# io.github.davidmosiah/fitbitmcp (npm · fitbit-mcp-unofficial)

Privacy-first, unofficial Fitbit MCP server for AI health, sleep, activity and heart-rate agents.

- Trust score: 69/100 (medium)
- Change this week: +18
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `fitbit-mcp-unofficial`: 69/100 (this document), [markdown](https://verifymcp.io/servers/davidmosiah-fitbitmcp/fitbit-mcp-unofficial.md), [page](https://verifymcp.io/servers/davidmosiah-fitbitmcp/fitbit-mcp-unofficial)

## Channel facts

- Registry: `npm`
- Package: `fitbit-mcp-unofficial`
- Version: `0.4.5`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 82/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2744 tokens (~70/item across 39 items; 32 tools + 7 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 88/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 58% of tool parameters carry a description.
  - Structured output schemas are declared (84% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add davidmosiah-fitbitmcp -- npx -y fitbit-mcp-unofficial
```

### Codex

```bash
codex mcp add davidmosiah-fitbitmcp -- npx -y fitbit-mcp-unofficial
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "davidmosiah-fitbitmcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "fitbit-mcp-unofficial"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add davidmosiah-fitbitmcp --command npx --arg -y --arg fitbit-mcp-unofficial
```

### Hermes

```yaml
mcp_servers:
  davidmosiah-fitbitmcp:
    command: "npx"
    args: ["-y", "fitbit-mcp-unofficial"]
```

### Other

```json
{
  "mcpServers": {
    "davidmosiah-fitbitmcp": {
      "command": "npx",
      "args": [
        "-y",
        "fitbit-mcp-unofficial"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 69, +39)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 30, +5)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass

### 2026-07-31 (score 25, −26)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 51, +27)

- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100

### 2026-07-28 (score 24, −27)

- [functional regression] Schema quality: 100 → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-07-27 (score 51)

First indexed and scored.

## MCP tools (32)

### `fitbit_data_inventory` (~45 tokens)

Fitbit Data Inventory

Inventory supported Fitbit data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call Fitbit APIs or expose user data.

Input parameters:

- `response_format` (string)

Output parameters:

- `api_boundary`
- `auth`
- `categories` (array)
- `data_access_model` (string)
- `first_tools` (array)
- `generated_at` (string)
- `kind` (string)
- `links` (object)
- `mcp_name` (string)
- `notes` (array)
- `privacy_modes` (array)
- `recommended_agent_flow` (array)
- `scopes` (array)
- `source` (string)
- `totals` (object)
- `unofficial` (boolean)

### `fitbit_agent_manifest` (~45 tokens)

Fitbit Agent Manifest

Machine-readable install, runtime and client guidance for AI agents. Does not call Fitbit or expose secrets.

Input parameters:

- `client` (string)
- `response_format` (string)

Output parameters:

- `agent_rules` (array)
- `client` (string)
- `hermes` (object)
- `links` (object)
- `mcp_name` (string)
- `oauth` (object)
- `package` (object)
- `project` (string)
- `recommended_first_calls` (array)
- `resources` (array)
- `standard_tools` (array)
- `troubleshooting` (array)
- `unofficial` (boolean)

### `fitbit_capabilities` (~33 tokens)

Fitbit MCP Capabilities

Explain supported Fitbit data, privacy boundaries, recommended agent workflow and project links.

Input parameters:

- `response_format` (string)

Output parameters:

- `api_boundary` (object)
- `auth_model` (object)
- `client_aliases` (object)
- `contribution_paths` (array)
- `creator` (object)
- `links` (object)
- `mcp_name` (string)
- `privacy_modes` (array)
- `project` (string)
- `recommended_agent_flow` (array)
- `supported_data` (array)
- `unofficial` (boolean)

### `fitbit_quickstart` (~62 tokens)

Fitbit Quickstart

Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Fitbit?'

