io.github.proscar87/oura-mcp
PYPI · MCP-OURA · SCANNED AUG 18
The Oura v2 API as an MCP server. Paginates, fixes the date range, warns when data is missing.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 2 of 30 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability76
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 881 tokens (~220/item across 4 items; 3 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability check failed: the tool surface changed between 0.2.0 and 0.3.3: 3 tool removals, 0 breaking changes, 3 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
pypi · mcp-oura
claude mcp add proscar87-oura-mcp -- uvx mcp-oura
codex mcp add proscar87-oura-mcp -- uvx mcp-oura
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"proscar87-oura-mcp": {
"type": "local",
"command": [
"uvx",
"mcp-oura"
],
"enabled": true
}
}
} openclaw mcp add proscar87-oura-mcp --command uvx --arg mcp-oura
mcp_servers:
proscar87-oura-mcp:
command: "uvx"
args: ["mcp-oura"] {
"mcpServers": {
"proscar87-oura-mcp": {
"command": "uvx",
"args": [
"mcp-oura"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 18 Aug 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 0.3.2 → 0.3.3 functional
- 12 Aug 26 +2
- Schema quality: 262 → 220 ▲ functional
- First check of Schema quality: 100 functional
- Schema quality: excellent → good functional
- Package version: 0.3.1 → 0.3.2 functional
- 11 Aug 26 +15
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 10 Aug 26 −8
- Stability: unverified → fail ▼ security
- Malware scan: pass → unverified ▼ security
- Schema quality: 287 → 256 ▲ functional
- Schema quality: poor → excellent functional
- Package version: 0.2.0 → 0.3.1 functional
- Package version: 0.2.0 → 0.3.0 functional
- 9 Aug 26 60
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 18 Aug 2026 · Analysed pypi/mcp-oura@0.3.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Dependencies 30 packages
| Packages resolved | 30 |
|---|---|
| Stale | 1 |
| No linked repository | 1 |
| Tree resolution | Complete |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
oura_check Self-check of the Oura connection ~63
Self-check: is there a credential, and does Oura respond? Exposing nothing. Returns neither the token nor any health value. It reports the token's LENGTH, never the token: diagnostic messages are the ones most often copied into chats and issues.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
oura_collections Oura collection catalog ~43
The 19 Oura collections, what each one carries and which parameters it takes. Use it before `oura_query` if you are unsure of the exact name.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
oura_query Query an Oura collection ~358
Fetches a COMPLETE Oura collection over the requested range. Follows pagination to the end: Oura returns `next_token` and whoever doesn't chase it receives the first page with nothing saying so. One local day of `heartrate` is 1,231 samples across 2 pages; a month, ~37,000. The range is INCLUSIVE on both ends: equal `start` and `end` return that day. Oura does not behave that way — some collections exclude the last day and others don't, and `workout` is skewed to UTC — but that is corrected here. Date-range collections use YYYY-MM-DD. `heartrate` and `ring_battery_level` use ISO 8601 with time. `personal_info` and `ring_configuration` take no range.
| Name | Type | Req | Description |
|---|---|---|---|
| collection | string | yes | Exact name. See `oura_collections` if you are unsure. |
| day | – | – | Shorthand for a single day: equivalent to start=end=day. |
| end | – | – | YYYY-MM-DD, or ISO 8601 with time |
| fields | – | – | Only these fields. Oura trims on its side, so less comes down: use it on long heartrate ranges. `day` and `id` always come back. |
| format | string | – | `json` (default) or `csv`. CSV for large volumes: a month of heartrate is ~37,000 records and in JSON the keys repeat 37,000 times. |
| latest | boolean | – | Only the most recent record. heartrate and ring_battery_level only; it needs no range. |
| start | – | – | YYYY-MM-DD, or ISO 8601 with time |
No output schema declared.
No examples provided.