# io.github.davidmosiah/google-health-mcp (npm · google-health-mcp-unofficial)

Privacy-first unofficial Google Health API v4 MCP server for health, sleep, activity, HR agents

- Trust score: 69/100 (medium)
- Change this week: +45
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `google-health-mcp-unofficial`: 69/100 (this document), [markdown](https://verifymcp.io/servers/davidmosiah-google-health-mcp/google-health-mcp-unofficial.md), [page](https://verifymcp.io/servers/davidmosiah-google-health-mcp/google-health-mcp-unofficial)

## Channel facts

- Registry: `npm`
- Package: `google-health-mcp-unofficial`
- Version: `0.5.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 82/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 3196 tokens (~96/item across 33 items; 26 tools + 7 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 83/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 40% of tool parameters carry a description.
  - Structured output schemas are declared (81% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add davidmosiah-google-health-mcp -- npx -y google-health-mcp-unofficial
```

### Codex

```bash
codex mcp add davidmosiah-google-health-mcp -- npx -y google-health-mcp-unofficial
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "davidmosiah-google-health-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "google-health-mcp-unofficial"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add davidmosiah-google-health-mcp --command npx --arg -y --arg google-health-mcp-unofficial
```

### Hermes

```yaml
mcp_servers:
  davidmosiah-google-health-mcp:
    command: "npx"
    args: ["-y", "google-health-mcp-unofficial"]
```

### Other

```json
{
  "mcpServers": {
    "davidmosiah-google-health-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "google-health-mcp-unofficial"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 68, +33)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-07-31 (score 35, +29)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 6, −73)

- [security regression] Known CVEs: partial → unverified
- [security regression] Malware scan: pass → unverified
- [security regression] Provenance: fail → unverified
- [security regression] Install scripts: pass → unverified
- [functional regression] License: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Dependency health: partial → unverified
- [functional regression] Maintenance: pass → unverified
- [functional] Licence: MIT

### 2026-07-29 (score 79, +54)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] License: unverified → pass
- [functional] First check of Schema quality: pass
- [functional] First check of Tool coverage: 40
- [functional] First check of Tool coverage: 81
- [functional] First check of Schema quality: good
- [functional] First check of Schema quality: fail
- [functional] Licence: MIT

### 2026-07-28 (score 25, +1)

- [functional improvement] Dependency health: unverified → partial

### 2026-07-27 (score 24)

First indexed and scored.

## MCP tools (26)

### `google_health_data_inventory` (~39 tokens)

Google Health Data Inventory

Inventory supported Google Health data types, auth scopes, privacy modes and recommended first calls without calling Google APIs.

Input parameters:

- `response_format` (string)

Output parameters:

- `api_boundary`
- `auth`
- `categories` (array)
- `data_access_model` (string)
- `first_tools` (array)
- `generated_at` (string)
- `kind` (string)
- `links` (object)
- `mcp_name` (string)
- `notes` (array)
- `privacy_modes` (array)
- `recommended_agent_flow` (array)
- `scopes` (array)
- `source` (string)
- `totals` (object)
- `unofficial` (boolean)

### `google_health_list_data_types` (~104 tokens)

List Google Health Data Types

List the canonical kebab-case data_type slugs accepted by the data point, reconcile and rollup tools, with each slug's unit, OAuth scope family, and which endpoint verbs (list/reconcile/rollup) support it. Call this before list_data_points, reconcile_data_points, daily_rollup or rollup to choose a valid data_type instead of guessing a slug. Static metadata; does not call Google APIs.

Input parameters:

- `response_format` (string)

Output parameters:

- `count` (integer)
- `data_types` (array)
- `generated_at` (string)
- `kind` (string)
- `note` (string)
- `official_source` (object)
- `source` (string)

### `google_health_data_type_coverage` (~136 tokens)

Google Health Data Type Coverage

Build a data-type coverage plan from the official Google Health API data-type table, or run explicit live read-only checks against a real OAuth account. Live mode returns only redacted status and point-count buckets, never raw health payloads.

