Care data, connected.

The Sandwich MCP server exposes a small toolbelt to any AI assistant that speaks the Model Context Protocol. A caregiver mints a key in the Sandwich app, pastes it into Claude Desktop, Cursor, or a custom agent, and the assistant can immediately query their own loved ones and recent care events — scoped to their own workspace, nothing more.

v1 tools:

What it is

Sandwich Pipe is the private-link layer between care-data producers and Sandwich's family-facing app. Think of it as Plaid for caregiving: agencies, EHRs, and home- health platforms push structured events at Sandwich Pipe, and Sandwich lights up the right loved-one record for the right family in real time.

Why a pipe

• Neutral shape. One event schema — institution_id, subject_ref, event_type, payload — lets us onboard any partner without redesigning the app.
• Signed and replayable. Every request carries X-SandwichPipe-Signature: sha256=…, computed over the raw body with a per-partner secret. Replays are cheap; forgeries are not.
• Fire-and-forget on the partner side. Partners never block their own workflow waiting on Sandwich. If Sandwich Pipe is down, events are queued and retried with exponential backoff.

Event envelope

{
  "institution_id": "sandwichsoft-sunrise-home-care",
  "subject_ref":    "client_8c1f",
  "event_type":     "visit_ended",
  "occurred_at":    "2026-04-16T21:04:00Z",
  "payload": {
    "caregiver_id":      "caregiver_maria_r",
    "actual_end":        "2026-04-16T21:04:00Z",
    "duration_minutes":  92
  }
}

Signature

Compute HMAC-SHA256(raw_body, partner_secret) and send the hex digest prefixed with sha256=. Sandwich verifies in constant time and rejects anything older than 5 minutes (clock-skew tolerant).

const sig = "sha256=" + hmacSha256Hex(secret, rawBody);
headers["X-SandwichPipe-Signature"]   = sig;
headers["X-SandwichPipe-Institution"] = institutionId;
headers["X-SandwichPipe-Timestamp"]   = new Date().toISOString();

Event types (v1)

Becoming a partner

Sandwich Soft agencies get Sandwich Pipe for free — it's wired into clock-in and clock-out. Outside partners (EHRs, hospital discharge systems, other agency platforms) can email hello@joinsandwich.com for a sandbox secret and a signed integration agreement.

What it is

Sandwich Soft is the operating system for home-care agencies. Each agency is a tenant with its own slug — soft.joinsandwich.com/sunrise-home-care — and its own admin dashboard, caregiver roster, client list, visit schedule, and message thread.

Who uses it

• Agency admins manage clients, caregivers, and schedules from the web dashboard. They own the book of record.
• Caregivers open the agency URL on their phone, sign in, and use the mobile portal at /me — pick a shift, clock in, log a note, clock out.
• Families don't use Sandwich Soft directly. They use the Sandwich app, and data flows to them through Sandwich Pipe when family share is on.

Data model

Every record is namespaced to a tenant — no cross-tenant reads, ever.

tenants/{tenant_id}/
  staff/{uid}             # caregivers & admins
  clients/{client_id}     # +family_share_enabled, +secret_hash
  visits/{visit_id}       # scheduled + in-progress + completed
  notes/{note_id}         # observations, vitals, med confirmations
  media/{media_id}        # photos taken during a visit
  messages/{msg_id}       # threads per client

Caregiver portal

Sandwich Soft's /me route is a phone-first webapp. Caregivers see their open shifts, pick one, clock in with a single tap, write a note, attach a photo, and clock out. Each action emits a Sandwich Pipe event if the client has family share on — no extra work for the caregiver.

Family share toggle

// admin flips family share for a client
await enrollFamilyShare(tenantId, clientId);
// → generates secret, stores sha256 hash on client row,
// → sends secret one-time to admin via secure download

// every clock-out after this call
emitFamilyShareEvent({
  tenantId, clientId,
  eventType: "visit_ended",
  payload: { durationMinutes, noteExcerpt }
});

Why it matters

• Families stop calling the agency for updates. They already have them in Sandwich.
• Agencies get a differentiator without writing a family app. Sandwich Pipe is the family app.
• Sandwich gets first-party, signed, structured care data — the foundation that makes the MCP tools actually useful.