Input parameters:

- `response_format` (string)

### `fitbit_demo` (~53 tokens)

Fitbit Demo

Returns realistic example payloads of fitbit_daily_summary, fitbit_wellness_context, and fitbit_get_heart_day so agents see the contract before calling real Fitbit APIs.

Input parameters:

- `response_format` (string)

### `fitbit_get_auth_url` (~71 tokens)

Get Fitbit OAuth URL

Generate a Fitbit OAuth authorization URL. Use this first when no local token exists.

Input parameters:

- `response_format` (string)
- `scopes` (array): Optional scope override. Defaults to read-only Fitbit scopes used by this server.
- `state` (string): Optional OAuth state value generated by the caller.

Output parameters:

- `auth_url` (string)
- `next_step` (string)
- `redirect_uri` (string)
- `scopes` (array)

### `fitbit_exchange_code` (~62 tokens)

Exchange Fitbit OAuth Code

Exchange a Fitbit OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned.

Input parameters:

- `code` (string, required): OAuth authorization code, or a full redirect URL containing ?code=...
- `response_format` (string)

Output parameters:

- `expires_at` (number)
- `note` (string)
- `ok` (boolean)
- `scope` (string)
- `token_path` (string)

### `fitbit_get_profile` (~66 tokens)

Get Fitbit Profile

Get the authenticated Fitbit user profile. Requires profile scope.

Input parameters:

- `privacy_mode` (string): Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `fitbit_list_devices` (~68 tokens)

List Fitbit Devices

List devices connected to the authenticated Fitbit account. Requires settings scope.

Input parameters:

- `privacy_mode` (string): Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `fitbit_list_activities` (~174 tokens)

Fitbit Activity Logs

List Fitbit activity logs. Supports before/after cursor, pagination and privacy modes. Requires activity scope.

Input parameters:

- `after` (string): Only return activities after this time. Converted to Fitbit epoch seconds.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return activities before this time. Converted to Fitbit epoch seconds.
- `limit` (integer): Fitbit per_page value. Fitbit allows up to 200.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Fitbit page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `fitbit_list_sleep` (~177 tokens)

Fitbit Sleep Logs

List Fitbit sleep logs. Supports before/after cursor, pagination and privacy modes. Requires sleep scope. Not medical advice.

Input parameters:

- `after` (string): Only return activities after this time. Converted to Fitbit epoch seconds.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return activities before this time. Converted to Fitbit epoch seconds.
- `limit` (integer): Fitbit per_page value. Fitbit allows up to 200.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Fitbit page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `fitbit_get_activity` (~75 tokens)

Fitbit Activity

Get detailed Fitbit activity log by id. Requires activity scope.

Input parameters:

- `id` (required): Fitbit resource id.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `fitbit_get_activity_day` (~86 tokens)

Fitbit Daily Activity

Get daily activity summary, goals and distances for a date. Requires activity scope.

Input parameters:

- `date` (string): Date as yyyy-MM-dd or today.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `fitbit_get_sleep_day` (~87 tokens)

Fitbit Daily Sleep

Get sleep logs and stages for a date. Requires sleep scope. Not medical advice.

Input parameters:

- `date` (string): Date as yyyy-MM-dd or today.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `fitbit_get_heart_day` (~90 tokens)

Fitbit Daily Heart Rate

Get daily heart-rate zones and resting heart rate. Requires heartrate scope. Not medical advice.

Input parameters:

- `date` (string): Date as yyyy-MM-dd or today.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `fitbit_get_hrv_day` (~94 tokens)

Fitbit Daily HRV

Get HRV summary for a date when available. Requires heartrate scope and supported device/data. Not medical advice.

Input parameters:

- `date` (string): Date as yyyy-MM-dd or today.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `fitbit_get_breathing_rate_day` (~92 tokens)

Fitbit Daily Breathing Rate

Get breathing-rate summary for a date when available. Requires heartrate scope. Not medical advice.

