Privacy-first, unofficial WHOOP MCP server for AI health, sleep, recovery, and performance agents.
Privacy-first, unofficial WHOOP MCP server for AI health, sleep, recovery, and performance agents.
This is a well-structured MCP server for the WHOOP health API with proper OAuth authentication, secure token storage practices, and read-mostly operations. The codebase demonstrates good security awareness with privacy modes, audit tools, and clear separation of concerns. Minor code quality findings around broad error handling and lack of input validation in some areas do not significantly impact the security posture given the server's legitimate permissions and purpose. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.
4 files analyzed · 9 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Set these up before or after installing:
Environment variable: WHOOP_CLIENT_ID
Environment variable: WHOOP_CLIENT_SECRET
Environment variable: WHOOP_REDIRECT_URI
Environment variable: WHOOP_TOKEN_PATH
Environment variable: WHOOP_PRIVACY_MODE
Environment variable: WHOOP_CACHE
Environment variable: WHOOP_CACHE_PATH
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-davidmosiah-whoop-mcp": {
"env": {
"WHOOP_CACHE": "your-whoop-cache-here",
"WHOOP_CLIENT_ID": "your-whoop-client-id-here",
"WHOOP_CACHE_PATH": "your-whoop-cache-path-here",
"WHOOP_TOKEN_PATH": "your-whoop-token-path-here",
"WHOOP_PRIVACY_MODE": "your-whoop-privacy-mode-here",
"WHOOP_REDIRECT_URI": "your-whoop-redirect-uri-here",
"WHOOP_CLIENT_SECRET": "your-whoop-client-secret-here"
},
"args": [
"-y",
"whoop-mcp-unofficial"
],
"command": "npx"
}
}
}From the project's GitHub README.
Unofficial MCP server for connecting AI agents to the WHOOP API.
Website: https://davidmosiah.github.io/whoop-mcp/
Unofficial project: this repository is not affiliated with, endorsed by, sponsored by, or supported by WHOOP, Inc. WHOOP is a trademark of its respective owner. Use this project only with your own WHOOP account and according to WHOOP's Developer Terms and API policies.
whoop-mcp-server lets MCP-compatible agents read WHOOP data through the official WHOOP OAuth API:
doctor and auth CLI commands for setup without manual code copyingThe server runs over MCP stdio, so it works well as a local integration for agents such as Hermes, OpenClaw, Claude Desktop, Cursor, and other MCP clients.
~/.whoop-mcp/tokens.json with 0600 permissions.whoop_revoke_access is intentionally destructive and removes access.WHOOP_PRIVACY_MODE defaults to structured; full raw WHOOP payloads are opt-in.Official WHOOP API docs: https://developer.whoop.com/api/
After npm publication:
npx -y whoop-mcp-unofficial doctor
For MCP clients, use the package with no subcommand so it starts the MCP stdio server.
git clone https://github.com/davidmosiah/whoop-mcp.git
cd whoop-mcp
npm install
npm run build
export WHOOP_CLIENT_ID="your-client-id"
export WHOOP_CLIENT_SECRET="your-client-secret"
export WHOOP_REDIRECT_URI="http://127.0.0.1:3000/callback"
# Optional
export WHOOP_TOKEN_PATH="$HOME/.whoop-mcp/tokens.json"
export WHOOP_SCOPES="read:recovery read:cycles read:workout read:sleep read:profile read:body_measurement"
export WHOOP_PRIVACY_MODE="structured" # summary | structured | raw
export WHOOP_CACHE="sqlite" # optional: true/sqlite/on
export WHOOP_CACHE_PATH="$HOME/.whoop-mcp/cache.sqlite"
Default scopes:
read:recovery read:cycles read:workout read:sleep read:profile read:body_measurement
This is the recommended path for non-technical setup:
npx -y whoop-mcp-unofficial setup
npx -y whoop-mcp-unofficial auth
npx -y whoop-mcp-unofficial doctor
What these commands do:
setup asks for WHOOP credentials, writes local config, and creates a client config/snippet.doctor checks Node.js, required WHOOP env vars, redirect URI, token file, privacy mode and cache.auth starts a temporary local callback server, opens the WHOOP authorization page, captures the OAuth code and saves tokens locally.doctor --json returns the same setup state in machine-readable form.~/.whoop-mcp/config.json with 0600 permissions, so MCP client configs do not need to contain your WHOOP secret.For automatic auth, configure the WHOOP Developer app redirect URI as:
http://127.0.0.1:3000/callback
Example local config:
{
"mcpServers": {
"whoop": {
"command": "node",
"args": ["/absolute/path/to/whoop-mcp/dist/index.js"]
}
}
}
For npm/npx usage after publication:
{
"mcpServers": {
"whoop": {
"command": "npx",
"args": ["-y", "whoop-mcp-unofficial"]
}
}
}
If you do not run setup, you can still provide WHOOP_CLIENT_ID, WHOOP_CLIENT_SECRET and WHOOP_REDIRECT_URI through your MCP client env block. Prefer setup for less secret sprawl.
