io.github.partymola/fitbit-mcp
PYPI · FITBIT-MCP · SCANNED SEP 20
Retired, superseded by google-health-mcp. Fitbit Web API shuts down 30 Sept 2026.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 1 of 30 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency32
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 30 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability68
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3449 tokens (~191/item across 18 items; 18 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management80
- Stability observed for 24 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 18 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the io.github.partymola/fitbit-mcp server?
io.github.partymola/fitbit-mcp runs locally as a PyPI package, launched with uvx fitbit-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · fitbit-mcp
claude mcp add partymola-fitbit-mcp -- uvx fitbit-mcp
{
"mcpServers": {
"partymola-fitbit-mcp": {
"command": "uvx",
"args": [
"fitbit-mcp"
]
}
}
} {
"servers": {
"partymola-fitbit-mcp": {
"command": "uvx",
"args": [
"fitbit-mcp"
]
}
}
} codex mcp add partymola-fitbit-mcp -- uvx fitbit-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"partymola-fitbit-mcp": {
"type": "local",
"command": [
"uvx",
"fitbit-mcp"
],
"enabled": true
}
}
} openclaw mcp add partymola-fitbit-mcp --command uvx --arg fitbit-mcp
mcp_servers:
partymola-fitbit-mcp:
command: "uvx"
args: ["fitbit-mcp"] {
"McpServers": {
"partymola-fitbit-mcp": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"fitbit-mcp"
]
}
}
} assistant mcp add partymola-fitbit-mcp -t stdio -c uvx -a fitbit-mcp
{
"mcpServers": {
"partymola-fitbit-mcp": {
"command": "uvx",
"args": [
"fitbit-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 −2
- Stability: pass → 0.80 functional
- 19 Sept 26 0
- Stability: 0.97 → pass security
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −1
- Stability: pass → 0.90 functional
- 15 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- Stability: 0.97 → pass security
- 14 Sept 26 −14
- Malware scan: pass → unverified ▼ security
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Sept 26 −2
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/fitbit-mcp@0.6.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 30 packages
| Packages resolved | 30 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
fitbit_get_activity ~189
Get daily activity summaries (steps, calories, active minutes, distance). Returns data from the local cache by default. Use live=True to fetch from Fitbit API. Run fitbit_sync first to populate the cache. Note: live=True fetches one API call per day - avoid large ranges to stay within the 150 requests/hour rate limit. Args: start_date: Start date as "YYYY-MM-DD", "YYYY-MM", or "30d". Default: last 30 days. end_date: End date as "YYYY-MM-DD". Default: today. live: If true, fetch directly from Fitbit API instead of cache. Returns one entry per day with steps, calories, active minutes, distance. active_minutes = very_active + fairly_active (excludes lightly active).
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | – | – | – |
| live | boolean | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_get_azm ~199
Get daily Active Zone Minutes (AZM) - Fitbit's headline cardio metric. AZM counts minutes spent in heart rate zones at or above Fat Burn intensity. Cardio and Peak zone minutes count double. Returns from local cache by default, auto-syncing if stale. Use live=True to bypass the cache. Args: start_date: Start date as "YYYY-MM-DD", "YYYY-MM", or "30d". Default: last 30 days. end_date: End date as "YYYY-MM-DD". Default: today. live: If true, fetch directly from Fitbit API instead of cache. Returns one entry per day with total_minutes plus per-zone breakdown (fat_burn_minutes, cardio_minutes, peak_minutes). Distinct from active_minutes in fitbit_get_activity, which counts wall-clock minutes regardless of intensity.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | – | – | – |
| live | boolean | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_get_breathing_rate ~175
Get nightly breathing rate (avg breaths per minute during sleep). Sourced during sleep tracking. Useful as an illness/recovery signal: sustained increases of 2-3 bpm above personal baseline can indicate incipient infection or strain. Returns from cache by default, auto-syncing if stale. Args: start_date: Start date as "YYYY-MM-DD", "YYYY-MM", or "30d". Default: last 30 days. end_date: End date as "YYYY-MM-DD". Default: today. live: If true, fetch directly from Fitbit API instead of cache. Returns one entry per night with breaths_per_min. Typical adult range: 12-20 bpm at rest.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | – | – | – |
