io.github.davidmosiah/wellness-cgm-mcp
NPM · WELLNESS-CGM-MCP · SCANNED SEP 21
Local-first CGM MCP for AI agents: Dexcom Developer API + FreeStyle Libre via LibreLink Up.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 22 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability78
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1878 tokens (~98/item across 19 items; 19 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
- Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage94
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 83% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 19 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.davidmosiah/wellness-cgm-mcp server?
io.github.davidmosiah/wellness-cgm-mcp runs locally as an npm package, launched with npx -y wellness-cgm-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · wellness-cgm-mcp
claude mcp add davidmosiah-wellness-cgm-mcp -- npx -y wellness-cgm-mcp
{
"mcpServers": {
"davidmosiah-wellness-cgm-mcp": {
"command": "npx",
"args": [
"-y",
"wellness-cgm-mcp"
]
}
}
} {
"servers": {
"davidmosiah-wellness-cgm-mcp": {
"command": "npx",
"args": [
"-y",
"wellness-cgm-mcp"
]
}
}
} codex mcp add davidmosiah-wellness-cgm-mcp -- npx -y wellness-cgm-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"davidmosiah-wellness-cgm-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"wellness-cgm-mcp"
],
"enabled": true
}
}
} openclaw mcp add davidmosiah-wellness-cgm-mcp --command npx --arg -y --arg wellness-cgm-mcp
mcp_servers:
davidmosiah-wellness-cgm-mcp:
command: "npx"
args: ["-y", "wellness-cgm-mcp"] {
"McpServers": {
"davidmosiah-wellness-cgm-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"wellness-cgm-mcp"
]
}
}
} assistant mcp add davidmosiah-wellness-cgm-mcp -t stdio -c npx -a -y wellness-cgm-mcp
{
"mcpServers": {
"davidmosiah-wellness-cgm-mcp": {
"command": "npx",
"args": [
"-y",
"wellness-cgm-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −3
- Stability: pass → 0.80 functional
- 15 Sept 26 +1
- Stability: 0.97 → pass security
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Sept 26 −3
- Stability: pass → 0.80 functional
- 8 Sept 26 +1
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed npm/wellness-cgm-mcp@0.4.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 95 packages
| Packages resolved | 95 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cgm_agent_manifest CGM agent manifest ~49
Returns the wellness-cgm-mcp agent manifest: tool list, supported clients, env vars, recommended first calls, capabilities, privacy posture, and community links.
| Name | Type | Req | Description |
|---|---|---|---|
| client | string | – | – |
No output schema declared.
No examples provided.
cgm_authorize_url CGM authorize URL ~67
Builds the Dexcom OAuth authorize URL. The user opens it, grants access, and Dexcom redirects to your registered DEXCOM_REDIRECT_URI with an auth code. If credentials are missing, returns a hint with the exact env vars needed.
| Name | Type | Req | Description |
|---|---|---|---|
| state | string | – | – |
No output schema declared.
No examples provided.
cgm_capabilities CGM capabilities ~28
Lists supported providers, configured providers (via env vars), available metrics, and privacy modes.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_connection_status CGM connection status ~67
Reports the active CGM provider (dexcom | libre), why it was selected, whether credentials are present, and whether the connector will return mock vs live data. For Dexcom it includes the env (sandbox/production); for FreeStyle Libre it includes the LibreLink Up region.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_daily_summary CGM daily summary ~66
Returns daily glucose stats: mean, median, min/max, stdev, GMI (estimated A1C), CV, time-in-range (diabetic 70-180 + metabolic-health 70-140).
| Name | Type | Req | Description |
|---|---|---|---|
| hours | integer | – | Window size; default 24. |
No output schema declared.
