v2.0.0: Standalone tutorials, AI agents and MCP servers

A complete rewrite of the InterSystems FHIR/AI Hackathon Kit. It still covers similar ground to V1, but is restructured into standalone tutorials by data type. A Docker setup brings up InterSystems IRIS for Health with a FHIR server.

What it covers

Tutorials are Jupyter notebooks (with markdown versions) that you can run in order:

• Key concepts and setup: short introductions to IRIS, FHIR, Docker and RAG, plus environment setup
• Tabular data: load CSV data into IRIS SQL tables with Python, then query it
• FHIR data: load FHIR bundles and resources over REST, query FHIR from Python, and explore the FHIR specification with Swagger
• Vector search: chunk PDFs, embed them with OpenAI, store them in an IRIS vector column and search with SQL
• AI agents: build LangChain agents with tools that access the IRIS data
• MCP servers: wrap data access as MCP servers (FastMCP over HTTP, and stdio)
• Extras: create synthetic FHIR data, set up a FHIR server in 5 minutes, and an integrated machine learning quickstart

Setup scripts are included that recreate the tables earlier tutorials build, so you can start from a later tutorial.

What changed since V1

• Tutorials are now standalone rather than building one chatbot end to end
• New coverage of AI agents and MCP servers in Python
• OpenAI models replace local Ollama models, which were slow and computationally heavy
• Automated tests that run the notebooks against the Docker container
• Agent skills for the topics covered

The V1 patient chatbot with Ollama is still available as release v1.0.0 and the V1 branch.

Requirements

• Python
• Docker
• An OpenAI API key with some credit. The README estimates a full run of the tutorials costs less than $0.01.

See the README for setup steps.

Initial Release

Fixes the **widget Settings **panel appearing empty after converting a dashboard widget with DashboardTools.ConvertWidget/ConvertAllWidgets. The converted widget's type wasn't resolving in the Dashboard Editor's catalog lookup; it now registers correctly, so Settings opens as expected.

Added protection against double request/response conversion when a charset is specified in Content-Type

For reasons this is a double release. Don't ask!

Feature Removed: ChatGPT Test message generator

I removed this to get this approved for use at work as the paperwork required wasn't worth the feature.

Feature Added: Prettify XML/JSON/FHIR

Option added to prettify XML/JSON on page load. Toggle button added to ensure you can still view the RAW content.

Useful when you have XML/JSON with CDATA embdedded data that does not natively prettify.

Search fucntion also added which can either hide or collapse non-matching data using the checkbox.

Feature Updated: Search History

Retention settings added to delete the cached searched after X days, set on the options page.

Feature Updated: Full Trace Tab

Changed how the FullTrace tab works as it now handles non-HL7 messages with the prettifier script. It's still a wee bit buggy but I'm working on it.

Feature Updated: Options Page Settings

More granular control enabled for settings.

Feature Updated: ReadMe file

Now sort of respects markdown on the options page. Ish. Makes it a bit easier to read

Background Tomfoolery:

Updated to load content scripts via a config file.

07/09/2026 Updates:

Version 1.11.0

Compatibility Update: HealthConnect

The extension should now work with HealthConnect instances.

Feature Added: Quick Analysis

On the message Viewer page there is now a Quick Analysis Tab. This shows a cut down version of the ChartJS integration for, you guessed it, quick analysis.

Feature Updated: Options Page

It looks marginally prettier (not my specialty) and is easier to navigate.

Feature Updated: Instances - Script Permissions

I'm planning on publishing this to the chrome/microsoft stores so we now ask the users for permission to run this extension on the urls added for your instances.

As it's only me editing this I've never bothered to do this - for some reason I trust myself not to add malware that scrapes other websites.

So now you control where these scripts run!

This is mainly for the Chrome store approval but I hope it gives you a warm fuzzy fealing too.

IMPORTANT If the features aren't working after this update, try clicking the IMPORT button on the Export/Import tab on the options page. This will prompt you to give permissions for this extension to run on your instances.

Organisational stuff: directories

These have been tidied.

Version 1.0.3 improves IRIS sign-in diagnostics and validates server information before establishing a connection. Empty and null read responses are rejected correctly, while successful empty writes—including HTTP 204—are supported.

Setup instructions now explain /api/admin Password authentication, the correct IRIS web port, and the separate /api/workbench extension.

