# io.github.davidmosiah/ouramcp (npm · oura-mcp-unofficial)

Privacy-first, unofficial Oura MCP server for AI health, sleep, activity and heart-rate agents.

- Trust score: 66/100 (medium)
- Change this week: +14
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `oura-mcp-unofficial`: 66/100 (this document), [markdown](https://verifymcp.io/servers/davidmosiah-ouramcp/oura-mcp-unofficial.md), [page](https://verifymcp.io/servers/davidmosiah-ouramcp/oura-mcp-unofficial)

## Channel facts

- Registry: `npm`
- Package: `oura-mcp-unofficial`
- Version: `0.4.6`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 85/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 3132 tokens (~92/item across 34 items; 27 tools + 7 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 92/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 71% of tool parameters carry a description.
  - Structured output schemas are declared (81% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add davidmosiah-ouramcp -- npx -y oura-mcp-unofficial
```

### Codex

```bash
codex mcp add davidmosiah-ouramcp -- npx -y oura-mcp-unofficial
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "davidmosiah-ouramcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "oura-mcp-unofficial"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add davidmosiah-ouramcp --command npx --arg -y --arg oura-mcp-unofficial
```

### Hermes

```yaml
mcp_servers:
  davidmosiah-ouramcp:
    command: "npx"
    args: ["-y", "oura-mcp-unofficial"]
```

### Other

```json
{
  "mcpServers": {
    "davidmosiah-ouramcp": {
      "command": "npx",
      "args": [
        "-y",
        "oura-mcp-unofficial"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 66, +41)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-07-31 (score 25, −27)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 52)

First indexed and scored.

## MCP tools (27)

### `oura_data_inventory` (~47 tokens)

Oura Data Inventory

Inventory supported Oura data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call Oura APIs or expose user data.

Input parameters:

- `response_format` (string)

Output parameters:

- `api_boundary`
- `auth`
- `categories` (array)
- `data_access_model` (string)
- `first_tools` (array)
- `generated_at` (string)
- `kind` (string)
- `links` (object)
- `mcp_name` (string)
- `notes` (array)
- `privacy_modes` (array)
- `recommended_agent_flow` (array)
- `scopes` (array)
- `source` (string)
- `totals` (object)
- `unofficial` (boolean)

### `oura_agent_manifest` (~46 tokens)

Oura Agent Manifest

Machine-readable install, runtime and client guidance for AI agents. Does not call Oura or expose secrets.

Input parameters:

- `client` (string)
- `response_format` (string)

Output parameters:

- `agent_rules` (array)
- `client` (string)
- `hermes` (object)
- `links` (object)
- `mcp_name` (string)
- `oauth` (object)
- `package` (object)
- `project` (string)
- `recommended_first_calls` (array)
- `resources` (array)
- `standard_tools` (array)
- `troubleshooting` (array)
- `unofficial` (boolean)

### `oura_capabilities` (~34 tokens)

Oura MCP Capabilities

Explain supported Oura data, privacy boundaries, recommended agent workflow and project links.

Input parameters:

- `response_format` (string)

Output parameters:

- `api_boundary` (object)
- `auth_model` (object)
- `client_aliases` (object)
- `contribution_paths` (array)
- `creator` (object)
- `links` (object)
- `mcp_name` (string)
- `privacy_modes` (array)
- `project` (string)
- `recommended_agent_flow` (array)
- `supported_data` (array)
- `unofficial` (boolean)

### `oura_quickstart` (~63 tokens)

Oura Quickstart

Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Oura?'

Input parameters:

- `response_format` (string)

### `oura_demo` (~54 tokens)

Oura Demo

Returns realistic example payloads of oura_daily_summary, oura_wellness_context, and oura_list_daily_readiness so agents see the contract before calling real Oura APIs.

Input parameters:

- `response_format` (string)

### `oura_profile_get` (~95 tokens)

Oura Profile Get (shared wellness profile)

Read the shared Delx wellness profile (~/.delx-wellness/profile.json). Returns the user's preferred name, body basics, goals, devices, training context, nutrition context, agent preferences, and missing critical fields. Cross-connector — the same profile is also available from other Delx Wellness MCPs (WHOOP, Garmin, Nourish, Fitbit, etc). Read-only.

Input parameters:

- `response_format` (string)

### `oura_profile_update` (~203 tokens)

Oura Profile Update (shared wellness profile)

Persist a partial patch to the shared Delx wellness profile (~/.delx-wellness/profile.json). REQUIRES explicit_user_intent=true. Top-level fields stored: profile (preferred_name, language, timezone, units, age_or_birth_year, height, weight, sex_or_gender_context), goals, devices, training, nutrition, preferences, safety, notes. NEVER stores OAuth tokens, API keys, refresh tokens, cookies, or any secret-shaped field — writes will be rejected at validation time. Cross-connector — the same profile is read by other Delx Wellness MCPs.

Input parameters:

- `explicit_user_intent` (boolean): Must be true. Set this AFTER the user has explicitly confirmed they want to save these changes to the shared wellness profile.
- `patch` (object, required): Partial WellnessProfileDocument patch. Top-level keys may be: profile, goals, devices, training, nutrition, preferences, safety, notes.
- `response_format` (string)

### `oura_onboarding` (~154 tokens)

Oura Onboarding (shared wellness profile)

Return the 11-question Delx wellness onboarding flow (in English or pt-BR) plus the current shared profile state and missing critical fields. Read-only. The agent should ask these questions one-by-one, then call oura_profile_update with explicit_user_intent=true to save. The same profile is reused by every Delx Wellness connector (WHOOP, Garmin, Nourish, etc.) — agents can call the equivalent {connector}_onboarding tools to cover their respective domains, or rely on this one since all connectors share the same questions.

Input parameters:

- `locale` (string): Onboarding locale. Defaults to 'en'. Use 'pt-BR' for Portuguese (Brazil).
- `response_format` (string)

### `oura_get_auth_url` (~73 tokens)

Get Oura OAuth URL

Generate an Oura OAuth authorization URL. Use this first when no local token exists.

Input parameters:

- `response_format` (string)
- `scopes` (array): Optional scope override. Defaults to read-only Oura scopes used by this server.
- `state` (string): Optional OAuth state value generated by the caller.

Output parameters:

- `auth_url` (string)
- `next_step` (string)
- `redirect_uri` (string)
- `scopes` (array)

### `oura_exchange_code` (~63 tokens)

Exchange Oura OAuth Code

Exchange an Oura OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned.

Input parameters:

- `code` (string, required): OAuth authorization code, or a full redirect URL containing ?code=...
- `response_format` (string)

Output parameters:

- `expires_at` (number)
- `note` (string)
- `ok` (boolean)
- `scope` (string)
- `token_path` (string)

### `oura_get_personal_info` (~75 tokens)

Get Oura Personal Info

Get Oura personal profile fields available to the authorized app. Requires the personal scope.

Input parameters:

- `privacy_mode` (string): Optional per-call privacy override. Defaults to OURA_PRIVACY_MODE or structured. raw returns upstream Oura JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `oura_list_daily_activity` (~183 tokens)

Oura Daily Activity

List daily Oura activity summaries. Supports start/end date filters through after/before and Oura cursor pagination.

Input parameters:

- `after` (string): Only return Oura records after this time. Converted to an Oura start_date.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return Oura records before this time. Converted to an Oura end_date.
- `limit` (integer): Local page-size hint used for pagination safety.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Oura page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to OURA_PRIVACY_MODE or structured. raw returns upstream Oura JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `oura_list_daily_sleep` (~184 tokens)

Oura Daily Sleep

List daily Oura sleep score summaries. Requires daily or sleep data access granted by the user. Not medical advice.

