How do I install Fitbit?

Fitbit is a local plugin. Install it using npm package: fitbit-mcp-unofficial and add the generated configuration snippet to your AI app's MCP config file. Then restart your AI app.

Is Fitbit safe to use?

Yes. Fitbit passed MCP Marketplace's automated security scan with a score of 9.7/10 (low risk). Every server on MCP Marketplace is security-scanned before it's listed; see the full security report on this page for the findings and permissions.

What credentials does Fitbit need?

Fitbit requires the following credentials or environment variables: FITBIT_CLIENT_ID, FITBIT_CLIENT_SECRET, FITBIT_REDIRECT_URI, FITBIT_TOKEN_PATH, FITBIT_PRIVACY_MODE, FITBIT_CACHE, FITBIT_CACHE_PATH, FITBIT_NO_CACHE. You can find setup instructions on the server detail page.

What AI apps work with Fitbit?

Fitbit uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Fitbit MCP Server

by davidmosiah

Developer ToolsLow Risk9.7Local

Free

Privacy-first, unofficial Fitbit MCP server for AI health, sleep, activity and heart-rate agents.

About

Privacy-first, unofficial Fitbit MCP server for AI health, sleep, activity and heart-rate agents.

Security Report

9.7

Low Risk9.7Low Risk

Valid MCP server (1 strong, 1 medium validity signals). No known CVEs in dependencies. ⚠️ Package registry links to a different repository than scanned source. Imported from the Official MCP Registry. 1 finding(s) downgraded by scanner intelligence.

4 files analyzed · 1 issue found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

file_system

Check that this permission is expected for this type of plugin.

database

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

Fitbit OAuth client ID. Optional when configured with fitbit-mcp-server setup.Optional

Environment variable: FITBIT_CLIENT_ID

Fitbit OAuth client secret. Prefer fitbit-mcp-server setup so this secret is stored in ~/.fitbit-mcp/config.json instead of MCP client config.Required

Environment variable: FITBIT_CLIENT_SECRET

Redirect URI configured in the Fitbit Developer Dashboard. Optional when configured with fitbit-mcp-server setup.Optional

Environment variable: FITBIT_REDIRECT_URI

Optional local path for OAuth tokens. Defaults to ~/.fitbit-mcp/tokens.json.Optional

Environment variable: FITBIT_TOKEN_PATH

Optional payload mode: summary, structured, or raw. Defaults to structured. raw means full Fitbit API payloads, not continuous 24/7 raw sensor telemetry.Optional

Environment variable: FITBIT_PRIVACY_MODE

Optional SQLite cache toggle. Set to true or sqlite to enable.Optional

Environment variable: FITBIT_CACHE

Optional local SQLite cache path. Defaults to ~/.fitbit-mcp/cache.sqlite.Optional

Environment variable: FITBIT_CACHE_PATH

Set to true to bypass the in-memory HTTP response cache (60s TTL for GET only). POST/PUT/DELETE and 4xx/5xx responses are never cached regardless.Optional

Environment variable: FITBIT_NO_CACHE

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-davidmosiah-fitbitmcp": {
      "env": {
        "FITBIT_CACHE": "your-fitbit-cache-here",
        "FITBIT_CLIENT_ID": "your-fitbit-client-id-here",
        "FITBIT_CACHE_PATH": "your-fitbit-cache-path-here",
        "FITBIT_TOKEN_PATH": "your-fitbit-token-path-here",
        "FITBIT_PRIVACY_MODE": "your-fitbit-privacy-mode-here",
        "FITBIT_REDIRECT_URI": "your-fitbit-redirect-uri-here",
        "FITBIT_CLIENT_SECRET": "your-fitbit-client-secret-here"
      },
      "args": [
        "-y",
        "fitbit-mcp-unofficial"
      ],
      "command": "npx"
    }
  }
}