# io.github.davidmosiah/apple-health-mcp (npm · apple-health-mcp-unofficial)

Unofficial local-first MCP server for Apple Health export data.

- Trust score: 68/100 (medium)
- Change this week: +18
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `apple-health-mcp-unofficial`: 68/100 (this document), [markdown](https://verifymcp.io/servers/davidmosiah-apple-health-mcp/apple-health-mcp-unofficial.md), [page](https://verifymcp.io/servers/davidmosiah-apple-health-mcp/apple-health-mcp-unofficial)

## Channel facts

- Registry: `npm`
- Package: `apple-health-mcp-unofficial`
- Version: `0.5.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (97 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 2 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 81/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1807 tokens (~78/item across 23 items; 18 tools + 5 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 80/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 40% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add davidmosiah-apple-health-mcp -- npx -y apple-health-mcp-unofficial
```

### Codex

```bash
codex mcp add davidmosiah-apple-health-mcp -- npx -y apple-health-mcp-unofficial
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "davidmosiah-apple-health-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "apple-health-mcp-unofficial"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add davidmosiah-apple-health-mcp --command npx --arg -y --arg apple-health-mcp-unofficial
```

### Hermes

```yaml
mcp_servers:
  davidmosiah-apple-health-mcp:
    command: "npx"
    args: ["-y", "apple-health-mcp-unofficial"]
```

### Other

```json
{
  "mcpServers": {
    "davidmosiah-apple-health-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "apple-health-mcp-unofficial"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 68, 0)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail

### 2026-08-02 (score 68, +44)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-08-01 (score 24, +19)

- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100

### 2026-07-31 (score 5, −1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 6, −44)

- [security regression] Malware scan: pass → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-07-27 (score 50)

First indexed and scored.

## MCP tools (18)

### `apple_health_agent_manifest` (~42 tokens)

Apple Health Agent Manifest

Machine-readable install, runtime and privacy guidance for AI agents operating Apple Health export data.

Input parameters:

- `client` (string)
- `response_format` (string)

### `apple_health_capabilities` (~38 tokens)

Apple Health MCP Capabilities

Explain supported Apple Health export data, unavailable live HealthKit access, privacy modes and recommended agent workflow.

Input parameters:

- `response_format` (string)

### `apple_health_connection_status` (~47 tokens)

Apple Health Connection Status

Check local Apple Health export path, Node version, privacy mode and Hermes client posture without reading full export data.

Input parameters:

- `client` (string)
- `response_format` (string)

### `apple_health_quickstart` (~84 tokens)

Apple Health Quickstart

Personalized 3-step setup walkthrough for the human user. Adapts to current state (is APPLE_HEALTH_EXPORT_PATH set? does the export file exist and parse?). Call this first when the user asks 'how do I connect Apple Health?'. This connector is local-first and never touches Apple servers or cloud APIs.

Input parameters:

- `response_format` (string)

### `apple_health_demo` (~59 tokens)

Apple Health Demo

Returns realistic example payloads of apple_health_daily_summary, apple_health_weekly_summary, and apple_health_wellness_context with Apple-Watch-style values, so agents see the contract before parsing a real export.

Input parameters:

- `response_format` (string)

### `apple_health_privacy_audit` (~33 tokens)

Apple Health Privacy Audit

Return the local privacy and export-file posture without revealing health data.

Input parameters:

- `response_format` (string)

### `apple_health_list_records` (~153 tokens)

List Apple Health Records

List bounded records from a local Apple Health export.xml. Use type/start/end filters to keep output small.

Input parameters:

- `end` (string): Optional ISO date/time upper bound.
- `incremental_cache` (boolean): When true and `type` is set, skip records already seen in a previous call (per-category cache at ~/.apple-health-mcp/incremental-cache.json). Cache auto-invalidates when the export file mtime changes.
- `limit` (integer)
- `privacy_mode` (string)
- `response_format` (string)
- `start` (string): Optional ISO date/time lower bound.
- `type` (string): Apple Health record type, e.g. HKQuantityTypeIdentifierStepCount.

### `apple_health_list_workouts` (~72 tokens)

List Apple Health Workouts

List bounded workout records from a local Apple Health export.xml.

Input parameters:

- `end` (string): Optional ISO date/time upper bound.
- `limit` (integer)
- `privacy_mode` (string)
- `response_format` (string)
- `start` (string): Optional ISO date/time lower bound.

### `apple_health_export_freshness` (~112 tokens)

Apple Health Export Freshness

Check how recently the local Apple Health export file/directory was written. Returns mtime, days_since_export, an is_stale flag, and a recommendation. Considered stale if the export is older than 30 days, or older than 7 days with no recent records (the inventory's latest-record date is also older than 7 days). Use before relying on apple_health_daily_summary or apple_health_wellness_context to confirm the export is fresh.

Input parameters:

- `response_format` (string)

### `apple_health_data_inventory` (~105 tokens)

Apple Health Data Inventory

Scan the local Apple Health export once and report available record types, workouts, date coverage, freshness and safe next calls.

Input parameters:

- `end` (string): Optional ISO date/time upper bound.
- `privacy_mode` (string)
- `response_format` (string)
- `start` (string): Optional ISO date/time lower bound.
- `timezone` (string): IANA timezone, e.g. America/Fortaleza. Defaults to APPLE_HEALTH_TIMEZONE or UTC.

