Meta-MCP that auto-detects installed wellness connectors and composes them into one body data layer.
Meta-MCP that auto-detects installed wellness connectors and composes them into one body data layer.
delx-living-body is a well-architected meta-MCP server with thoughtful security practices for a developer/wellness tool. It properly strips secrets before spawning child processes, implements reasonable timeouts, and uses rule-based synthesis to avoid unnecessary LLM calls. However, there are concerns around subprocess spawning without strict validation, broad shell command construction, and reliance on detection heuristics that could be circumvented. The tool's permissions broadly match its purpose, but the subprocess spawning capability and broad environment variable filtering (rather than allowlisting) introduce moderate risk. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.
6 files analyzed · 11 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Set these up before or after installing:
Environment variable: DELX_LIVING_BODY_DETECT_TTL
Environment variable: DELX_LIVING_BODY_NO_CACHE
Environment variable: DELX_LIVING_BODY_CACHE_PATH
Environment variable: DELX_LIVING_BODY_NPM_RUNNER
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-davidmosiah-delx-living-body": {
"env": {
"DELX_LIVING_BODY_NO_CACHE": "your-delx-living-body-no-cache-here",
"DELX_LIVING_BODY_CACHE_PATH": "your-delx-living-body-cache-path-here",
"DELX_LIVING_BODY_DETECT_TTL": "your-delx-living-body-detect-ttl-here",
"DELX_LIVING_BODY_NPM_RUNNER": "your-delx-living-body-npm-runner-here"
},
"args": [
"-y",
"delx-living-body"
],
"command": "npx"
}
}
}From the project's GitHub README.
Meta-MCP that turns 15 wellness MCPs into one unified body data layer for AI agents.
Today, answering "should I train hard today?" forces an agent to orchestrate WHOOP recovery, Garmin Body Battery, Oura sleep, Nourish nutrition, and cycle phase across five separate MCP servers. That's brittle for users and confusing for the agent.
delx-living-body is one MCP server that:
Install it once. Get a unified body data layer. Works with whatever wellness MCPs you already have.
npx -y delx-living-body
That's the whole install. No OAuth flow, no API keys — delx-living-body has no auth of its own. Each child connector handles its own credentials.
git clone https://github.com/davidmosiah/delx-living-body && cd delx-living-body
npm install && npm run build
npm run demo
The demo boots the real MCP server, fakes three installed connectors
(WHOOP + Oura + Garmin, backed by a bundled stub child that carries synthetic
body data), and drives it over stdio exactly the way an agent does. No real
accounts, API keys, or network. Captured output lives at
examples/demo-what-should-i-do-today.txt:
2) living_body_ask question="What should I do today?"
────────────────────────────────────────────────────────────────
Recommendation:
Today at a glance: recovery 74, sleep 83, body battery 68.
Confidence: high Sources: whoop, oura, garmin
3) living_body_ask question="Should I train hard today?"
────────────────────────────────────────────────────────────────
Recommendation:
Green light for a hard session. Recovery and sleep both support high intensity.
Confidence: high Sources: whoop, oura, garmin
Reasoning trace (rule-based, no LLM):
Intent classified as: training_readiness
- (rec_high) Recovery 74 supports a high-intensity day.
- (sleep_good) Sleep score 83 is supporting recovery.
One question in → one synthesized answer composed across all three connectors, with a stable reasoning trace and zero LLM calls. This is the Body-vertical entrypoint: install once, ask in plain language, get a unified answer.
| Tool | Purpose |
|---|---|
living_body_status | Which connectors are detected? Safe; no subprocess spawning. |
living_body_ask | Main tool. Spawns detected children in parallel, returns synthesized answer. Requires explicit_user_intent: true. |
living_body_daily_brief | Markdown brief built from each connector's daily_summary. |
living_body_compose_context | Normalized delx-wellness-context/v1 shape merged across sources. |
living_body_health_check | All 15 known connectors with install hints for missing ones. |
living_body_capabilities | Self-description + per-connector availability matrix. |
For each known connector, delx-living-body checks:
~/.<vendor>-mcp/tokens.json exists~/.<vendor>-mcp/config.json exists (password-based connectors like Eight Sleep)~/.delx-wellness/profile.json lists the deviceIf any check passes → detected. Otherwise → missing (with install hint). Stateless connectors (Cycle Coach) are always considered available.