Input parameters:

- `data_source_family` (string)
- `data_types` (array): Optional subset of data_type slugs. Omit to validate the full local catalog.
- `date` (string)
- `live` (boolean): Default false. When true, calls read-only Google Health endpoints after OAuth setup and returns only redacted coverage status.
- `response_format` (string)

Output parameters:

- `kind` (string)
- `mode` (string)

### `google_health_agent_manifest` (~46 tokens)

Google Health Agent Manifest

Machine-readable install, runtime and client guidance for AI agents. Does not call Google Health or expose secrets.

Input parameters:

- `client` (string)
- `response_format` (string)

Output parameters:

- `agent_rules` (array)
- `beta_notice` (string)
- `client` (string)
- `hermes` (object)
- `links` (object)
- `mcp_name` (string)
- `mutating_tools` (object)
- `oauth` (object)
- `package` (object)
- `project` (string)
- `recommended_first_calls` (array)
- `resources` (array)
- `standard_tools` (array)
- `status` (string)
- `troubleshooting` (array)
- `unofficial` (boolean)

### `google_health_capabilities` (~34 tokens)

Google Health MCP Capabilities

Explain supported Google Health data, privacy boundaries, beta status and recommended agent workflow.

Input parameters:

- `response_format` (string)

Output parameters:

- `api_boundary` (object)
- `auth_model` (object)
- `beta_notice` (string)
- `client_aliases` (object)
- `contribution_paths` (array)
- `creator` (object)
- `links` (object)
- `mcp_name` (string)
- `mutating_tools` (object)
- `privacy_modes` (array)
- `project` (string)
- `recommended_agent_flow` (array)
- `status` (string)
- `supported_data` (array)
- `unofficial` (boolean)

### `google_health_quickstart` (~63 tokens)

Google Health Quickstart

Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Google Health?'

Input parameters:

- `response_format` (string)

### `google_health_demo` (~57 tokens)

Google Health Demo

Returns realistic Pixel-Watch-style example payloads of google_health_daily_summary, google_health_wellness_context, and google_health_daily_rollup so agents see the contract before calling real Google Health APIs.

Input parameters:

- `response_format` (string)

### `google_health_get_auth_url` (~76 tokens)

Get Google Health OAuth URL

Generate a Google OAuth authorization URL for Google Health API. Use this first when no local token exists.

Input parameters:

- `response_format` (string)
- `scopes` (array): Optional scope override. Defaults to read-only Google Health scopes used by this server.
- `state` (string): Optional OAuth state value generated by the caller.

Output parameters:

- `auth_url` (string)
- `next_step` (string)
- `redirect_uri` (string)
- `scopes` (array)

### `google_health_exchange_code` (~78 tokens)

Exchange Google Health OAuth Code

Exchange a Google OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned. Gated: requires explicit user intent — agents must not call this autonomously.

Input parameters:

- `code` (string, required): OAuth authorization code, or a full redirect URL containing ?code=...
- `response_format` (string)

Output parameters:

- `expires_at` (number)
- `note` (string)
- `ok` (boolean)
- `scope` (string)
- `token_path` (string)

### `google_health_get_identity` (~68 tokens)

Get Google Health Identity

Get the Google Health identity mapping for the authenticated user. Useful for Fitbit-to-Google migrations.

Input parameters:

- `privacy_mode` (string): Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `google_health_get_profile` (~62 tokens)

Get Google Health Profile

Get authenticated user profile details from Google Health. Requires profile scope.

Input parameters:

- `privacy_mode` (string): Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `google_health_get_settings` (~63 tokens)

Get Google Health Settings

Get authenticated user settings such as units and timezone. Requires settings scope.

Input parameters:

- `privacy_mode` (string): Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `google_health_list_data_points` (~335 tokens)

List Google Health Data Points

Query detailed data points for a Google Health data type. Use kebab-case endpoint data types, e.g. steps, sleep, heart-rate.

Input parameters:

- `data_type` (string): Google Health data type in kebab case. Supported slugs (call google_health_list_data_types for units and which verbs each supports): active-energy-burned, active-minutes, active-zone-minutes, activit…
- `filter` (string): Optional Google AIP-160 filter expression. Use snake_case field names in filters.
- `page_size` (integer)
- `page_token` (string)
- `privacy_mode` (string): Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `google_health_reconcile_data_points` (~345 tokens)

Reconcile Google Health Data Points

Read a reconciled stream for one data type across sources. Supports all-sources, google-wearables and google-sources data source families.