Linux and Windows source checks, a fresh IRIS Community 2026.2 connection test, and the live browser demonstration passed.

Release and source download:
https://github.com/agammann/iris-workbench/releases/tag/v1.0.3

Updated installation instructions:
https://github.com/agammann/iris-workbench/blob/main/README.md

Watch the 2.5-minute captioned live demonstration:
https://github.com/agammann/iris-workbench/releases/download/v1.0.3/iris-workbench_1.0.3_screencast.mp4

[2.18.0] - 2026-10-13

Added

• Record map classes and their generated data classes are now automatically added to source control (#955)

Fixed

• Import All no longer deletes items that are mapped in from another database, which could delete Embedded Git itself where it is mapped instance-wide (#997)
• A custom pull event handler stored in the repository is now loaded and compiled before it runs, so operations on a freshly built instance no longer fail with <CLASS DOES NOT EXIST> (#1000)
• IRIS BI Architect no longer throws <CLASS DOES NOT EXIST> error when no cube selected (#980)

Initial Release

Agent

• The agent can read, edit, save and create classes and routines. Every save or create is a proposal you confirm, and OcuPilot's own classes are refused. When you ask about a class or routine, the agent reads its source, up to about 60,000 characters, and sends it to your configured model provider. Values that look like known secrets are filtered first.
• The agent can propose permission changes, and it refuses to act on a screen you can't open, naming the screen.
• Each turn starts with the tools for the screen you're on, the general tools and a tool search, and the agent finds any other tool it needs in the same turn. A turn's first request is now a few thousand tokens instead of close to two hundred thousand, so models with smaller context windows can hold it.
• Turns cost less and can go further: repeat calls in a turn reuse cached input where your provider supports it, so they are faster and cheaper, and a turn can make more calls before it reaches its token limit.
• Each tool call starts about a second faster.
• Long blocks in the agent panel start collapsed, with Show more and Show less.
• Agents using Google Gemini work again; a few tool descriptions were being rejected by Gemini.

Interoperability

• The Interoperability menus appear only in namespaces where interoperability is enabled.
• Accounts that use the classic Interoperability pages can sign in to OcuPilot.
• Productions: start, stop, restart, update or recover them. The agent now reports correctly when a stop is refused.
• Production items: enable, disable, add and remove them, each after confirmation.
• Item settings: view and change them, each change confirmed. Settings that look like passwords or keys are hidden and can't be changed here; use the classic portal for those. A file adapter's directory can't point into the instance's manager directory or OcuPilot's own folder.
• The production monitor, and tabs for each business host's status, queue, jobs, messages and log. Queued messages, queues and jobs can be aborted, and a job suspended or stopped.
• Business processes, business rules and data transformations are listed.
• Lookup tables: create and edit tables and their entries, and import or export them as .LUT files. Business partners can be viewed.
• Test a business host from its Test tab, which sends it a request.

Security and permissions

• The agent can no longer propose deleting, disabling or changing OcuPilot's own internal applications.
• Passwords typed into SQL statements are masked wherever statement text is shown, and before it reaches the agent.
• Screen permissions: see which permission each screen requires and adjust it. Nothing changes on update: every screen requires what it did until an administrator adjusts it.
• Authentication and web session options, superservers, and managed file transfer connections.
• Wallet secrets: RSA and symmetric keys.
• SQL privileges on objects and columns, and SQL admin privileges.
• Roles show each member's admin option, a new user can be copied from an existing one, and password rules can be set.

Web applications

• %-class access, Doc DB applications, privileged routine applications with their roles and routines, and spec-based REST services, including creating one.

Monitoring

• A Prometheus metrics table, and the dashboard's detail views: ECP, globals and routines, the most active processes, and system resources.
• OcuPilot no longer raises the instance's alert state for two harmless events of its own.

Fixes

• Confirming a save or create whose stored request is damaged is now refused.
• Several smaller fixes across tasks, databases, auditing and services.

Safety

• Fifteen more agent actions start switched off: removing a production item; aborting a job, a queue or a queued message; removing a lookup entry; deleting or importing a lookup table; deleting a managed file transfer connection or revoking its token; replacing an RSA wallet secret; deleting a superserver; and deleting a %-class access entry, a Doc DB application, a REST service or a privileged routine application. Turn them on under Agent co-pilot → Governance policy; the screens do all fifteen.
• Agent saves of classes and routines now start switched on. After an upgrade the agent begins offering them, unless you switched them off before; a setting you stored is kept.

