Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.BerkKilicoglu/google-health-fitbit-mcp

NPM · GOOGLE-HEALTH-FITBIT-MCP · SCANNED SEP 21

Privacy-first Google Health API MCP server for health, sleep, activity and HR agents

0 this week 84 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 52 of 130 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 55 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability84
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 3755 tokens (~104/item across 36 items; 29 tools + 7 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
  • Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage83
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 41% of tool parameters carry a description.Partial
  • Structured output schemas are declared (83% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 30 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.github.BerkKilicoglu/google-health-fitbit-mcp server?

io.github.BerkKilicoglu/google-health-fitbit-mcp runs locally as an npm package, launched with npx -y google-health-fitbit-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · google-health-fitbit-mcp

# add to Claude Code
claude mcp add berkkilicoglu-google-health-fitbit-mcp -- npx -y google-health-fitbit-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "berkkilicoglu-google-health-fitbit-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "google-health-fitbit-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "berkkilicoglu-google-health-fitbit-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "google-health-fitbit-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add berkkilicoglu-google-health-fitbit-mcp -- npx -y google-health-fitbit-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "berkkilicoglu-google-health-fitbit-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "google-health-fitbit-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add berkkilicoglu-google-health-fitbit-mcp --command npx --arg -y --arg google-health-fitbit-mcp
# ~/.hermes/config.yaml
mcp_servers:
  berkkilicoglu-google-health-fitbit-mcp:
    command: "npx"
    args: ["-y", "google-health-fitbit-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "berkkilicoglu-google-health-fitbit-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "google-health-fitbit-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add berkkilicoglu-google-health-fitbit-mcp -t stdio -c npx -a -y google-health-fitbit-mcp
// mcp.json
{
  "mcpServers": {
    "berkkilicoglu-google-health-fitbit-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "google-health-fitbit-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 21 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 19 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 16 Sept 26 +1
    • Stability: 0.97 → pass security
  • 14 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 12 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 10 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 9 Sept 26 0
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 21 Sept 2026 · Analysed npm/google-health-fitbit-mcp@1.0.2

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 130 packages
Packages resolved 130
Deprecated 1
Stale 51
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 29 exposed · ~3,627 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
google_health_agent_manifest ~46

Machine-readable install, runtime and client guidance for AI agents. Does not call Google Health or expose secrets.

NameTypeReqDescription
clientstring
response_formatstring
NameTypeReqDescription
agent_rulesarrayyes
beta_noticestringyes
clientstringyes
hermesobjectyes
linksobjectyes
mcp_namestringyes
mutating_toolsobjectyes
oauthobjectyes
packageobjectyes
projectstringyes
recommended_first_callsarrayyes
resourcesarrayyes
standard_toolsarrayyes
statusstringyes
troubleshootingarrayyes
unofficialbooleanyes

No examples provided.

google_health_cache_status ~40

Show optional local SQLite cache status. Enable with GOOGLE_HEALTH_CACHE=sqlite or GOOGLE_HEALTH_CACHE=true.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
enabledbooleanyes
entriesintegeryes
http_cacheobject
newest_cached_atstring
pathstringyes

No examples provided.

google_health_capabilities ~34

Explain supported Google Health data, privacy boundaries, beta status and recommended agent workflow.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
api_boundaryobjectyes
auth_modelobjectyes
beta_noticestringyes
client_aliasesobjectyes
contribution_pathsarrayyes
creatorobjectyes
linksobjectyes
mcp_namestringyes
mutating_toolsobject
privacy_modesarrayyes
projectstringyes
recommended_agent_flowarrayyes
statusstringyes
supported_dataarrayyes
unofficialbooleanyes

No examples provided.

google_health_connection_status ~55

Check local Google Health config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Google APIs or exposing secrets.

NameTypeReqDescription
clientstring
response_formatstring
NameTypeReqDescription
automatic_auth_supportedbooleanyes
cacheobjectyes
clientstring
client_checksobject
configobjectyes
missing_envarrayyes
next_stepsarrayyes
nodeobjectyes
oauthobjectyes
okbooleanyes
privacy_modestringyes
ready_for_google_health_apibooleanyes
redirect_uristring
required_envobjectyes
tokenobjectyes

No examples provided.

google_health_daily_rollup ~358

Aggregate a data type over civil days using Google Health dailyRollUp. Useful for steps, distance, calories, active minutes, weight and heart summaries.

