io.github.davidmosiah/fitbitmcp
NPM · FITBIT-MCP-UNOFFICIAL
Privacy-first, unofficial Fitbit MCP server for AI health, sleep, activity and heart-rate agents.
Available components
Last scanned (6 hours ago)
Scores higher than 90% of npm servers
Category Health and Science
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 51 of 127 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 67 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability86
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 2744 tokens (~70/item across 39 items; 32 tools + 7 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage88
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 58% of tool parameters carry a description.Partial
- Structured output schemas are declared (84% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 33 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
- Stability: 0.97 → pass security
- 3 Nov 26 −1
- Stability: pass → 0.93 functional
- 28 Oct 26 +1
- Stability: 0.97 → pass security
- 27 Oct 26 −1
- Stability: pass → 0.97 functional
- 21 Oct 26 +1
- Stability: 0.97 → pass security
- 20 Oct 26 −1
- Stability: pass → 0.97 functional
- 17 Oct 26 +3
- Stability: 0.83 → pass security
- 15 Oct 26 −3
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/fitbit-mcp-unofficial@0.4.5
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 127 packages
| Packages resolved | 127 |
|---|---|
| Deprecated | 1 |
| Stale | 50 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
fitbit_agent_manifest Fitbit Agent Manifest ~45
Machine-readable install, runtime and client guidance for AI agents. Does not call Fitbit or expose secrets.
| Name | Type | Req | Description |
|---|---|---|---|
| client | string | – | – |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| agent_rules | array | yes | – |
| client | string | yes | – |
| hermes | object | yes | – |
| links | object | yes | – |
| mcp_name | string | yes | – |
| oauth | object | yes | – |
| package | object | yes | – |
| project | string | yes | – |
| recommended_first_calls | array | yes | – |
| resources | array | yes | – |
| standard_tools | array | yes | – |
| troubleshooting | array | yes | – |
| unofficial | boolean | yes | – |
No examples provided.
fitbit_cache_status Fitbit Cache Status ~38
Show optional local SQLite cache status. Enable with FITBIT_CACHE=sqlite or FITBIT_CACHE=true.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| enabled | boolean | yes | – |
| entries | integer | yes | – |
| http_cache | object | – | – |
| newest_cached_at | string | – | – |
| path | string | yes | – |
No examples provided.
fitbit_capabilities Fitbit MCP Capabilities ~33
Explain supported Fitbit data, privacy boundaries, recommended agent workflow and project links.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| api_boundary | object | yes | – |
| auth_model | object | yes | – |
| client_aliases | object | yes | – |
| contribution_paths | array | yes | – |
| creator | object | yes | – |
| links | object | yes | – |
| mcp_name | string | yes | – |
| privacy_modes | array | yes | – |
| project | string | yes | – |
| recommended_agent_flow | array | yes | – |
| supported_data | array | yes | – |
| unofficial | boolean | yes | – |
No examples provided.
fitbit_connection_status Fitbit Connection Status ~53
Check local Fitbit config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Fitbit or exposing secrets.
| Name | Type | Req | Description |
|---|---|---|---|
| client | string | – | – |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| automatic_auth_supported | boolean | yes | – |
| cache | object | yes | – |
| client | string | – | – |
| client_checks | object | – | – |
| config | object | yes | – |
| missing_env | array | yes | – |
| next_steps | array | yes | – |
| node | object | yes | – |
| oauth | object | yes | – |
| ok | boolean | yes | – |
| privacy_mode | string | yes | – |
| ready_for_fitbit_api | boolean | yes | – |
| redirect_uri | string | – | – |
| required_env | object | yes | – |
| token | object | yes | – |
No examples provided.
fitbit_daily_summary Fitbit Daily Health Summary ~83
Build a practical daily summary from Fitbit activity, sleep, heart-rate, HRV and weight data when available. Read-only and non-medical.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Lookback window for recent training context. |
| response_format | string | – | – |
| timezone | string | – | IANA timezone used only for display, e.g. America/New_York. |
| Name | Type | Req | Description |
|---|---|---|---|
| generated_at | string | yes | – |
| kind | string | yes | – |
No examples provided.
