Two MCP servers — this page is the family one
LovedOne Family MCP
A household key lets an agent read that family's loved ones, members, and inbox. It cannot list another family, and it cannot act as a vendor. Providers use Sandwich Soft MCP with a different key.
This product
LovedOne Family MCP
api.lovedone.app/mcp/v1
Mint keys at Settings → MCP API keys on this site.
The other product
Sandwich Soft MCP
api.lovedone.app/mcp/vendor/v1
One provider key → that agency's client roster. A family key on the vendor URL returns 403 WRONG_SURFACE.
Provider MCP docsConnect
{
"mcpServers": {
"lovedone-family": {
"url": "https://api.lovedone.app/mcp/v1",
"headers": {
"Authorization": "Bearer sk-sand-..."
}
}
}
}Family tools
ping
Smoke-test tool. Returns pong plus the authenticated caller's uid, tenant, and auth method. No PHI. No side effects.
get_user_profile
Returns the signed-in user's Sandwich profile: uid, email, tenant type, and any linked family workspace.
list_loved_ones
Lists loved ones in the caller's family workspace: id, name, and Family Inbox address. Does not return date of birth or medications.
list_family_members
Lists people on the caller's family workspace (role, relationship, invite status). Emails are PII — do not log them in third-party agent traces if you can avoid it.
list_inbox_messages
Lists recent messages in one loved one's Family Inbox (subject, sender, category, preview). Does not return HTML bodies. Scope: the caller's family workspace only. PHI may be present in subjects and previews.
get_inbox_message
Returns one Family Inbox message as plaintext (no HTML). Requires messageId from list_inbox_messages. Rejected if the message is not in the caller's workspace. Treat bodyText as potentially PHI.
list_care_events
Returns recent care events for the caller's family workspace. Optionally scope to a single lovedOneId; otherwise aggregates across all loved ones on the workspace. Limit is 1-50 and is applied per loved one when aggregating.
Provider tools (not on this server)
- ping
- get_agency_profile
- list_clients
- get_client
- list_visits
- add_visit_note
- list_invoices
Health data, vault, SOC 2
Inbox subjects and bodies can be PHI (appointments, labs, EOBs). Tools return plaintext, never raw HTML. API keys are stored as SHA-256 hashes; every call writes an append-only mcp_audit_log row (tool name, caller, timestamp — not message bodies). Sandwich Pipe vault (raw EHR / inbound MIME) is a separate GCP project with no user-facing routes. list_care_events only returns already-redacted vault fields, and only when Pipe is deployed. We are building toward SOC 2 Type I, then Type II. Full specification: LovedOne Family MCP.