Two MCP servers — this page is the provider one

Sandwich Soft MCP

One API key, minted in your Soft portal, lists your clients, visits, and invoices. It cannot open a family's inbox. That is LovedOne Family MCP — a different key, a different URL, a different tenant.

This product

Sandwich Soft MCP

api.lovedone.app/mcp/vendor/v1

Audience: home-care agencies, tech-support vendors, trades. Mint keys in portal → Settings → MCP keys.

The other product

LovedOne Family MCP

api.lovedone.app/mcp/v1

Audience: adult children coordinating a household. A family key on this vendor URL is rejected (403 WRONG_SURFACE).

Family MCP docs

Connect

{
  "mcpServers": {
    "sandwich-soft": {
      "url": "https://api.lovedone.app/mcp/vendor/v1",
      "headers": {
        "Authorization": "Bearer sk-sand-..."
      }
    }
  }
}

Provider tools

  • ping

    Smoke-test tool. Returns pong plus the authenticated caller's uid, tenant, and auth method. No PHI. No side effects.

  • get_agency_profile

    Returns the authenticated provider's agency: id, name, slug, plan, and the caller's role. Use this first when building a vendor dashboard.

  • list_clients

    Lists this Sandwich Soft agency's clients (agency-context loved ones). Includes whether each client is linked to a LovedOne family inbox. Does not return other agencies' clients or family-member emails.

  • get_client

    Returns one client owned by this agency, plus recent visits/notes. Rejected if the client belongs to another agency.

  • list_visits

    Lists Sandwich Soft visit/note events for this agency, optionally for one client. Notes may contain health information logged by staff.

  • add_visit_note

    Logs a note on an agency client. If the client is linked to a LovedOne family inbox, a copy is posted there so siblings see it. This is a write. Notes may be health-related — only record what the family has asked you to share.

  • list_invoices

    Lists invoices this agency issued to families (amounts, status, assignment). Sandwich does not move money — these are ledger records. Payment handles on the invoice are contact pointers, not credentials.

Family tools (not on this server)

Listed so developers do not mix them into a vendor dashboard.

  • ping
  • get_user_profile
  • list_loved_ones
  • list_family_members
  • list_inbox_messages
  • get_inbox_message
  • list_care_events

Health data and SOC 2

Client names, visit notes, and invoices can be health-related or household-sensitive. Keys are hashed at rest, every call is audited, and a key only sees clients linked to that agency. We are designing toward SOC 2 Type I then Type II. Sandwich Pipe vault (raw EHR) is a separate, higher-trust project — this MCP does not return raw vault artifacts. Read the vendor MCP specification.