Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

io.github.davidmosiah/whoop-mcp

NPM · WHOOP-MCP-UNOFFICIAL · SCANNED AUG 3

Privacy-first, unofficial WHOOP MCP server for AI health, sleep, recovery, and performance agents.

+19 this week 70 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability85
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Tool/resource definitions use about 3485 tokens (~91/item across 38 items; 30 tools + 8 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage89
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 62% of tool parameters carry a description.Partial
  • Structured output schemas are declared (83% of tools); any adoption earns full credit.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · whoop-mcp-unofficial

# add to Claude Code
claude mcp add davidmosiah-whoop-mcp -- npx -y whoop-mcp-unofficial
# add to Codex CLI
codex mcp add davidmosiah-whoop-mcp -- npx -y whoop-mcp-unofficial
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "davidmosiah-whoop-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "whoop-mcp-unofficial"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add davidmosiah-whoop-mcp --command npx --arg -y --arg whoop-mcp-unofficial
# ~/.hermes/config.yaml
mcp_servers:
  davidmosiah-whoop-mcp:
    command: "npx"
    args: ["-y", "whoop-mcp-unofficial"]
// mcp.json
{
  "mcpServers": {
    "davidmosiah-whoop-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "whoop-mcp-unofficial"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Aug 26 +4
    • Stability: unverified → 0.27 functional
  • 2 Aug 26 +41
    • Provenance: unverified → fail security
    • Install scripts: unverified → pass security
    • Known CVEs: unverified → partial security
    • Malware scan: unverified → pass security
    • Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
    • License: unverified → pass functional
    • Dependency health: unverified → partial functional
    • Maintenance: unverified → pass functional
    • MCP protocol: unverified → pass functional
    • Schema quality: unverified → excellent functional
    • Licence: MIT functional
  • 31 Jul 26 −8
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 −18
    • Malware scan: pass → unverified security
  • 27 Jul 26 51

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 129 packages

129 packages in the resolved dependency tree · 129 deprecated · 49 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 30 exposed · ~3,333 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
whoop_agent_manifest ~51

Machine-readable install, runtime and client guidance for AI agents operating the WHOOP MCP. Does not read WHOOP or expose secrets.

NameTypeReqDescription
clientstring
response_formatstring
NameTypeReqDescription
agent_rulesarrayyes
clientstringyes
hermesobjectyes
linksobjectyes
mcp_namestringyes
oauthobjectyes
packageobjectyes
projectstringyes
recommended_first_callsarrayyes
resourcesarrayyes
standard_toolsarrayyes
troubleshootingarrayyes
unofficialbooleanyes

No examples provided.

whoop_cache_status ~38

Show optional local SQLite cache status. Enable with WHOOP_CACHE=sqlite or WHOOP_CACHE=true.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
enabledbooleanyes
entriesintegeryes
http_cacheobject
newest_cached_atstring
pathstringyes

No examples provided.

whoop_capabilities ~49

Explain supported WHOOP data, unavailable raw sensor streams, privacy modes, recommended agent workflow, and project links. Does not read WHOOP or expose secrets.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
api_boundaryobjectyes
auth_modelobjectyes
client_aliasesobject
contribution_pathsarrayyes
creatorobjectyes
linksobjectyes
mcp_namestringyes
privacy_modesarrayyes
projectstringyes
recommended_agent_flowarrayyes
supported_dataarrayyes
unofficialbooleanyes

No examples provided.

whoop_connection_status ~55

Check whether local WHOOP env vars, token file, Node version, privacy mode and cache are ready. Does not call WHOOP or expose secrets.