No examples provided.
cgm_data_inventory CGM data inventory ~26
Returns the metric catalog plus thresholds (TIR ranges, GMI formula reference).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_demo CGM demo ~49
Returns realistic example payloads of cgm_glucose_now, cgm_daily_summary, and cgm_meal_response. Use this to help users see what the connector will return before configuring Dexcom.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_glucose_now CGM glucose now ~28
Returns the most recent EGV (estimated glucose value) plus trend arrow if available.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_glucose_window CGM glucose window ~33
Returns all EGVs over the last N hours (default 24).
| Name | Type | Req | Description |
|---|---|---|---|
| hours | integer | – | – |
No output schema declared.
No examples provided.
cgm_hypo_events CGM hypo events ~348
v0.3.3 — Detect hypoglycemia events between `from` and `to` ISO dates. Returns an array of contiguous below-threshold runs lasting ≥ `min_duration_minutes`, each with `started_at`, `ended_at`, `duration_minutes`, `min_glucose_mg_dl`, `mean_glucose_mg_dl`, `severity` (level_1 = <70 ADA Level 1, level_2 = <54 ADA Level 2), and `recovery_time_minutes` (time to first reading ≥ threshold+10). Also returns `total_events`, `total_minutes_below`, `mean_min_glucose`, `events_per_day`, a `summary` string, and `recommendations` grounded in what was actually observed. **MEDICAL DISCLAIMER: NOT medical advice. Do not use for treatment decisions. Hypo events should be discussed with your clinician.**
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | yes | ISO-8601 timestamp / date of the analysis window start. |
| min_duration_minutes | integer | – | Minimum contiguous-minutes-below-threshold to count as an event. Default 15. |
| response_format | string | – | Output shape. "structured" (default) returns the full event array. "summary" omits the per-event array, keeping totals + summary + recommendations. |
| severe_threshold_mg_dl | number | – | Severe hypo threshold in mg/dL. Default 54 (ADA Level 2). |
| threshold_mg_dl | number | – | Hypo threshold in mg/dL. Default 70 (ADA Level 1). |
| to | string | yes | ISO-8601 timestamp / date of the analysis window end. |
No output schema declared.
No examples provided.
cgm_libre_login CGM Libre login ~84
Authenticate against LibreLink Up using LIBRELINKUP_EMAIL / LIBRELINKUP_PASSWORD and list the sensors (connections) this account follows. Confirms the FreeStyle Libre path works end-to-end before reading glucose. Never returns the auth token. When credentials are missing it returns mock=true with a synthetic connection so the surface can be demoed without an Abbott account.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_libre_status CGM Libre status ~77
Reports FreeStyle Libre (LibreLink Up) configuration: region, whether LIBRELINKUP_EMAIL/PASSWORD (or a token) are set, whether a patient id is pinned, and whether reads will be live or mock. Use this to confirm the Libre path is wired before calling glucose tools with CGM_PROVIDER=libre.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_meal_response CGM meal response ~110
Compute glucose response to a meal: baseline → peak → return-to-baseline. Returns peak delta, peak time (min after meal), and a band (excellent/good/moderate/poor).
| Name | Type | Req | Description |
|---|---|---|---|
| meal_time | string | yes | ISO-8601 timestamp of when the meal was eaten (e.g. '2026-05-10T13:15:00Z'). |
| window_hours | integer | – | Hours of CGM data to load before+after; default 4. |
No output schema declared.
No examples provided.
cgm_onboarding CGM onboarding ~84
Returns the 11-question onboarding flow for the shared Delx Wellness profile. Read-only. The agent should ask these questions next so wellness-cgm-mcp (and the rest of the wellness stack) can personalize responses — non-secret data only, stored at ~/.delx-wellness/profile.json.
| Name | Type | Req | Description |
|---|---|---|---|
| locale | string | – | Onboarding locale. Defaults to en. |
No output schema declared.