Input parameters:

- `after` (string): Only return Oura records after this time. Converted to an Oura start_date.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return Oura records before this time. Converted to an Oura end_date.
- `limit` (integer): Local page-size hint used for pagination safety.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Oura page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to OURA_PRIVACY_MODE or structured. raw returns upstream Oura JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `oura_list_daily_readiness` (~178 tokens)

Oura Daily Readiness

List Oura readiness summaries and contributors. Requires daily scope. Not medical advice.

Input parameters:

- `after` (string): Only return Oura records after this time. Converted to an Oura start_date.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return Oura records before this time. Converted to an Oura end_date.
- `limit` (integer): Local page-size hint used for pagination safety.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Oura page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to OURA_PRIVACY_MODE or structured. raw returns upstream Oura JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `oura_list_sleep` (~184 tokens)

Oura Sleep Periods

List detailed Oura sleep period records, including sleep stages and timing where available. Requires sleep scope. Not medical advice.

Input parameters:

- `after` (string): Only return Oura records after this time. Converted to an Oura start_date.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return Oura records before this time. Converted to an Oura end_date.
- `limit` (integer): Local page-size hint used for pagination safety.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Oura page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to OURA_PRIVACY_MODE or structured. raw returns upstream Oura JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `oura_list_workouts` (~171 tokens)

Oura Workouts

List Oura workout summaries. Requires workout scope.

Input parameters:

- `after` (string): Only return Oura records after this time. Converted to an Oura start_date.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return Oura records before this time. Converted to an Oura end_date.
- `limit` (integer): Local page-size hint used for pagination safety.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Oura page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to OURA_PRIVACY_MODE or structured. raw returns upstream Oura JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `oura_list_heartrate` (~188 tokens)

Oura Heart Rate

List Oura heart-rate time-series records where the user's ring and membership expose them. Requires heartrate scope. Not medical advice.

Input parameters:

- `after` (string): Only return Oura records after this time. Converted to an Oura start_date.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return Oura records before this time. Converted to an Oura end_date.
- `limit` (integer): Local page-size hint used for pagination safety.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Oura page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to OURA_PRIVACY_MODE or structured. raw returns upstream Oura JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `oura_list_daily_spo2` (~186 tokens)

Oura Daily SpO2

List daily Oura SpO2 averages recorded during sleep when available. Requires spo2 scope. Not medical advice.

Input parameters:

- `after` (string): Only return Oura records after this time. Converted to an Oura start_date.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return Oura records before this time. Converted to an Oura end_date.
- `limit` (integer): Local page-size hint used for pagination safety.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Oura page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to OURA_PRIVACY_MODE or structured. raw returns upstream Oura JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `oura_list_sessions` (~177 tokens)

Oura Sessions

List guided and unguided Oura app sessions when the user granted session scope.

Input parameters:

- `after` (string): Only return Oura records after this time. Converted to an Oura start_date.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return Oura records before this time. Converted to an Oura end_date.
- `limit` (integer): Local page-size hint used for pagination safety.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Oura page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to OURA_PRIVACY_MODE or structured. raw returns upstream Oura JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `oura_list_tags` (~174 tokens)

Oura Tags

List user-entered Oura tags when the user granted tag scope.

Input parameters:

- `after` (string): Only return Oura records after this time. Converted to an Oura start_date.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return Oura records before this time. Converted to an Oura end_date.
- `limit` (integer): Local page-size hint used for pagination safety.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Oura page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to OURA_PRIVACY_MODE or structured. raw returns upstream Oura JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `oura_connection_status` (~55 tokens)

Oura Connection Status

Check local Oura config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Oura or exposing secrets.

Input parameters:

- `client` (string)
- `response_format` (string)

Output parameters:

- `automatic_auth_supported` (boolean)
- `cache` (object)
- `client` (string)
- `client_checks` (object)
- `config` (object)
- `missing_env` (array)
- `next_steps` (array)
- `node` (object)
- `oauth` (object)
- `ok` (boolean)
- `privacy_mode` (string)
- `ready_for_oura_api` (boolean)
- `redirect_uri` (string)
- `required_env` (object)
- `token` (object)

### `oura_cache_status` (~38 tokens)

Oura Cache Status

Show optional local SQLite cache status. Enable with OURA_CACHE=sqlite or OURA_CACHE=true.

