io.github.davidmosiah/withingsmcp
NPM · WITHINGS-MCP-UNOFFICIAL
Privacy-first, unofficial Withings MCP server for AI health, sleep, activity and heart-rate agents.
Available components
Last scanned (16 hours ago)
Scores higher than 87% of npm servers
Category Health and Science
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 51 of 127 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 32 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability84
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2392 tokens (~79/item across 30 items; 23 tools + 7 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage90
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 66% of tool parameters carry a description.Partial
- Structured output schemas are declared (78% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 24 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (16)
- Malware scan
- Known CVEs
- Install scripts
- Dependency health
- Source repository
- Provenance
- License
- Maintenance
- Security disclosure
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this package (2)
- Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
- Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Nov 26 0
- Stability: 0.97 → pass security
- 2 Nov 26 0
- Stability: pass → 0.97 functional
- 27 Oct 26 0
- Stability: 0.97 → pass security
- 26 Oct 26 0
- Stability: pass → 0.97 functional
- 20 Oct 26 0
- Stability: 0.97 → pass security
- 19 Oct 26 0
- Stability: pass → 0.97 functional
- 17 Oct 26 +1
- Stability: 0.87 → pass security
- 16 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/withings-mcp-unofficial@0.4.7
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 127 packages
| Packages resolved | 127 |
|---|---|
| Deprecated | 1 |
| Stale | 50 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
withings_agent_manifest Withings Agent Manifest ~46
Machine-readable install, runtime and client guidance for AI agents. Does not call Withings or expose secrets.
| Name | Type | Req | Description |
|---|---|---|---|
| client | string | – | – |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| agent_rules | array | yes | – |
| client | string | yes | – |
| hermes | object | yes | – |
| links | object | yes | – |
| mcp_name | string | yes | – |
| oauth | object | yes | – |
| package | object | yes | – |
| project | string | yes | – |
| recommended_first_calls | array | yes | – |
| resources | array | yes | – |
| standard_tools | array | yes | – |
| troubleshooting | array | yes | – |
| unofficial | boolean | yes | – |
No examples provided.
withings_cache_status Withings Cache Status ~38
Show optional local SQLite cache status. Enable with WITHINGS_CACHE=sqlite or WITHINGS_CACHE=true.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| enabled | boolean | yes | – |
| entries | integer | yes | – |
| http_cache | object | – | – |
| newest_cached_at | string | – | – |
| path | string | yes | – |
No examples provided.
withings_capabilities Withings MCP Capabilities ~34
Explain supported Withings data, privacy boundaries, recommended agent workflow and project links.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| api_boundary | object | yes | – |
| auth_model | object | yes | – |
| client_aliases | object | yes | – |
| contribution_paths | array | yes | – |
| creator | object | yes | – |
| links | object | yes | – |
| mcp_name | string | yes | – |
| privacy_modes | array | yes | – |
| project | string | yes | – |
| recommended_agent_flow | array | yes | – |
| supported_data | array | yes | – |
| unofficial | boolean | yes | – |
No examples provided.
withings_connection_status Withings Connection Status ~55
Check local Withings config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Withings or exposing secrets.
| Name | Type | Req | Description |
|---|---|---|---|
| client | string | – | – |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| automatic_auth_supported | boolean | yes | – |
| cache | object | yes | – |
| client | string | – | – |
| client_checks | object | – | – |
| config | object | yes | – |
| missing_env | array | yes | – |
| next_steps | array | yes | – |
| node | object | yes | – |
| oauth | object | yes | – |
| ok | boolean | yes | – |
| privacy_mode | string | yes | – |
| ready_for_withings_api | boolean | yes | – |
| redirect_uri | string | – | – |
| required_env | object | yes | – |
| token | object | yes | – |
No examples provided.
withings_daily_summary Withings Daily Wellness Summary ~80
Build a practical daily summary from Withings activity, sleep and body/heart data when available. Read-only and non-medical.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Lookback window for recent training context. |
| response_format | string | – | – |
| timezone | string | – | IANA timezone used only for display, e.g. America/New_York. |
| Name | Type | Req | Description |
|---|---|---|---|
| generated_at | string | yes | – |
| kind | string | yes | – |
No examples provided.
withings_data_inventory Withings Data Inventory ~47
Inventory supported Withings data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call Withings APIs or expose user data.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| api_boundary | – | – | – |
| auth | – | – | – |
| categories | array | yes | – |
| data_access_model | string | yes | – |
| first_tools | array | yes | – |
| generated_at | string | yes | – |
| kind | string | yes | – |
| links | object | yes | – |
| mcp_name | string | yes | – |
| notes | array | yes | – |
| privacy_modes | array | yes | – |
| recommended_agent_flow | array | yes | – |
| scopes | array | yes | – |
| source | string | yes | – |
| totals | object | yes | – |
| unofficial | boolean | yes | – |
No examples provided.
withings_demo Withings Demo ~54
Returns realistic example payloads of withings_daily_summary, withings_wellness_context, and withings_list_body_measures so agents see the contract before calling real Withings APIs.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
No output schema declared.
No examples provided.
withings_exchange_code Exchange Withings OAuth Code ~63
Exchange a Withings OAuth authorization code for local tokens using Withings signed request flow. Tokens are stored locally and never returned.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | OAuth authorization code, or a full redirect URL containing ?code=... |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| expires_at | number | – | – |
| note | string | yes | – |
| ok | boolean | yes | – |
| scope | string | – | – |
| token_path | string | yes | – |
No examples provided.
withings_get_auth_url Get Withings OAuth URL ~73
Generate a Withings OAuth authorization URL. Use this first when no local token exists.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| scopes | array | – | Optional scope override. Defaults to read-only Withings scopes used by this server. |
| state | string | – | Optional OAuth state value generated by the caller. |
| Name | Type | Req | Description |
|---|---|---|---|
| auth_url | string | yes | – |
| next_step | string | yes | – |
| redirect_uri | string | yes | – |
| scopes | array | yes | – |
No examples provided.
withings_list_activity Withings Daily Activity ~175
List Withings daily activity summaries. Requires user.activity scope.
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Only return Withings records after this time. Converted to Withings startdate. |
| all_pages | boolean | – | Fetch multiple pages up to max_pages. |
| before | string | – | Only return Withings records before this time. Converted to Withings enddate. |
| limit | integer | – | Upstream page-size hint and local output cap used for pagination safety. |
| max_pages | integer | – | Maximum pages to fetch when all_pages is true. |
| page | integer | – | Withings page number. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | yes | – |
| endpoint | string | yes | – |
| has_more | boolean | yes | – |
| next_page | integer | – | – |
| pages_fetched | integer | yes | – |
| privacy_mode | string | yes | – |
| records | array | yes | – |
No examples provided.
withings_list_body_measures Withings Body Measures ~186
List Withings punctual measurements such as weight and body composition. Requires user.metrics scope. Not medical advice.
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Only return Withings records after this time. Converted to Withings startdate. |
| all_pages | boolean | – | Fetch multiple pages up to max_pages. |
| before | string | – | Only return Withings records before this time. Converted to Withings enddate. |
| limit | integer | – | Upstream page-size hint and local output cap used for pagination safety. |
| max_pages | integer | – | Maximum pages to fetch when all_pages is true. |
| page | integer | – | Withings page number. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | yes | – |
| endpoint | string | yes | – |
| has_more | boolean | yes | – |
| next_page | integer | – | – |
| pages_fetched | integer | yes | – |
| privacy_mode | string | yes | – |
| records | array | yes | – |
No examples provided.
withings_list_heart Withings Heart Records ~181
List Withings heart records where available. Requires user.metrics scope. Not medical advice.
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Only return Withings records after this time. Converted to Withings startdate. |
| all_pages | boolean | – | Fetch multiple pages up to max_pages. |
| before | string | – | Only return Withings records before this time. Converted to Withings enddate. |
| limit | integer | – | Upstream page-size hint and local output cap used for pagination safety. |
| max_pages | integer | – | Maximum pages to fetch when all_pages is true. |
| page | integer | – | Withings page number. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | yes | – |
| endpoint | string | yes | – |
| has_more | boolean | yes | – |
| next_page | integer | – | – |
| pages_fetched | integer | yes | – |
| privacy_mode | string | yes | – |
| records | array | yes | – |
No examples provided.
withings_list_sleep Withings Sleep Detail ~181
List detailed Withings sleep data where available. Requires user.activity scope. Not medical advice.
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Only return Withings records after this time. Converted to Withings startdate. |
| all_pages | boolean | – | Fetch multiple pages up to max_pages. |
| before | string | – | Only return Withings records before this time. Converted to Withings enddate. |
| limit | integer | – | Upstream page-size hint and local output cap used for pagination safety. |
| max_pages | integer | – | Maximum pages to fetch when all_pages is true. |
| page | integer | – | Withings page number. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | yes | – |
| endpoint | string | yes | – |
| has_more | boolean | yes | – |
| next_page | integer | – | – |
| pages_fetched | integer | yes | – |
| privacy_mode | string | yes | – |
| records | array | yes | – |
No examples provided.
withings_list_sleep_summary Withings Sleep Summaries ~183
List Withings sleep summaries with common sleep fields. Requires user.activity scope. Not medical advice.
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Only return Withings records after this time. Converted to Withings startdate. |
| all_pages | boolean | – | Fetch multiple pages up to max_pages. |
| before | string | – | Only return Withings records before this time. Converted to Withings enddate. |
| limit | integer | – | Upstream page-size hint and local output cap used for pagination safety. |
| max_pages | integer | – | Maximum pages to fetch when all_pages is true. |
| page | integer | – | Withings page number. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | yes | – |
| endpoint | string | yes | – |
| has_more | boolean | yes | – |
| next_page | integer | – | – |
| pages_fetched | integer | yes | – |
| privacy_mode | string | yes | – |
| records | array | yes | – |
No examples provided.
withings_list_workouts Withings Workouts ~174
List Withings workouts. Requires user.activity scope.
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Only return Withings records after this time. Converted to Withings startdate. |
| all_pages | boolean | – | Fetch multiple pages up to max_pages. |
| before | string | – | Only return Withings records before this time. Converted to Withings enddate. |
| limit | integer | – | Upstream page-size hint and local output cap used for pagination safety. |
| max_pages | integer | – | Maximum pages to fetch when all_pages is true. |
| page | integer | – | Withings page number. |
| privacy_mode | string | – | Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details. |
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | yes | – |
| endpoint | string | yes | – |
| has_more | boolean | yes | – |
| next_page | integer | – | – |
| pages_fetched | integer | yes | – |
| privacy_mode | string | yes | – |
| records | array | yes | – |
No examples provided.
withings_onboarding Delx Wellness Onboarding Flow ~123
Return the 11-question onboarding flow plus the current profile state and missing fields. Read-only — does NOT persist anything. Pair with withings_profile_update once the user answers. Cross-connector: the same profile is shared by every Delx Wellness MCP (whoop, garmin, oura, fitbit, strava, polar, withings, apple-health, samsung-health, google-health, nourish, cycle-coach, cgm, air).
| Name | Type | Req | Description |
|---|---|---|---|
| locale | string | – | Onboarding locale. Defaults to en. |
| response_format | string | – | – |
No output schema declared.
No examples provided.
withings_privacy_audit Withings Privacy Audit ~38
Return local privacy, cache, token-path and env-presence posture without revealing secret values.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| cache_enabled | boolean | yes | – |
| cache_path | string | yes | – |
| config_source | string | yes | – |
| gps_redaction_default | boolean | yes | – |
| local_config_exists | boolean | yes | – |
| local_config_path | string | yes | – |
| local_config_secure_permissions | boolean | – | – |
| notes | array | yes | – |
| privacy_mode_default | string | yes | – |
| project | string | yes | – |
| raw_payloads_opt_in | boolean | yes | – |
| redacted_key_patterns | array | yes | – |
| required_env_present | object | yes | – |
| secret_env_vars | array | yes | – |
| stdout_safe | boolean | yes | – |
| token_path | string | yes | – |
| unofficial | boolean | yes | – |
No examples provided.
withings_profile_get Get Delx Wellness Profile ~67
Read the shared Delx Wellness profile from ~/.delx-wellness/profile.json. Returns preferred name, goals, devices, training/nutrition/exercise/agent preferences and safety flags. NEVER contains OAuth tokens or API secrets. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
No output schema declared.
No examples provided.
withings_profile_update Update Delx Wellness Profile ~153
Persist a partial patch to ~/.delx-wellness/profile.json. Requires explicit_user_intent=true (otherwise returns USER_ACTION_REQUIRED). Rejects secret-like fields (oauth, token, secret, password, cookie, refresh, api_key, session) at write time. Use to record preferred name, goals, devices, training context, nutrition context, exercise preferences, agent preferences, and safety flags.
| Name | Type | Req | Description |
|---|---|---|---|
| explicit_user_intent | boolean | – | Must be true to persist. Prevents accidental writes from agent inference. |
| patch | object | yes | Partial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes. |
| response_format | string | – | – |
No output schema declared.
No examples provided.
withings_quickstart Withings Quickstart ~63
Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Withings?'
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
No output schema declared.
No examples provided.
withings_revoke_access Clear Withings Local Access ~47
Delete the local Withings token file. Withings token revocation support varies by app/API plan, so this tool only clears local access.
| Name | Type | Req | Description |
|---|---|---|---|
| response_format | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| local_tokens_cleared | boolean | yes | – |
| note | string | yes | – |
| ok | boolean | yes | – |
| token_path | string | yes | – |
No examples provided.
withings_weekly_summary Withings Weekly Wellness Review ~101
Build a weekly Withings scorecard with sleep, activity, body measures, bottlenecks and actions. Read-only and non-medical.
| Name | Type | Req | Description |
|---|---|---|---|
| compare_days | integer | – | Prior comparison window in days. Use 0 to disable comparison. |
| days | integer | – | Recent analysis window in days. |
| response_format | string | – | – |
| timezone | string | – | IANA timezone used only for display, e.g. America/New_York. |
| Name | Type | Req | Description |
|---|---|---|---|
| generated_at | string | yes | – |
| kind | string | yes | – |
No examples provided.
withings_wellness_context Withings Wellness Context ~97
Normalize Withings sleep and activity load into the shared wellness_context shape for recommendation engines.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Lookback window for normalized Withings wellness context. |
| injury_flags | array | – | – |
| notes | string | – | – |
| response_format | string | – | – |
| soreness | array | – | – |
| timezone | string | – | IANA timezone used only for display, e.g. America/New_York. |
| Name | Type | Req | Description |
|---|---|---|---|
| generated_at | string | yes | – |
| injury_flags | array | yes | – |
| notes | array | yes | – |
| recent_training_load | string | yes | – |
| soreness | array | yes | – |
| source | string | yes | – |
No examples provided.
How do I install the io.github.davidmosiah/withingsmcp MCP server?
io.github.davidmosiah/withingsmcp runs locally as an npm package, launched with npx -y withings-mcp-unofficial. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · withings-mcp-unofficial
claude mcp add davidmosiah-withingsmcp -- npx -y withings-mcp-unofficial
What is the io.github.davidmosiah/withingsmcp MCP server?
io.github.davidmosiah/withingsmcp is an MCP server listed in the public MCP registry as io.github.davidmosiah/withingsmcp. Privacy-first, unofficial Withings MCP server for AI health, sleep, activity and heart-rate agents. This page covers its npm package (withings-mcp-unofficial).
Is the io.github.davidmosiah/withingsmcp MCP server safe to use?
io.github.davidmosiah/withingsmcp scores 85 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.davidmosiah/withingsmcp MCP server expose?
io.github.davidmosiah/withingsmcp exposes 23 tools: withings_data_inventory, withings_agent_manifest, withings_capabilities, withings_quickstart, withings_demo, and 18 more. Their descriptions and schemas cost roughly 2,259 tokens of context every time the server is loaded.
Is the io.github.davidmosiah/withingsmcp MCP server still maintained?
io.github.davidmosiah/withingsmcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.davidmosiah/withingsmcp MCP server under?
io.github.davidmosiah/withingsmcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.
What did VerifyMCP test on the io.github.davidmosiah/withingsmcp MCP server?
VerifyMCP ran 16 checks on io.github.davidmosiah/withingsmcp, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.