| live | boolean | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_get_cardio_fitness ~194
Get Cardio Fitness Score (VO2 Max estimate). Fitbit estimates VO2 Max from resting HR, HR during walks/runs, and demographics. Updates roughly weekly. Returns from cache by default, auto-syncing if stale. Args: start_date: Start date as "YYYY-MM-DD", "YYYY-MM", or "30d". Default: last 30 days. end_date: End date as "YYYY-MM-DD". Default: today. live: If true, fetch directly from Fitbit API instead of cache. Returns entries with vo2_max_low and vo2_max_high (mL/kg/min). Fitbit reports as a range (e.g. 39-43); when a single value is given, low and high are equal. Higher = better cardiorespiratory fitness.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | – | – | – |
| live | boolean | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_get_core_temperature ~207
Get manually-logged core (body) temperature readings (degrees Celsius). These are absolute body temperatures the user enters by hand - e.g. a forehead/thermometer reading saved to Fitbit - and are the right source for fever / body-temperature questions. They are NOT the device-derived nightly skin-temperature variation from fitbit_get_skin_temperature. A single day can hold several readings (each timestamped), useful for tracking a fever over time. Args: start_date: Start date as "YYYY-MM-DD", "YYYY-MM", or "30d". Default: last 30 days. end_date: End date as "YYYY-MM-DD". Default: today. live: If true, fetch directly from Fitbit API instead of cache. Returns one entry per logged reading with datetime (YYYY-MM-DDThh:mm:ss) and temp_celsius.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | – | – | – |
| live | boolean | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_get_devices ~94
List paired Fitbit devices with battery level and last sync time. Live-only (no caching) - reflects current device state. Useful for monitoring tracker health, knowing which device produced data, and spotting sync gaps. Returns one entry per paired device with id, type, device_version, battery (e.g. "High"), battery_level (0-100), last_sync_time, mac, and features list.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_get_exercises ~212
Get exercise log entries (individual tracked activities). Returns exercise sessions from the local cache by default. Use live=True to fetch from Fitbit API. Run fitbit_sync first to populate the cache. Args: start_date: Start date as "YYYY-MM-DD", "YYYY-MM", or "30d". Default: last 30 days. end_date: End date as "YYYY-MM-DD". Default: today. exercise_type: Filter by activity name (case-insensitive substring match), e.g. "cycling", "walk", "run". Default: all types. live: If true, fetch directly from Fitbit API instead of cache. Returns exercise entries with name, duration, calories, avg heart rate, distance, and source (auto-detect vs manual). Note: HR data from cycling may be unreliable (optical sensor vs handlebar grip).
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | – | – | – |
| exercise_type | – | – | – |
| live | boolean | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_get_food_log ~163
Get daily food and water log summary. Returns calories consumed and water intake (in mL) per day. Only populated if the user logs food/water in the Fitbit app. Returns from cache by default, auto-syncing if stale. Args: start_date: Start date as "YYYY-MM-DD", "YYYY-MM", or "30d". Default: last 30 days. end_date: End date as "YYYY-MM-DD". Default: today. live: If true, fetch directly from Fitbit API. Uses one API call per day. Returns one entry per day with calories_in and water_ml. Days with no logging are omitted.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | – | – | – |
| live | boolean | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_get_goals ~106
Get user-set activity goals for steps, distance, calories, etc. Live-only (no caching). Use to compare actuals (from fitbit_get_activity) against the targets the user set in the Fitbit app. Args: period: "daily" or "weekly". Default: "daily". Returns goals dict with keys like steps, distance, calories_out, active_minutes, active_zone_minutes, floors. Weekly omits some fields.