Input parameters:

- `data_source_family` (string)
- `data_type` (string): Google Health data type in kebab case. Supported slugs (call google_health_list_data_types for units and which verbs each supports): active-energy-burned, active-minutes, active-zone-minutes, activit…
- `filter` (string): Optional Google AIP-160 filter expression. Use snake_case field names in filters.
- `page_size` (integer)
- `page_token` (string)
- `privacy_mode` (string): Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `google_health_daily_rollup` (~360 tokens)

Google Health Daily Rollup

Aggregate a data type over civil days using Google Health dailyRollUp. Useful for steps, distance, calories, active minutes, weight and heart summaries.

Input parameters:

- `data_source_family` (string)
- `data_type` (string): Google Health data type in kebab case. Supported slugs (call google_health_list_data_types for units and which verbs each supports): active-energy-burned, active-minutes, active-zone-minutes, activit…
- `end_date` (string): Exclusive end date as YYYY-MM-DD. Defaults to the next day.
- `page_size` (integer)
- `page_token` (string)
- `privacy_mode` (string): Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
- `response_format` (string)
- `start_date` (string)
- `window_size_days` (integer)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `google_health_rollup` (~394 tokens)

Google Health Physical-Time Rollup

Aggregate a data type over physical time intervals using Google Health rollUp.

Input parameters:

- `data_source_family` (string)
- `data_type` (string): Google Health data type in kebab case. Supported slugs (call google_health_list_data_types for units and which verbs each supports): active-energy-burned, active-minutes, active-zone-minutes, activit…
- `end_time` (string, required): ISO 8601 date-time with timezone, e.g. 2026-05-01T00:00:00Z
- `page_size` (integer)
- `page_token` (string)
- `privacy_mode` (string): Optional per-call privacy override. Defaults to GOOGLE_HEALTH_PRIVACY_MODE or structured. raw returns upstream Google Health JSON.
- `response_format` (string)
- `start_time` (string, required): ISO 8601 date-time with timezone, e.g. 2026-05-01T00:00:00Z
- `window_size` (string): Duration in protobuf seconds format, e.g. 3600s.

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `google_health_connection_status` (~55 tokens)

Google Health Connection Status

Check local Google Health config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Google APIs or exposing secrets.

Input parameters:

- `client` (string)
- `response_format` (string)

Output parameters:

- `automatic_auth_supported` (boolean)
- `cache` (object)
- `client` (string)
- `client_checks` (object)
- `config` (object)
- `missing_env` (array)
- `next_steps` (array)
- `node` (object)
- `oauth` (object)
- `ok` (boolean)
- `privacy_mode` (string)
- `ready_for_google_health_api` (boolean)
- `redirect_uri` (string)
- `required_env` (object)
- `token` (object)

### `google_health_cache_status` (~40 tokens)

Google Health Cache Status

Show optional local SQLite cache status. Enable with GOOGLE_HEALTH_CACHE=sqlite or GOOGLE_HEALTH_CACHE=true.

Input parameters:

- `response_format` (string)

Output parameters:

- `enabled` (boolean)
- `entries` (integer)
- `http_cache` (object)
- `newest_cached_at` (string)
- `path` (string)

### `google_health_privacy_audit` (~38 tokens)

Google Health Privacy Audit

Return local privacy, cache, token-path and env-presence posture without revealing secret values.

Input parameters:

- `response_format` (string)

Output parameters:

- `cache_enabled` (boolean)
- `cache_path` (string)
- `config_source` (string)
- `gps_redaction_default` (boolean)
- `local_config_exists` (boolean)
- `local_config_path` (string)
- `local_config_secure_permissions` (boolean)
- `notes` (array)
- `privacy_mode_default` (string)
- `project` (string)
- `raw_payloads_opt_in` (boolean)
- `redacted_key_patterns` (array)
- `required_env_present` (object)
- `secret_env_vars` (array)
- `stdout_safe` (boolean)
- `token_path` (string)
- `unofficial` (boolean)

### `google_health_revoke_access` (~61 tokens)

Revoke Google Health OAuth Access

Revoke the current Google OAuth grant and delete the local token file. Use only when the user explicitly wants to disconnect Google Health. Gated: requires explicit user intent — agents must not call this autonomously.

