# io.github.davidmosiah/wellness-cgm-mcp (npm · wellness-cgm-mcp)

Local-first CGM MCP for AI agents: Dexcom Developer API + FreeStyle Libre via LibreLink Up.

- Trust score: 69/100 (medium)
- Change this week: +45
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `wellness-cgm-mcp`: 69/100 (this document), [markdown](https://verifymcp.io/servers/davidmosiah-wellness-cgm-mcp/wellness-cgm-mcp.md), [page](https://verifymcp.io/servers/davidmosiah-wellness-cgm-mcp/wellness-cgm-mcp)

## Channel facts

- Registry: `npm`
- Package: `wellness-cgm-mcp`
- Version: `0.4.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 95), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 95), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 75/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1878 tokens (~98/item across 19 items; 19 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 94/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 83% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add davidmosiah-wellness-cgm-mcp -- npx -y wellness-cgm-mcp
```

### Codex

```bash
codex mcp add davidmosiah-wellness-cgm-mcp -- npx -y wellness-cgm-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "davidmosiah-wellness-cgm-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "wellness-cgm-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add davidmosiah-wellness-cgm-mcp --command npx --arg -y --arg wellness-cgm-mcp
```

### Hermes

```yaml
mcp_servers:
  davidmosiah-wellness-cgm-mcp:
    command: "npx"
    args: ["-y", "wellness-cgm-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "davidmosiah-wellness-cgm-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "wellness-cgm-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 68, +63)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-08-01 (score 5, −23)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 28, +3)

- [security regression] Malware scan: pass → unverified
- [functional regression] Security disclosure: unverified → fail
- [functional regression] Dependency health: partial → unverified
- [functional improvement] Tool coverage: unverified → 100

### 2026-07-29 (score 25, −21)

- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional improvement] Dependency health: unverified → partial

### 2026-07-28 (score 46, +22)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: unverified
- [functional] First check of Schema quality: pass
- [functional] First check of Tool coverage: 83
- [functional] First check of Schema quality: fail

### 2026-07-27 (score 24)

First indexed and scored.

## MCP tools (19)

### `cgm_agent_manifest` (~49 tokens)

CGM agent manifest

Returns the wellness-cgm-mcp agent manifest: tool list, supported clients, env vars, recommended first calls, capabilities, privacy posture, and community links.

Input parameters:

- `client` (string)

### `cgm_capabilities` (~28 tokens)

CGM capabilities

Lists supported providers, configured providers (via env vars), available metrics, and privacy modes.

### `cgm_connection_status` (~67 tokens)

CGM connection status

Reports the active CGM provider (dexcom | libre), why it was selected, whether credentials are present, and whether the connector will return mock vs live data. For Dexcom it includes the env (sandbox/production); for FreeStyle Libre it includes the LibreLink Up region.

### `cgm_privacy_audit` (~38 tokens)

CGM privacy audit

Returns what wellness-cgm-mcp stores locally, what is sent to Dexcom, what is never logged, and agent rules.

### `cgm_data_inventory` (~26 tokens)

CGM data inventory

Returns the metric catalog plus thresholds (TIR ranges, GMI formula reference).

### `cgm_glucose_now` (~28 tokens)

CGM glucose now

Returns the most recent EGV (estimated glucose value) plus trend arrow if available.

### `cgm_glucose_window` (~33 tokens)

CGM glucose window

Returns all EGVs over the last N hours (default 24).

Input parameters:

- `hours` (integer)

### `cgm_hypo_events` (~348 tokens)

CGM hypo events

v0.3.3 — Detect hypoglycemia events between `from` and `to` ISO dates. Returns an array of contiguous below-threshold runs lasting ≥ `min_duration_minutes`, each with `started_at`, `ended_at`, `duration_minutes`, `min_glucose_mg_dl`, `mean_glucose_mg_dl`, `severity` (level_1 = <70 ADA Level 1, level_2 = <54 ADA Level 2), and `recovery_time_minutes` (time to first reading ≥ threshold+10). Also returns `total_events`, `total_minutes_below`, `mean_min_glucose`, `events_per_day`, a `summary` string, and `recommendations` grounded in what was actually observed. **MEDICAL DISCLAIMER: NOT medical advice. Do not use for treatment decisions. Hypo events should be discussed with your clinician.**

Input parameters:

- `from` (string, required): ISO-8601 timestamp / date of the analysis window start.
- `min_duration_minutes` (integer): Minimum contiguous-minutes-below-threshold to count as an event. Default 15.
- `response_format` (string): Output shape. "structured" (default) returns the full event array. "summary" omits the per-event array, keeping totals + summary + recommendations.
- `severe_threshold_mg_dl` (number): Severe hypo threshold in mg/dL. Default 54 (ADA Level 2).
- `threshold_mg_dl` (number): Hypo threshold in mg/dL. Default 70 (ADA Level 1).
- `to` (string, required): ISO-8601 timestamp / date of the analysis window end.

### `cgm_daily_summary` (~66 tokens)

CGM daily summary

Returns daily glucose stats: mean, median, min/max, stdev, GMI (estimated A1C), CV, time-in-range (diabetic 70-180 + metabolic-health 70-140).

Input parameters:

- `hours` (integer): Window size; default 24.

