MedRecPro

MedRecPro is a pharmaceutical structured product label (SPL) management platform built with ASP.NET Core. It provides secure access to FDA drug label data through a RESTful API, an AI-powered chat interface, a Model Context Protocol (MCP) server for integration with AI assistants like Claude, and an interactive adverse-event risk dashboard built on a multi-stage table-standardization and risk-statistics pipeline.

Specifications

• HL7 Version: HL7 Dec 2023 https://www.fda.gov/media/84201/download
• Info: https://www.fda.gov/industry/fda-data-standards-advisory-board/structured-product-labeling-resources
• SPL Data Source: https://dailymed.nlm.nih.gov/dailymed/spl-resources-all-drug-labels.cfm
• Orange Book Data Source: https://www.fda.gov/drugs/drug-approvals-and-databases/approved-drug-products-therapeutic-equivalence-evaluations-orange-book

Technology Stack

• Runtime: ASP.NET Core (.NET 8.0 LTS)
• Database: Azure SQL Server (Serverless free tier) with Dapper + Entity Framework Core
• Authentication: Cookie-based auth with Google and Microsoft OAuth providers; JWT bearer tokens for API access; McpBearer JWT scheme for MCP server integration (claims normalized to standard JWT short names: sub, name, email)
• AI Integration: Claude API for natural language query interpretation and synthesis
• MCP Protocol: Model Context Protocol server with OAuth 2.1 (PKCE S256) for Claude.ai connector integration
• Hosting: Azure App Service (Windows, IIS) with Cloudflare CDN/WAF/DNS
• Secrets: Azure Key Vault
• API Documentation: Swagger/OpenAPI
• Error Contracts: Centralized ASP.NET Core IExceptionHandler with sanitized RFC 7807 ProblemDetails responses and request trace correlation
• Testing: MSTest, WebApplicationFactory<Program>, kept-open SQLite test databases, reviewed Debug/Release OpenAPI snapshots, and real-host HTTP contracts
• Verification: PowerShell gate runner plus GitHub Actions for fast architecture checks, Debug/Release contracts, and the full regression suite
• SPL Rendering: RazorLight templates for SPL XML-to-HTML generation

Solution Architecture

The solution's three web projects are deployed to a single Azure App Service using IIS virtual applications (the console, library, React SPA source, prototypes, and test projects are not deployed as separate apps):

                        Cloudflare (CDN/WAF/DNS)
                                |
                                v
    Azure App Service: "MedRecPro" (Windows, IIS)
   +--------------------------------------------------------+
   |                                                        |
   |  /                site\wwwroot       MedRecProStatic   |
   |  /adverse-events  (MedRecProStatic, React island)      |
   |  /api             site\wwwroot\api   MedRecPro API     |
   |  /mcp             site\wwwroot\mcp   MedRecProMCP      |
   |                                                        |
   +--------------------------------------------------------+
                        |
                        v
               Azure Key Vault
              (medrecprovault)

Build and Solution Boundary

MedRecPro.sln is the focused API/import/test solution. It intentionally contains MedRecPro, MedRecProImportClass, and MedRecProTest; the test project references MedRecProConsole, so the CLI stays in the regular regression build without making the solution responsible for every deployed app. MedRecProStatic and MedRecProMCP are separately deployed IIS virtual applications and should be built or published explicitly when their code changes:

dotnet build .\MedRecPro.sln --no-restore -p:UseAppHost=false
dotnet build .\MedRecProStatic\MedRecProStatic.csproj --no-restore -p:UseAppHost=false
dotnet build .\MedRecProMCP\MedRecProMCP.csproj --no-restore -p:UseAppHost=false

If a local apphost executable is locked by a running process, keep output inside the workspace and disable apphost generation for the verification pass, for example dotnet build .\MedRecPro.sln --no-restore -p:UseAppHost=false -p:BaseOutputPath=.\MedRecPro\.codex-build\. The API project excludes bin/** and .codex-build/** from default item globbing so copied RazorLight templates from generated output cannot re-enter compilation when BaseOutputPath is redirected.

How the Projects Relate

MedRecProStatic is the user-facing front end. Its AI chat interface (/Home/Chat) communicates with the API using a request-interpret-execute-synthesize pattern: user queries are sent to the API's AI endpoints, which use Claude to map natural language to API calls. The static site also serves OAuth/MCP discovery metadata (/.well-known/*) at the domain root on behalf of the MCP server, because the MCP SDK resolves discovery URLs relative to the domain root rather than the /mcp path.

MedRecPro (API) is the core backend. It handles label data CRUD, user authentication, AI query interpretation via Claude, database views for navigation, SPL document rendering via RazorLight templates, and the HTTP/progress boundary for SPL ZIP uploads. The public Label surface remains one 51-operation /api/Label route family, but its implementation is split across small feature controllers and injected query/operation services. The former DtoLabelAccess implementation is now owned by those services; one forwarding-only static facade remains for external .NET compatibility. The actual SPL ZIP traversal, XML parsing, duplicate checks, and parser orchestration live in MedRecProImportClass; the API keeps thin compatibility adapters and maps import-library result DTOs back into the web import-progress models.

MedRecProMCP is an OAuth 2.1 gateway that exposes MedRecPro API capabilities as MCP tools. When Claude.ai connects, it authenticates users through Google/Microsoft OAuth, resolves upstream identity provider identities to numeric database user IDs (auto-provisioning new users if needed), then forwards authenticated MCP JWTs to the MedRecPro API. It uses JWT tokens, PKCE (S256), Dynamic Client Registration (RFC 7591), and a shared PKSecret for encrypted user ID exchange with the API.

MedRecProReact is the source for the adverse-event risk dashboard — a React + Vite single-page "island". Its Vite build emits a deterministic bundle directly into MedRecProStatic/wwwroot/ae-dashboard, which MedRecProStatic serves at /adverse-events. The dashboard reads only from the API's /api/AdverseEvent surface (AdverseEventController), which in turn queries the materialized AE risk tables produced by the table-standardization pipeline (Stage 5). Current dashboard focuses cover product-level risk, pharmacologic-class SOC correlation, and MedDRA-system-scoped class correlation. See the MedRecProReact README for the dashboard, and the MedRecProImportClass README for the risk-statistics contract.

Backend Boundaries and Compatibility Safeguards