fitbit_data_inventory Fitbit Data Inventory ~45
Inventory supported Fitbit data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call Fitbit APIs or expose user data.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| api_boundary | – | – | – |
| auth | – | – | – |
| categories | array | yes | – |
| data_access_model | string | yes | – |
| first_tools | array | yes | – |
| generated_at | string | yes | – |
| kind | string | yes | – |
| links | object | yes | – |
| mcp_name | string | yes | – |
| notes | array | yes | – |
| privacy_modes | array | yes | – |
| recommended_agent_flow | array | yes | – |
| scopes | array | yes | – |
| source | string | yes | – |
| totals | object | yes | – |
| unofficial | boolean | yes | – |
No examples provided.
fitbit_demo Fitbit Demo ~53
Returns realistic example payloads of fitbit_daily_summary, fitbit_wellness_context, and fitbit_get_heart_day so agents see the contract before calling real Fitbit APIs.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
No output schema declared.
No examples provided.
fitbit_exchange_code Exchange Fitbit OAuth Code ~62
Exchange a Fitbit OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | OAuth authorization code, or a full redirect URL containing ?code=... |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| expires_at | number | – | – |
| note | string | yes | – |
| ok | boolean | yes | – |
| scope | string | – | – |
| token_path | string | yes | – |
No examples provided.
fitbit_get_activity Fitbit Activity ~75
Get detailed Fitbit activity log by id. Requires activity scope.
| Name | Type | Req | Description |
|---|---|---|---|
| id | – | yes | Fitbit resource id. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
fitbit_get_activity_day Fitbit Daily Activity ~86
Get daily activity summary, goals and distances for a date. Requires activity scope.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date as yyyy-MM-dd or today. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
fitbit_get_auth_url Get Fitbit OAuth URL ~71
Generate a Fitbit OAuth authorization URL. Use this first when no local token exists.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| scopes | array | – | Optional scope override. Defaults to read-only Fitbit scopes used by this server. |
| state | string | – | Optional OAuth state value generated by the caller. |
| Name | Type | Req | Description |
|---|---|---|---|
| auth_url | string | yes | – |
| next_step | string | yes | – |
| redirect_uri | string | yes | – |
| scopes | array | yes | – |
No examples provided.
fitbit_get_breathing_rate_day Fitbit Daily Breathing Rate ~92
Get breathing-rate summary for a date when available. Requires heartrate scope. Not medical advice.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date as yyyy-MM-dd or today. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
fitbit_get_food_day Fitbit Food Logs ~81
Get food logs for a date. Requires nutrition scope.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date as yyyy-MM-dd or today. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
fitbit_get_heart_day Fitbit Daily Heart Rate ~90
Get daily heart-rate zones and resting heart rate. Requires heartrate scope. Not medical advice.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date as yyyy-MM-dd or today. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
fitbit_get_heart_intraday Fitbit Heart Rate Intraday ~145
Get heart-rate intraday samples for a date. Personal apps can access their own intraday data; third-party client/server apps may require Fitbit approval. Requires heartrate scope. Not medical advice.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date as yyyy-MM-dd or today. |
| detail_level | string | – | – |
| end_time | string | – | Optional HH:mm end time. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| start_time | string | – | Optional HH:mm start time. |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
fitbit_get_hrv_day Fitbit Daily HRV ~94
Get HRV summary for a date when available. Requires heartrate scope and supported device/data. Not medical advice.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date as yyyy-MM-dd or today. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
fitbit_get_profile Get Fitbit Profile ~66
Get the authenticated Fitbit user profile. Requires profile scope.
| Name | Type | Req | Description |
|---|---|---|---|
| privacy_mode | string | – | Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
fitbit_get_sleep_day Fitbit Daily Sleep ~87
Get sleep logs and stages for a date. Requires sleep scope. Not medical advice.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date as yyyy-MM-dd or today. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
fitbit_get_spo2_day Fitbit Daily SpO2 ~92
Get SpO2 summary for a date when available. Requires heartrate scope. Not medical advice.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date as yyyy-MM-dd or today. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
fitbit_get_water_day Fitbit Water Logs ~81
Get water logs for a date. Requires nutrition scope.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date as yyyy-MM-dd or today. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
fitbit_get_weight_day Fitbit Weight Logs ~85
Get weight logs for a date. Requires weight scope. Not medical advice.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date as yyyy-MM-dd or today. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
fitbit_list_activities Fitbit Activity Logs ~174
List Fitbit activity logs. Supports before/after cursor, pagination and privacy modes. Requires activity scope.