NameTypeReqDescription
clientstring
response_formatstring
NameTypeReqDescription
automatic_auth_supportedbooleanyes
cacheobjectyes
clientstring
client_checksobject
configobjectyes
missing_envarrayyes
next_stepsarrayyes
nodeobjectyes
okbooleanyes
privacy_modestringyes
ready_for_whoop_apibooleanyes
redirect_uristring
required_envobjectyes
tokenobjectyes

No examples provided.

whoop_daily_summary ~128

Build a privacy-conscious daily performance summary from WHOOP recovery, sleep, cycle and workout data. This workflow tool fetches recent WHOOP v2 records, computes a defensive baseline, and returns readiness, sleep, load, diagnostic signals and concrete action candidates. It does not provide medical advice and does not store data locally.

NameTypeReqDescription
daysintegerLookback window used to build the daily baseline. Minimum 7, maximum 30.
response_formatstring
timezonestringIANA timezone used only for display, e.g. America/New_York.
NameTypeReqDescription
generated_atstringyes
kindstringyes

No examples provided.

whoop_data_inventory ~47

Inventory supported WHOOP data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call WHOOP APIs or expose user data.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
api_boundary
auth
categoriesarrayyes
data_access_modelstringyes
first_toolsarrayyes
generated_atstringyes
kindstringyes
linksobjectyes
mcp_namestringyes
notesarrayyes
privacy_modesarrayyes
recommended_agent_flowarrayyes
scopesarrayyes
sourcestringyes
totalsobjectyes
unofficialbooleanyes

No examples provided.

whoop_demo ~54

Returns realistic example payloads of whoop_daily_summary, whoop_wellness_context, and whoop_list_recoveries so agents see the contract before calling real WHOOP APIs.

NameTypeReqDescription
response_formatstring

No output schema declared.

No examples provided.

whoop_exchange_code ~82

Exchange a WHOOP OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned by this tool. Gated: requires explicit user intent — agents must not call this autonomously.

NameTypeReqDescription
codestringyesOAuth authorization code, or a full redirect URL containing ?code=...
response_formatstring
NameTypeReqDescription
expires_atnumber
notestringyes
okbooleanyes
scopestring
token_pathstringyes

No examples provided.

whoop_get_auth_url ~84

Generate a WHOOP OAuth authorization URL. This does not read or modify WHOOP data. Use this first when no local token exists.

NameTypeReqDescription
response_formatstring
scopesarrayOptional scope override. Defaults to all read-only WHOOP scopes used by this server.
statestringOptional OAuth state value generated by the caller.
NameTypeReqDescription
auth_urlstringyes
next_stepstringyes
redirect_uristringyes
scopesarrayyes

No examples provided.

whoop_get_body_measurements ~88

Get the authenticated user's WHOOP body measurements (height, weight, max heart rate). Requires read:body_measurement scope. Not medical advice.

NameTypeReqDescription
privacy_modestringOptional per-call payload privacy override. Defaults to WHOOP_PRIVACY_MODE or structured. raw returns full WHOOP API payloads, not raw device sensor streams.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

whoop_get_cycle ~82

Get one WHOOP cycle by numeric cycle id. Requires read:cycles scope.

NameTypeReqDescription
idyesWHOOP resource id.
privacy_modestringOptional per-call payload privacy override. Defaults to WHOOP_PRIVACY_MODE or structured. raw returns full WHOOP API payloads, not raw device sensor streams.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

whoop_get_cycle_recovery ~89

Get the recovery associated with a WHOOP cycle. Requires read:recovery scope. Not medical advice.

NameTypeReqDescription
idyesWHOOP resource id.
privacy_modestringOptional per-call payload privacy override. Defaults to WHOOP_PRIVACY_MODE or structured. raw returns full WHOOP API payloads, not raw device sensor streams.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

whoop_get_cycle_sleep ~87

Get the sleep associated with a WHOOP cycle. Requires read:sleep scope. Not medical advice.

NameTypeReqDescription
idyesWHOOP resource id.
privacy_modestringOptional per-call payload privacy override. Defaults to WHOOP_PRIVACY_MODE or structured. raw returns full WHOOP API payloads, not raw device sensor streams.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

whoop_get_profile ~72

Get the authenticated user's basic WHOOP profile. Requires read:profile scope.

NameTypeReqDescription
privacy_modestringOptional per-call payload privacy override. Defaults to WHOOP_PRIVACY_MODE or structured. raw returns full WHOOP API payloads, not raw device sensor streams.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

whoop_get_sleep ~85

Get one WHOOP sleep activity by UUID. Requires read:sleep scope. Not medical advice.

NameTypeReqDescription
idyesWHOOP resource id.
privacy_modestringOptional per-call payload privacy override. Defaults to WHOOP_PRIVACY_MODE or structured. raw returns full WHOOP API payloads, not raw device sensor streams.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

whoop_get_workout ~82

Get one WHOOP workout by UUID. Requires read:workout scope.

NameTypeReqDescription
idyesWHOOP resource id.
privacy_modestringOptional per-call payload privacy override. Defaults to WHOOP_PRIVACY_MODE or structured. raw returns full WHOOP API payloads, not raw device sensor streams.
response_formatstring
NameTypeReqDescription
datayes
endpointstringyes
privacy_modestringyes

No examples provided.

whoop_list_cycles ~213

List WHOOP physiological cycles. Supports start/end filters and WHOOP pagination. Requires read:cycles scope.

NameTypeReqDescription
all_pagesbooleanFetch multiple pages up to max_pages.
endstringISO 8601 date-time with timezone, e.g. 2026-04-30T00:00:00Z
limitintegerWHOOP page size. WHOOP allows a maximum of 25.
max_pagesintegerMaximum pages to fetch when all_pages is true.
next_tokenstringWHOOP pagination token returned by a previous call.
privacy_modestringOptional per-call payload privacy override. Defaults to WHOOP_PRIVACY_MODE or structured. raw returns full WHOOP API payloads, not raw device sensor streams.
response_formatstring
startstringISO 8601 date-time with timezone, e.g. 2026-04-30T00:00:00Z
NameTypeReqDescription
countintegeryes
endpointstringyes
has_morebooleanyes
next_tokenstring
pages_fetchedintegeryes
privacy_modestringyes
recordsarrayyes

No examples provided.

whoop_list_recoveries ~237

List WHOOP recoveries sorted by related sleep start time descending. Returns recovery score, HRV, RHR, SpO2 and skin temperature when scored. Requires read:recovery scope. Not medical advice.

NameTypeReqDescription
all_pagesbooleanFetch multiple pages up to max_pages.
endstringISO 8601 date-time with timezone, e.g. 2026-04-30T00:00:00Z
limitintegerWHOOP page size. WHOOP allows a maximum of 25.
max_pagesintegerMaximum pages to fetch when all_pages is true.
next_tokenstringWHOOP pagination token returned by a previous call.
privacy_modestringOptional per-call payload privacy override. Defaults to WHOOP_PRIVACY_MODE or structured. raw returns full WHOOP API payloads, not raw device sensor streams.
response_formatstring
startstringISO 8601 date-time with timezone, e.g. 2026-04-30T00:00:00Z
NameTypeReqDescription
countintegeryes
endpointstringyes
has_morebooleanyes
next_tokenstring
pages_fetchedintegeryes
privacy_modestringyes
recordsarrayyes

No examples provided.

whoop_list_sleeps ~231

List WHOOP sleep activities. Returns sleep stages, performance, consistency and efficiency when scored. Supports start/end filters and WHOOP pagination. Requires read:sleep scope. Not medical advice.

NameTypeReqDescription
all_pagesbooleanFetch multiple pages up to max_pages.
endstringISO 8601 date-time with timezone, e.g. 2026-04-30T00:00:00Z
limitintegerWHOOP page size. WHOOP allows a maximum of 25.
max_pagesintegerMaximum pages to fetch when all_pages is true.
next_tokenstringWHOOP pagination token returned by a previous call.
privacy_modestringOptional per-call payload privacy override. Defaults to WHOOP_PRIVACY_MODE or structured. raw returns full WHOOP API payloads, not raw device sensor streams.
response_formatstring
startstringISO 8601 date-time with timezone, e.g. 2026-04-30T00:00:00Z
NameTypeReqDescription
countintegeryes
endpointstringyes
has_morebooleanyes
next_tokenstring
pages_fetchedintegeryes
privacy_modestringyes
recordsarrayyes

No examples provided.

whoop_list_workouts ~214

List WHOOP workouts. Supports start/end filters and WHOOP pagination. Requires read:workout scope.

NameTypeReqDescription
all_pagesbooleanFetch multiple pages up to max_pages.
endstringISO 8601 date-time with timezone, e.g. 2026-04-30T00:00:00Z
limitintegerWHOOP page size. WHOOP allows a maximum of 25.
max_pagesintegerMaximum pages to fetch when all_pages is true.
next_tokenstringWHOOP pagination token returned by a previous call.
privacy_modestringOptional per-call payload privacy override. Defaults to WHOOP_PRIVACY_MODE or structured. raw returns full WHOOP API payloads, not raw device sensor streams.
response_formatstring
startstringISO 8601 date-time with timezone, e.g. 2026-04-30T00:00:00Z
NameTypeReqDescription
countintegeryes
endpointstringyes
has_morebooleanyes
next_tokenstring
pages_fetchedintegeryes
privacy_modestringyes
recordsarrayyes

No examples provided.

whoop_onboarding ~154

Return the 11-question Delx wellness onboarding flow (in English or pt-BR) plus the current shared profile state and missing critical fields. Read-only. The agent should ask these questions one-by-one, then call whoop_profile_update with explicit_user_intent=true to save. The same profile is reused by every Delx Wellness connector (Oura, Garmin, Nourish, etc.) — agents can call the equivalent {connector}_onboarding tools to cover their respective domains, or rely on this one since all connectors share the same questions.

NameTypeReqDescription
localestringOnboarding locale. Defaults to 'en'. Use 'pt-BR' for Portuguese (Brazil).
response_formatstring

No output schema declared.

No examples provided.

whoop_privacy_audit ~42

Return the local privacy, cache, token-path, env-presence and redaction posture without revealing secret values.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
cache_enabledbooleanyes
cache_pathstringyes
config_sourcestringyes
local_config_existsbooleanyes
local_config_pathstringyes
local_config_secure_permissionsboolean
notesarrayyes
privacy_mode_defaultstringyes
projectstringyes
raw_payloads_opt_inbooleanyes
redacted_key_patternsarrayyes
required_env_presentobjectyes
secret_env_varsarrayyes
stdout_safebooleanyes
token_pathstringyes
unofficialbooleanyes

No examples provided.

whoop_profile_get ~95

Read the shared Delx wellness profile (~/.delx-wellness/profile.json). Returns the user's preferred name, body basics, goals, devices, training context, nutrition context, agent preferences, and missing critical fields. Cross-connector — the same profile is also available from other Delx Wellness MCPs (Oura, Garmin, Nourish, Fitbit, etc). Read-only.

NameTypeReqDescription
response_formatstring

No output schema declared.

No examples provided.

whoop_profile_update ~203

Persist a partial patch to the shared Delx wellness profile (~/.delx-wellness/profile.json). REQUIRES explicit_user_intent=true. Top-level fields stored: profile (preferred_name, language, timezone, units, age_or_birth_year, height, weight, sex_or_gender_context), goals, devices, training, nutrition, preferences, safety, notes. NEVER stores OAuth tokens, API keys, refresh tokens, cookies, or any secret-shaped field — writes will be rejected at validation time. Cross-connector — the same profile is read by other Delx Wellness MCPs.

NameTypeReqDescription
explicit_user_intentbooleanMust be true. Set this AFTER the user has explicitly confirmed they want to save these changes to the shared wellness profile.
patchobjectyesPartial WellnessProfileDocument patch. Top-level keys may be: profile, goals, devices, training, nutrition, preferences, safety, notes.
response_formatstring

No output schema declared.

No examples provided.

whoop_quickstart ~63

Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect WHOOP?'

NameTypeReqDescription
response_formatstring

No output schema declared.

No examples provided.

whoop_recovery_trend ~206

Aggregate WHOOP recovery over the last N days (default 30) into a per-metric trend for recovery score, HRV (hrv_rmssd_milli) and resting heart rate. Each metric returns { avg, min, max, slope, direction, n_valid } where slope is a least-squares fit over the chronologically ordered scored records (oldest to newest) and direction is rising, falling, stable or insufficient_data. Use this to answer "is my recovery trending up or down?" without paging the raw collection yourself. Read-only; fetches recent WHOOP v2 records, computes statistics, stores nothing. Not medical advice.

NameTypeReqDescription
daysintegerNumber of days to aggregate into the trend. Minimum 2 (slope needs two points), maximum 30. Defaults to 30.
response_formatstring
timezonestringIANA timezone reserved for display, e.g. America/New_York.
NameTypeReqDescription
data_qualityyes
diagnosticobjectyes
generated_atstringyes
kindstringyes
lookback_daysintegeryes
metricsobjectyes

No examples provided.

whoop_revoke_access ~63

Revoke the current WHOOP OAuth access grant and delete the local token file. Use only when the user explicitly wants to disconnect WHOOP. Gated: requires explicit user intent — agents must not call this autonomously.

NameTypeReqDescription
response_formatstring
NameTypeReqDescription
local_tokens_clearedbooleanyes
notestringyes
okbooleanyes
token_pathstringyes

No examples provided.

whoop_sleep_trend ~200

Aggregate WHOOP sleep over the last N days (default 30) into a per-metric trend for sleep performance percentage, sleep duration (hours) and sleep efficiency percentage. Each metric returns { avg, min, max, slope, direction, n_valid } where slope is a least-squares fit over the chronologically ordered scored sleeps (oldest to newest) and direction is rising, falling, stable or insufficient_data. Use this to answer "is my sleep improving or degrading?" without paging the raw collection yourself. Read-only; fetches recent WHOOP v2 records, computes statistics, stores nothing. Not medical advice.

NameTypeReqDescription
daysintegerNumber of days to aggregate into the trend. Minimum 2 (slope needs two points), maximum 30. Defaults to 30.
response_formatstring
timezonestringIANA timezone reserved for display, e.g. America/New_York.
NameTypeReqDescription
data_qualityyes
diagnosticobjectyes
generated_atstringyes
kindstringyes
lookback_daysintegeryes
metricsobjectyes

No examples provided.

whoop_weekly_summary ~128

Build a weekly WHOOP operating review with recovery, sleep, strain, workouts, bottlenecks, action candidates and next-week success metrics. This workflow tool compares a recent window against a prior window when available. It is intended for coaching and agent workflows, not medical diagnosis.

NameTypeReqDescription
compare_daysintegerPrior comparison window in days. Use 0 to disable comparison.
daysintegerRecent analysis window in days.
response_formatstring
timezonestringIANA timezone used only for display, e.g. America/New_York.
NameTypeReqDescription
generated_atstringyes
kindstringyes

No examples provided.

whoop_wellness_context ~111

Normalize WHOOP recovery, sleep, strain and recent workout load into the shared wellness_context shape for exercise recommendation engines and Telegram agents.

NameTypeReqDescription
daysintegerLookback window used to normalize WHOOP recovery, sleep and strain context.
injury_flagsarray
notesstring
response_formatstring
sorenessarray
timezonestringIANA timezone used only for display, e.g. America/New_York.
NameTypeReqDescription
context_contract_versionstringyes
context_typestringyes
data_quality
generated_atstringyes
injury_flagsarrayyes
notesarrayyes
recent_training_loadstringyes
recommended_handoffobjectyes
recovery_scorenumber
sleep_scorenumber
sorenessarrayyes
sourcestringyes
strain_scorenumber
telegram_summarystring

No examples provided.