Connector Registry & Live Capability Discovery Re-discover

Each card reflects a real-time discovery call made just now. server/discover is tried first (a single self-contained HTTP request, no handshake — MCP RC-aligned); if a connector doesn't support it, discovery falls back to the SDK's initialize+listTools path.

Metadata Hub Catalog Force refresh

Classification tags the Gateway's Policy Decision Point uses to decide what to mask.

Run a Tool Call (through the Gateway & Policy Decision Point)

Runs as you, signed in — your session's role determines what gets masked. Shows exactly which masking rule fired on each field.

Run a query to see the response.

Each run opens a brand-new MCP client connection to the connector and closes it when done — no session is kept between calls, and every request carries Mcp-Method/Mcp-Name/traceparent headers plus a reverse-DNS-namespaced _meta identity block (see the Gateway's mcpClient.ts).

Reports Refresh

A report is a saved query, not saved data — running it (or exporting it) always re-executes it live, masked for whoever is currently signed in, through the exact same Policy Decision Point as the panel above. A "federated" report can chain steps across multiple connectors (structured FHIR rows, unstructured clinical notes, catalog metadata) into one merged table — real per-connector masked calls merged together, not a distributed query planner.

Create a report

Dashboards Refresh

Custom, user-built dashboards over the data catalog, connectors, and saved reports. Every widget's data is computed live when the dashboard is opened — masked for whoever is viewing it, exactly like a report.

Create a dashboard

Ask a question checking provider…

A free-text question is resolved through the exact same masked, audited query path as everything else on this page — the provider (frontier AI, a local self-hosted model, or the built-in keyword matcher) only proposes a query; it is validated and executed identically to a saved report, scoped to your role. Nothing it proposes can bypass masking or write data.

Users (admin) Refresh

Create local user accounts. New users sign in with a temporary password shown once here, then can register their own passkey from "My account".

Create a local user

Audit Log Refresh

Every call recorded with the acting identity, connector/tool, masking outcome, and latency — never raw unmasked values for roles not entitled to them.