NameTypeReqDescription
data_source_familystring
data_typestringGoogle Health data type in kebab case. Supported slugs (call google_health_list_data_types for units and which verbs each supports): active-energy-burned, active-minutes, active-zone-minutes, activit…
end_datestringExclusive end date as YYYY-MM-DD. Defaults to the next day.
page_sizeinteger
page_tokenstring
privacy_modestringOptional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_formatstring
start_datestring
window_size_daysinteger
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

google_health_daily_summary ~73

Build a practical daily summary from Google Health rollups and reconciled streams when available. Read-only, beta, non-medical.

NameTypeReqDescription
datestring
response_formatstring
timezonestringIANA timezone used only for display, e.g. America/New_York.
NameTypeReqDescription
generated_atstringyes
kindstringyes

No examples provided.

google_health_data_inventory ~39

Inventory supported Google Health data types, auth scopes, privacy modes and recommended first calls without calling Google APIs.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
api_boundary
auth
categoriesarrayyes
data_access_modelstringyes
first_toolsarrayyes
generated_atstringyes
kindstringyes
linksobjectyes
mcp_namestringyes
notesarrayyes
privacy_modesarrayyes
recommended_agent_flowarrayyes
scopesarrayyes
sourcestringyes
totalsobjectyes
unofficialbooleanyes

No examples provided.

google_health_data_type_coverage ~136

Build a data-type coverage plan from the official Google Health API data-type table, or run explicit live read-only checks against a real OAuth account. Live mode returns only redacted status and point-count buckets, never raw health payloads.

NameTypeReqDescription
data_source_familystring
data_typesarrayOptional subset of data_type slugs. Omit to validate the full local catalog.
datestring
livebooleanDefault false. When true, calls read-only Google Health endpoints after OAuth setup and returns only redacted coverage status.
response_formatstring
NameTypeReqDescription
kindstringyes
modestringyes

No examples provided.

google_health_demo ~57

Returns realistic Pixel-Watch-style example payloads of google_health_daily_summary, google_health_wellness_context, and google_health_daily_rollup so agents see the contract before calling real Google Health APIs.

NameTypeReqDescription
response_formatstring

No output schema declared.

No examples provided.

google_health_exchange_code ~78

Exchange a Google OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned. Gated: requires explicit user intent — agents must not call this autonomously.

NameTypeReqDescription
codestringyesOAuth authorization code, or a full redirect URL containing ?code=...
response_formatstring
NameTypeReqDescription
expires_atnumber
notestringyes
okbooleanyes
scopestring
token_pathstringyes

No examples provided.

google_health_get_auth_url ~76

Generate a Google OAuth authorization URL for Google Health API. Use this first when no local token exists.

NameTypeReqDescription
response_formatstring
scopesarrayOptional scope override. Defaults to read-only Google Health scopes used by this server.
statestringOptional OAuth state value generated by the caller.
NameTypeReqDescription
auth_urlstringyes
next_stepstringyes
redirect_uristringyes
scopesarrayyes

No examples provided.

google_health_get_data_point ~362

Fetch one data point by id — e.g. a specific sleep session, exercise or weight entry found via list/reconcile. Accepts the bare id or the full resource name from a previous response. Only data types whose official_operations include 'get' support this (see google_health_list_data_types).

NameTypeReqDescription
data_point_idstringyesData point id, or the full resource name from a list/reconcile response (users/me/dataTypes/<type>/dataPoints/<id>).
data_typestringyesGoogle Health data type in kebab case. Supported slugs (call google_health_list_data_types for units and which verbs each supports): active-energy-burned, active-minutes, active-zone-minutes, activit…
privacy_modestringOptional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

google_health_get_identity ~68

Get the Google Health identity mapping for the authenticated user. Useful for Fitbit-to-Google migrations.

