← Back to search

io.github.davidmosiah/whoop-mcp

davidmosiah Scanned 17d ago

Privacy-first, unofficial WHOOP MCP server for AI health, sleep, recovery, and performance agents.

B
78.4 / 100

Versions

0.5.4latest
Jul 16, 2026
0.5.3
Jun 27, 2026
0.5.2
Jun 27, 2026
0.5.1
Jun 27, 2026
0.5.0
Jun 2, 2026
+ show 14 moreshow less
0.4.5
May 29, 2026
0.4.4
May 24, 2026
0.4.3
May 20, 2026
0.4.2
May 19, 2026
0.4.1
May 11, 2026
0.4.0
May 11, 2026
0.3.0
May 10, 2026
0.2.1
May 6, 2026
0.2.0
May 4, 2026
0.1.4
Apr 30, 2026
0.1.3
Apr 30, 2026
0.1.2
Apr 30, 2026
0.1.1
Apr 30, 2026
0.1.0
Apr 30, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 21

whoop_data_inventory
annotations: verified low

Inventory supported WHOOP data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call WHOOP APIs or expose user data.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
whoop_capabilities
annotations: verified low

Explain supported WHOOP data, unavailable raw sensor streams, privacy modes, recommended agent workflow, and project links. Does not read WHOOP or expose secrets.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
whoop_agent_manifest
annotations: verified low

Machine-readable install, runtime and client guidance for AI agents operating the WHOOP MCP. Does not read WHOOP or expose secrets.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
whoop_quickstart
annotations: verified low

Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect WHOOP?'

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
whoop_demo
annotations: verified low

Returns realistic example payloads of whoop_daily_summary, whoop_wellness_context, and whoop_list_recoveries so agents see the contract before calling real WHOOP APIs. Shapes are verified against the real tools by a build gate, so a parser written against this demo works on live data.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
whoop_profile_get
annotations: verified low

Read the shared Delx wellness profile (~/.delx-wellness/profile.json). Returns the user's preferred name, body basics, goals, devices, training context, nutrition context, agent preferences, and missing critical fields. Cross-connector — the same profile is also available from other Delx Wellness MCPs (Oura, Garmin, Nourish, Fitbit, etc). Read-only.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
whoop_profile_update
annotations: verified low

Persist a partial patch to the shared Delx wellness profile (~/.delx-wellness/profile.json). REQUIRES explicit_user_intent=true. Top-level fields stored: profile (preferred_name, language, timezone, units, age_or_birth_year, height, weight, sex_or_gender_context), goals, devices, training, nutrition, preferences, safety, notes. NEVER stores OAuth tokens, API keys, refresh tokens, cookies, or any secret-shaped field — writes will be rejected at validation time. Cross-connector — the same profile is read by other Delx Wellness MCPs.

readOnlyHint false openWorldHint false idempotentHint false destructiveHint false
whoop_onboarding
annotations: verified low

Return the 11-question Delx wellness onboarding flow (in English or pt-BR) plus the current shared profile state and missing critical fields. Read-only. The agent should ask these questions one-by-one, then call whoop_profile_update with explicit_user_intent=true to save. The same profile is reused by every Delx Wellness connector (Oura, Garmin, Nourish, etc.) — agents can call the equivalent {connector}_onboarding tools to cover their respective domains, or rely on this one since all connectors share the same questions.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
whoop_get_auth_url
annotations: verified low

Generate a WHOOP OAuth authorization URL. This does not read or modify WHOOP data. Use this first when no local token exists.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
whoop_exchange_code
annotations: verified low

Exchange a WHOOP OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned by this tool. Gated: requires explicit user intent — agents must not call this autonomously.

readOnlyHint false openWorldHint true idempotentHint false destructiveHint false
whoop_get_profile
annotations: verified low

Get the authenticated user's basic WHOOP profile. Requires read:profile scope.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
whoop_get_body_measurements
annotations: verified low

Get the authenticated user's WHOOP body measurements (height, weight, max heart rate). Requires read:body_measurement scope. Not medical advice.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
whoop_connection_status
annotations: verified low

Check whether local WHOOP env vars, token file, Node version, privacy mode and cache are ready. Does not call WHOOP or expose secrets.

response_format enum
readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
whoop_cache_status
annotations: verified low

Show optional local SQLite cache status. Enable with WHOOP_CACHE=sqlite or WHOOP_CACHE=true.

response_format enum
readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
whoop_privacy_audit
annotations: verified low

Return the local privacy, cache, token-path, env-presence and redaction posture without revealing secret values.

response_format enum
readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
whoop_revoke_access
annotations: verified low

Revoke the current WHOOP OAuth access grant and delete the local token file. Use only when the user explicitly wants to disconnect WHOOP. Gated: requires explicit user intent — agents must not call this autonomously.

