# io.github.davidmosiah/withingsmcp (npm · withings-mcp-unofficial)

Privacy-first, unofficial Withings MCP server for AI health, sleep, activity and heart-rate agents.

- Trust score: 70/100 (medium)
- Change this week: +46
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `withings-mcp-unofficial`: 70/100 (this document), [markdown](https://verifymcp.io/servers/davidmosiah-withingsmcp/withings-mcp-unofficial.md), [page](https://verifymcp.io/servers/davidmosiah-withingsmcp/withings-mcp-unofficial)

## Channel facts

- Registry: `npm`
- Package: `withings-mcp-unofficial`
- Version: `0.4.7`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 84/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2392 tokens (~79/item across 30 items; 23 tools + 7 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 90/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 66% of tool parameters carry a description.
  - Structured output schemas are declared (78% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add davidmosiah-withingsmcp -- npx -y withings-mcp-unofficial
```

### Codex

```bash
codex mcp add davidmosiah-withingsmcp -- npx -y withings-mcp-unofficial
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "davidmosiah-withingsmcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "withings-mcp-unofficial"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add davidmosiah-withingsmcp --command npx --arg -y --arg withings-mcp-unofficial
```

### Hermes

```yaml
mcp_servers:
  davidmosiah-withingsmcp:
    command: "npx"
    args: ["-y", "withings-mcp-unofficial"]
```

### Other

```json
{
  "mcpServers": {
    "davidmosiah-withingsmcp": {
      "command": "npx",
      "args": [
        "-y",
        "withings-mcp-unofficial"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 70, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 69, +44)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-07-31 (score 25, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 24, −27)

- [functional regression] Schema quality: 100 → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-07-28 (score 51, +27)

- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 66
- [functional] First check of Tool coverage: 78
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: unverified
- [functional] First check of Schema quality: pass

### 2026-07-27 (score 24)

First indexed and scored.

## MCP tools (23)

### `withings_data_inventory` (~47 tokens)

Withings Data Inventory

Inventory supported Withings data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call Withings APIs or expose user data.

Input parameters:

- `response_format` (string)

Output parameters:

- `api_boundary`
- `auth`
- `categories` (array)
- `data_access_model` (string)
- `first_tools` (array)
- `generated_at` (string)
- `kind` (string)
- `links` (object)
- `mcp_name` (string)
- `notes` (array)
- `privacy_modes` (array)
- `recommended_agent_flow` (array)
- `scopes` (array)
- `source` (string)
- `totals` (object)
- `unofficial` (boolean)

### `withings_agent_manifest` (~46 tokens)

Withings Agent Manifest

Machine-readable install, runtime and client guidance for AI agents. Does not call Withings or expose secrets.

Input parameters:

- `client` (string)
- `response_format` (string)

Output parameters:

- `agent_rules` (array)
- `client` (string)
- `hermes` (object)
- `links` (object)
- `mcp_name` (string)
- `oauth` (object)
- `package` (object)
- `project` (string)
- `recommended_first_calls` (array)
- `resources` (array)
- `standard_tools` (array)
- `troubleshooting` (array)
- `unofficial` (boolean)

### `withings_capabilities` (~34 tokens)

Withings MCP Capabilities

Explain supported Withings data, privacy boundaries, recommended agent workflow and project links.

Input parameters:

- `response_format` (string)

Output parameters:

- `api_boundary` (object)
- `auth_model` (object)
- `client_aliases` (object)
- `contribution_paths` (array)
- `creator` (object)
- `links` (object)
- `mcp_name` (string)
- `privacy_modes` (array)
- `project` (string)
- `recommended_agent_flow` (array)
- `supported_data` (array)
- `unofficial` (boolean)

### `withings_quickstart` (~63 tokens)

Withings Quickstart

Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Withings?'

Input parameters:

- `response_format` (string)

### `withings_demo` (~54 tokens)

Withings Demo

Returns realistic example payloads of withings_daily_summary, withings_wellness_context, and withings_list_body_measures so agents see the contract before calling real Withings APIs.

Input parameters:

- `response_format` (string)

### `withings_get_auth_url` (~73 tokens)

Get Withings OAuth URL

Generate a Withings OAuth authorization URL. Use this first when no local token exists.

Input parameters:

- `response_format` (string)
- `scopes` (array): Optional scope override. Defaults to read-only Withings scopes used by this server.
- `state` (string): Optional OAuth state value generated by the caller.