Input parameters:

- `date` (string): Date as yyyy-MM-dd or today.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `fitbit_get_spo2_day` (~92 tokens)

Fitbit Daily SpO2

Get SpO2 summary for a date when available. Requires heartrate scope. Not medical advice.

Input parameters:

- `date` (string): Date as yyyy-MM-dd or today.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `fitbit_get_weight_day` (~85 tokens)

Fitbit Weight Logs

Get weight logs for a date. Requires weight scope. Not medical advice.

Input parameters:

- `date` (string): Date as yyyy-MM-dd or today.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `fitbit_get_food_day` (~81 tokens)

Fitbit Food Logs

Get food logs for a date. Requires nutrition scope.

Input parameters:

- `date` (string): Date as yyyy-MM-dd or today.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `fitbit_get_water_day` (~81 tokens)

Fitbit Water Logs

Get water logs for a date. Requires nutrition scope.

Input parameters:

- `date` (string): Date as yyyy-MM-dd or today.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `fitbit_get_heart_intraday` (~145 tokens)

Fitbit Heart Rate Intraday

Get heart-rate intraday samples for a date. Personal apps can access their own intraday data; third-party client/server apps may require Fitbit approval. Requires heartrate scope. Not medical advice.

Input parameters:

- `date` (string): Date as yyyy-MM-dd or today.
- `detail_level` (string)
- `end_time` (string): Optional HH:mm end time.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to FITBIT_PRIVACY_MODE or structured. raw returns upstream Fitbit JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)
- `start_time` (string): Optional HH:mm start time.

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `fitbit_connection_status` (~53 tokens)

Fitbit Connection Status

Check local Fitbit config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Fitbit or exposing secrets.

Input parameters:

- `client` (string)
- `response_format` (string)

Output parameters:

- `automatic_auth_supported` (boolean)
- `cache` (object)
- `client` (string)
- `client_checks` (object)
- `config` (object)
- `missing_env` (array)
- `next_steps` (array)
- `node` (object)
- `oauth` (object)
- `ok` (boolean)
- `privacy_mode` (string)
- `ready_for_fitbit_api` (boolean)
- `redirect_uri` (string)
- `required_env` (object)
- `token` (object)

### `fitbit_cache_status` (~38 tokens)

Fitbit Cache Status

Show optional local SQLite cache status. Enable with FITBIT_CACHE=sqlite or FITBIT_CACHE=true.

Input parameters:

- `response_format` (string)

Output parameters:

- `enabled` (boolean)
- `entries` (integer)
- `http_cache` (object)
- `newest_cached_at` (string)
- `path` (string)

### `fitbit_privacy_audit` (~38 tokens)

Fitbit Privacy Audit

Return local privacy, cache, token-path and env-presence posture without revealing secret values.

Input parameters:

- `response_format` (string)

Output parameters:

- `cache_enabled` (boolean)
- `cache_path` (string)
- `config_source` (string)
- `gps_redaction_default` (boolean)
- `local_config_exists` (boolean)
- `local_config_path` (string)
- `local_config_secure_permissions` (boolean)
- `notes` (array)
- `privacy_mode_default` (string)
- `project` (string)
- `raw_payloads_opt_in` (boolean)
- `redacted_key_patterns` (array)
- `required_env_present` (object)
- `secret_env_vars` (array)
- `stdout_safe` (boolean)
- `token_path` (string)
- `unofficial` (boolean)

### `fitbit_revoke_access` (~44 tokens)

Revoke Fitbit OAuth Access

Revoke the current Fitbit OAuth grant and delete the local token file. Use only when the user explicitly wants to disconnect Fitbit.

Input parameters:

- `response_format` (string)

Output parameters:

- `local_tokens_cleared` (boolean)
- `note` (string)
- `ok` (boolean)
- `token_path` (string)

### `fitbit_daily_summary` (~83 tokens)

Fitbit Daily Health Summary

Build a practical daily summary from Fitbit activity, sleep, heart-rate, HRV and weight data when available. Read-only and non-medical.