| Name | Type | Req | Description |
|---|---|---|---|
| period | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_get_heart_rate ~174
Get daily resting heart rate and heart rate zones. Returns resting HR and zone breakdown (Out of Range, Fat Burn, Cardio, Peak) from the local cache by default, auto-syncing if stale. Use live=True to bypass the cache entirely. Args: start_date: Start date as "YYYY-MM-DD", "YYYY-MM", or "30d". Default: last 30 days. end_date: End date as "YYYY-MM-DD". Default: today. live: If true, fetch directly from Fitbit API instead of cache. Returns one entry per day with resting_hr and zones array. Zone data: name, minutes, caloriesOut, max/min HR for each zone.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | – | – | – |
| live | boolean | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_get_hrv ~198
Get nightly HRV (heart rate variability) data. Returns data from the local cache by default. Use live=True to fetch from Fitbit API. Run fitbit_sync first to populate the cache. HRV data is sparse: only nights with on-wrist sleep tracking produce readings. Requires Fitbit Premium for access to this endpoint. Args: start_date: Start date as "YYYY-MM-DD", "YYYY-MM", or "30d". Default: last 30 days. end_date: End date as "YYYY-MM-DD". Default: today. live: If true, fetch directly from Fitbit API instead of cache. Returns one entry per night with daily_rmssd and deep_rmssd (ms). RMSSD = root mean square of successive RR interval differences. Higher values generally indicate better recovery and parasympathetic activity.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | – | – | – |
| live | boolean | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_get_lifetime_stats ~96
Get all-time activity totals and personal best records. Live-only (no caching). Returns lifetime totals (steps, distance, floors, calories, active score) and personal bests (best day for steps, distance, floors), each with the date the record was set. Useful for long-term context that the daily activity table can't easily answer (e.g. "what's my best step day ever?").
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_get_skin_temperature ~188
Get nightly skin temperature variation (degrees Celsius from personal baseline). This is the device-derived RELATIVE deviation recorded during sleep, NOT an absolute body temperature - for fever / body-temperature readings use fitbit_get_core_temperature instead. Fitbit needs ~3 nights to establish a baseline before values appear. Useful as an illness/cycle/recovery signal. Args: start_date: Start date as "YYYY-MM-DD", "YYYY-MM", or "30d". Default: last 30 days. end_date: End date as "YYYY-MM-DD". Default: today. live: If true, fetch directly from Fitbit API instead of cache. Returns one entry per night with nightly_relative (degrees C, can be negative) and log_type (e.g. "dermal").
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | – | – | – |
| live | boolean | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_get_sleep ~188
Get nightly sleep data (duration, stages, efficiency). Returns sleep data from the local cache by default. Use live=True to fetch from Fitbit API. Run fitbit_sync first to populate the cache. Sleep data is sparse: only nights with watch-tracked sleep are present. Travel, off-wrist nights, or manual logs may be missing. Args: start_date: Start date as "YYYY-MM-DD", "YYYY-MM", or "30d". Default: last 30 days. end_date: End date as "YYYY-MM-DD". Default: today. live: If true, fetch directly from Fitbit API instead of cache. Returns one entry per night with total_minutes, efficiency, start/end times, and stage breakdown (deep, light, REM, wake minutes).