Input parameters:

- `response_format` (string)

Output parameters:

- `enabled` (boolean)
- `entries` (integer)
- `http_cache` (object)
- `newest_cached_at` (string)
- `path` (string)

### `oura_privacy_audit` (~38 tokens)

Oura Privacy Audit

Return local privacy, cache, token-path and env-presence posture without revealing secret values.

Input parameters:

- `response_format` (string)

Output parameters:

- `cache_enabled` (boolean)
- `cache_path` (string)
- `config_source` (string)
- `gps_redaction_default` (boolean)
- `local_config_exists` (boolean)
- `local_config_path` (string)
- `local_config_secure_permissions` (boolean)
- `notes` (array)
- `privacy_mode_default` (string)
- `project` (string)
- `raw_payloads_opt_in` (boolean)
- `redacted_key_patterns` (array)
- `required_env_present` (object)
- `secret_env_vars` (array)
- `stdout_safe` (boolean)
- `token_path` (string)
- `unofficial` (boolean)

### `oura_revoke_access` (~46 tokens)

Revoke Oura OAuth Access

Revoke the current Oura OAuth grant and delete the local token file. Use only when the user explicitly wants to disconnect Oura.

Input parameters:

- `response_format` (string)

Output parameters:

- `local_tokens_cleared` (boolean)
- `note` (string)
- `ok` (boolean)
- `token_path` (string)

### `oura_daily_summary` (~85 tokens)

Oura Daily Recovery Summary

Build a practical daily summary from Oura readiness, sleep, activity, heart-rate and SpO2 data when available. Read-only and non-medical.

Input parameters:

- `days` (integer): Lookback window for recent training context.
- `response_format` (string)
- `timezone` (string): IANA timezone used only for display, e.g. America/New_York.

Output parameters:

- `generated_at` (string)
- `kind` (string)

### `oura_weekly_summary` (~104 tokens)

Oura Weekly Recovery Review

Build a weekly Oura scorecard with readiness, sleep, activity, HRV availability, bottlenecks and actions. Read-only and non-medical.

Input parameters:

- `compare_days` (integer): Prior comparison window in days. Use 0 to disable comparison.
- `days` (integer): Recent analysis window in days.
- `response_format` (string)
- `timezone` (string): IANA timezone used only for display, e.g. America/New_York.

Output parameters:

- `generated_at` (string)
- `kind` (string)

### `oura_wellness_context` (~99 tokens)

Oura Wellness Context

Normalize Oura readiness, sleep and activity load into the shared wellness_context shape for recommendation engines.

Input parameters:

- `days` (integer): Lookback window for normalized Oura wellness context.
- `injury_flags` (array)
- `notes` (string)
- `response_format` (string)
- `soreness` (array)
- `timezone` (string): IANA timezone used only for display, e.g. America/New_York.

Output parameters:

- `generated_at` (string)
- `injury_flags` (array)
- `notes` (array)
- `recent_training_load` (string)
- `soreness` (array)
- `source` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/davidmosiah-ouramcp/oura-mcp-unofficial#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 66
- 2026-08-01: 25
- 2026-07-31: 25
- 2026-07-30: 52
- 2026-07-28: 52
- 2026-07-27: 52

## Links

- npm package: https://www.npmjs.com/package/oura-mcp-unofficial
- Socket report: https://socket.dev/npm/package/oura-mcp-unofficial
- Repository: https://github.com/davidmosiah/oura-mcp
- Website: https://wellness.delx.ai/connectors/oura
- Changelog RSS feed: https://verifymcp.io/servers/davidmosiah-ouramcp/oura-mcp-unofficial/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/davidmosiah-ouramcp/oura-mcp-unofficial/changelog.json
- HTML version of this page: https://verifymcp.io/servers/davidmosiah-ouramcp/oura-mcp-unofficial