Known issue

• Install OcuPilot into one namespace per instance: in this release, installing it with IPM into a second namespace moves its web applications to that namespace. The next release fixes this.

Requires InterSystems IRIS or IRIS for Health 2026.2 or later. Upgrading from 1.0.11 keeps your agent definitions, conversations, settings and audit records.

Initial Release

Due to third-party app scraping, HuggingFace has constrained anonymous access. Please sign-up for a HuggingFace account ( https://huggingface.co/ ) to gain proper access.

Agent

• The agent can run read-only SQL for you. It runs as you, with your SQL privileges checked on every statement, hides columns whose names suggest credentials, and refuses statements that carry code. A statement that changes data or the schema is a proposal you confirm, and that action starts switched off. What the agent reads goes to your model provider like any other tool result.
• A picker chooses which agent definition the panel uses. Picking another starts a new conversation, so a conversation's history never goes to a different provider.

System Explorer

• Document databases: list a namespace's DocDB databases, create one, and drop one by typing its name. The screen needs the %Service_DocDB service enabled.
• The data browser says "1 row" and "1 change" where it used to say "1 rows" and "1 changes".

OS management

• SQL activity: see the SQL statements running right now, slowest first, and open the process behind one. Statement text shows for your own statements, and for another user's only when you hold the database privileges.

Security

• Database encryption and data element encryption: activate a key file's keys and deactivate a key, with the vendor's refusals explained in plain sentences.
• Encryption startup settings: turning on audit-log encryption takes the strongest confirmation, and asking for the key at startup is refused while the audit log or a system database is still encrypted.

Safety

• Seven more agent actions start switched off: activating or deactivating a database or data element encryption key, changing the encryption startup settings, dropping a document database, and running SQL that changes data or the schema. Turn them on under Agent co-pilot → Governance policy; the screens do all seven.

Requires InterSystems IRIS or IRIS for Health 2026.2 or later. Upgrading from 1.0.10 keeps your agent definitions, conversations, settings and audit records.

System Explorer

• Data browser editing: change rows in place, add, duplicate and delete them, then save them all in one step after you confirm. A save runs as you, with your SQL privileges. Only a person saves, and rows never reach the agent.
• Data browser tabs: open up to eight tables side by side, each keeping its own filters, sort and page. Download the page as CSV, jump to a row number, and use keyboard shortcuts.
• Class reference: see a class's reference page from the instance's own class documentation, beside its source.

OS management

• ECP settings: view and change the application server and data server settings.
• ECP application servers: see which application servers are connected, and authorize, reject or delete their SSL/TLS requests.

Security

• Encryption key files: create a key file, and add or remove its keys and administrators. Removing a key that OcuPilot, a protected database or the journal relies on is refused.

Safety

• Six more agent actions start switched off: creating an encryption key file, adding or removing its keys or administrators, and deleting an ECP application server's SSL/TLS authorization. Turn them on under Agent co-pilot → Governance policy; the screens themselves do all six.

Fixes

• Download CSV keeps negative numbers in number columns as numbers.

For judges

• On the live demo, open System Explorer → Data browser, pick DemoData → Patient, and edit the sample rows: change a cell, add or delete a row, then save and confirm.

Requires InterSystems IRIS or IRIS for Health 2026.2 or later. Upgrading from 1.0.9 keeps your agent definitions, conversations, settings and audit records.

OpsDeck 1.0.1

This maintenance release adds a reproducible Docker quick-start for OpsDeck 1.0.

Docker quick-start

OpsDeck can now be started from a clean Docker environment using the documented quick-start workflow.
The workflow:

• starts the pinned InterSystems IRIS Community 2026.2 container;
• creates a fresh persistent IRIS data volume;
• generates a local _SYSTEM credential using the official InterSystems PasswordHash mechanism;
• downloads and verifies the exact qualified OpsDeck 1.0.0 release archive;
• installs OpsDeck through IPM;
• verifies the installed opsdeck 1.0.0 package;
• checks native and authenticated OpsDeck endpoints; and
• verifies the installation again after container restart.
  The native topology is unchanged: IRIS serves OpsDeck directly at /opsdeck/index.html. No Node.js container, proxy, or additional web server is introduced.
  The Docker service is bound to loopback by default, and generated credential material remains local and is ignored by Git.