NameTypeReqDescription
privacy_modestringOptional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

google_health_get_irn_profile ~103

Get the user's irregular rhythm notification (IRN) engagement status — whether the AFib detection feature is enabled on their Fitbit/Pixel Watch. Requires the googlehealth.irn.readonly scope (setup --scope-preset heart). Read-only, non-diagnostic.

NameTypeReqDescription
privacy_modestringOptional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

google_health_get_profile ~62

Get authenticated user profile details from Google Health. Requires profile scope.

NameTypeReqDescription
privacy_modestringOptional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

google_health_get_settings ~63

Get authenticated user settings such as units and timezone. Requires settings scope.

NameTypeReqDescription
privacy_modestringOptional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

google_health_list_data_points ~333

Query detailed data points for a Google Health data type. Use kebab-case endpoint data types, e.g. steps, sleep, heart-rate.

NameTypeReqDescription
data_typestringGoogle Health data type in kebab case. Supported slugs (call google_health_list_data_types for units and which verbs each supports): active-energy-burned, active-minutes, active-zone-minutes, activit…
filterstringOptional Google AIP-160 filter expression. Use snake_case field names in filters.
page_sizeinteger
page_tokenstring
privacy_modestringOptional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

google_health_list_data_types ~104

List the canonical kebab-case data_type slugs accepted by the data point, reconcile and rollup tools, with each slug's unit, OAuth scope family, and which endpoint verbs (list/reconcile/rollup) support it. Call this before list_data_points, reconcile_data_points, daily_rollup or rollup to choose a valid data_type instead of guessing a slug. Static metadata; does not call Google APIs.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
countintegeryes
data_typesarrayyes
generated_atstringyes
kindstringyes
notestringyes
official_sourceobjectyes
sourcestringyes

No examples provided.

google_health_list_paired_devices ~106

List the Fitbit trackers, Pixel Watches and other devices paired to the authenticated Google Health account. Useful to answer 'is my watch syncing?' and to see which device produces which data. Read-only.

NameTypeReqDescription
page_sizeinteger
page_tokenstring
privacy_modestringOptional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

google_health_onboarding ~121

Return the 11-question onboarding flow plus the current profile state and missing fields. Read-only — does NOT persist anything. Pair with google_health_profile_update once the user answers. Cross-connector: the same profile is shared by every Wellness MCP (whoop, garmin, oura, fitbit, strava, polar, withings, apple-health, samsung-health, google-health, nourish, cycle-coach, cgm, air).

NameTypeReqDescription
localestringOnboarding locale. Defaults to en.
response_formatstring

No output schema declared.

No examples provided.

google_health_privacy_audit ~38

Return local privacy, cache, token-path and env-presence posture without revealing secret values.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
cache_enabledbooleanyes
cache_pathstringyes
config_sourcestringyes
gps_redaction_defaultbooleanyes
local_config_existsbooleanyes
local_config_pathstringyes
local_config_secure_permissionsboolean
notesarrayyes
privacy_mode_defaultstringyes
projectstringyes
raw_payloads_opt_inbooleanyes
redacted_key_patternsarrayyes
required_env_presentobjectyes
secret_env_varsarrayyes
stdout_safebooleanyes
token_pathstringyes
unofficialbooleanyes

No examples provided.

google_health_profile_get ~65

Read the shared Wellness profile from ~/.delx-wellness/profile.json. Returns preferred name, goals, devices, training/nutrition/exercise/agent preferences and safety flags. NEVER contains OAuth tokens or API secrets. Read-only.

NameTypeReqDescription
response_formatstring

No output schema declared.

No examples provided.

google_health_profile_update ~153

Persist a partial patch to ~/.delx-wellness/profile.json. Requires explicit_user_intent=true (otherwise returns USER_ACTION_REQUIRED). Rejects secret-like fields (oauth, token, secret, password, cookie, refresh, api_key, session) at write time. Use to record preferred name, goals, devices, training context, nutrition context, exercise preferences, agent preferences, and safety flags.