Detection results cache for 60s (DELX_LIVING_BODY_DETECT_TTL).
| ID | Package | Category |
|---|---|---|
whoop | whoop-mcp-unofficial | recovery |
oura | oura-mcp-unofficial | sleep |
garmin | garmin-mcp-unofficial | recovery |
strava | strava-mcp-unofficial | training |
fitbit | fitbit-mcp-unofficial | recovery |
google_health | google-health-mcp-unofficial | multi |
withings | withings-mcp-unofficial | multi |
apple_health | apple-health-mcp-unofficial | multi |
samsung_health | samsung-health-mcp-unofficial | multi |
polar | polar-mcp-unofficial | training |
eight_sleep | eight-sleep-mcp-unofficial | sleep |
nourish | wellness-nourish | nutrition |
air | wellness-air | environment |
cycle_coach | wellness-cycle-coach | cycle |
cgm | wellness-cgm-mcp | glucose |
When living_body_ask or living_body_compose_context runs:
npx -y <package> over StdioClientTransport.*_wellness_context (or *_daily_summary) tool in parallel.delx-wellness-context/v1 shape with merged scores.Critically: delx-living-body never calls an LLM. Synthesis is deterministic so downstream agents can reason on top of a stable trace.
14 heuristic rules, each with a stable rule_id that appears in the reasoning trace:
rec_low / rec_mid / rec_high — recovery score bandsbb_low / bb_high — Garmin Body Battery bandssleep_poor / sleep_good — sleep score bandsstrain_high — WHOOP strain ≥ 18cycle_luteal / cycle_follicular — cycle phase signalsload_high / load_low — aggregate training loadno_data — nothing installed, advisory onlyconflict — sources disagree → low confidencedelx-living-body never reads child connector tokens or config files — children read their own credentials independently.*_CLIENT_SECRET, *_ACCESS_TOKEN, *_REFRESH_TOKEN, *_API_KEY, *_PASSWORD) are stripped before spawning children.privacy_mode=structured by default. raw is only honored when the caller sets explicit_user_intent: true on living_body_ask.timeout and skipped.~/.delx-living-body/cache.sqlite (chmod 600), 5 min TTL. Disable with DELX_LIVING_BODY_NO_CACHE=true.delx-living-body itself.See SECURITY.md for the full threat model.
| Variable | Default | Purpose |
|---|---|---|
DELX_LIVING_BODY_DETECT_TTL | 60 | Detection cache TTL in seconds |
DELX_LIVING_BODY_NO_CACHE | unset | Disable SQLite response cache |
DELX_LIVING_BODY_CACHE_PATH | ~/.delx-living-body/cache.sqlite | Override cache path |
DELX_LIVING_BODY_NPM_RUNNER | npx | Override npm runner for child spawning |
DELX_LIVING_BODY_CHILD_OVERRIDE_<ID> | unset | Override child binary path (testing only) |
LIVING_BODY_MCP_HOST / LIVING_BODY_MCP_PORT | 127.0.0.1 / 3030 | HTTP transport bind address |
living-body-mcp-server # MCP stdio server (default)
living-body-mcp-server --http # Local HTTP transport
living-body-mcp-server doctor # Detect installed connectors
living-body-mcp-server doctor --json # JSON output
living-body-mcp-server setup # Print profile path + install hints
living-body-mcp-server version
{
"mcpServers": {
"living-body": {
"command": "npx",
"args": ["-y", "delx-living-body"]
}
}
}
{
"mcpServers": {
"living-body": { "command": "npx", "args": ["-y", "delx-living-body"] }
}
}
Outputs are operational context for training/recovery/sleep/nutrition agents. Not for medical diagnosis or clinical use.
MIT — see LICENSE. Built by David Mosiah.
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.