### `apple_health_daily_summary` (~90 tokens)

Apple Health Daily Summary

Build a daily wellness summary from local Apple Health export data. It is not live HealthKit and not medical advice.

Input parameters:

- `date` (string): YYYY-MM-DD local date. Defaults to today in the configured timezone.
- `response_format` (string)
- `timezone` (string): IANA timezone, e.g. America/Fortaleza. Defaults to APPLE_HEALTH_TIMEZONE or UTC.

### `apple_health_wellness_context` (~112 tokens)

Apple Health Wellness Context

Normalize local Apple Health export sleep, workout and activity data into the shared wellness_context shape for recommendation engines.

Input parameters:

- `date` (string): YYYY-MM-DD local date. Defaults to today in the configured timezone.
- `injury_flags` (array)
- `notes` (string)
- `response_format` (string)
- `soreness` (array)
- `timezone` (string): IANA timezone, e.g. America/Fortaleza. Defaults to APPLE_HEALTH_TIMEZONE or UTC.

### `apple_health_weekly_summary` (~108 tokens)

Apple Health Weekly Summary

Build a weekly wellness summary from local Apple Health export data. It is not live HealthKit and not medical advice.

Input parameters:

- `days` (integer)
- `end_date` (string): YYYY-MM-DD local end date. Defaults to today in the configured timezone.
- `privacy_mode` (string)
- `response_format` (string)
- `timezone` (string): IANA timezone, e.g. America/Fortaleza. Defaults to APPLE_HEALTH_TIMEZONE or UTC.

### `apple_health_profile_get` (~92 tokens)

Get Delx Wellness Profile

Read the shared Delx Wellness profile from ~/.delx-wellness/profile.json. Returns preferred name, goals, devices, training/nutrition/exercise/agent preferences and safety flags. NEVER contains OAuth tokens or API secrets — this connector is local-export and has no cloud auth, but the profile contract is the same across every Delx Wellness MCP. Read-only.

Input parameters:

- `response_format` (string)

### `apple_health_profile_update` (~153 tokens)

Update Delx Wellness Profile

Persist a partial patch to ~/.delx-wellness/profile.json. Requires explicit_user_intent=true (otherwise returns USER_ACTION_REQUIRED). Rejects secret-like fields (oauth, token, secret, password, cookie, refresh, api_key, session) at write time. Use to record preferred name, goals, devices, training context, nutrition context, exercise preferences, agent preferences, and safety flags.

Input parameters:

- `explicit_user_intent` (boolean): Must be true to persist. Prevents accidental writes from agent inference.
- `patch` (object, required): Partial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes.
- `response_format` (string)

### `apple_health_clear_incremental_cache` (~106 tokens)

Clear Apple Health Incremental Import Cache

Manually clear the incremental import cache at ~/.apple-health-mcp/incremental-cache.json. The cache tracks the latest parsed timestamp per HealthKit category so subsequent `apple_health_list_records` calls (with `incremental_cache: true`) skip already-seen records. Use this when you want to force a full re-parse without changing the export file. The cache also auto-invalidates when the export file mtime changes.

Input parameters:

- `response_format` (string)

### `apple_health_reimport` (~177 tokens)

Reimport Apple Health Export from Watch Folder

Re-scan the configured watch folder (APPLE_HEALTH_WATCH_PATH or `setup --watch-path <dir>`) for a newer Apple Health export. If a newer export.xml/export.zip/apple_health_export directory is found, it is promoted to the active export, the in-memory snapshot cache and incremental cache are cleared, and subsequent summaries reflect the new data. With check_only=true, only report what would happen without promoting. This is the cross-platform recurring-refresh path — the native HealthKit bridge needs macOS and is separate.

Input parameters:

- `check_only` (boolean): When true, report the watch-folder status without promoting a new export.
- `force` (boolean): When true, re-promote the newest export in the folder even if it already matches the active export (forces a cache refresh).
- `response_format` (string)

### `apple_health_onboarding` (~123 tokens)

Delx Wellness Onboarding Flow

Return the 11-question onboarding flow plus the current profile state and missing fields. Read-only — does NOT persist anything. Pair with apple_health_profile_update once the user answers. Cross-connector: the same profile is shared by every Delx Wellness MCP (whoop, garmin, oura, fitbit, strava, polar, withings, apple-health, samsung-health, google-health, nourish, cycle-coach, cgm, air).

Input parameters:

- `locale` (string): Onboarding locale. Defaults to en.
- `response_format` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/davidmosiah-apple-health-mcp/apple-health-mcp-unofficial#diagnostics

## Score history

- 2026-08-04: 68
- 2026-08-03: 68
- 2026-08-02: 68
- 2026-08-01: 24
- 2026-07-31: 5
- 2026-07-30: 6
- 2026-07-28: 50
- 2026-07-27: 50

## Links

- npm package: https://www.npmjs.com/package/apple-health-mcp-unofficial
- Socket report: https://socket.dev/npm/package/apple-health-mcp-unofficial
- Repository: https://github.com/davidmosiah/apple-health-mcp
- Website: https://wellness.delx.ai/connectors/apple-health
- Changelog RSS feed: https://verifymcp.io/servers/davidmosiah-apple-health-mcp/apple-health-mcp-unofficial/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/davidmosiah-apple-health-mcp/apple-health-mcp-unofficial/changelog.json
- HTML version of this page: https://verifymcp.io/servers/davidmosiah-apple-health-mcp/apple-health-mcp-unofficial