HHS · no agency ID · record R0730

Support for MCP and AI APIs in Digital Gateway

Department of Health and Human Services · HHS/CDC

Overview

Development stage: In development or acquisitionSource: a) Pre-deployment – The use case is in a development or acquisition status.
High-impact designation: Not high-impactSource: c) Not high-impact
Impact justification: Not reported
Start date: Not reported
Withheld from public reporting: NoSource: a) No

Mission

Topic area: Information Technology
Operational functions: No function tag matched Derived by keyword rules; see methodology

Problem the AI is intended to solve

Digital Gateway (CDC's API Platform) can support MCP and AI APIs. Given MCPs are a new addition to the ecosystem, the goal is to explore what it takes to implement MCPs internally.

Expected benefits

Centralized Management: The Digital Gateway can act as a centralized point for managing interactions between AI agents and MCP servers. This simplifies the integration process and ensures consistent policy enforcement across all tools and data sources. Enhanced Security: By routing all requests through the Digital Gateway, the CDC can enforce security policies, access controls, and rate limiting. This helps protect sensitive health data and ensures compliance with regulatory requirements. Improved Data Governance: The Gateway can provide visibility into data usage and interactions, helping the CDC maintain robust data governance practices. This includes monitoring access, usage patterns, etc.

System outputs

The output will be a test Model Context protocol. This will be an internal server which will have access to public only data to support future development of the related Digital Gateway infrastructure for future potential MCPs and APIs.

Technology

AI classification: Agentic AISource: Agentic AI: AI systems that perform tasks or make decisions autonomously with minimal human intervention.
System name(s): Not reported
Custom-developed code: Not reported
Public source code: Not reported

Sourcing

How it was built: Not reported
Vendor (as reported): Not reported
Vendors (standardized): None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: Not reported
Privacy Impact Assessment: Not reported
Authorization to Operate: Not reported
Demographic features: Not reported
Training and evaluation data: Not reported
Federal Data Catalog: Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingNo answer reported

AI impact assessmentNo answer reported

Independent reviewNo answer reported

Ongoing monitoringNo answer reported

Operator trainingNo answer reported

Fail-safeNo answer reported

Appeal processNo answer reported

User and public consultationNo answer reported

Potential impacts and how they were identified

Not reported