io.github.davidmosiah/wellness-cgm-mcp
NPM · WELLNESS-CGM-MCP · SCANNED AUG 3
Local-first CGM MCP for AI agents: Dexcom Developer API + FreeStyle Libre via LibreLink Up.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (94 of 95), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (94 of 95), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 1 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability75
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 1878 tokens (~98/item across 19 items; 19 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage94
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 83% of tool parameters carry a description.Partial
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · wellness-cgm-mcp
claude mcp add davidmosiah-wellness-cgm-mcp -- npx -y wellness-cgm-mcp
codex mcp add davidmosiah-wellness-cgm-mcp -- npx -y wellness-cgm-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"davidmosiah-wellness-cgm-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"wellness-cgm-mcp"
],
"enabled": true
}
}
} openclaw mcp add davidmosiah-wellness-cgm-mcp --command npx --arg -y --arg wellness-cgm-mcp
mcp_servers:
davidmosiah-wellness-cgm-mcp:
command: "npx"
args: ["-y", "wellness-cgm-mcp"] {
"mcpServers": {
"davidmosiah-wellness-cgm-mcp": {
"command": "npx",
"args": [
"-y",
"wellness-cgm-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Aug 26 +63
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Schema quality: unverified → good ▲ functional
- Stability: unverified → 0.23 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Licence: MIT functional
- 1 Aug 26 −23
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 +3
- Malware scan: pass → unverified ▼ security
- Security disclosure: unverified → fail ▼ functional
- Dependency health: partial → unverified ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- 29 Jul 26 −21
- Tool coverage: 100 → unverified ▼ functional
- Security disclosure: fail → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- 28 Jul 26 +22
- Tool coverage: unverified → 100 ▲ functional
- First check of Schema quality: unverified functional
- First check of Schema quality: pass functional
- First check of Tool coverage: 83 functional
- First check of Schema quality: fail functional
- 27 Jul 26 24
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 94 packages
94 packages in the resolved dependency tree · 94 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
cgm_agent_manifest CGM agent manifest ~49
Returns the wellness-cgm-mcp agent manifest: tool list, supported clients, env vars, recommended first calls, capabilities, privacy posture, and community links.
| Name | Type | Req | Description |
|---|---|---|---|
| client | string | — | — |
No output schema declared.
No examples provided.
cgm_authorize_url CGM authorize URL ~67
Builds the Dexcom OAuth authorize URL. The user opens it, grants access, and Dexcom redirects to your registered DEXCOM_REDIRECT_URI with an auth code. If credentials are missing, returns a hint with the exact env vars needed.
| Name | Type | Req | Description |
|---|---|---|---|
| state | string | — | — |
No output schema declared.
No examples provided.
cgm_capabilities CGM capabilities ~28
Lists supported providers, configured providers (via env vars), available metrics, and privacy modes.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_connection_status CGM connection status ~67
Reports the active CGM provider (dexcom | libre), why it was selected, whether credentials are present, and whether the connector will return mock vs live data. For Dexcom it includes the env (sandbox/production); for FreeStyle Libre it includes the LibreLink Up region.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_daily_summary CGM daily summary ~66
Returns daily glucose stats: mean, median, min/max, stdev, GMI (estimated A1C), CV, time-in-range (diabetic 70-180 + metabolic-health 70-140).
| Name | Type | Req | Description |
|---|---|---|---|
| hours | integer | — | Window size; default 24. |
No output schema declared.
No examples provided.
cgm_data_inventory CGM data inventory ~26
Returns the metric catalog plus thresholds (TIR ranges, GMI formula reference).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_demo CGM demo ~49
Returns realistic example payloads of cgm_glucose_now, cgm_daily_summary, and cgm_meal_response. Use this to help users see what the connector will return before configuring Dexcom.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_glucose_now CGM glucose now ~28
Returns the most recent EGV (estimated glucose value) plus trend arrow if available.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_glucose_window CGM glucose window ~33
Returns all EGVs over the last N hours (default 24).
| Name | Type | Req | Description |
|---|---|---|---|
| hours | integer | — | — |
No output schema declared.
No examples provided.
cgm_hypo_events CGM hypo events ~348
v0.3.3 — Detect hypoglycemia events between `from` and `to` ISO dates. Returns an array of contiguous below-threshold runs lasting ≥ `min_duration_minutes`, each with `started_at`, `ended_at`, `duration_minutes`, `min_glucose_mg_dl`, `mean_glucose_mg_dl`, `severity` (level_1 = <70 ADA Level 1, level_2 = <54 ADA Level 2), and `recovery_time_minutes` (time to first reading ≥ threshold+10). Also returns `total_events`, `total_minutes_below`, `mean_min_glucose`, `events_per_day`, a `summary` string, and `recommendations` grounded in what was actually observed. **MEDICAL DISCLAIMER: NOT medical advice. Do not use for treatment decisions. Hypo events should be discussed with your clinician.**
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | yes | ISO-8601 timestamp / date of the analysis window start. |
| min_duration_minutes | integer | — | Minimum contiguous-minutes-below-threshold to count as an event. Default 15. |
| response_format | string | — | Output shape. "structured" (default) returns the full event array. "summary" omits the per-event array, keeping totals + summary + recommendations. |
| severe_threshold_mg_dl | number | — | Severe hypo threshold in mg/dL. Default 54 (ADA Level 2). |
| threshold_mg_dl | number | — | Hypo threshold in mg/dL. Default 70 (ADA Level 1). |
| to | string | yes | ISO-8601 timestamp / date of the analysis window end. |
No output schema declared.
