestamp — not message bodies). Sandwich Pipe vault (raw EHR / inbound MIME) is a separate GCP project with no user-facing routes. list_care_events only returns already-redacted vault fields, and only when Pipe is deployed. We are building toward SOC 2 Type I, then Type II. Full specification: LovedOne Family MCP.