Ask three EDC vendors whether an AI agent can drive their platform through the Model Context Protocol. Three will say yes. The first means the agent can search the user manual. The second means it can pull enrolment numbers. The third means it can build your eCRF.
All three have an EDC MCP server. They are not selling the same thing.
The gap shows up after you sign. A study team that expected form building and got a documentation search will spend the same weeks on database build it spent last year.
Here is how to grade what sits behind the claim, with a test you can run during a demo.
| Level | What the agent does | What you get | Who is here today |
|---|---|---|---|
| 1 | Reads your documentation | Fewer support tickets | Medidata Platform Help |
| 2 | Reads your study data | Monitoring answers without a report request | Medidata Site Ranking, CData for Veeva |
| 3 | Drafts a study on paper | A specification your team retypes | General AI tools with your protocol pasted in |
| 4 | Builds the study in DRAFT | Forms you open, review and accept | Datacapt |
For how an MCP server connects a model to an EDC in the first place, read MCP and LLMs in Clinical Research first.
Where clinical MCP servers stand today
Medidata deployed MCP servers with Anthropic and names two use cases. Platform Help searches their product knowledge base, so a user can ask how to configure a data check instead of opening the manual. Intelligent Site Ranking reads site history to predict which sites will enrol. Both stop at reading, and Medidata describes no path that writes a record into Rave.
Veeva customers who want MCP access reach for a connector that CData built on a JDBC driver. It is read-only, and it comes from a third party rather than from Veeva.
Several MCP servers expose ClinicalTrials.gov. They query a public registry, so no confidentiality question arises and no validation work follows.
The one published attempt at write access sits in a preprint. TrialMCP proposes five servers linking trial robots to scheduling, EDC, eConsent, imaging archives and lab systems. Its authors want to remove the point-to-point integrations that multiply every time a sponsor adds a platform.
Every shipped product on that list reads. The levels below start there.
Level 1: the agent reads your EDC documentation
The agent answers questions about the software. How do I set up a repeating visit? Which permission lets a user close a query? What does this error mean?
A vendor can build this in a few weeks. No protected data crosses a boundary, no write path exists, and the validation package stays untouched, because the agent never enters the system that holds your records. Your support team sees fewer tickets. Your study team sees the same build timeline as last year.
How to spot it: ask whether any tool takes a study identifier. If none does, the server reads documentation.
Level 2: the agent reads your study data
Now the tools take a study identifier. The agent reports enrolment against forecast at site 102, lists sites with forms overdue past fourteen days, or counts open queries by site and by age.
Two designs produce that answer, and your data protection officer will care which one you bought. One sends the model rows of data and lets it count. The other counts inside the platform and sends the model a number. The first shows subject-level values to whoever hosts the model. The second shows a total.
Datacapt uses the second design across the whole server. No eCRF value, no ePRO response and no subject identifier leaves the platform. An agent working from counts cannot review a subject's record, so it cannot tell you that visit V3 is dated before visit V2 for subject 012.
How to spot it: ask what the tool returns for list the subjects overdue for a lab draw. A row per subject, or a count per site.
Level 3: the agent drafts a study for you to rebuild
The agent reads your protocol and drafts the study. Form structure, visit schedule, field types, conditional logic, edit checks. It hands you a document.
A data manager then rebuilds that document inside the EDC by hand. The agent did the thinking and your team still does the typing. On a study with sixty forms, transcription eats most of the saving, and every retyped field is another chance to mistype a range or invert a condition.
Vendors land here when the agent sits outside the platform. A model can describe a form in detail, and it can create one only if the platform exposes that operation as a tool. A draft beats a blank page, and your team is still the one building the study.
How to spot it: ask what the study looks like when the agent finishes. A specification, or forms you can open.
Level 4: the agent builds the study in your EDC
The agent creates the forms, sets the conditional logic, configures the validation rules and adds the study languages. A data manager opens the result and accepts or rejects it. Datacapt measures around 60% time saved on study build this way.
Four controls decide whether your quality team signs this off.