No examples provided.
cgm_libre_login CGM Libre login ~84
Authenticate against LibreLink Up using LIBRELINKUP_EMAIL / LIBRELINKUP_PASSWORD and list the sensors (connections) this account follows. Confirms the FreeStyle Libre path works end-to-end before reading glucose. Never returns the auth token. When credentials are missing it returns mock=true with a synthetic connection so the surface can be demoed without an Abbott account.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_libre_status CGM Libre status ~77
Reports FreeStyle Libre (LibreLink Up) configuration: region, whether LIBRELINKUP_EMAIL/PASSWORD (or a token) are set, whether a patient id is pinned, and whether reads will be live or mock. Use this to confirm the Libre path is wired before calling glucose tools with CGM_PROVIDER=libre.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_meal_response CGM meal response ~110
Compute glucose response to a meal: baseline → peak → return-to-baseline. Returns peak delta, peak time (min after meal), and a band (excellent/good/moderate/poor).
| Name | Type | Req | Description |
|---|---|---|---|
| meal_time | string | yes | ISO-8601 timestamp of when the meal was eaten (e.g. '2026-05-10T13:15:00Z'). |
| window_hours | integer | — | Hours of CGM data to load before+after; default 4. |
No output schema declared.
No examples provided.
cgm_onboarding CGM onboarding ~84
Returns the 11-question onboarding flow for the shared Delx Wellness profile. Read-only. The agent should ask these questions next so wellness-cgm-mcp (and the rest of the wellness stack) can personalize responses — non-secret data only, stored at ~/.delx-wellness/profile.json.
| Name | Type | Req | Description |
|---|---|---|---|
| locale | string | — | Onboarding locale. Defaults to en. |
No output schema declared.
No examples provided.
cgm_privacy_audit CGM privacy audit ~38
Returns what wellness-cgm-mcp stores locally, what is sent to Dexcom, what is never logged, and agent rules.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_profile_get CGM profile get ~66
Returns the shared Delx Wellness profile (~/.delx-wellness/profile.json). Read-only. Surfaces diabetes status / non-DM context so wellness-cgm-mcp can pick the right time-in-range profile (70-180 ADA vs 70-140 metabolic-health).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cgm_profile_update CGM profile update ~116
Persist a partial patch to the shared Delx Wellness profile. Requires explicit_user_intent: true. Rejects any field containing oauth/token/secret/password/cookie/refresh/api_key/session — the profile is for non-secret wellness context only.
| Name | Type | Req | Description |
|---|---|---|---|
| explicit_user_intent | boolean | — | Must be true. Pass only after the user explicitly asked to save/update profile data. |
| patch | object | yes | Partial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes. |
No output schema declared.
No examples provided.
cgm_quickstart CGM quickstart ~59
Returns a personalized 3-step walkthrough for getting wellness-cgm-mcp from mock mode → live mode (Dexcom). Call this first when the user asks 'how do I connect my CGM?'
| Name | Type | Req | Description |
|---|---|---|---|
| client | string | — | — |
No output schema declared.
No examples provided.
cgm_time_in_range CGM time in range (windowed) ~483
Compute Time in Range (TIR), Time Below Range, and Time Above Range over a specific time window with a customizable target range. Use this for mealtime TIR (e.g. 7am-10am breakfast window), overnight TIR (e.g. 23:00-07:00), or specific date-range comparisons. Returns total_readings, readings_in_window, mean_glucose, median_glucose, and GMI (Glucose Management Indicator, estimated A1C per ADA / Bergenstal 2018: GMI% = 3.31 + 0.02392 × mean_mg_dL). Supports a `time_window` preset ("wake" = 06:00-22:00, "sleep" = 22:00-06:00, "all") OR explicit `start_hour` / `end_hour` (0-24, UTC) for recurring hour-of-day filtering. Defaults: 24h load, ADA 70-180 mg/dL, time_window=all. Pulls from cgm_glucose_window data; falls back to mock in unauth mode.
| Name | Type | Req | Description |
|---|---|---|---|
| end_hour | number | — | Explicit recurring hour-of-day end (0-24, UTC). May be < start_hour to wrap midnight (e.g. 22→6). |
| end_time | string | — | ISO-8601 timestamp of window end. Defaults to the latest reading available. |
| hours | integer | — | How many hours of data to load before filtering. Default 24. |
| start_hour | number | — | Explicit recurring hour-of-day start (0-24, UTC). Use with end_hour to override time_window preset. |
| start_time | string | — | ISO-8601 timestamp of window start. Defaults to the earliest reading available. |
| target_high | number | — | High end of target range in mg/dL. Default 180 (ADA). |
| target_low | number | — | Low end of target range in mg/dL. Default 70 (ADA). |
| time_window | string | — | Hour-of-day preset. "wake" = 06:00-22:00, "sleep" = 22:00-06:00 (wraps midnight), "all" = no hour filter. Default "all". Overridden by explicit start_hour/end_hour. |
No output schema declared.
No examples provided.