Privacy-first MCP server for Garmin Connect health, sleep, recovery and activities.
Privacy-first MCP server for Garmin Connect health, sleep, recovery and activities.
This is a well-structured MCP server for accessing personal Garmin health data with appropriate authentication and privacy controls. The code demonstrates good security practices including local token storage, privacy modes, proper input validation via Zod schemas, and read-only data access patterns. Minor code quality observations exist around error handling breadth and logging, but these do not represent security vulnerabilities. Permissions align well with the server's purpose of reading Garmin Connect data. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.
4 files analyzed · 8 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Set these up before or after installing:
Environment variable: GARMIN_TOKEN_PATH
Environment variable: GARMIN_PRIVACY_MODE
Environment variable: GARMIN_CACHE
Environment variable: GARMIN_CACHE_PATH
Environment variable: GARMIN_DOMAIN
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-davidmosiah-garminmcp": {
"env": {
"GARMIN_CACHE": "your-garmin-cache-here",
"GARMIN_DOMAIN": "your-garmin-domain-here",
"GARMIN_CACHE_PATH": "your-garmin-cache-path-here",
"GARMIN_TOKEN_PATH": "your-garmin-token-path-here",
"GARMIN_PRIVACY_MODE": "your-garmin-privacy-mode-here"
},
"args": [
"-y",
"garmin-mcp-unofficial"
],
"command": "npx"
}
}
}From the project's GitHub README.
Unofficial, local-first Garmin Connect MCP server for AI agents. It lets Claude, Cursor, Windsurf, Hermes, OpenClaw and any MCP-compatible client read processed Garmin signals such as sleep, HRV, Body Battery, stress, training readiness, daily movement and activities.
Not affiliated with Garmin. Not medical advice. Garmin Connect personal mode is unofficial and can break if Garmin changes private auth or endpoints.
Garmin has excellent health and training signals, but the official Garmin Health API is primarily partner-approved. This project gives individual Garmin users a practical open-source bridge for personal AI agents while keeping credentials and tokens local.
No Garmin developer app is required. setup only writes local MCP configuration; it does not ask for your Garmin password.
npx -y garmin-mcp-unofficial setup
npx -y garmin-mcp-unofficial auth --install-helper
npx -y garmin-mcp-unofficial doctor
For Hermes:
npx -y garmin-mcp-unofficial setup --client hermes
npx -y garmin-mcp-unofficial auth --install-helper
npx -y garmin-mcp-unofficial doctor --client hermes
The auth helper prompts locally for Garmin email, password and MFA if needed. This MCP does not store your Garmin password. Tokens are saved under ~/.garmin-mcp/garmin_tokens.json with user-only permissions.
If macOS/Homebrew Python blocks helper installs, auth --install-helper falls back to an isolated virtualenv under ~/.garmin-mcp/venv instead of asking users to debug Python packaging.
If you want one command to write config and immediately start Garmin login, use:
npx -y garmin-mcp-unofficial setup --auth
Generic MCP config:
{
"mcpServers": {
"garmin": {
"command": "npx",
"args": ["-y", "garmin-mcp-unofficial"]
}
}
}
Useful optional env/config values:
GARMIN_TOKEN_PATH=~/.garmin-mcp/garmin_tokens.json
GARMIN_PRIVACY_MODE=summary # summary | structured | raw
GARMIN_CACHE=sqlite
GARMIN_CACHE_PATH=~/.garmin-mcp/cache.sqlite
GARMIN_DOMAIN=garmin.com # or garmin.cn
Start with:
garmin_agent_manifestgarmin_auth_instructionsgarmin_connection_statusgarmin_daily_summarygarmin_weekly_summaryLow-level tools include:
garmin_get_profilegarmin_get_user_settingsgarmin_list_devicesgarmin_get_daily_summarygarmin_get_sleep_daygarmin_get_heart_daygarmin_get_hrv_daygarmin_get_stress_daygarmin_get_body_battery_daygarmin_get_training_readiness_daygarmin_list_activitiesgarmin_get_activity_detailsgarmin_get_weight_rangegarmin_privacy_auditsummary: minimized identifiers and sensitive fields.structured: normalized useful data for agents.raw: upstream Garmin Connect payloads. Use only when explicitly needed.This MCP reads processed Garmin Connect data and supported activity detail payloads. It does not provide unrestricted raw accelerometer, gyroscope or continuous device telemetry.
Paste this into your agent when you want it to install the bridge for you:
Install the unofficial Garmin MCP server for me.
Repository: https://github.com/davidmosiah/garminmcp
Run setup, then auth --install-helper, then doctor.
If this is Hermes, use setup --client hermes and reload MCP with /reload-mcp or hermes mcp test garmin.
Never ask me to paste Garmin passwords, tokens or raw private payloads into chat.
Start with garmin_connection_status, then garmin_daily_summary.
This is not medical advice.
npm install
npm test
npm run build
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
by Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption
by mcp-marketplace · Developer Tools
Scaffold, build, and publish TypeScript MCP servers to npm — conversationally
by Taylorwilsdon · Productivity
Control Gmail, Calendar, Docs, Sheets, Drive, and more from your AI