MedMCP: An Open Agentic Ecosystem for Medical Imaging Workflows

medmcp.ai · Quick start · Security · Contributing

MedMCP is an open, community-driven agentic framework that exposes validated medical imaging tools through a natural-language interface.
It is designed to enable clinicians, radiologists, and domain researchers to apply state-of-the-art image analysis methods without requiring expertise in command-line interfaces, Python environment management, or library-specific APIs.

Everything runs on-premise: a locally served model plans and sequences the work, all computation is delegated to tested implementations, and no imaging data, patient metadata, or results leave your infrastructure. You work through a single workspace that contains a file explorer, image viewer, replay engine for personal workflows, and the chat interface.

[!WARNING]
MedMCP is under active development and not licensed for clinical use.

Quick start

The easiest way to run MedMCP is with the prebuilt Docker images.

Start with a single command: Set MEDMCP_WORKSPACE to the folder where your imaging data lives and results should be saved (any absolute path):

MEDMCP_WORKSPACE="$HOME/medmcp-data" \
  docker compose -f oci://ghcr.io/medmcp/compose:main up -d

Then open http://localhost:8100.

Requirements: Linux OS with an NVIDIA GPU (≥ 24 GB VRAM recommended for the local Muse Glimmer 30B model), a recent driver (≥ R570 / CUDA 12.8), and Docker with GPU access via the NVIDIA Container Toolkit (CDI; rootless Docker works).

Stop with docker compose -f oci://ghcr.io/medmcp/compose:main down.

Update by re-running the start command with --pull always.

Want to build from source or run host-native? See CONTRIBUTING.md.

See it in action

A short launch trailer demonstrating MedMCP's capabilities at launch.

Features

• Chat & Agent: a familiar interface to interact with your local models, tools, and skills.
• File explorer: a builtin file explorer to organize your data.
• Image viewer: a builtin image viewer for medical images (.nii.gz, .nrrd, .dcm, ...) and other file formats (.pdf, .csv, ...).
• Replay engine: a replay engine for distilling and replaying processing pipelines into shareable workflows.
• Easy to extend: easily install new imaging capabilities through the UI.

Security

MedMCP assumes the local model can be steered by prompt injection (e.g. text pasted from untrusted documents), so its safety model is built around explicit user control:

• Nothing is changed or sent without your approval: writing a file, editing
  one, fetching a URL, or running a command with side effects each require an
  explicit click. There is no "always allow" and no session-wide approval — each
  call is approved on its own. Read-only shell commands (ls, cat, grep, …)
  run without a prompt inside your workspace; pointed outside it, they ask
  first, and find -exec is treated as execution, not reading.
• Localhost only: the server binds to localhost. Do not expose port 8100 over a network without adding real authentication.
• No data egress: web_search is disabled and web_fetch requires approval.
• Isolated tool stacks: stack containers run with --network none, all capabilities dropped, and no privilege escalation. They bake their models at build time, so a tool call cannot reach the network even if the agent is steered into making one. A stack that genuinely needs egress must declare it in its image label.

To report a vulnerability, see SECURITY.md.

Contributing

We welcome community contributions.

See CONTRIBUTING.md to set up a development environment and submit a pull request.

Contributors

Paul Friedrich 💻 🤔 📖 🐛 👀 🚧

Julian McGinnis 💻 🤔 📖 🐛 👀

This project follows the all-contributors specification — contributions of any kind are welcome!

Acknowledgements

MedMCP builds on a lot of open-source work. In particular:

• Agent runtime: mistral-vibe over the Agent Client Protocol
• Web server: FastAPI, Starlette, and Uvicorn
• Frontend: React and Vite, with Niivue for the medical-image viewer and react-markdown for chat rendering
• Typefaces: Inter and JetBrains Mono
• Local inference: Ollama, serving Meta's Muse Glimmer by default (Apache 2.0)

A complete list of bundled components and their licenses is in
THIRD_PARTY_NOTICES.md; model and base-layer
attributions are in NOTICE.

License

MedMCP is released under the Apache License 2.0.
See NOTICE for attribution that downstream redistributors must retain.