Open source

What we run, what we point at, what we publish

ImOnFHIR is built on open source, evaluates open source in the open — including the negative results — and publishes exactly what is real. Nothing on this page is aspirational.

The posture

This lab links 139 open-source packages into what it serves, runs four open-source systems beside the app, and points at the wider FHIR ecosystem rather than rehosting it. Where we evaluated a project and chose not to adopt it, the evaluation is published with its reasons — a decision you can audit beats a stack you have to take on faith.

What we run

Separate services beside the app — none of them sees anything you paste into the browser-only tools.

  • HL7 FHIR Validator (Inferno community image)

    Apache-2.0

    The validation sidecar — the same engine behind the official validator, so our standards verdicts match what implementers already trust.

  • HAPI FHIR

    Apache-2.0

    The FHIR server class our hosted sandbox and adapter integrate against — the reference implementation most real systems run.

  • Synthea

    Apache-2.0

    Generates the synthetic patients behind our fixtures; generated data carries no upstream license restriction.

  • Vercel · Cloudflare · DigitalOcean · Neon

    commercial services

    Hosting, tunnel/access control, the sidecar host, and the database. The full subprocessor list with data-handling detail lives on /security.

What we evaluated, and did not adopt

The Questionnaire-renderer field, ranked. ImOnFHIR renders no Questionnaire — our published SDC card says so — and this survey exists so that decision stays informed rather than open. Verified 2026-07-28 against npm manifests and each project’s own documentation; rows marked self-assessed carry the maintainer’s claims, not our source verification.

  • @aehrc/smart-forms-renderer

    CSIRO/AEHRCApache-2.0The one to beat

    The only genuine SDC reference implementation — verified $populate and template-based $extract, the deepest expression layer. The costs are real: 3.27 MB unpacked, 29 production dependencies, a mandatory react-query peer, and no documented SSR story.

    On npm →

  • LForms

    NLM/LHNCBCcustom BSD-style (GitHub: NOASSERTION)self-assessedBest maintenance, weakest SDC claim

    Broadest FHIR-version coverage in the field, but its own support notes exclude CQL and several SDC mechanisms, and it self-describes as partially supporting SDC.

    On npm →

  • @formbox/renderer

    Health SamuraiMITself-assessedNot adoptable today

    Self-declared Alpha ("expect breaking changes"); its own coverage doc puts $populate and $extract explicitly out of scope. Adopting it also means adopting MobX, and the shipped theme reproduces protected NHS branding that is not ours to apply.

    On npm →

  • react-fhir-forms

    communityMIT (as declared)Categorically disqualified

    Broken as published: every declared entry point resolves to a file the tarball does not ship. A prior internal doc recommended it; that recommendation is discredited on the facts, and we say so rather than quietly deleting it.

    On npm →

  • @medplum/react QuestionnaireForm

    MedplumApache-2.0Pragmatic only if already on Medplum

    Solid conditional logic, and the only renderer where signature rendering was source-verified. No FHIRPath expression-population layer.

    On npm →

  • @helsenorge/refero

    Norwegian national health portalMITself-assessedCredible

    The only library in the field declaring an explicit React 19 range. Our own earlier survey missed it entirely — recorded because the miss is part of the evidence.

    On npm →

FHIRPath engines got the same treatment: HL7’s fhirpath.js is the one to use if one is ever needed — donated to HL7, maintained by NLM, under a custom BSD-derived license whose file must travel with both source and binary redistributions. Its origin story — a vendor CTO and a US government lab — is a fair one-line picture of how this ecosystem actually works. We link nothing else in that field as a dependency; several well-starred alternatives publish no license file at all, and public is not the same thing as open source.

What we publish

Honestly: no npm packages, and the application source is private. What is public and real today:

  • A FHIR CapabilityStatement at /api/v1/metadata that declares only operations that exist — plus Bundle/$validate and a compare endpoint behind it.
  • Client handoff from the Payload Workbook: bring a payload in from a Postman collection, HAR, .bru, or curl, and emit it back out in any of them — generated in your browser, nothing hosted.
  • Synthetic test scenarios and teaching fixtures, served through the Lab’s own tools rather than as raw downloads — every one of them synthetic by construction.

When that inventory grows — published packages, committed collections, public schemas — this list grows with it. It will not grow ahead of it.

The license inventory

Every open-source package linked into what this site serves — all 139, with the attribution each requires — is generated from the lockfile and verified in CI on the licenses page. That page stays ungated: it discharges an obligation, and no configuration may hide it.