Output parameters:

- `auth_url` (string)
- `next_step` (string)
- `redirect_uri` (string)
- `scopes` (array)

### `withings_exchange_code` (~63 tokens)

Exchange Withings OAuth Code

Exchange a Withings OAuth authorization code for local tokens using Withings signed request flow. Tokens are stored locally and never returned.

Input parameters:

- `code` (string, required): OAuth authorization code, or a full redirect URL containing ?code=...
- `response_format` (string)

Output parameters:

- `expires_at` (number)
- `note` (string)
- `ok` (boolean)
- `scope` (string)
- `token_path` (string)

### `withings_list_body_measures` (~186 tokens)

Withings Body Measures

List Withings punctual measurements such as weight and body composition. Requires user.metrics scope. Not medical advice.

Input parameters:

- `after` (string): Only return Withings records after this time. Converted to Withings startdate.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return Withings records before this time. Converted to Withings enddate.
- `limit` (integer): Upstream page-size hint and local output cap used for pagination safety.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Withings page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `withings_list_activity` (~175 tokens)

Withings Daily Activity

List Withings daily activity summaries. Requires user.activity scope.

Input parameters:

- `after` (string): Only return Withings records after this time. Converted to Withings startdate.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return Withings records before this time. Converted to Withings enddate.
- `limit` (integer): Upstream page-size hint and local output cap used for pagination safety.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Withings page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `withings_list_workouts` (~174 tokens)

Withings Workouts

List Withings workouts. Requires user.activity scope.

Input parameters:

- `after` (string): Only return Withings records after this time. Converted to Withings startdate.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return Withings records before this time. Converted to Withings enddate.
- `limit` (integer): Upstream page-size hint and local output cap used for pagination safety.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Withings page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `withings_list_sleep_summary` (~183 tokens)

Withings Sleep Summaries

List Withings sleep summaries with common sleep fields. Requires user.activity scope. Not medical advice.

Input parameters:

- `after` (string): Only return Withings records after this time. Converted to Withings startdate.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return Withings records before this time. Converted to Withings enddate.
- `limit` (integer): Upstream page-size hint and local output cap used for pagination safety.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Withings page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `withings_list_sleep` (~181 tokens)

Withings Sleep Detail

List detailed Withings sleep data where available. Requires user.activity scope. Not medical advice.

Input parameters:

- `after` (string): Only return Withings records after this time. Converted to Withings startdate.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return Withings records before this time. Converted to Withings enddate.
- `limit` (integer): Upstream page-size hint and local output cap used for pagination safety.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Withings page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `withings_list_heart` (~181 tokens)

Withings Heart Records

List Withings heart records where available. Requires user.metrics scope. Not medical advice.

Input parameters:

- `after` (string): Only return Withings records after this time. Converted to Withings startdate.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return Withings records before this time. Converted to Withings enddate.
- `limit` (integer): Upstream page-size hint and local output cap used for pagination safety.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Withings page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to WITHINGS_PRIVACY_MODE or structured. raw returns upstream Withings JSON. summary minimizes sensitive health and profile details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `withings_connection_status` (~55 tokens)

Withings Connection Status

Check local Withings config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Withings or exposing secrets.

Input parameters:

- `client` (string)
- `response_format` (string)

Output parameters:

- `automatic_auth_supported` (boolean)
- `cache` (object)
- `client` (string)
- `client_checks` (object)
- `config` (object)
- `missing_env` (array)
- `next_steps` (array)
- `node` (object)
- `oauth` (object)
- `ok` (boolean)
- `privacy_mode` (string)
- `ready_for_withings_api` (boolean)
- `redirect_uri` (string)
- `required_env` (object)
- `token` (object)

### `withings_cache_status` (~38 tokens)

Withings Cache Status

Show optional local SQLite cache status. Enable with WITHINGS_CACHE=sqlite or WITHINGS_CACHE=true.

Input parameters:

- `response_format` (string)

Output parameters:

- `enabled` (boolean)
- `entries` (integer)
- `http_cache` (object)
- `newest_cached_at` (string)
- `path` (string)

### `withings_privacy_audit` (~38 tokens)

Withings Privacy Audit

Return local privacy, cache, token-path and env-presence posture without revealing secret values.

Input parameters:

- `response_format` (string)

Output parameters:

- `cache_enabled` (boolean)
- `cache_path` (string)
- `config_source` (string)
- `gps_redaction_default` (boolean)
- `local_config_exists` (boolean)
- `local_config_path` (string)
- `local_config_secure_permissions` (boolean)
- `notes` (array)
- `privacy_mode_default` (string)
- `project` (string)
- `raw_payloads_opt_in` (boolean)
- `redacted_key_patterns` (array)
- `required_env_present` (object)
- `secret_env_vars` (array)
- `stdout_safe` (boolean)
- `token_path` (string)
- `unofficial` (boolean)

### `withings_revoke_access` (~47 tokens)

Clear Withings Local Access

Delete the local Withings token file. Withings token revocation support varies by app/API plan, so this tool only clears local access.