Input parameters:

- `days` (integer): Lookback window for recent training context.
- `response_format` (string)
- `timezone` (string): IANA timezone used only for display, e.g. America/New_York.

Output parameters:

- `generated_at` (string)
- `kind` (string)

### `fitbit_weekly_summary` (~104 tokens)

Fitbit Weekly Health Review

Build a weekly Fitbit scorecard with activity, sleep, heart-rate, HRV availability, bottlenecks and actions. Read-only and non-medical.

Input parameters:

- `compare_days` (integer): Prior comparison window in days. Use 0 to disable comparison.
- `days` (integer): Recent analysis window in days.
- `response_format` (string)
- `timezone` (string): IANA timezone used only for display, e.g. America/New_York.

Output parameters:

- `generated_at` (string)
- `kind` (string)

### `fitbit_wellness_context` (~95 tokens)

Fitbit Wellness Context

Normalize Fitbit sleep and activity load into the shared wellness_context shape for recommendation engines.

Input parameters:

- `days` (integer): Lookback window for normalized Fitbit wellness context.
- `injury_flags` (array)
- `notes` (string)
- `response_format` (string)
- `soreness` (array)
- `timezone` (string): IANA timezone used only for display, e.g. America/New_York.

Output parameters:

- `generated_at` (string)
- `injury_flags` (array)
- `notes` (array)
- `recent_training_load` (string)
- `soreness` (array)
- `source` (string)

### `fitbit_profile_get` (~68 tokens)

Get Shared Wellness Profile

Read the canonical Delx Wellness profile shared with the other wellness MCP connectors (Nourish, Cycle Coach, CGM, etc.). Read-only. Profile stores only what the user typed during onboarding — never OAuth tokens, API keys, or biomarkers.

Input parameters:

- `response_format` (string)

### `fitbit_profile_update` (~130 tokens)

Update Shared Wellness Profile

Persist a partial patch to the canonical Delx Wellness profile. Requires explicit_user_intent=true after the user confirms they want to save. Rejects secret-like fields (oauth, token, api_key, password, cookie, refresh, session).

Input parameters:

- `explicit_user_intent` (boolean): Set to true ONLY after the user has explicitly confirmed they want to save this. Otherwise the tool refuses to write.
- `patch` (object, required): Partial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes.
- `response_format` (string)

### `fitbit_onboarding` (~101 tokens)

Wellness Onboarding Flow

Read-only. Return the 11-question Delx Wellness onboarding flow (en or pt-BR), the current shared profile, missing critical fields, and a cross-connector hint. Use this when the user starts a fresh wellness session and you need to fill out preferred_name, goals, devices, training context, nutrition, preferences, and safety.

Input parameters:

- `locale` (string): Onboarding locale. Defaults to en.
- `response_format` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/davidmosiah-fitbitmcp/fitbit-mcp-unofficial#diagnostics

## Score history

- 2026-08-03: 69
- 2026-08-02: 69
- 2026-08-01: 30
- 2026-07-31: 25
- 2026-07-30: 51
- 2026-07-28: 24
- 2026-07-27: 51

## Links

- npm package: https://www.npmjs.com/package/fitbit-mcp-unofficial
- Socket report: https://socket.dev/npm/package/fitbit-mcp-unofficial
- Repository: https://github.com/davidmosiah/fitbit-mcp
- Website: https://wellness.delx.ai/connectors/fitbit
- Changelog RSS feed: https://verifymcp.io/servers/davidmosiah-fitbitmcp/fitbit-mcp-unofficial/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/davidmosiah-fitbitmcp/fitbit-mcp-unofficial/changelog.json
- HTML version of this page: https://verifymcp.io/servers/davidmosiah-fitbitmcp/fitbit-mcp-unofficial