Documentation

The Docker quick-start is now linked directly from the repository README alongside the native installation and evaluator guides.
This release does not replace or modify the qualified OpsDeck 1.0.0 application artifact. It adds a reproducible clean-environment deployment path around that existing release.

Production Release

System Explorer

• SQL query: run SQL as yourself, with your SQL privileges checked on every statement. A query runs at once; an insert, update, delete, schema change or procedure call runs only after you confirm it; statements that would manage users, roles or databases, read server files, set a password or touch OcuPilot's own tables are refused. Parameters, a row limit and Explain plan. Only a person runs SQL, and statements and results never reach the agent.
• Background queries: start a long query, leave, and pick up its result when you come back. Results are kept for 15 minutes and only you can see them.
• Data browser: pick a table from a tree and page through its rows, with filter and sort, using your own SQL privileges.

OS management

• License key: see the license, validate a new key, and activate it. Only a person can activate a key, and you confirm it first.
• License servers: list, create, edit and delete.
• ECP data servers: list, create, edit, delete and change their status.

Safety

• Three more agent actions start switched off: deleting a license server, deleting an ECP data server, and changing an ECP data server's status. Turn them on under Agent co-pilot → Governance policy; the screens themselves do all three.

For judges

• The live demo now has sample tables to try SQL query and the data browser on: DemoData.Patient and DemoData.Visit, with invented data.

Requires InterSystems IRIS or IRIS for Health 2026.2 or later. Upgrading from 1.0.8 keeps your agent definitions, conversations, settings and audit records.

System Explorer

• Edit source: open a class or routine and choose Edit source, then Save. Only a person can save code; the agent never does. A save is refused if someone else changed the document since you opened it, or holds it locked, and OcuPilot's own code cannot be saved.
• Search code across a namespace's classes and routines, compare two documents line by line, and find where a macro is defined. You can also ask the agent to search or look up a macro.
• An SQL catalog: schemas, tables, views and procedures, each with its details - fields, indices, triggers, constraints, partitions, cached queries and the SQL statements that use it. You see only what your own SQL privileges reach.

Journals

• The journal list and each file's details; switch to a new journal file or directory; check a journal's integrity.
• View and change the journal settings. A change is checked for the privileges it needs before anything is written, so it is never half-applied.
• Page through a journal file's records.

Easier to use

• Typing a screen's name in the command box opens that screen first.

Requires InterSystems IRIS or IRIS for Health 2026.2 or later. Upgrading from 1.0.7 keeps your agent definitions, conversations, settings and audit records.

IRIS startup fix

Thank you to the QA team for testing the full IRIS setup and reporting the password-change failure. The previously selected IRIS Community 2026.2 image lacks a utility needed by its --password-file startup path. The optional IRIS stack now pins the tested 2026.1 image and validates the password before startup.

A fresh full-stack run now starts IRIS, connects Battery as _SYSTEM, reads 16 tasks, and confirms that an unreviewed task is blocked. Live changes remain disabled by default. The lightweight synthetic demonstration is unchanged.

For a retest after a failed initialization, use a fresh disposable Compose project rather than deleting an existing data volume.

Source: https://github.com/rbnbric/armada-battery
Passing live check: https://github.com/rbnbric/armada-battery/actions/runs/37143309190

Model switch in the agent console (DPI-I-516)

IRIS Relay 0.5.1: the full operations UI, installed with IPM and served by IRIS. No external Node.js or Python server and no extra container are needed.

On IRIS 2026.2 with IPM and access to the public registry:
zpm "repo -r -n registry -url https://pm.community.intersystems.com/"
zpm "install iris-relay"
The first line configures the registry once on a fresh IPM 0.9+. Open /relay/index.html over HTTPS, or http://localhost:52773/relay/index.html on the IRIS machine, and sign in with your IRIS account and the documented permissions.

The full UI covers system overview, web applications, a 28-operation read-only REST explorer, permissions, security, scheduled tasks, current and archived log investigation, lexical similarity search with Embedded Python and IRIS Vector Search, audit summaries, baseline comparison and Markdown/JSON handover export. Changes use review, fresh-state checks, replay rejection and readback; IRIS still enforces authorization.