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Only return activities after this time. Converted to Fitbit epoch seconds. |
| all_pages | boolean | – | Fetch multiple pages up to max_pages. |
| before | string | – | Only return activities before this time. Converted to Fitbit epoch seconds. |
| limit | integer | – | Fitbit per_page value. Fitbit allows up to 200. |
| max_pages | integer | – | Maximum pages to fetch when all_pages is true. |
| page | integer | – | Fitbit page number. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | yes | – |
| endpoint | string | yes | – |
| has_more | boolean | yes | – |
| next_page | integer | – | – |
| pages_fetched | integer | yes | – |
| privacy_mode | string | yes | – |
| records | array | yes | – |
No examples provided.
fitbit_list_devices List Fitbit Devices ~68
List devices connected to the authenticated Fitbit account. Requires settings scope.
| Name | Type | Req | Description |
|---|---|---|---|
| privacy_mode | string | – | Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| data | – | yes | – |
| endpoint | string | yes | – |
| privacy_mode | string | yes | – |
No examples provided.
fitbit_list_sleep Fitbit Sleep Logs ~177
List Fitbit sleep logs. Supports before/after cursor, pagination and privacy modes. Requires sleep scope. Not medical advice.
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Only return activities after this time. Converted to Fitbit epoch seconds. |
| all_pages | boolean | – | Fetch multiple pages up to max_pages. |
| before | string | – | Only return activities before this time. Converted to Fitbit epoch seconds. |
| limit | integer | – | Fitbit per_page value. Fitbit allows up to 200. |
| max_pages | integer | – | Maximum pages to fetch when all_pages is true. |
| page | integer | – | Fitbit page number. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | yes | – |
| endpoint | string | yes | – |
| has_more | boolean | yes | – |
| next_page | integer | – | – |
| pages_fetched | integer | yes | – |
| privacy_mode | string | yes | – |
| records | array | yes | – |
No examples provided.
fitbit_onboarding Wellness Onboarding Flow ~101
Read-only. Return the 11-question Delx Wellness onboarding flow (en or pt-BR), the current shared profile, missing critical fields, and a cross-connector hint. Use this when the user starts a fresh wellness session and you need to fill out preferred_name, goals, devices, training context, nutrition, preferences, and safety.
| Name | Type | Req | Description |
|---|---|---|---|
| locale | string | – | Onboarding locale. Defaults to en. |
| response_format | string | – | – |
No output schema declared.
No examples provided.
fitbit_privacy_audit Fitbit Privacy Audit ~38
Return local privacy, cache, token-path and env-presence posture without revealing secret values.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| cache_enabled | boolean | yes | – |
| cache_path | string | yes | – |
| config_source | string | yes | – |
| gps_redaction_default | boolean | yes | – |
| local_config_exists | boolean | yes | – |
| local_config_path | string | yes | – |
| local_config_secure_permissions | boolean | – | – |
| notes | array | yes | – |
| privacy_mode_default | string | yes | – |
| project | string | yes | – |
| raw_payloads_opt_in | boolean | yes | – |
| redacted_key_patterns | array | yes | – |
| required_env_present | object | yes | – |
| secret_env_vars | array | yes | – |
| stdout_safe | boolean | yes | – |
| token_path | string | yes | – |
| unofficial | boolean | yes | – |
No examples provided.
fitbit_profile_get Get Shared Wellness Profile ~68
Read the canonical Delx Wellness profile shared with the other wellness MCP connectors (Nourish, Cycle Coach, CGM, etc.). Read-only. Profile stores only what the user typed during onboarding — never OAuth tokens, API keys, or biomarkers.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
No output schema declared.