Input parameters:

- `response_format` (string)

Output parameters:

- `local_tokens_cleared` (boolean)
- `note` (string)
- `ok` (boolean)
- `token_path` (string)

### `google_health_daily_summary` (~73 tokens)

Google Health Daily Summary

Build a practical daily summary from Google Health rollups and reconciled streams when available. Read-only, beta, non-medical.

Input parameters:

- `date` (string)
- `response_format` (string)
- `timezone` (string): IANA timezone used only for display, e.g. America/New_York.

Output parameters:

- `generated_at` (string)
- `kind` (string)

### `google_health_weekly_summary` (~101 tokens)

Google Health Weekly Review

Build a weekly Google Health scorecard with activity, sleep, heart context and missing-data awareness. Read-only, beta, non-medical.

Input parameters:

- `compare_days` (integer): Prior comparison window in days. Use 0 to disable comparison.
- `days` (integer): Recent analysis window in days.
- `response_format` (string)
- `timezone` (string): IANA timezone used only for display, e.g. America/New_York.

Output parameters:

- `generated_at` (string)
- `kind` (string)

### `google_health_wellness_context` (~97 tokens)

Google Health Wellness Context

Normalize Google Health activity/sleep context into the shared wellness_context shape for recommendation engines.

Input parameters:

- `days` (integer): Lookback window for normalized Google Health wellness context.
- `injury_flags` (array)
- `notes` (string)
- `response_format` (string)
- `soreness` (array)
- `timezone` (string): IANA timezone used only for display, e.g. America/New_York.

Output parameters:

- `generated_at` (string)
- `injury_flags` (array)
- `notes` (array)
- `recent_training_load` (string)
- `soreness` (array)
- `source` (string)

### `google_health_profile_get` (~67 tokens)

Get Delx Wellness Profile

Read the shared Delx Wellness profile from ~/.delx-wellness/profile.json. Returns preferred name, goals, devices, training/nutrition/exercise/agent preferences and safety flags. NEVER contains OAuth tokens or API secrets. Read-only.

Input parameters:

- `response_format` (string)

### `google_health_profile_update` (~153 tokens)

Update Delx Wellness Profile

Persist a partial patch to ~/.delx-wellness/profile.json. Requires explicit_user_intent=true (otherwise returns USER_ACTION_REQUIRED). Rejects secret-like fields (oauth, token, secret, password, cookie, refresh, api_key, session) at write time. Use to record preferred name, goals, devices, training context, nutrition context, exercise preferences, agent preferences, and safety flags.

Input parameters:

- `explicit_user_intent` (boolean): Must be true to persist. Prevents accidental writes from agent inference.
- `patch` (object, required): Partial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes.
- `response_format` (string)

### `google_health_onboarding` (~123 tokens)

Delx Wellness Onboarding Flow

Return the 11-question onboarding flow plus the current profile state and missing fields. Read-only — does NOT persist anything. Pair with google_health_profile_update once the user answers. Cross-connector: the same profile is shared by every Delx Wellness MCP (whoop, garmin, oura, fitbit, strava, polar, withings, apple-health, samsung-health, google-health, nourish, cycle-coach, cgm, air).

Input parameters:

- `locale` (string): Onboarding locale. Defaults to en.
- `response_format` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/davidmosiah-google-health-mcp/google-health-mcp-unofficial#diagnostics

## Score history

- 2026-08-03: 69
- 2026-08-02: 68
- 2026-08-01: 35
- 2026-07-31: 35
- 2026-07-30: 6
- 2026-07-29: 79
- 2026-07-28: 25
- 2026-07-27: 24

## Links

- npm package: https://www.npmjs.com/package/google-health-mcp-unofficial
- Socket report: https://socket.dev/npm/package/google-health-mcp-unofficial
- Repository: https://github.com/davidmosiah/google-health-mcp
- Website: https://wellness.delx.ai/connectors/google-health
- Changelog RSS feed: https://verifymcp.io/servers/davidmosiah-google-health-mcp/google-health-mcp-unofficial/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/davidmosiah-google-health-mcp/google-health-mcp-unofficial/changelog.json
- HTML version of this page: https://verifymcp.io/servers/davidmosiah-google-health-mcp/google-health-mcp-unofficial