Version 0.5.1 addresses Robert Cemper's review: the new disposable Compose lab publishes the IRIS web server on 127.0.0.1:52773 and clears pre-expired lab passwords once. This lab bootstrap does not reset users in an IPM installation or the existing public demo. Relay sign-in offers a manual password-change form in the Node and IRIS-served UIs. In USER, a failed /api/relay sign-in returns 404 and the page cannot distinguish an expired password from a wrong one; Change password appears beside the sign-in error, with a Management Portal link. IRIS checks the current password and password rules. The public demo remains unchanged.

The 0.5.1 public-registry installation is now verified: Claude installed it on clean IRIS 2026.2 with IPM 0.10.9 after registry transport setup, then checked HTTP, the full IRIS-served UI in Chromium, guards, manual password change with disposable accounts and uninstall. Codex reviewed the evidence. There are 183 recorded checks, including 112 browser checks and wrapper records; they are not 183 independent behaviors or a production-readiness claim. Codex's earlier isolated VPS checks passed 69 JavaScript and 36 Python tests with zero skips; CI and Pages succeeded on the same source commit.

Source: https://github.com/rafaorlando3/iris-relay/commit/ebe392be0f6f96899c2fa94e65f4b75df3bf2aab
AI disclosure: Claude implemented and tested the changes; Codex reviewed, integrated and published them, and drafted this release-note update.

1.0.6 was not published here on its own, so these notes cover 1.0.6 and 1.0.7.

New

• System Explorer, a new area: browse a namespace's classes and routines and read their source; compile and delete them, with the compiler's output on the screen; export them as XML to a file on the server or a download; and import an XML export or a source file from the server or your computer. As in the classic portal, browsing needs only %Development and read access to the namespace's code, so a developer can use it without any administration role. Changing code also needs write access, and OcuPilot's own classes are refused.
• Remote databases: list, create, edit and delete remote (ECP) database definitions, with a licence check first.
• Enable interoperability on a namespace, from the Namespaces screen or by asking the agent. On IRIS for Health this also runs the HealthShare Foundation setup, which cannot be undone, so you type the namespace's name to confirm, and only an account assigned the %All role itself can do it.

Safety

• Six of the agent's new actions start switched off: enabling interoperability, deleting a remote database, and deleting or importing classes and routines. Turn them on under Agent co-pilot → Governance policy; the screens themselves do all six.
• An import shows what the file holds before you confirm, and is refused if the file changes after you review it.
• A secret the model repeats as a tool call's id now shows as [redacted] in the tool-call card, the progress view and the saved conversation. Conversations saved before the update keep it until retention removes them.
• Giving a service a privileged role, such as %Manager, %Operator or any role that reaches %All or an %Admin_ resource, is now treated as a destructive change and marked as privileged in the Services editor.

For judges

• The README now opens with a two-minute path: six steps on the live demo, the three-command Docker start, and how OcuPilot is built on the SysAdmin API. The demo account can now open System Explorer too.

Requires InterSystems IRIS or IRIS for Health 2026.2 or later. Upgrading from 1.0.5 keeps your agent definitions, conversations, settings and audit records.

Reviewer-feedback update

Thank you to the reviewer who built and tested the first release. This revision addresses the friction they found while keeping the traditional portal available.

• The default Docker path now starts the lightweight synthetic portal. A live IRIS instance is an optional overlay.
• The eight-scenario proof and full test suite run inside Docker; neither requires local Python.
• The overview now shows an observed synthetic task-history finding. It opens a guarded request and resolves only after fresh evidence supports a verified receipt.
• The result is visible up front: one dispatch, zero automatic retries, and 8/8 deterministic checks passed.

The original demonstration remains available. A separate before-and-after video update shows the changes and the complete finding-to-receipt path.

The finding and assurance walkthrough use synthetic fixtures. Live IRIS remains read-only by default; this release does not claim qualified live mutations.

