mcp.medigami.com

This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.

This tool accepts raw denial-letter text (which frequently contains patient name, DOB, claim numbers, and other PHI) and transmits it to a 'Denial Common Crawl' aggregate dataset. Although consent-gated (consent=true) and described as being scrubbed server-side before storage, the raw, unredacted text still leaves the user's control and is processed by a remote service before any redaction occurs. If the server-side scrubber fails or is bypassed, PHI could be exposed in a public aggregate. Agents should encourage users to redact identifying details before invoking this tool, and should not invoke it on a user's behalf without clear, explicit confirmation that the user understands their letter text is being uploaded externally.

The description text for this deprecated alias of verify_attestation contains boilerplate 'WHEN TO USE / WHEN NOT' guidance ('Reference lookups: individual code details, verifying a provider registry entry...') that does not match the tool's actual function (cryptographic envelope verification). This mismatched guidance could cause an agent to invoke the tool in inappropriate contexts or misunderstand its purpose. Not a malicious instruction, but a documentation-quality issue worth correcting.

Same issue as verify_mcp_response: this deprecated alias of format_citation carries generic 'reference lookup' guidance text that doesn't describe its actual citation-formatting function, which could confuse tool selection logic though it poses no direct harm.