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | – | – | – |
| live | boolean | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_get_spo2 ~193
Get nightly SpO2 (blood oxygen saturation) data. Returns data from the local cache by default. Use live=True to fetch from Fitbit API. Run fitbit_sync first to populate the cache. SpO2 data is sparse: only nights with on-wrist sleep tracking produce readings. Requires Fitbit Premium for access to this endpoint. Args: start_date: Start date as "YYYY-MM-DD", "YYYY-MM", or "30d". Default: last 30 days. end_date: End date as "YYYY-MM-DD". Default: today. live: If true, fetch directly from Fitbit API instead of cache. Returns one entry per night with avg, min, max SpO2 percentage. Normal range: 95-100%. Below 90% may indicate sleep apnea.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | – | – | – |
| live | boolean | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_get_weight ~162
Get weight log entries (weight, BMI, body fat percentage). Returns data from the local cache by default. Use live=True to fetch from Fitbit API. Run fitbit_sync first to populate the cache. Weight data is sparse: only days with weigh-in entries are present. Args: start_date: Start date as "YYYY-MM-DD", "YYYY-MM", or "30d". Default: last 30 days. end_date: End date as "YYYY-MM-DD". Default: today. live: If true, fetch directly from Fitbit API instead of cache. Returns one entry per weigh-in with weight_kg, bmi, fat_pct.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | – | – | – |
| live | boolean | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_sync ~362
Sync Fitbit health data to the local cache. Fetches data from the Fitbit API and stores it in SQLite for fast offline queries. Run this before using other fitbit_get_* tools. Syncs incrementally: only fetches data newer than the most recent entry in each table. First sync fetches the specified number of days. Args: data_types: What to sync. Options: "all", "heart_rate", "activity", "exercises", "sleep", "weight", "spo2", "hrv", "azm", "breathing_rate", "skin_temperature", "core_temperature", "cardio_fitness", "food_log". Comma-separated for multiple, e.g. "sleep,hrv". Default: "all". days: Days of history for first sync (default: 30). Ignored on subsequent syncs (uses last synced date). since: Optional "YYYY-MM-DD" backfill date. When set, fetches from this date regardless of what is already cached - use to pull history older than the current cache. Overrides incremental resume and days. until: Optional "YYYY-MM-DD" inclusive end date; requires since. Together they re-fetch and upsert exactly the since..until window - use to repair a gap in the middle of the cache without re-pulling everything from the gap to today. Returns summary of records synced per data type. Not for querying data - use fitbit_get_heart_rate, fitbit_get_activity, fitbit_get_sleep, etc. instead.
| Name | Type | Req | Description |
|---|---|---|---|
| data_types | string | – | – |
| days | integer | – | – |
| since | – | – | – |
| until | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
fitbit_trends ~349
Analyse trends in cached Fitbit data. Computes averages and totals over time from the local cache, auto-syncing if stale. Args: data_type: What to analyse. Options: "heart_rate", "activity", "exercises", "sleep", "weight", "spo2", "hrv", "azm", "breathing_rate", "skin_temperature", "core_temperature", "cardio_fitness", "food_log". Default: "activity". period: Aggregation period. Options: "weekly", "monthly", "quarterly". Default: "monthly". start_date: Start date as "YYYY-MM-DD" or "365d". Default: last 12 months. end_date: End date as "YYYY-MM-DD". Default: today. compare: Compare two periods. Format: "last_30d vs previous_30d", "2026-03 vs 2026-02", "2026-Q1 vs 2025-Q4". When set, period/start_date/end_date are ignored. Returns aggregated averages per period. For activity: steps, distance, active minutes. For exercises: sessions, duration, calories. For sleep: duration, efficiency, stage breakdown. For heart_rate: resting HR min/avg/max. For weight: weight, fat%, BMI. For spo2: avg/min/max oxygen saturation. For hrv: daily and deep RMSSD. Not for raw data - use fitbit_get_* tools instead.
| Name | Type | Req | Description |
|---|---|---|---|
| compare | – | – | – |
| data_type | string | – | – |
| end_date | – | – | – |
| period | string | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
What is the io.github.partymola/fitbit-mcp server?
io.github.partymola/fitbit-mcp is listed in the public MCP registry as io.github.partymola/fitbit-mcp. Retired, superseded by google-health-mcp. Fitbit Web API shuts down 30 Sept 2026. This page covers its PyPI package (fitbit-mcp).
Is the io.github.partymola/fitbit-mcp server safe to use?
io.github.partymola/fitbit-mcp scores 76 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.partymola/fitbit-mcp server expose?
io.github.partymola/fitbit-mcp exposes 18 tools: fitbit_sync, fitbit_get_activity, fitbit_trends, fitbit_get_azm, fitbit_get_breathing_rate, and 13 more. Their descriptions and schemas cost roughly 3,449 tokens of context every time the server is loaded.
Is the io.github.partymola/fitbit-mcp server still maintained?
io.github.partymola/fitbit-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.