Input parameters:

- `response_format` (string)

Output parameters:

- `local_tokens_cleared` (boolean)
- `note` (string)
- `ok` (boolean)
- `token_path` (string)

### `withings_daily_summary` (~80 tokens)

Withings Daily Wellness Summary

Build a practical daily summary from Withings activity, sleep and body/heart data when available. Read-only and non-medical.

Input parameters:

- `days` (integer): Lookback window for recent training context.
- `response_format` (string)
- `timezone` (string): IANA timezone used only for display, e.g. America/New_York.

Output parameters:

- `generated_at` (string)
- `kind` (string)

### `withings_weekly_summary` (~101 tokens)

Withings Weekly Wellness Review

Build a weekly Withings scorecard with sleep, activity, body measures, bottlenecks and actions. Read-only and non-medical.

Input parameters:

- `compare_days` (integer): Prior comparison window in days. Use 0 to disable comparison.
- `days` (integer): Recent analysis window in days.
- `response_format` (string)
- `timezone` (string): IANA timezone used only for display, e.g. America/New_York.

Output parameters:

- `generated_at` (string)
- `kind` (string)

### `withings_wellness_context` (~97 tokens)

Withings Wellness Context

Normalize Withings sleep and activity load into the shared wellness_context shape for recommendation engines.

Input parameters:

- `days` (integer): Lookback window for normalized Withings wellness context.
- `injury_flags` (array)
- `notes` (string)
- `response_format` (string)
- `soreness` (array)
- `timezone` (string): IANA timezone used only for display, e.g. America/New_York.

Output parameters:

- `generated_at` (string)
- `injury_flags` (array)
- `notes` (array)
- `recent_training_load` (string)
- `soreness` (array)
- `source` (string)

### `withings_profile_get` (~67 tokens)

Get Delx Wellness Profile

Read the shared Delx Wellness profile from ~/.delx-wellness/profile.json. Returns preferred name, goals, devices, training/nutrition/exercise/agent preferences and safety flags. NEVER contains OAuth tokens or API secrets. Read-only.

Input parameters:

- `response_format` (string)

### `withings_profile_update` (~153 tokens)

Update Delx Wellness Profile

Persist a partial patch to ~/.delx-wellness/profile.json. Requires explicit_user_intent=true (otherwise returns USER_ACTION_REQUIRED). Rejects secret-like fields (oauth, token, secret, password, cookie, refresh, api_key, session) at write time. Use to record preferred name, goals, devices, training context, nutrition context, exercise preferences, agent preferences, and safety flags.

Input parameters:

- `explicit_user_intent` (boolean): Must be true to persist. Prevents accidental writes from agent inference.
- `patch` (object, required): Partial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes.
- `response_format` (string)

### `withings_onboarding` (~123 tokens)

Delx Wellness Onboarding Flow

Return the 11-question onboarding flow plus the current profile state and missing fields. Read-only — does NOT persist anything. Pair with withings_profile_update once the user answers. Cross-connector: the same profile is shared by every Delx Wellness MCP (whoop, garmin, oura, fitbit, strava, polar, withings, apple-health, samsung-health, google-health, nourish, cycle-coach, cgm, air).

Input parameters:

- `locale` (string): Onboarding locale. Defaults to en.
- `response_format` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/davidmosiah-withingsmcp/withings-mcp-unofficial#diagnostics

## Score history

- 2026-08-03: 70
- 2026-08-02: 69
- 2026-08-01: 25
- 2026-07-31: 25
- 2026-07-30: 24
- 2026-07-28: 51
- 2026-07-27: 24

## Links

- npm package: https://www.npmjs.com/package/withings-mcp-unofficial
- Socket report: https://socket.dev/npm/package/withings-mcp-unofficial
- Repository: https://github.com/davidmosiah/withings-mcp
- Website: https://wellness.delx.ai/connectors/withings
- Changelog RSS feed: https://verifymcp.io/servers/davidmosiah-withingsmcp/withings-mcp-unofficial/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/davidmosiah-withingsmcp/withings-mcp-unofficial/changelog.json
- HTML version of this page: https://verifymcp.io/servers/davidmosiah-withingsmcp/withings-mcp-unofficial