io.github.BerkKilicoglu/google-health-fitbit-mcp

NPM · GOOGLE-HEALTH-FITBIT-MCP · SCANNED AUG 3

Privacy-first Google Health API MCP server for health, sleep, activity and HR agents

Available components

+15 this week 65 65 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 6 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability82

100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
AI-judged instruction clarity (good).Pass
Context-footprint check failed: tool/resource definitions use about 3755 tokens (~104/item across 36 items; 29 tools + 7 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage83

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
41% of tool parameters carry a description.Partial
Structured output schemas are declared (83% of tools); any adoption earns full credit.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · google-health-fitbit-mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add berkkilicoglu-google-health-fitbit-mcp -- npx -y google-health-fitbit-mcp

# add to Codex CLI

codex mcp add berkkilicoglu-google-health-fitbit-mcp -- npx -y google-health-fitbit-mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "berkkilicoglu-google-health-fitbit-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "google-health-fitbit-mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add berkkilicoglu-google-health-fitbit-mcp --command npx --arg -y --arg google-health-fitbit-mcp

# ~/.hermes/config.yaml

mcp_servers:
  berkkilicoglu-google-health-fitbit-mcp:
    command: "npx"
    args: ["-y", "google-health-fitbit-mcp"]

// mcp.json

{
  "mcpServers": {
    "berkkilicoglu-google-health-fitbit-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "google-health-fitbit-mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +45
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Security disclosure: unverified → fail ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → 100 ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Schema quality: unverified → good ▲ functional
- Licence: MIT functional
2 Aug 26 −4
- Malware scan: unverified → pass ▲ security
- Security disclosure: fail → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
31 Jul 26 +18
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 −44
- Malware scan: pass → unverified ▼ security
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
27 Jul 26 50

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 129 packages

129 packages in the resolved dependency tree · 129 deprecated · 49 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 29 exposed · ~3,627 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

google_health_agent_manifest Google Health Agent Manifest ~46

Machine-readable install, runtime and client guidance for AI agents. Does not call Google Health or expose secrets.

Input Output Examples

Name	Type	Req	Description
client	string	—	—
response_format	string	—	—

Name	Type	Req	Description
agent_rules	array	yes	—
beta_notice	string	yes	—
client	string	yes	—
hermes	object	yes	—
links	object	yes	—
mcp_name	string	yes	—
mutating_tools	object	yes	—
oauth	object	yes	—
package	object	yes	—
project	string	yes	—
recommended_first_calls	array	yes	—
resources	array	yes	—
standard_tools	array	yes	—
status	string	yes	—
troubleshooting	array	yes	—
unofficial	boolean	yes	—

No examples provided.

google_health_cache_status Google Health Cache Status ~40

Show optional local SQLite cache status. Enable with GOOGLE_HEALTH_CACHE=sqlite or GOOGLE_HEALTH_CACHE=true.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
enabled	boolean	yes	—
entries	integer	yes	—
http_cache	object	—	—
newest_cached_at	string	—	—
path	string	yes	—

No examples provided.

google_health_capabilities Google Health MCP Capabilities ~34

Explain supported Google Health data, privacy boundaries, beta status and recommended agent workflow.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
api_boundary	object	yes	—
auth_model	object	yes	—
beta_notice	string	yes	—
client_aliases	object	yes	—
contribution_paths	array	yes	—
creator	object	yes	—
links	object	yes	—
mcp_name	string	yes	—
mutating_tools	object	—	—
privacy_modes	array	yes	—
project	string	yes	—
recommended_agent_flow	array	yes	—
status	string	yes	—
supported_data	array	yes	—
unofficial	boolean	yes	—

No examples provided.

google_health_connection_status Google Health Connection Status ~55

Check local Google Health config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Google APIs or exposing secrets.

Input Output Examples

Name	Type	Req	Description
client	string	—	—
response_format	string	—	—

Name	Type	Req	Description
automatic_auth_supported	boolean	yes	—
cache	object	yes	—
client	string	—	—
client_checks	object	—	—
config	object	yes	—
missing_env	array	yes	—
next_steps	array	yes	—
node	object	yes	—
oauth	object	yes	—
ok	boolean	yes	—
privacy_mode	string	yes	—
ready_for_google_health_api	boolean	yes	—
redirect_uri	string	—	—
required_env	object	yes	—
token	object	yes	—

No examples provided.

google_health_daily_rollup Google Health Daily Rollup ~358

Aggregate a data type over civil days using Google Health dailyRollUp. Useful for steps, distance, calories, active minutes, weight and heart summaries.

