Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

io.github.davidmosiah/fitbitmcp

NPM · FITBIT-MCP-UNOFFICIAL · SCANNED AUG 3

Privacy-first, unofficial Fitbit MCP server for AI health, sleep, activity and heart-rate agents.

+18 this week 69 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability82
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Tool/resource definitions use about 2744 tokens (~70/item across 39 items; 32 tools + 7 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage88
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 58% of tool parameters carry a description.Partial
  • Structured output schemas are declared (84% of tools); any adoption earns full credit.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · fitbit-mcp-unofficial

# add to Claude Code
claude mcp add davidmosiah-fitbitmcp -- npx -y fitbit-mcp-unofficial
# add to Codex CLI
codex mcp add davidmosiah-fitbitmcp -- npx -y fitbit-mcp-unofficial
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "davidmosiah-fitbitmcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "fitbit-mcp-unofficial"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add davidmosiah-fitbitmcp --command npx --arg -y --arg fitbit-mcp-unofficial
# ~/.hermes/config.yaml
mcp_servers:
  davidmosiah-fitbitmcp:
    command: "npx"
    args: ["-y", "fitbit-mcp-unofficial"]
// mcp.json
{
  "mcpServers": {
    "davidmosiah-fitbitmcp": {
      "command": "npx",
      "args": [
        "-y",
        "fitbit-mcp-unofficial"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 2 Aug 26 +39
    • Provenance: unverified → fail security
    • Known CVEs: unverified → partial security
    • Install scripts: unverified → pass security
    • Malware scan: unverified → pass security
    • Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
    • Capabilities: pass → unverified functional
    • Security disclosure: fail → unverified functional
    • Tool coverage: 100 → unverified functional
    • Schema quality: 100 → unverified functional
    • Schema quality: unverified → good functional
    • Maintenance: unverified → pass functional
    • Dependency health: unverified → partial functional
    • Stability: unverified → 0.23 functional
    • License: unverified → pass functional
    • Licence: MIT functional
  • 1 Aug 26 +5
    • Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
    • MCP protocol: unverified → pass functional
  • 31 Jul 26 −26
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 +27
    • Tool coverage: unverified → 100 functional
    • Schema quality: unverified → 100 functional
  • 28 Jul 26 −27
    • Schema quality: 100 → unverified functional
    • Tool coverage: 100 → unverified functional
  • 27 Jul 26 51

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 129 packages

129 packages in the resolved dependency tree · 129 deprecated · 49 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 32 exposed · ~2,618 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
fitbit_agent_manifest ~45

Machine-readable install, runtime and client guidance for AI agents. Does not call Fitbit or expose secrets.

NameTypeReqDescription
clientstring
response_formatstring
NameTypeReqDescription
agent_rulesarrayyes
clientstringyes
hermesobjectyes
linksobjectyes
mcp_namestringyes
oauthobjectyes
packageobjectyes
projectstringyes
recommended_first_callsarrayyes
resourcesarrayyes
standard_toolsarrayyes
troubleshootingarrayyes
unofficialbooleanyes

No examples provided.

fitbit_cache_status ~38

Show optional local SQLite cache status. Enable with FITBIT_CACHE=sqlite or FITBIT_CACHE=true.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
enabledbooleanyes
entriesintegeryes
http_cacheobject
newest_cached_atstring
pathstringyes

No examples provided.

fitbit_capabilities ~33

Explain supported Fitbit data, privacy boundaries, recommended agent workflow and project links.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
api_boundaryobjectyes
auth_modelobjectyes
client_aliasesobjectyes
contribution_pathsarrayyes
creatorobjectyes
linksobjectyes
mcp_namestringyes
privacy_modesarrayyes
projectstringyes
recommended_agent_flowarrayyes
supported_dataarrayyes
unofficialbooleanyes

No examples provided.

fitbit_connection_status ~53

Check local Fitbit config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Fitbit or exposing secrets.

NameTypeReqDescription
clientstring
response_formatstring
NameTypeReqDescription
automatic_auth_supportedbooleanyes
cacheobjectyes
clientstring
client_checksobject
configobjectyes
missing_envarrayyes
next_stepsarrayyes
nodeobjectyes
oauthobjectyes
okbooleanyes
privacy_modestringyes
ready_for_fitbit_apibooleanyes
redirect_uristring
required_envobjectyes
tokenobjectyes

No examples provided.

fitbit_daily_summary ~83

Build a practical daily summary from Fitbit activity, sleep, heart-rate, HRV and weight data when available. Read-only and non-medical.

