Name: InPlan
Author: inplan

InPlan MCP

Is this US provider in this health plan? Network checks by NPI and plan ID, with dated sources.

Tool-list grade A Remote · Streamable HTTP API key 7 tools v1.0.0

No reviews yet by inplan The publisher’s own endpoint — this marketplace is not in the path

96/100

tool-list score

tools declared

remote

at its publisher

—

calls last 7d

What it does

Is this US provider in this health plan? Network checks by NPI and plan ID, with dated sources.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http inplan-mcp https://api.inplan.io/mcp --header 'Authorization: Bearer ${AUTHORIZATION}'

# 2 — ask your agent for something these tools do
#   lookup_provider, plans_for_provider, check_network and 4 more

It needs AUTHORIZATION (Your InPlan API key as "Bearer ip_live_...". Free key: https://inplan.io/signup): this sends it in the Authorization header from your environment, so export it first — its endpoint answers 401 without it.

InPlan costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

inplan1 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.

Claude Codedeclared by this listing

This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it. Claude Code reads AUTHORIZATION (Your InPlan API key as "Bearer ip_live_...". Free key: https://inplan.io/signup) from your environment each time it connects and sends it in the Authorization header — its endpoint answers 401 without it — so the key stays out of its config: export it in your shell profile (macOS, Linux), or run setx AUTHORIZATION … and open a new terminal (Windows).

claude mcp add --scope user --transport http inplan-mcp https://api.inplan.io/mcp --header 'Authorization: Bearer ${AUTHORIZATION}'

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add — but its publisher asks for a key of their own on every call.

What it asks of you

It reaches a system of yours, so it needs your own credential rather than the publisher’s: Authorization header — Your InPlan API key as "Bearer ip_live_...". Free key: https://inplan.io/signup. You set it in your own client’s config, on your machine — this marketplace never holds it.

What it writes

One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.

What you approve

7 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Identity of a US healthcare provider by NPI: name, credential, specialties, practice locations and groups, plus a summary of the Marketplace (ACA) and Medicare Advantage plans whose network directories list them (plan counts, states, plan years, as_of dates). Use it to confirm who an NPI is before checking networks. For the plan list itself use plans_for_provider. Costs 1 call.

Parameter	Type	Required	Notes
npi	string	yes	10-digit National Provider Identifier, as a string, e.g. "1184617268".

Every Marketplace (ACA) and Medicare Advantage plan whose network directory lists the provider, one row per plan and plan year, each with plan name, insurer, state, network tier and source {type, as_of}. Medicare Advantage rows carry service_area_states and provider_state_in_service_area. Filter by market, state or year; page with limit and offset (next_offset is null on the last page). A plan mis

Parameter	Type	Required	Notes
npi	string	yes	10-digit National Provider Identifier, as a string, e.g. "1184617268".
market	string	no	"aca" = Marketplace plans, "ma" = Medicare Advantage plans. Optional; default both.
state	string	no	2-letter US state code, e.g. "OH". Optional.
year	integer	no	Plan year, e.g. 2026. Optional; by default all plan years we hold are considered.
limit	integer	no	Plans per page, 1 to 500. Default 50.
offset	integer	no	Rows to skip; pass next_offset from the previous page. Default 0.

Answers whether one plan's network directory lists one provider. answer "listed" (in_network: true) comes with evidence: plan year, network tier and source {type, as_of}. answer "not_found" (in_network: null) means no listing was found in current directory data for this provider and plan; it is NOT a statement that the provider is out of network, so never report it as "out of network". answer "no_

Parameter	Type	Required	Notes
npi	string	yes	10-digit National Provider Identifier, as a string, e.g. "1184617268".
plan_id	string	yes	Plan ID. Marketplace (ACA) plans: 14 characters like "29276OH0970001" (a 16-character "-01" variant form is accepted). Medicare Advantage plans: "H1234-001-000" (the segment "-000" is optional).
year	integer	no	Plan year, e.g. 2026. Optional; by default all plan years we hold are considered.

The check_network answer for up to 100 (npi, plan_id) pairs in one request, with the same listed / not_found / no_provider_network semantics. Invalid pairs come back with a per-item error and are not charged; each accepted pair costs 1 call. Needs the Builder plan or higher.

Parameter	Type	Required	Notes
items	array	yes	1 to 100 pairs.
year	integer	no	Default plan year for items that do not set one. Optional.

Details of one Marketplace (ACA) or Medicare Advantage plan by plan ID: name, insurer or organization, state or service area, plan type, metal level, the plan years we hold, and whether we hold its directory listings, with their as_of date. Costs 1 call.

Parameter	Type	Required	Notes
plan_id	string	yes	Plan ID. Marketplace (ACA) plans: 14 characters like "29276OH0970001" (a 16-character "-01" variant form is accepted). Medicare Advantage plans: "H1234-001-000" (the segment "-000" is optional).
year	integer	no	Plan year, e.g. 2026. Optional; by default all plan years we hold are considered.

Providers that a Marketplace (ACA) plan's network directory lists, with name, credential, primary specialty, network tiers and up to 5 locations. Filter by state, specialty (substring, e.g. "cardiology"), zip, or zip plus radius in miles. Pages are cursor-based: pass next_cursor back unchanged until it is null; with filters a page can hold fewer than limit providers. Medicare Advantage plans: use

Parameter	Type	Required	Notes
plan_id	string	yes	Plan ID. Marketplace (ACA) plans: 14 characters like "29276OH0970001" (a 16-character "-01" variant form is accepted). Medicare Advantage plans: "H1234-001-000" (the segment "-000" is optional).
state	string	no	2-letter US state code, e.g. "OH". Optional.
specialty	string	no	Specialty name or part of it, e.g. "family medicine". Optional.
zip	string	no	5-digit ZIP code, as a string. Optional.
radius	integer	no	Miles around zip, 1 to 100. Needs zip.
year	integer	no	Plan year, e.g. 2026. Optional; by default all plan years we hold are considered.
limit	integer	no	Providers per page, 1 to 100. Default 25.
cursor	string	no	next_cursor from the previous page.

The markets, states and insurers InPlan holds directory listings for, with plan counts and as_of dates, by plan year. Filter by market, state or year. Use it to see which states and insurers you can query. Costs 1 call.

Parameter	Type	Required	Notes
market	string	no	"aca" = Marketplace plans, "ma" = Medicare Advantage plans. Optional; default both.
state	string	no	2-letter US state code, e.g. "OH". Optional.
year	integer	no	Plan year, e.g. 2026. Optional; by default all plan years we hold are considered.

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install InPlan or to call it, at any volume.

ATool-list grade · score 96 / 100

Release 1.0.0 · scanned 31 Oct 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score96

Findings0 threat · 0 capability

Capabilityminimal

Coveragemanifest

Verificationnot in this report

Surface digest35cac5e5bcf549bd45bda52793bd430dac72016500883be43798c3910426c71e

Score vectorthreat 100 → client 96

Term	Level	What it prices	Points
capability-exposure	minimal	capability blast radius (minimal) — client exposure if the model is manipulated	−0
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. minimal is the level these add up to.

Tool	Capability tags	Why the tag was assigned
lookup_provider	no tags
plans_for_provider	no tags
check_network	no tags
check_network_batch	no tags
get_plan	no tags
search_plan_providers	no tags
coverage	no tags

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.

Supply chain and provenance

Integrityfirst-seen

Surface digest35cac5e5bcf549bd

Scanned2026-10-31

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.