MCP server · the same clinic, exposed as a protocol
Clínica Aurora · MCP server with two-phase writes
The clinic schedule published as a Model Context Protocol server, so any MCP client can book, reschedule and cancel through it. The business rules are enforced on this side, not requested in a prompt.
Demo limits
- ·A browser cannot open this endpoint: it speaks a protocol, not a page. A GET returns 406 on purpose.
- ·To check it yourself: POST to https://aurora.pgdev.com.br/mcp with `Accept: application/json, text/event-stream` and an `initialize` call, then `tools/list` with the session id it returns.
- ·Or point any MCP client at that URL. The seven tools in the screenshot are what it advertises.
- ·It writes into the same demo schedule as the chat demo, which resets on its own.
A public AI demo is a spending endpoint. Cost control is part of what I ship.
Problem
An MCP server is usually a thin wrapper: it hands the model a set of functions and hopes the prompt keeps it in line. That is fine until the tools write into something real, and then the interesting questions arrive. What stops a model that was talked into it from cancelling an appointment nobody approved? What proves, months later, which rule refused a change? This server answers both on the server side, where a prompt cannot reach.
Approach
- →Every write takes two calls. The first returns a proposal and a confirmation token without touching the schedule; the second commits it with that token. A model that decides to skip the confirmation step still cannot, because the token it would need does not exist yet.
- →The business rules are a deterministic policy engine behind the tools, not instructions in the system prompt. A write the policy refuses comes back as a refusal carrying the rule code, and the model is told to read `ler_politica` before promising anything to anyone.
- →Two tools exist purely so the decision can be inspected: `ler_politica` returns the rules and their version, and `ler_log_de_decisao` returns every call, every policy decision and every write of the session, each with the rule code that produced it.
- →It is the same clinic the chat demo drives, so the two can be compared side by side: one shows a person talking to an agent, the other shows another agent plugging into the same guarded surface.
- →Protocol version 2025-06-18, streamable HTTP with session ids, running behind Traefik as its own service.