NameTypeReqDescription
daysintegerLookback window for recent training context.
response_formatstring
timezonestringIANA timezone used only for display, e.g. America/New_York.
NameTypeReqDescription
generated_atstringyes
kindstringyes

No examples provided.

fitbit_data_inventory ~45

Inventory supported Fitbit data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call Fitbit APIs or expose user data.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
api_boundary
auth
categoriesarrayyes
data_access_modelstringyes
first_toolsarrayyes
generated_atstringyes
kindstringyes
linksobjectyes
mcp_namestringyes
notesarrayyes
privacy_modesarrayyes
recommended_agent_flowarrayyes
scopesarrayyes
sourcestringyes
totalsobjectyes
unofficialbooleanyes

No examples provided.

fitbit_demo ~53

Returns realistic example payloads of fitbit_daily_summary, fitbit_wellness_context, and fitbit_get_heart_day so agents see the contract before calling real Fitbit APIs.

NameTypeReqDescription
response_formatstring

No output schema declared.

No examples provided.

fitbit_exchange_code ~62

Exchange a Fitbit OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned.

NameTypeReqDescription
codestringyesOAuth authorization code, or a full redirect URL containing ?code=...
response_formatstring
NameTypeReqDescription
expires_atnumber
notestringyes
okbooleanyes
scopestring
token_pathstringyes

No examples provided.

fitbit_get_activity ~75

Get detailed Fitbit activity log by id. Requires activity scope.

NameTypeReqDescription
idyesFitbit resource id.
privacy_modestringOptional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

fitbit_get_activity_day ~86

Get daily activity summary, goals and distances for a date. Requires activity scope.

NameTypeReqDescription
datestringDate as yyyy-MM-dd or today.
privacy_modestringOptional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

fitbit_get_auth_url ~71

Generate a Fitbit OAuth authorization URL. Use this first when no local token exists.

NameTypeReqDescription
response_formatstring
scopesarrayOptional scope override. Defaults to read-only Fitbit scopes used by this server.
statestringOptional OAuth state value generated by the caller.
NameTypeReqDescription
auth_urlstringyes
next_stepstringyes
redirect_uristringyes
scopesarrayyes

No examples provided.

fitbit_get_breathing_rate_day ~92

Get breathing-rate summary for a date when available. Requires heartrate scope. Not medical advice.

NameTypeReqDescription
datestringDate as yyyy-MM-dd or today.
privacy_modestringOptional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

fitbit_get_food_day ~81

Get food logs for a date. Requires nutrition scope.

NameTypeReqDescription
datestringDate as yyyy-MM-dd or today.
privacy_modestringOptional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

fitbit_get_heart_day ~90

Get daily heart-rate zones and resting heart rate. Requires heartrate scope. Not medical advice.

NameTypeReqDescription
datestringDate as yyyy-MM-dd or today.
privacy_modestringOptional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

fitbit_get_heart_intraday ~145

Get heart-rate intraday samples for a date. Personal apps can access their own intraday data; third-party client/server apps may require Fitbit approval. Requires heartrate scope. Not medical advice.

NameTypeReqDescription
datestringDate as yyyy-MM-dd or today.
detail_levelstring
end_timestringOptional HH:mm end time.
privacy_modestringOptional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
response_formatstring
start_timestringOptional HH:mm start time.
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

fitbit_get_hrv_day ~94

Get HRV summary for a date when available. Requires heartrate scope and supported device/data. Not medical advice.

NameTypeReqDescription
datestringDate as yyyy-MM-dd or today.
privacy_modestringOptional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

fitbit_get_profile ~66

Get the authenticated Fitbit user profile. Requires profile scope.

NameTypeReqDescription
privacy_modestringOptional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

fitbit_get_sleep_day ~87

Get sleep logs and stages for a date. Requires sleep scope. Not medical advice.

NameTypeReqDescription
datestringDate as yyyy-MM-dd or today.
privacy_modestringOptional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

fitbit_get_spo2_day ~92

Get SpO2 summary for a date when available. Requires heartrate scope. Not medical advice.

NameTypeReqDescription
datestringDate as yyyy-MM-dd or today.
privacy_modestringOptional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

fitbit_get_water_day ~81

Get water logs for a date. Requires nutrition scope.

NameTypeReqDescription
datestringDate as yyyy-MM-dd or today.
privacy_modestringOptional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

fitbit_get_weight_day ~85

Get weight logs for a date. Requires weight scope. Not medical advice.

NameTypeReqDescription
datestringDate as yyyy-MM-dd or today.
privacy_modestringOptional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

fitbit_list_activities ~174

List Fitbit activity logs. Supports before/after cursor, pagination and privacy modes. Requires activity scope.