No examples provided.
fitbit_profile_update Update Shared Wellness Profile ~130
Persist a partial patch to the canonical Delx Wellness profile. Requires explicit_user_intent=true after the user confirms they want to save. Rejects secret-like fields (oauth, token, api_key, password, cookie, refresh, session).
| Name | Type | Req | Description |
|---|---|---|---|
| explicit_user_intent | boolean | – | Set to true ONLY after the user has explicitly confirmed they want to save this. Otherwise the tool refuses to write. |
| patch | object | yes | Partial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes. |
| response_format | string | – | – |
No output schema declared.
No examples provided.
fitbit_quickstart Fitbit Quickstart ~62
Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Fitbit?'
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
No output schema declared.
No examples provided.
fitbit_revoke_access Revoke Fitbit OAuth Access ~44
Revoke the current Fitbit OAuth grant and delete the local token file. Use only when the user explicitly wants to disconnect Fitbit.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| local_tokens_cleared | boolean | yes | – |
| note | string | yes | – |
| ok | boolean | yes | – |
| token_path | string | yes | – |
No examples provided.
fitbit_weekly_summary Fitbit Weekly Health Review ~104
Build a weekly Fitbit scorecard with activity, sleep, heart-rate, HRV availability, bottlenecks and actions. Read-only and non-medical.
| Name | Type | Req | Description |
|---|---|---|---|
| compare_days | integer | – | Prior comparison window in days. Use 0 to disable comparison. |
| days | integer | – | Recent analysis window in days. |
| response_format | string | – | – |
| timezone | string | – | IANA timezone used only for display, e.g. America/New_York. |
| Name | Type | Req | Description |
|---|---|---|---|
| generated_at | string | yes | – |
| kind | string | yes | – |
No examples provided.
fitbit_wellness_context Fitbit Wellness Context ~95
Normalize Fitbit sleep and activity load into the shared wellness_context shape for recommendation engines.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Lookback window for normalized Fitbit wellness context. |
| injury_flags | array | – | – |
| notes | string | – | – |
| response_format | string | – | – |
| soreness | array | – | – |
| timezone | string | – | IANA timezone used only for display, e.g. America/New_York. |
| Name | Type | Req | Description |
|---|---|---|---|
| generated_at | string | yes | – |
| injury_flags | array | yes | – |
| notes | array | yes | – |
| recent_training_load | string | yes | – |
| soreness | array | yes | – |
| source | string | yes | – |
No examples provided.
How do I install the io.github.davidmosiah/fitbitmcp MCP server?
io.github.davidmosiah/fitbitmcp runs locally as an npm package, launched with npx -y fitbit-mcp-unofficial. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · fitbit-mcp-unofficial
claude mcp add davidmosiah-fitbitmcp -- npx -y fitbit-mcp-unofficial
What is the io.github.davidmosiah/fitbitmcp MCP server?
io.github.davidmosiah/fitbitmcp is an MCP server listed in the public MCP registry as io.github.davidmosiah/fitbitmcp. Privacy-first, unofficial Fitbit MCP server for AI health, sleep, activity and heart-rate agents. This page covers its npm package (fitbit-mcp-unofficial).
Is the io.github.davidmosiah/fitbitmcp MCP server safe to use?
io.github.davidmosiah/fitbitmcp scores 86 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.davidmosiah/fitbitmcp MCP server expose?
io.github.davidmosiah/fitbitmcp exposes 32 tools: fitbit_data_inventory, fitbit_agent_manifest, fitbit_capabilities, fitbit_quickstart, fitbit_demo, and 27 more. Their descriptions and schemas cost roughly 2,618 tokens of context every time the server is loaded.
Is the io.github.davidmosiah/fitbitmcp MCP server still maintained?
io.github.davidmosiah/fitbitmcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.davidmosiah/fitbitmcp MCP server under?
io.github.davidmosiah/fitbitmcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.