response_format enum
readOnlyHint false openWorldHint true idempotentHint false destructiveHint true
whoop_daily_summary
annotations: verified low

Build a privacy-conscious daily performance summary from WHOOP recovery, sleep, cycle and workout data. This workflow tool fetches recent WHOOP v2 records, computes a defensive baseline, and returns readiness, sleep, load, diagnostic signals and concrete action candidates. It does not provide medical advice and does not store data locally.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
whoop_weekly_summary
annotations: verified low

Build a weekly WHOOP operating review with recovery, sleep, strain, workouts, bottlenecks, action candidates and next-week success metrics. This workflow tool compares a recent window against a prior window when available. It is intended for coaching and agent workflows, not medical diagnosis.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
whoop_recovery_trend
annotations: verified low

Aggregate WHOOP recovery over the last N days (default 30) into a per-metric trend for recovery score, HRV (hrv_rmssd_milli) and resting heart rate. Each metric returns { avg, min, max, slope, direction, n_valid } where slope is a least-squares fit over the chronologically ordered scored records (oldest to newest) and direction is rising, falling, stable or insufficient_data. Use this to answer "is my recovery trending up or down?" without paging the raw collection yourself. Read-only; fetches recent WHOOP v2 records, computes statistics, stores nothing. Not medical advice.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
whoop_sleep_trend
annotations: verified low

Aggregate WHOOP sleep over the last N days (default 30) into a per-metric trend for sleep performance percentage, sleep duration (hours) and sleep efficiency percentage. Each metric returns { avg, min, max, slope, direction, n_valid } where slope is a least-squares fit over the chronologically ordered scored sleeps (oldest to newest) and direction is rising, falling, stable or insufficient_data. Use this to answer "is my sleep improving or degrading?" without paging the raw collection yourself. Read-only; fetches recent WHOOP v2 records, computes statistics, stores nothing. Not medical advice.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
whoop_wellness_context
annotations: verified low

Normalize WHOOP recovery, sleep, strain and recent workout load into the shared wellness_context shape for exercise recommendation engines and Telegram agents.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 57

info
Tool 'whoop_data_inventory' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_capabilities' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_agent_manifest' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_quickstart' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_demo' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_profile_get' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_profile_update' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_onboarding' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_get_auth_url' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_exchange_code' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_get_profile' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_get_body_measurements' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_connection_status' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_cache_status' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_privacy_audit' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_revoke_access' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_daily_summary' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_weekly_summary' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_recovery_trend' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_sleep_trend' annotations are consistent annotation_checker · 80%
info
Tool 'whoop_wellness_context' annotations are consistent annotation_checker · 80%
high
Hardcoded OAuth client secret in davidmosiah-whoop-mcp-9d7a7b3/scripts/security-test.mjs auth_checker · 95%
high
Hardcoded OAuth client secret in davidmosiah-whoop-mcp-9d7a7b3/scripts/agent-readiness-test.mjs auth_checker · 95%
high
Hardcoded OAuth client secret in davidmosiah-whoop-mcp-9d7a7b3/scripts/endpoint-contract-test.mjs auth_checker · 95%
high
Hardcoded OAuth client secret in davidmosiah-whoop-mcp-9d7a7b3/scripts/cli-ux-test.mjs auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
info
package.json metadata manifest_parser · 100%
info
Tool: whoop_data_inventory manifest_parser · 85%
info
Tool: whoop_capabilities manifest_parser · 85%
info
Tool: whoop_agent_manifest manifest_parser · 85%
info
Tool: whoop_quickstart manifest_parser · 85%
info
Tool: whoop_demo manifest_parser · 85%
info
Tool: whoop_profile_get manifest_parser · 85%
info
Tool: whoop_profile_update manifest_parser · 85%
info
Tool: whoop_onboarding manifest_parser · 85%
info
Tool: whoop_get_auth_url manifest_parser · 85%
info
Tool: whoop_exchange_code manifest_parser · 85%
info
Tool: whoop_get_profile manifest_parser · 85%
info
Tool: whoop_get_body_measurements manifest_parser · 85%
info
Tool: whoop_connection_status manifest_parser · 85%
info
Tool: whoop_cache_status manifest_parser · 85%
info
Tool: whoop_privacy_audit manifest_parser · 85%
info
Tool: whoop_revoke_access manifest_parser · 85%
info
Tool: whoop_daily_summary manifest_parser · 85%
info
Tool: whoop_weekly_summary manifest_parser · 85%
info
Tool: whoop_recovery_trend manifest_parser · 85%
info
Tool: whoop_sleep_trend manifest_parser · 85%
info
Tool: whoop_wellness_context manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (14) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 173 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%