### `cgm_time_in_range` (~483 tokens)

CGM time in range (windowed)

Compute Time in Range (TIR), Time Below Range, and Time Above Range over a specific time window with a customizable target range. Use this for mealtime TIR (e.g. 7am-10am breakfast window), overnight TIR (e.g. 23:00-07:00), or specific date-range comparisons. Returns total_readings, readings_in_window, mean_glucose, median_glucose, and GMI (Glucose Management Indicator, estimated A1C per ADA / Bergenstal 2018: GMI% = 3.31 + 0.02392 × mean_mg_dL). Supports a `time_window` preset ("wake" = 06:00-22:00, "sleep" = 22:00-06:00, "all") OR explicit `start_hour` / `end_hour` (0-24, UTC) for recurring hour-of-day filtering. Defaults: 24h load, ADA 70-180 mg/dL, time_window=all. Pulls from cgm_glucose_window data; falls back to mock in unauth mode.

Input parameters:

- `end_hour` (number): Explicit recurring hour-of-day end (0-24, UTC). May be < start_hour to wrap midnight (e.g. 22→6).
- `end_time` (string): ISO-8601 timestamp of window end. Defaults to the latest reading available.
- `hours` (integer): How many hours of data to load before filtering. Default 24.
- `start_hour` (number): Explicit recurring hour-of-day start (0-24, UTC). Use with end_hour to override time_window preset.
- `start_time` (string): ISO-8601 timestamp of window start. Defaults to the earliest reading available.
- `target_high` (number): High end of target range in mg/dL. Default 180 (ADA).
- `target_low` (number): Low end of target range in mg/dL. Default 70 (ADA).
- `time_window` (string): Hour-of-day preset. "wake" = 06:00-22:00, "sleep" = 22:00-06:00 (wraps midnight), "all" = no hour filter. Default "all". Overridden by explicit start_hour/end_hour.

### `cgm_meal_response` (~110 tokens)

CGM meal response

Compute glucose response to a meal: baseline → peak → return-to-baseline. Returns peak delta, peak time (min after meal), and a band (excellent/good/moderate/poor).

Input parameters:

- `meal_time` (string, required): ISO-8601 timestamp of when the meal was eaten (e.g. '2026-05-10T13:15:00Z').
- `window_hours` (integer): Hours of CGM data to load before+after; default 4.

### `cgm_authorize_url` (~67 tokens)

CGM authorize URL

Builds the Dexcom OAuth authorize URL. The user opens it, grants access, and Dexcom redirects to your registered DEXCOM_REDIRECT_URI with an auth code. If credentials are missing, returns a hint with the exact env vars needed.

Input parameters:

- `state` (string)

### `cgm_quickstart` (~59 tokens)

CGM quickstart

Returns a personalized 3-step walkthrough for getting wellness-cgm-mcp from mock mode → live mode (Dexcom). Call this first when the user asks 'how do I connect my CGM?'

Input parameters:

- `client` (string)

### `cgm_profile_get` (~66 tokens)

CGM profile get

Returns the shared Delx Wellness profile (~/.delx-wellness/profile.json). Read-only. Surfaces diabetes status / non-DM context so wellness-cgm-mcp can pick the right time-in-range profile (70-180 ADA vs 70-140 metabolic-health).

### `cgm_profile_update` (~116 tokens)

CGM profile update

Persist a partial patch to the shared Delx Wellness profile. Requires explicit_user_intent: true. Rejects any field containing oauth/token/secret/password/cookie/refresh/api_key/session — the profile is for non-secret wellness context only.

Input parameters:

- `explicit_user_intent` (boolean): Must be true. Pass only after the user explicitly asked to save/update profile data.
- `patch` (object, required): Partial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes.

### `cgm_onboarding` (~84 tokens)

CGM onboarding

Returns the 11-question onboarding flow for the shared Delx Wellness profile. Read-only. The agent should ask these questions next so wellness-cgm-mcp (and the rest of the wellness stack) can personalize responses — non-secret data only, stored at ~/.delx-wellness/profile.json.

Input parameters:

- `locale` (string): Onboarding locale. Defaults to en.

### `cgm_demo` (~49 tokens)

CGM demo

Returns realistic example payloads of cgm_glucose_now, cgm_daily_summary, and cgm_meal_response. Use this to help users see what the connector will return before configuring Dexcom.

### `cgm_libre_status` (~77 tokens)

CGM Libre status

Reports FreeStyle Libre (LibreLink Up) configuration: region, whether LIBRELINKUP_EMAIL/PASSWORD (or a token) are set, whether a patient id is pinned, and whether reads will be live or mock. Use this to confirm the Libre path is wired before calling glucose tools with CGM_PROVIDER=libre.

### `cgm_libre_login` (~84 tokens)

CGM Libre login

Authenticate against LibreLink Up using LIBRELINKUP_EMAIL / LIBRELINKUP_PASSWORD and list the sensors (connections) this account follows. Confirms the FreeStyle Libre path works end-to-end before reading glucose. Never returns the auth token. When credentials are missing it returns mock=true with a synthetic connection so the surface can be demoed without an Abbott account.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/davidmosiah-wellness-cgm-mcp/wellness-cgm-mcp#diagnostics

## Score history

- 2026-08-03: 69
- 2026-08-02: 68
- 2026-08-01: 5
- 2026-07-31: 28
- 2026-07-29: 25
- 2026-07-28: 46
- 2026-07-27: 24

## Links

- npm package: https://www.npmjs.com/package/wellness-cgm-mcp
- Socket report: https://socket.dev/npm/package/wellness-cgm-mcp
- Repository: https://github.com/davidmosiah/wellness-cgm-mcp
- Website: https://wellness.delx.ai/connectors/cgm
- Changelog RSS feed: https://verifymcp.io/servers/davidmosiah-wellness-cgm-mcp/wellness-cgm-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/davidmosiah-wellness-cgm-mcp/wellness-cgm-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/davidmosiah-wellness-cgm-mcp/wellness-cgm-mcp