Recommended for humans:
npx -y whoop-mcp-unofficial auth
Manual MCP-client flow:
whoop_get_auth_url.code or full redirect URL.whoop_exchange_code with that code/URL.whoop_list_recoveries or whoop_get_profile.The exchange tool stores tokens locally and intentionally does not return token values.
whoop_get_auth_url - Generate an OAuth authorization URL.whoop_exchange_code - Exchange authorization code for local tokens.whoop_revoke_access - Revoke WHOOP OAuth access and delete local tokens.whoop_connection_status - Check env, token, Node, redirect, privacy and cache readiness without calling WHOOP.whoop_get_profile - Get basic profile.whoop_get_body_measurements - Get height, weight and max heart rate.whoop_cache_status - Show optional SQLite cache status.whoop_privacy_audit - Show local privacy, cache, env-presence and redaction posture without revealing secrets.All collection tools support:
start: ISO date-time filterend: ISO date-time filterlimit: WHOOP page size, max 25next_token: cursor from a previous callall_pages: fetch multiple pagesmax_pages: cap for multi-page fetchesresponse_format: markdown or jsonprivacy_mode: optional override: summary, structured, or rawTools:
whoop_list_cycleswhoop_list_recoverieswhoop_list_sleepswhoop_list_workoutswhoop_get_cyclewhoop_get_sleepwhoop_get_workoutwhoop_get_cycle_sleepwhoop_get_cycle_recoveryThese tools fetch the required WHOOP collections, compute defensive baselines, and return structured coaching context for agents. They are read-only and do not store data locally.
whoop_daily_summary - Latest recovery/sleep/load signals plus action candidates for the next 24 hours.whoop_weekly_summary - Weekly scorecard, prior-window comparison, bottlenecks, action candidates and next-week success metrics.whoop://latest/recoverywhoop://latest/sleepwhoop://latest/cyclewhoop://summary/dailywhoop://summary/weeklydaily_performance_coachweekly_training_reviewsleep_recovery_investigatorDaily summary inputs:
days: lookback window for baseline, default 10, min 7, max 30timezone: display timezone, default UTCresponse_format: markdown or jsonWeekly summary inputs:
days: recent analysis window, default 7compare_days: prior comparison window, default 7, use 0 to disable comparisontimezone: display timezone, default UTCresponse_format: markdown or jsonUse the WHOOP MCP server to summarize my last 7 days of sleep and recovery. Compare HRV, RHR, sleep performance, consistency and strain. Do not provide medical advice.
Fetch my latest recovery, latest sleep and workouts from the last 3 days. Give me a practical training recommendation for today based only on the data.
Call whoop_weekly_summary with response_format=json, then turn the bottlenecks and success metrics into a concrete training, sleep and focus plan for next week.
npm install
npm test
npm run typecheck
npm run build
Run locally:
npm run build
node dist/index.js
Test with MCP Inspector:
npx @modelcontextprotocol/inspector node dist/index.js
Optional local HTTP transport:
WHOOP_MCP_TRANSPORT=http WHOOP_MCP_PORT=3000 node dist/index.js
curl http://127.0.0.1:3000/health
This software is provided as-is. It is not a medical device, does not provide medical advice, and should not be used for diagnosis or treatment. Always consult qualified professionals for medical concerns.
Be the first to review this server!
by Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
by Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption
by mcp-marketplace · Developer Tools
Scaffold, build, and publish TypeScript MCP servers to npm — conversationally
by Taylorwilsdon · Productivity
Control Gmail, Calendar, Docs, Sheets, Drive, and more from your AI