Input Output Examples

Name	Type	Req	Description
data_source_family	string	—	—
data_type	string	—	Google Health data type in kebab case. Supported slugs (call google_health_list_data_types for units and which verbs each supports): active-energy-burned, active-minutes, active-zone-minutes, activit…
end_date	string	—	Exclusive end date as YYYY-MM-DD. Defaults to the next day.
page_size	integer	—	—
page_token	string	—	—
privacy_mode	string	—	Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_format	string	—	—
start_date	string	—	—
window_size_days	integer	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

google_health_daily_summary Google Health Daily Summary ~73

Build a practical daily summary from Google Health rollups and reconciled streams when available. Read-only, beta, non-medical.

Input Output Examples

Name	Type	Req	Description
date	string	—	—
response_format	string	—	—
timezone	string	—	IANA timezone used only for display, e.g. America/New_York.

Name	Type	Req	Description
generated_at	string	yes	—
kind	string	yes	—

No examples provided.

google_health_data_inventory Google Health Data Inventory ~39

Inventory supported Google Health data types, auth scopes, privacy modes and recommended first calls without calling Google APIs.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
api_boundary	—	—	—
auth	—	—	—
categories	array	yes	—
data_access_model	string	yes	—
first_tools	array	yes	—
generated_at	string	yes	—
kind	string	yes	—
links	object	yes	—
mcp_name	string	yes	—
notes	array	yes	—
privacy_modes	array	yes	—
recommended_agent_flow	array	yes	—
scopes	array	yes	—
source	string	yes	—
totals	object	yes	—
unofficial	boolean	yes	—

No examples provided.

google_health_data_type_coverage Google Health Data Type Coverage ~136

Build a data-type coverage plan from the official Google Health API data-type table, or run explicit live read-only checks against a real OAuth account. Live mode returns only redacted status and point-count buckets, never raw health payloads.

Input Output Examples

Name	Type	Req	Description
data_source_family	string	—	—
data_types	array	—	Optional subset of data_type slugs. Omit to validate the full local catalog.
date	string	—	—
live	boolean	—	Default false. When true, calls read-only Google Health endpoints after OAuth setup and returns only redacted coverage status.
response_format	string	—	—

Name	Type	Req	Description
kind	string	yes	—
mode	string	yes	—

No examples provided.

google_health_demo Google Health Demo ~57

Returns realistic Pixel-Watch-style example payloads of google_health_daily_summary, google_health_wellness_context, and google_health_daily_rollup so agents see the contract before calling real Google Health APIs.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

No output schema declared.

No examples provided.

google_health_exchange_code Exchange Google Health OAuth Code ~78

Exchange a Google OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned. Gated: requires explicit user intent — agents must not call this autonomously.

Input Output Examples

Name	Type	Req	Description
code	string	yes	OAuth authorization code, or a full redirect URL containing ?code=...
response_format	string	—	—

Name	Type	Req	Description
expires_at	number	—	—
note	string	yes	—
ok	boolean	yes	—
scope	string	—	—
token_path	string	yes	—

No examples provided.

google_health_get_auth_url Get Google Health OAuth URL ~76

Generate a Google OAuth authorization URL for Google Health API. Use this first when no local token exists.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—
scopes	array	—	Optional scope override. Defaults to read-only Google Health scopes used by this server.
state	string	—	Optional OAuth state value generated by the caller.

Name	Type	Req	Description
auth_url	string	yes	—
next_step	string	yes	—
redirect_uri	string	yes	—
scopes	array	yes	—

No examples provided.

google_health_get_data_point Get Google Health Data Point ~362

Fetch one data point by id — e.g. a specific sleep session, exercise or weight entry found via list/reconcile. Accepts the bare id or the full resource name from a previous response. Only data types whose official_operations include 'get' support this (see google_health_list_data_types).