NameTypeReqDescription
explicit_user_intentbooleanMust be true to persist. Prevents accidental writes from agent inference.
patchobjectyesPartial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes.
response_formatstring

No output schema declared.

No examples provided.

google_health_quickstart ~63

Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Google Health?'

NameTypeReqDescription
response_formatstring

No output schema declared.

No examples provided.

google_health_reconcile_data_points ~343

Read a reconciled stream for one data type across sources. Supports all-sources, google-wearables and google-sources data source families.

NameTypeReqDescription
data_source_familystring
data_typestringGoogle Health data type in kebab case. Supported slugs (call google_health_list_data_types for units and which verbs each supports): active-energy-burned, active-minutes, active-zone-minutes, activit…
filterstringOptional Google AIP-160 filter expression. Use snake_case field names in filters.
page_sizeinteger
page_tokenstring
privacy_modestringOptional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

google_health_revoke_access ~61

Revoke the current Google OAuth grant and delete the local token file. Use only when the user explicitly wants to disconnect Google Health. Gated: requires explicit user intent — agents must not call this autonomously.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
local_tokens_clearedbooleanyes
notestringyes
okbooleanyes
token_pathstringyes

No examples provided.

google_health_rollup ~392

Aggregate a data type over physical time intervals using Google Health rollUp.

NameTypeReqDescription
data_source_familystring
data_typestringGoogle Health data type in kebab case. Supported slugs (call google_health_list_data_types for units and which verbs each supports): active-energy-burned, active-minutes, active-zone-minutes, activit…
end_timestringyesISO 8601 date-time with timezone, e.g. 2026-05-01T00:00:00Z
page_sizeinteger
page_tokenstring
privacy_modestringOptional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_formatstring
start_timestringyesISO 8601 date-time with timezone, e.g. 2026-05-01T00:00:00Z
window_sizestringDuration in protobuf seconds format, e.g. 3600s.
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

google_health_weekly_summary ~101

Build a weekly Google Health scorecard with activity, sleep, heart context and missing-data awareness. Read-only, beta, non-medical.

NameTypeReqDescription
compare_daysintegerPrior comparison window in days. Use 0 to disable comparison.
daysintegerRecent analysis window in days.
response_formatstring
timezonestringIANA timezone used only for display, e.g. America/New_York.
NameTypeReqDescription
generated_atstringyes
kindstringyes

No examples provided.

google_health_wellness_context ~97

Normalize Google Health activity/sleep context into the shared wellness_context shape for recommendation engines.

NameTypeReqDescription
daysintegerLookback window for normalized Google Health wellness context.
injury_flagsarray
notesstring
response_formatstring
sorenessarray
timezonestringIANA timezone used only for display, e.g. America/New_York.
NameTypeReqDescription
generated_atstringyes
injury_flagsarrayyes
notesarrayyes
recent_training_loadstringyes
sorenessarrayyes
sourcestringyes

No examples provided.

Common questions

What is the io.github.BerkKilicoglu/google-health-fitbit-mcp server?

io.github.BerkKilicoglu/google-health-fitbit-mcp is listed in the public MCP registry as io.github.BerkKilicoglu/google-health-fitbit-mcp. Privacy-first Google Health API MCP server for health, sleep, activity and HR agents. This page covers its npm package (google-health-fitbit-mcp).

Is the io.github.BerkKilicoglu/google-health-fitbit-mcp server safe to use?

io.github.BerkKilicoglu/google-health-fitbit-mcp scores 84 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.BerkKilicoglu/google-health-fitbit-mcp server expose?

io.github.BerkKilicoglu/google-health-fitbit-mcp exposes 29 tools: google_health_data_inventory, google_health_list_data_types, google_health_data_type_coverage, google_health_agent_manifest, google_health_capabilities, and 24 more. Their descriptions and schemas cost roughly 3,627 tokens of context every time the server is loaded.

Is the io.github.BerkKilicoglu/google-health-fitbit-mcp server still maintained?

io.github.BerkKilicoglu/google-health-fitbit-mcp is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.BerkKilicoglu/google-health-fitbit-mcp server under?

io.github.BerkKilicoglu/google-health-fitbit-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.