Source revision: 5ab2531

✨ New

• Step execution detail in the run view. Click a step in any run, live or finished, to see when it started and finished, where and as whom it ran, the platform's failure reason in full, and the result it produced (size report, headroom findings). A step can be opened by its own link (?run=…&step=…), so you can share exactly what you were looking at.
• Refreshed canvas design:
  • A global top bar and a dedicated flow bar.
  • A clearer empty canvas.
  • A palette you can collapse.
  • The Task catalog and the Overview now point you to what needs attention first.
• Ready-made demo flows. The image now comes with a weekly maintenance window flow and failure scenarios, such as a check that fails inside the window and a security posture report with findings. You can see how a failed step stops the steps after it at an ALL_MUST_SUCCEED join without building anything first.

🐛 Fixes

• A 401 that came in before a token renewal no longer signs you out of the session. Before, this could freeze the live run view during long runs.
• Accessibility: each screen now has exactly one main landmark and one h1. Long class names in the palette now wrap at the dots instead of overflowing.

📚 Docs

• A "For judges: two minutes" quick path at the top of the README: what makes SentaiTask different, and a 90-second Docker quickstart.
• Fixed the description of what happens to downstream steps when a disk check fails: they are stopped at the join, not skipped.
• A demo video is now in the repository (sentai-demo.mp4 / .webm).

🧪 Quality

• The e2e suite is green again. Three failures came from outdated tests, not from the product.

IRIS Relay 0.5.0 installs the full Relay UI through IPM and serves it directly from IRIS at /relay/index.html. No Node.js or Python server is needed outside IRIS. Relay Lite remains available at /relay/lite.html.

The IRIS-served UI includes management views, the 28-operation REST explorer, reviewed configuration changes, scheduled tasks, log paging and similarity search, audit summaries, baseline comparison and Markdown/JSON handover export. Changes use review, fresh-state checks and readback. IRIS authorization still governs each operation. HTTPS is required for remote use; HTTP is allowed only on loopback. The README documents operator roles, SQL grants, shared-origin risks and the tested Normal security configuration.

Reviewed source: 89b9d525f30c61c93ed294f1fe8c7d979df6c4bc. Codex independently ran 64 JavaScript and 29 Python tests on the isolated VPS checkout, with zero skips; GitHub CI and Pages succeeded on this commit. Claude's isolated-cloud validation passed 158 end-to-end checks using local IPM load, including 112 browser checks of the IRIS-served UI. Public registry installation will be verified independently after this release.

AI disclosure: Claude implemented and tested the IRIS-served UI; Codex reviewed, integrated and published it.

v1.0.3: added the AI-Powered Instance Monitor feature (Community Opportunity idea DPI-I-512).

Relay Lite is now served directly by IRIS after installing iris-relay 0.4.1 from IPM: open /relay/index.html over HTTPS (HTTP is allowed only on loopback). It lists log sources, pages through messages.log and rotations, and provides lexical similarity search over a bounded IRIS Vector Search index. The Lite UI needs no Node.js or Python server; the full management UI remains available through the existing Compose/Node setup.

The page requires an IRIS user with %Admin_Operate:U; search SQL permissions and index limits are documented in README. Credentials are blocked outside HTTPS or loopback, stale requests cannot overwrite a newer session, and /relay serves static files with CSP/automatic compilation disabled.

Reviewed source: 34ed98984f15fec85d54036104f1c93d9cdd474d. GitHub CI: 46 JavaScript and 29 Python tests passed. Claude tested local IPM load/uninstall and 15 browser groups in an isolated cloud IRIS; public registry installation will be checked independently after this release. The existing public demo is unchanged.

AI disclosure: Claude implemented and tested Relay Lite; Codex reviewed and published the change.

• Added the online demo link (hosted on Oracle Cloud with HTTPS).
• Added the YouTube demonstration video.
• Enabled publishing to the IPM/ZPM Package Manager registry.

• Every screen fits a phone and a laptop. The dashboard's upcoming tasks keep their status inside the card, with the time under each name: on a 1280-pixel laptop the status badges used to sit 92 pixels outside the card, and on a phone the page scrolled sideways. A database's volumes, the license servers and the connections now scroll sideways inside their card on a phone, as the other tables do.
• A browser test keeps it that way. It opens every screen at 360 and 1024 pixels wide and fails when anything scrolls the page sideways or leaves its card.

The image: docker pull ghcr.io/mxsalata/aperture:1.3.0

Changed container repository to the public one so that everyone can see it.

Updated the details in the deployment process