NameTypeReqDescription
afterstringOnly return activities after this time. Converted to Fitbit epoch seconds.
all_pagesbooleanFetch multiple pages up to max_pages.
beforestringOnly return activities before this time. Converted to Fitbit epoch seconds.
limitintegerFitbit per_page value. Fitbit allows up to 200.
max_pagesintegerMaximum pages to fetch when all_pages is true.
pageintegerFitbit page number.
privacy_modestringOptional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
response_formatstring
NameTypeReqDescription
countintegeryes
endpointstringyes
has_morebooleanyes
next_pageinteger
pages_fetchedintegeryes
privacy_modestringyes
recordsarrayyes

No examples provided.

fitbit_list_devices ~68

List devices connected to the authenticated Fitbit account. Requires settings scope.

NameTypeReqDescription
privacy_modestringOptional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

fitbit_list_sleep ~177

List Fitbit sleep logs. Supports before/after cursor, pagination and privacy modes. Requires sleep scope. Not medical advice.

NameTypeReqDescription
afterstringOnly return activities after this time. Converted to Fitbit epoch seconds.
all_pagesbooleanFetch multiple pages up to max_pages.
beforestringOnly return activities before this time. Converted to Fitbit epoch seconds.
limitintegerFitbit per_page value. Fitbit allows up to 200.
max_pagesintegerMaximum pages to fetch when all_pages is true.
pageintegerFitbit page number.
privacy_modestringOptional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
response_formatstring
NameTypeReqDescription
countintegeryes
endpointstringyes
has_morebooleanyes
next_pageinteger
pages_fetchedintegeryes
privacy_modestringyes
recordsarrayyes

No examples provided.

fitbit_onboarding ~101

Read-only. Return the 11-question Delx Wellness onboarding flow (en or pt-BR), the current shared profile, missing critical fields, and a cross-connector hint. Use this when the user starts a fresh wellness session and you need to fill out preferred_name, goals, devices, training context, nutrition, preferences, and safety.

NameTypeReqDescription
localestringOnboarding locale. Defaults to en.
response_formatstring

No output schema declared.

No examples provided.

fitbit_privacy_audit ~38

Return local privacy, cache, token-path and env-presence posture without revealing secret values.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
cache_enabledbooleanyes
cache_pathstringyes
config_sourcestringyes
gps_redaction_defaultbooleanyes
local_config_existsbooleanyes
local_config_pathstringyes
local_config_secure_permissionsboolean
notesarrayyes
privacy_mode_defaultstringyes
projectstringyes
raw_payloads_opt_inbooleanyes
redacted_key_patternsarrayyes
required_env_presentobjectyes
secret_env_varsarrayyes
stdout_safebooleanyes
token_pathstringyes
unofficialbooleanyes

No examples provided.

fitbit_profile_get ~68

Read the canonical Delx Wellness profile shared with the other wellness MCP connectors (Nourish, Cycle Coach, CGM, etc.). Read-only. Profile stores only what the user typed during onboarding — never OAuth tokens, API keys, or biomarkers.

NameTypeReqDescription
response_formatstring

No output schema declared.

No examples provided.

fitbit_profile_update ~130

Persist a partial patch to the canonical Delx Wellness profile. Requires explicit_user_intent=true after the user confirms they want to save. Rejects secret-like fields (oauth, token, api_key, password, cookie, refresh, session).

NameTypeReqDescription
explicit_user_intentbooleanSet to true ONLY after the user has explicitly confirmed they want to save this. Otherwise the tool refuses to write.
patchobjectyesPartial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes.
response_formatstring

No output schema declared.

No examples provided.

fitbit_quickstart ~62

Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Fitbit?'

NameTypeReqDescription
response_formatstring

No output schema declared.

No examples provided.

fitbit_revoke_access ~44

Revoke the current Fitbit OAuth grant and delete the local token file. Use only when the user explicitly wants to disconnect Fitbit.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
local_tokens_clearedbooleanyes
notestringyes
okbooleanyes
token_pathstringyes

No examples provided.

fitbit_weekly_summary ~104

Build a weekly Fitbit scorecard with activity, sleep, heart-rate, HRV availability, bottlenecks and actions. Read-only and non-medical.

NameTypeReqDescription
compare_daysintegerPrior comparison window in days. Use 0 to disable comparison.
daysintegerRecent analysis window in days.
response_formatstring
timezonestringIANA timezone used only for display, e.g. America/New_York.
NameTypeReqDescription
generated_atstringyes
kindstringyes

No examples provided.

fitbit_wellness_context ~95

Normalize Fitbit sleep and activity load into the shared wellness_context shape for recommendation engines.

NameTypeReqDescription
daysintegerLookback window for normalized Fitbit wellness context.
injury_flagsarray
notesstring
response_formatstring
sorenessarray
timezonestringIANA timezone used only for display, e.g. America/New_York.
NameTypeReqDescription
generated_atstringyes
injury_flagsarrayyes
notesarrayyes
recent_training_loadstringyes
sorenessarrayyes
sourcestringyes

No examples provided.