Input Output Examples

Name	Type	Req	Description
data_point_id	string	yes	Data point id, or the full resource name from a list/reconcile response (users/me/dataTypes/<type>/dataPoints/<id>).
data_type	string	yes	Google Health data type in kebab case. Supported slugs (call google_health_list_data_types for units and which verbs each supports): active-energy-burned, active-minutes, active-zone-minutes, activit…
privacy_mode	string	—	Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

google_health_get_identity Get Google Health Identity ~68

Get the Google Health identity mapping for the authenticated user. Useful for Fitbit-to-Google migrations.

Input Output Examples

Name	Type	Req	Description
privacy_mode	string	—	Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

google_health_get_irn_profile Get Irregular Rhythm Notification Profile ~103

Get the user's irregular rhythm notification (IRN) engagement status — whether the AFib detection feature is enabled on their Fitbit/Pixel Watch. Requires the googlehealth.irn.readonly scope (setup --scope-preset heart). Read-only, non-diagnostic.

Input Output Examples

Name	Type	Req	Description
privacy_mode	string	—	Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

google_health_get_profile Get Google Health Profile ~62

Get authenticated user profile details from Google Health. Requires profile scope.

Input Output Examples

Name	Type	Req	Description
privacy_mode	string	—	Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

google_health_get_settings Get Google Health Settings ~63

Get authenticated user settings such as units and timezone. Requires settings scope.

Input Output Examples

Name	Type	Req	Description
privacy_mode	string	—	Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

google_health_list_data_points List Google Health Data Points ~333

Query detailed data points for a Google Health data type. Use kebab-case endpoint data types, e.g. steps, sleep, heart-rate.

Input Output Examples

Name	Type	Req	Description
data_type	string	—	Google Health data type in kebab case. Supported slugs (call google_health_list_data_types for units and which verbs each supports): active-energy-burned, active-minutes, active-zone-minutes, activit…
filter	string	—	Optional Google AIP-160 filter expression. Use snake_case field names in filters.
page_size	integer	—	—
page_token	string	—	—
privacy_mode	string	—	Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

google_health_list_data_types List Google Health Data Types ~104

List the canonical kebab-case data_type slugs accepted by the data point, reconcile and rollup tools, with each slug's unit, OAuth scope family, and which endpoint verbs (list/reconcile/rollup) support it. Call this before list_data_points, reconcile_data_points, daily_rollup or rollup to choose a valid data_type instead of guessing a slug. Static metadata; does not call Google APIs.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
count	integer	yes	—
data_types	array	yes	—
generated_at	string	yes	—
kind	string	yes	—
note	string	yes	—
official_source	object	yes	—
source	string	yes	—

No examples provided.

google_health_list_paired_devices List Paired Devices ~106

List the Fitbit trackers, Pixel Watches and other devices paired to the authenticated Google Health account. Useful to answer 'is my watch syncing?' and to see which device produces which data. Read-only.

Input Output Examples

Name	Type	Req	Description
page_size	integer	—	—
page_token	string	—	—
privacy_mode	string	—	Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

google_health_onboarding Wellness Onboarding Flow ~121

Return the 11-question onboarding flow plus the current profile state and missing fields. Read-only — does NOT persist anything. Pair with google_health_profile_update once the user answers. Cross-connector: the same profile is shared by every Wellness MCP (whoop, garmin, oura, fitbit, strava, polar, withings, apple-health, samsung-health, google-health, nourish, cycle-coach, cgm, air).

Input Output Examples

Name	Type	Req	Description
locale	string	—	Onboarding locale. Defaults to en.
response_format	string	—	—

No output schema declared.

No examples provided.

google_health_privacy_audit Google Health Privacy Audit ~38

Return local privacy, cache, token-path and env-presence posture without revealing secret values.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
cache_enabled	boolean	yes	—
cache_path	string	yes	—
config_source	string	yes	—
gps_redaction_default	boolean	yes	—
local_config_exists	boolean	yes	—
local_config_path	string	yes	—
local_config_secure_permissions	boolean	—	—
notes	array	yes	—
privacy_mode_default	string	yes	—
project	string	yes	—
raw_payloads_opt_in	boolean	yes	—
redacted_key_patterns	array	yes	—
required_env_present	object	yes	—
secret_env_vars	array	yes	—
stdout_safe	boolean	yes	—
token_path	string	yes	—
unofficial	boolean	yes	—

No examples provided.

google_health_profile_get Get Wellness Profile ~65

Read the shared Wellness profile from ~/.delx-wellness/profile.json. Returns preferred name, goals, devices, training/nutrition/exercise/agent preferences and safety flags. NEVER contains OAuth tokens or API secrets. Read-only.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

No output schema declared.