- Agent identity. The call carries the person who made it. Datacapt issues one MCP key per user, separate from the classic API key, time-limited, revocable, with scopes fixed when it is created. The key inherits that person's rights and no others. A shared service account with study-wide permissions breaks attribution for every action the agent takes.
- A guard that lives in the backend. Writes land on DRAFT studies or on a new version, never on a published one. The check belongs in the server, where a model cannot reach it. Some vendors handle this by telling the model to leave production alone. A prompt instruction is advice, and a model can ignore advice.
- Audit trail attribution. Every call records MCP origin, under the user's name, with the tool invoked and the parameters passed. Part 11 and Annex 11 want an audit trail of entries and edits whatever produced them. If an agent action reads like a human action in your log, you cannot answer the first question an inspector asks, so check that they can filter on it.
- Human acceptance before production. The agent proposes, a person validates, and the study goes live on that person's signature. That holds whether the agent built ten fields or four hundred.
How to spot it: ask for the tool list and read the verbs. Tools named get_* and list_* are level 2. A create_item or its equivalent is level 4.
The level nobody should build
Sooner or later a vendor will offer an agent that writes clinical values into a live study, and will present it as the next step up from level 4.
Part 11 does not ban it in a single line. It makes it expensive in ways that are easy to miss. An electronic signature attributes a record to a person, and an agent has no signature of its own. A subject's record is a poor place to find out that your agent read milligrams as micrograms. An error caught after database lock costs more than the build it accelerated.
Datacapt blocks writes on published versions in the backend. An agent can open a query for a human to answer. Answering it stays the human's job.
Five questions for your EDC vendor
Put these in your RFP. Each one turns a marketing claim into something you can check.
| Question | What a weak answer sounds like |
|---|---|
| Which of your MCP tools write, and to which object? | “The agent can help with study build.” |
| What leaves the platform for the model: values, or counts and structures? | “The connection is encrypted.” |
| Can the agent modify a study in production, and what enforces the limit? | “We instruct the model not to.” |
| Does the audit trail separate an agent action from a human one, and can an inspector filter on it? | “Everything is logged.” |
| What credential does the agent use? | “A service account.” |
The second question needs a note, because vendors often answer it with encryption. A model cannot compare two dates or suggest a medical code inside ciphertext, so if the agent does those things, someone decrypted the data first. Ask what the model receives, and treat the encryption answer as a separate topic.
Where Datacapt sits
- Writes eCRF structure, conditional logic, validation rules, templates and languages into DRAFT studies.
- Sends models metadata and aggregates. The one piece of entered text that can leave is a verbatim term on its own, for a coding suggestion.
- One MCP key per user, scoped and revocable.
- MCP origin in the audit trail, with a dedicated filter for inspections.
You can drive it from the chat inside the platform or from your own MCP client, connected to Claude, ChatGPT, Gemini or another model you have chosen. See how V5 builds a study.
FAQ
What is an MCP server for an EDC?
An MCP server exposes an EDC's operations to an AI agent as a catalogue of tools the model can discover and call, so a data manager can state a request in plain language instead of moving through the interface. It sits on top of the platform's existing API rather than replacing it.
Does an AI agent writing to an EDC break 21 CFR Part 11?
No, provided the write is attributed. The agent needs an identity tied to a named user, the audit trail has to record that the action came through MCP with the tool and parameters used, and the electronic signature that releases the study stays with a person. An agent operating through a shared service account fails the attribution requirement.
Can an AI agent see my patient data through MCP?
That depends on the server, not on the protocol. A server that aggregates in the backend sends the model counts and structures. A server that forwards query results sends it rows. Ask the vendor which one describes their build.
Which EDC vendors have an MCP server?
Medidata has deployed MCP servers for documentation search and site ranking. CData, a third party, ships a read-only connector that reaches Veeva data. Datacapt runs an MCP server with write access to study configuration. Several public servers expose ClinicalTrials.gov.
How much time does MCP save on study build?
Datacapt measures around 60% on the build itself. The saving depends on which level the server reaches: a server that produces a specification a human retypes returns a fraction of what a server that creates the forms returns.