No examples provided.
cgm_privacy_audit CGM privacy audit ~38
Returns what wellness-cgm-mcp stores locally, what is sent to Dexcom, what is never logged, and agent rules.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_profile_get CGM profile get ~66
Returns the shared Delx Wellness profile (~/.delx-wellness/profile.json). Read-only. Surfaces diabetes status / non-DM context so wellness-cgm-mcp can pick the right time-in-range profile (70-180 ADA vs 70-140 metabolic-health).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_profile_update CGM profile update ~116
Persist a partial patch to the shared Delx Wellness profile. Requires explicit_user_intent: true. Rejects any field containing oauth/token/secret/password/cookie/refresh/api_key/session — the profile is for non-secret wellness context only.
| Name | Type | Req | Description |
|---|---|---|---|
| explicit_user_intent | boolean | – | Must be true. Pass only after the user explicitly asked to save/update profile data. |
| patch | object | yes | Partial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes. |
No output schema declared.
No examples provided.
cgm_quickstart CGM quickstart ~59
Returns a personalized 3-step walkthrough for getting wellness-cgm-mcp from mock mode → live mode (Dexcom). Call this first when the user asks 'how do I connect my CGM?'
| Name | Type | Req | Description |
|---|---|---|---|
| client | string | – | – |
No output schema declared.
No examples provided.
cgm_time_in_range CGM time in range (windowed) ~483
Compute Time in Range (TIR), Time Below Range, and Time Above Range over a specific time window with a customizable target range. Use this for mealtime TIR (e.g. 7am-10am breakfast window), overnight TIR (e.g. 23:00-07:00), or specific date-range comparisons. Returns total_readings, readings_in_window, mean_glucose, median_glucose, and GMI (Glucose Management Indicator, estimated A1C per ADA / Bergenstal 2018: GMI% = 3.31 + 0.02392 × mean_mg_dL). Supports a `time_window` preset ("wake" = 06:00-22:00, "sleep" = 22:00-06:00, "all") OR explicit `start_hour` / `end_hour` (0-24, UTC) for recurring hour-of-day filtering. Defaults: 24h load, ADA 70-180 mg/dL, time_window=all. Pulls from cgm_glucose_window data; falls back to mock in unauth mode.
| Name | Type | Req | Description |
|---|---|---|---|
| end_hour | number | – | Explicit recurring hour-of-day end (0-24, UTC). May be < start_hour to wrap midnight (e.g. 22→6). |
| end_time | string | – | ISO-8601 timestamp of window end. Defaults to the latest reading available. |
| hours | integer | – | How many hours of data to load before filtering. Default 24. |
| start_hour | number | – | Explicit recurring hour-of-day start (0-24, UTC). Use with end_hour to override time_window preset. |
| start_time | string | – | ISO-8601 timestamp of window start. Defaults to the earliest reading available. |
| target_high | number | – | High end of target range in mg/dL. Default 180 (ADA). |
| target_low | number | – | Low end of target range in mg/dL. Default 70 (ADA). |
| time_window | string | – | Hour-of-day preset. "wake" = 06:00-22:00, "sleep" = 22:00-06:00 (wraps midnight), "all" = no hour filter. Default "all". Overridden by explicit start_hour/end_hour. |
No output schema declared.
No examples provided.
What is the io.github.davidmosiah/wellness-cgm-mcp server?
io.github.davidmosiah/wellness-cgm-mcp is listed in the public MCP registry as io.github.davidmosiah/wellness-cgm-mcp. Local-first CGM MCP for AI agents: Dexcom Developer API + FreeStyle Libre via LibreLink Up. This page covers its npm package (wellness-cgm-mcp).
Is the io.github.davidmosiah/wellness-cgm-mcp server safe to use?
io.github.davidmosiah/wellness-cgm-mcp scores 84 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.davidmosiah/wellness-cgm-mcp server expose?
io.github.davidmosiah/wellness-cgm-mcp exposes 19 tools: cgm_agent_manifest, cgm_capabilities, cgm_connection_status, cgm_privacy_audit, cgm_data_inventory, and 14 more. Their descriptions and schemas cost roughly 1,878 tokens of context every time the server is loaded.
Is the io.github.davidmosiah/wellness-cgm-mcp server still maintained?
io.github.davidmosiah/wellness-cgm-mcp is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.davidmosiah/wellness-cgm-mcp server under?
io.github.davidmosiah/wellness-cgm-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.