No examples provided.

google_health_profile_update Update Wellness Profile ~153

Persist a partial patch to ~/.delx-wellness/profile.json. Requires explicit_user_intent=true (otherwise returns USER_ACTION_REQUIRED). Rejects secret-like fields (oauth, token, secret, password, cookie, refresh, api_key, session) at write time. Use to record preferred name, goals, devices, training context, nutrition context, exercise preferences, agent preferences, and safety flags.

Input Output Examples

Name	Type	Req	Description
explicit_user_intent	boolean	—	Must be true to persist. Prevents accidental writes from agent inference.
patch	object	yes	Partial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes.
response_format	string	—	—

No output schema declared.

No examples provided.

google_health_quickstart Google Health Quickstart ~63

Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Google Health?'

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

No output schema declared.

No examples provided.

google_health_reconcile_data_points Reconcile Google Health Data Points ~343

Read a reconciled stream for one data type across sources. Supports all-sources, google-wearables and google-sources data source families.

Input Output Examples

Name	Type	Req	Description
data_source_family	string	—	—
data_type	string	—	Google Health data type in kebab case. Supported slugs (call google_health_list_data_types for units and which verbs each supports): active-energy-burned, active-minutes, active-zone-minutes, activit…
filter	string	—	Optional Google AIP-160 filter expression. Use snake_case field names in filters.
page_size	integer	—	—
page_token	string	—	—
privacy_mode	string	—	Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

google_health_revoke_access Revoke Google Health OAuth Access ~61

Revoke the current Google OAuth grant and delete the local token file. Use only when the user explicitly wants to disconnect Google Health. Gated: requires explicit user intent — agents must not call this autonomously.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
local_tokens_cleared	boolean	yes	—
note	string	yes	—
ok	boolean	yes	—
token_path	string	yes	—

No examples provided.

google_health_rollup Google Health Physical-Time Rollup ~392

Aggregate a data type over physical time intervals using Google Health rollUp.

Input Output Examples

Name	Type	Req	Description
data_source_family	string	—	—
data_type	string	—	Google Health data type in kebab case. Supported slugs (call google_health_list_data_types for units and which verbs each supports): active-energy-burned, active-minutes, active-zone-minutes, activit…
end_time	string	yes	ISO 8601 date-time with timezone, e.g. 2026-05-01T00:00:00Z
page_size	integer	—	—
page_token	string	—	—
privacy_mode	string	—	Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
response_format	string	—	—
start_time	string	yes	ISO 8601 date-time with timezone, e.g. 2026-05-01T00:00:00Z
window_size	string	—	Duration in protobuf seconds format, e.g. 3600s.

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

google_health_weekly_summary Google Health Weekly Review ~101

Build a weekly Google Health scorecard with activity, sleep, heart context and missing-data awareness. Read-only, beta, non-medical.

Input Output Examples

Name	Type	Req	Description
compare_days	integer	—	Prior comparison window in days. Use 0 to disable comparison.
days	integer	—	Recent analysis window in days.
response_format	string	—	—
timezone	string	—	IANA timezone used only for display, e.g. America/New_York.

Name	Type	Req	Description
generated_at	string	yes	—
kind	string	yes	—

No examples provided.

google_health_wellness_context Google Health Wellness Context ~97

Normalize Google Health activity/sleep context into the shared wellness_context shape for recommendation engines.

Input Output Examples

Name	Type	Req	Description
days	integer	—	Lookback window for normalized Google Health wellness context.
injury_flags	array	—	—
notes	string	—	—
response_format	string	—	—
soreness	array	—	—
timezone	string	—	IANA timezone used only for display, e.g. America/New_York.

Name	Type	Req	Description
generated_at	string	yes	—
injury_flags	array	yes	—
notes	array	yes	—
recent_training_load	string	yes	—
soreness	array	yes	—
source	string	yes	—

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug