io.github.davidmosiah/withingsmcp

NPM · WITHINGS-MCP-UNOFFICIAL · SCANNED AUG 3

Privacy-first, unofficial Withings MCP server for AI health, sleep, activity and heart-rate agents.

Available components

+46 this week 70 70 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 1 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability84

100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
AI-judged instruction clarity (good).Pass
Tool/resource definitions use about 2392 tokens (~79/item across 30 items; 23 tools + 7 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage90

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
66% of tool parameters carry a description.Partial
Structured output schemas are declared (78% of tools); any adoption earns full credit.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · withings-mcp-unofficial

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add davidmosiah-withingsmcp -- npx -y withings-mcp-unofficial

# add to Codex CLI

codex mcp add davidmosiah-withingsmcp -- npx -y withings-mcp-unofficial

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "davidmosiah-withingsmcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "withings-mcp-unofficial"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add davidmosiah-withingsmcp --command npx --arg -y --arg withings-mcp-unofficial

# ~/.hermes/config.yaml

mcp_servers:
  davidmosiah-withingsmcp:
    command: "npx"
    args: ["-y", "withings-mcp-unofficial"]

// mcp.json

{
  "mcpServers": {
    "davidmosiah-withingsmcp": {
      "command": "npx",
      "args": [
        "-y",
        "withings-mcp-unofficial"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
2 Aug 26 +44
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Tool coverage: 100 → unverified ▼ functional
- Security disclosure: fail → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Schema quality: unverified → good ▲ functional
- Stability: unverified → 0.23 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Licence: MIT functional
31 Jul 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 −27
- Schema quality: 100 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
28 Jul 26 +27
- Schema quality: unverified → 100 ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Tool coverage: 66 functional
- First check of Tool coverage: 78 functional
- First check of Schema quality: fail functional
- First check of Schema quality: unverified functional
- First check of Schema quality: pass functional
27 Jul 26 24

First indexed and scored.

Show 4 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 129 packages

129 packages in the resolved dependency tree · 129 deprecated · 49 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 23 exposed · ~2,259 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

withings_agent_manifest Withings Agent Manifest ~46

Machine-readable install, runtime and client guidance for AI agents. Does not call Withings or expose secrets.

Input Output Examples

Name	Type	Req	Description
client	string	—	—
response_format	string	—	—

Name	Type	Req	Description
agent_rules	array	yes	—
client	string	yes	—
hermes	object	yes	—
links	object	yes	—
mcp_name	string	yes	—
oauth	object	yes	—
package	object	yes	—
project	string	yes	—
recommended_first_calls	array	yes	—
resources	array	yes	—
standard_tools	array	yes	—
troubleshooting	array	yes	—
unofficial	boolean	yes	—

No examples provided.

withings_cache_status Withings Cache Status ~38

Show optional local SQLite cache status. Enable with WITHINGS_CACHE=sqlite or WITHINGS_CACHE=true.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
enabled	boolean	yes	—
entries	integer	yes	—
http_cache	object	—	—
newest_cached_at	string	—	—
path	string	yes	—

No examples provided.

withings_capabilities Withings MCP Capabilities ~34

Explain supported Withings data, privacy boundaries, recommended agent workflow and project links.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
api_boundary	object	yes	—
auth_model	object	yes	—
client_aliases	object	yes	—
contribution_paths	array	yes	—
creator	object	yes	—
links	object	yes	—
mcp_name	string	yes	—
privacy_modes	array	yes	—
project	string	yes	—
recommended_agent_flow	array	yes	—
supported_data	array	yes	—
unofficial	boolean	yes	—

No examples provided.

withings_connection_status Withings Connection Status ~55

Check local Withings config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Withings or exposing secrets.

Input Output Examples

Name	Type	Req	Description
client	string	—	—
response_format	string	—	—

Name	Type	Req	Description
automatic_auth_supported	boolean	yes	—
cache	object	yes	—
client	string	—	—
client_checks	object	—	—
config	object	yes	—
missing_env	array	yes	—
next_steps	array	yes	—
node	object	yes	—
oauth	object	yes	—
ok	boolean	yes	—
privacy_mode	string	yes	—
ready_for_withings_api	boolean	yes	—
redirect_uri	string	—	—
required_env	object	yes	—
token	object	yes	—

No examples provided.

withings_daily_summary Withings Daily Wellness Summary ~80

Build a practical daily summary from Withings activity, sleep and body/heart data when available. Read-only and non-medical.

Input Output Examples

Name	Type	Req	Description
days	integer	—	Lookback window for recent training context.
response_format	string	—	—
timezone	string	—	IANA timezone used only for display, e.g. America/New_York.

Name	Type	Req	Description
generated_at	string	yes	—
kind	string	yes	—

No examples provided.

withings_data_inventory Withings Data Inventory ~47

Inventory supported Withings data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call Withings APIs or expose user data.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
api_boundary	—	—	—
auth	—	—	—
categories	array	yes	—
data_access_model	string	yes	—
first_tools	array	yes	—
generated_at	string	yes	—
kind	string	yes	—
links	object	yes	—
mcp_name	string	yes	—
notes	array	yes	—
privacy_modes	array	yes	—
recommended_agent_flow	array	yes	—
scopes	array	yes	—
source	string	yes	—
totals	object	yes	—
unofficial	boolean	yes	—

No examples provided.

withings_demo Withings Demo ~54

Returns realistic example payloads of withings_daily_summary, withings_wellness_context, and withings_list_body_measures so agents see the contract before calling real Withings APIs.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

No output schema declared.

No examples provided.

withings_exchange_code Exchange Withings OAuth Code ~63

Exchange a Withings OAuth authorization code for local tokens using Withings signed request flow. Tokens are stored locally and never returned.

Input Output Examples

Name	Type	Req	Description
code	string	yes	OAuth authorization code, or a full redirect URL containing ?code=...
response_format	string	—	—

Name	Type	Req	Description
expires_at	number	—	—
note	string	yes	—
ok	boolean	yes	—
scope	string	—	—
token_path	string	yes	—

No examples provided.

withings_get_auth_url Get Withings OAuth URL ~73

Generate a Withings OAuth authorization URL. Use this first when no local token exists.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—
scopes	array	—	Optional scope override. Defaults to read-only Withings scopes used by this server.
state	string	—	Optional OAuth state value generated by the caller.

Name	Type	Req	Description
auth_url	string	yes	—
next_step	string	yes	—
redirect_uri	string	yes	—
scopes	array	yes	—

No examples provided.

withings_list_activity Withings Daily Activity ~175

List Withings daily activity summaries. Requires user.activity scope.

Input Output Examples

Name	Type	Req	Description
after	string	—	Only return Withings records after this time. Converted to Withings startdate.
all_pages	boolean	—	Fetch multiple pages up to max_pages.
before	string	—	Only return Withings records before this time. Converted to Withings enddate.
limit	integer	—	Upstream page-size hint and local output cap used for pagination safety.
max_pages	integer	—	Maximum pages to fetch when all_pages is true.
page	integer	—	Withings page number.
privacy_mode	string	—	Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details.
response_format	string	—	—

Name	Type	Req	Description
count	integer	yes	—
endpoint	string	yes	—
has_more	boolean	yes	—
next_page	integer	—	—
pages_fetched	integer	yes	—
privacy_mode	string	yes	—
records	array	yes	—

No examples provided.

withings_list_body_measures Withings Body Measures ~186

List Withings punctual measurements such as weight and body composition. Requires user.metrics scope. Not medical advice.

Input Output Examples

Name	Type	Req	Description
after	string	—	Only return Withings records after this time. Converted to Withings startdate.
all_pages	boolean	—	Fetch multiple pages up to max_pages.
before	string	—	Only return Withings records before this time. Converted to Withings enddate.
limit	integer	—	Upstream page-size hint and local output cap used for pagination safety.
max_pages	integer	—	Maximum pages to fetch when all_pages is true.
page	integer	—	Withings page number.
privacy_mode	string	—	Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details.
response_format	string	—	—

Name	Type	Req	Description
count	integer	yes	—
endpoint	string	yes	—
has_more	boolean	yes	—
next_page	integer	—	—
pages_fetched	integer	yes	—
privacy_mode	string	yes	—
records	array	yes	—

No examples provided.

withings_list_heart Withings Heart Records ~181

List Withings heart records where available. Requires user.metrics scope. Not medical advice.

Input Output Examples

Name	Type	Req	Description
after	string	—	Only return Withings records after this time. Converted to Withings startdate.
all_pages	boolean	—	Fetch multiple pages up to max_pages.
before	string	—	Only return Withings records before this time. Converted to Withings enddate.
limit	integer	—	Upstream page-size hint and local output cap used for pagination safety.
max_pages	integer	—	Maximum pages to fetch when all_pages is true.
page	integer	—	Withings page number.
privacy_mode	string	—	Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details.
response_format	string	—	—

Name	Type	Req	Description
count	integer	yes	—
endpoint	string	yes	—
has_more	boolean	yes	—
next_page	integer	—	—
pages_fetched	integer	yes	—
privacy_mode	string	yes	—
records	array	yes	—

No examples provided.

withings_list_sleep Withings Sleep Detail ~181

List detailed Withings sleep data where available. Requires user.activity scope. Not medical advice.

Input Output Examples

Name	Type	Req	Description
after	string	—	Only return Withings records after this time. Converted to Withings startdate.
all_pages	boolean	—	Fetch multiple pages up to max_pages.
before	string	—	Only return Withings records before this time. Converted to Withings enddate.
limit	integer	—	Upstream page-size hint and local output cap used for pagination safety.
max_pages	integer	—	Maximum pages to fetch when all_pages is true.
page	integer	—	Withings page number.
privacy_mode	string	—	Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details.
response_format	string	—	—

Name	Type	Req	Description
count	integer	yes	—
endpoint	string	yes	—
has_more	boolean	yes	—
next_page	integer	—	—
pages_fetched	integer	yes	—
privacy_mode	string	yes	—
records	array	yes	—

No examples provided.

withings_list_sleep_summary Withings Sleep Summaries ~183

List Withings sleep summaries with common sleep fields. Requires user.activity scope. Not medical advice.

Input Output Examples

Name	Type	Req	Description
after	string	—	Only return Withings records after this time. Converted to Withings startdate.
all_pages	boolean	—	Fetch multiple pages up to max_pages.
before	string	—	Only return Withings records before this time. Converted to Withings enddate.
limit	integer	—	Upstream page-size hint and local output cap used for pagination safety.
max_pages	integer	—	Maximum pages to fetch when all_pages is true.
page	integer	—	Withings page number.
privacy_mode	string	—	Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details.
response_format	string	—	—

Name	Type	Req	Description
count	integer	yes	—
endpoint	string	yes	—
has_more	boolean	yes	—
next_page	integer	—	—
pages_fetched	integer	yes	—
privacy_mode	string	yes	—
records	array	yes	—

No examples provided.

withings_list_workouts Withings Workouts ~174

List Withings workouts. Requires user.activity scope.

Input Output Examples

Name	Type	Req	Description
after	string	—	Only return Withings records after this time. Converted to Withings startdate.
all_pages	boolean	—	Fetch multiple pages up to max_pages.
before	string	—	Only return Withings records before this time. Converted to Withings enddate.
limit	integer	—	Upstream page-size hint and local output cap used for pagination safety.
max_pages	integer	—	Maximum pages to fetch when all_pages is true.
page	integer	—	Withings page number.
privacy_mode	string	—	Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details.
response_format	string	—	—

Name	Type	Req	Description
count	integer	yes	—
endpoint	string	yes	—
has_more	boolean	yes	—
next_page	integer	—	—
pages_fetched	integer	yes	—
privacy_mode	string	yes	—
records	array	yes	—

No examples provided.

withings_onboarding Delx Wellness Onboarding Flow ~123

Return the 11-question onboarding flow plus the current profile state and missing fields. Read-only — does NOT persist anything. Pair with withings_profile_update once the user answers. Cross-connector: the same profile is shared by every Delx Wellness MCP (whoop, garmin, oura, fitbit, strava, polar, withings, apple-health, samsung-health, google-health, nourish, cycle-coach, cgm, air).

Input Output Examples

Name	Type	Req	Description
locale	string	—	Onboarding locale. Defaults to en.
response_format	string	—	—

No output schema declared.

No examples provided.

withings_privacy_audit Withings Privacy Audit ~38

Return local privacy, cache, token-path and env-presence posture without revealing secret values.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
cache_enabled	boolean	yes	—
cache_path	string	yes	—
config_source	string	yes	—
gps_redaction_default	boolean	yes	—
local_config_exists	boolean	yes	—
local_config_path	string	yes	—
local_config_secure_permissions	boolean	—	—
notes	array	yes	—
privacy_mode_default	string	yes	—
project	string	yes	—
raw_payloads_opt_in	boolean	yes	—
redacted_key_patterns	array	yes	—
required_env_present	object	yes	—
secret_env_vars	array	yes	—
stdout_safe	boolean	yes	—
token_path	string	yes	—
unofficial	boolean	yes	—

No examples provided.

withings_profile_get Get Delx Wellness Profile ~67

Read the shared Delx Wellness profile from ~/.delx-wellness/profile.json. Returns preferred name, goals, devices, training/nutrition/exercise/agent preferences and safety flags. NEVER contains OAuth tokens or API secrets. Read-only.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

No output schema declared.

No examples provided.

withings_profile_update Update Delx Wellness Profile ~153

Persist a partial patch to ~/.delx-wellness/profile.json. Requires explicit_user_intent=true (otherwise returns USER_ACTION_REQUIRED). Rejects secret-like fields (oauth, token, secret, password, cookie, refresh, api_key, session) at write time. Use to record preferred name, goals, devices, training context, nutrition context, exercise preferences, agent preferences, and safety flags.

Input Output Examples

Name	Type	Req	Description
explicit_user_intent	boolean	—	Must be true to persist. Prevents accidental writes from agent inference.
patch	object	yes	Partial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes.
response_format	string	—	—

No output schema declared.

No examples provided.

withings_quickstart Withings Quickstart ~63

Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Withings?'

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

No output schema declared.

No examples provided.

withings_revoke_access Clear Withings Local Access ~47

Delete the local Withings token file. Withings token revocation support varies by app/API plan, so this tool only clears local access.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
local_tokens_cleared	boolean	yes	—
note	string	yes	—
ok	boolean	yes	—
token_path	string	yes	—

No examples provided.

withings_weekly_summary Withings Weekly Wellness Review ~101

Build a weekly Withings scorecard with sleep, activity, body measures, bottlenecks and actions. Read-only and non-medical.

Input Output Examples

Name	Type	Req	Description
compare_days	integer	—	Prior comparison window in days. Use 0 to disable comparison.
days	integer	—	Recent analysis window in days.
response_format	string	—	—
timezone	string	—	IANA timezone used only for display, e.g. America/New_York.

Name	Type	Req	Description
generated_at	string	yes	—
kind	string	yes	—

No examples provided.

withings_wellness_context Withings Wellness Context ~97

Normalize Withings sleep and activity load into the shared wellness_context shape for recommendation engines.

Input Output Examples

Name	Type	Req	Description
days	integer	—	Lookback window for normalized Withings wellness context.
injury_flags	array	—	—
notes	string	—	—
response_format	string	—	—
soreness	array	—	—
timezone	string	—	IANA timezone used only for display, e.g. America/New_York.

Name	Type	Req	Description
generated_at	string	yes	—
injury_flags	array	yes	—
notes	array	yes	—
recent_training_load	string	yes	—
soreness	array	yes	—
source	string	yes	—

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug