MCP.Market

Fitbitmcp MCP server

by davidmosiah·io.github.davidmosiah/fitbitmcp·v0.4.5·5 stars
No reviews yet

Privacy-first, unofficial Fitbit MCP server for AI health, sleep, activity and heart-rate agents.

B83/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B83/100

full report

Adoption
Growing

5 stars419 downloads/wk

Reviews

Write one

Nobody has reviewed Fitbitmcp yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Fitbitmcp tools (20, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • fitbit_agent_manifest

    Machine-readable install, runtime and client guidance for AI agents. Does not call Fitbit or expose secrets.

  • fitbit_cache_status

    Show optional local SQLite cache status. Enable with FITBIT_CACHE=sqlite or FITBIT_CACHE=true.

  • fitbit_capabilities

    Explain supported Fitbit data, privacy boundaries, recommended agent workflow and project links.

  • fitbit_connection_status

    Check local Fitbit config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Fitbit or exposing secrets.

  • fitbit_daily_summary

    Build a practical daily summary from Fitbit activity, sleep, heart-rate, HRV and weight data when available. Read-only and non-medical.

  • fitbit_data_inventory

    Inventory supported Fitbit data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call Fitbit APIs or expose user data.

  • fitbit_demo

    Returns realistic example payloads of fitbit_daily_summary, fitbit_wellness_context, and fitbit_get_heart_day so agents see the contract before calling real Fitbit APIs.

  • fitbit_exchange_code

    Exchange a Fitbit OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned.

  • fitbit_get_auth_url

    Generate a Fitbit OAuth authorization URL. Use this first when no local token exists.

  • fitbit_get_heart_intraday

    Get heart-rate intraday samples for a date. Personal apps can access their own intraday data; third-party client/server apps may require Fitbit approval. Requires heartrate scope. Not medical advice.

  • fitbit_get_profile

    Get the authenticated Fitbit user profile. Requires profile scope.

  • fitbit_list_devices

    List devices connected to the authenticated Fitbit account. Requires settings scope.

  • fitbit_onboarding

    Read-only. Return the 11-question Delx Wellness onboarding flow (en or pt-BR), the current shared profile, missing critical fields, and a cross-connector hint. Use this when the user starts a fresh wellness session and you need to fill out preferred_name, goals, devices, training context, nutrition, preferences, and safety.

  • fitbit_privacy_audit

    Return local privacy, cache, token-path and env-presence posture without revealing secret values.

  • fitbit_profile_get

    Read the canonical Delx Wellness profile shared with the other wellness MCP connectors (Nourish, Cycle Coach, CGM, etc.). Read-only. Profile stores only what the user typed during onboarding — never OAuth tokens, API keys, or biomarkers.

  • fitbit_profile_updatewrite action

    Persist a partial patch to the canonical Delx Wellness profile. Requires explicit_user_intent=true after the user confirms they want to save. Rejects secret-like fields (oauth, token, api_key, password, cookie, refresh, session).

  • fitbit_quickstart

    Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Fitbit?'

  • fitbit_revoke_access

    Revoke the current Fitbit OAuth grant and delete the local token file. Use only when the user explicitly wants to disconnect Fitbit.

  • fitbit_weekly_summary

    Build a weekly Fitbit scorecard with activity, sleep, heart-rate, HRV availability, bottlenecks and actions. Read-only and non-medical.

  • fitbit_wellness_context

    Normalize Fitbit sleep and activity load into the shared wellness_context shape for recommendation engines.

Public scan report

scanner v0.1.10 · 2026-11-10 · same rubric, same numbers if you re-run it

no findings
  • Code scan58 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 5 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Fitbitmcp compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
83/100
higher than 65% of 48,114 servers
Tools
20
the typical server has 7
Tools that change things
5%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
5
more than 83% of 28,851 servers
Downloads a week
419
more than 86% of 15,093 servers with a package

What its tools let an agent do: 19 read · 1 change

Install Fitbitmcp in Claude Code, Cursor or VS Code

Runs npx -y fitbit-mcp-unofficial on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add fitbitmcp -- npx -y fitbit-mcp-unofficial
Add to Cursor

What the publisher says

From the Fitbitmcp repository's README, as published. We do not edit it. Read it on GitHub

<!-- delx-wellness header v2 --> Fitbit MCP

Give your AI agent your Fitbit activity, sleep, heart and HRV data &mdash; locally. Local-first MCP server &mdash; tokens never leave your machine.

⚡ One-command install with Delx Wellness for Hermes:

npx -y delx-wellness-hermes setup &mdash; preconfigures this connector and the other 8 in a dedicated Hermes profile.

Or wire it standalone into Claude Desktop / Cursor / ChatGPT Desktop &mdash; see the install section below.

HTTP (v2 stateless)

Default is stdio. Optional Streamable HTTP — no session id, JSON responses, loopback only:

npx -y fitbit-mcp-unofficial --http
# GET  http://127.0.0.1:3000/health
# POST http://127.0.0.1:3000/mcp   (sessionless)

Env: FITBITMCPHOST, FITBITMCPPORT, FITBITMCPTRANSPORT=http.

<!-- /delx-wellness header v2 -->

Local-first MCP server that connects AI agents to your Fitbit activity, sleep, heart-rate, HRV, SpO2 and weight data.

Unofficial project. Not affiliated with, endorsed by or supported by Fitbit or Google. Use this only with your own Fitbit account and in line with the Fitbit Web API terms.

Platform migration risk: Fitbit is migrating to the Google Health API. OAuth, base URL, scopes and reconnection flows may change in 2026. Treat any breakage as platform drift and check the Fitbit Web API docs before reporting it as a bug.

Built by David Mosiah for people who use Claude, Cursor, Hermes, OpenClaw or other MCP-compatible agents to think about activity, sleep and heart context — without copy-pasting numbers from the Fitbit app.

Part of Delx Wellness, a registry of local-first wellness MCP connectors.

If this connector helps your agent workflow, please star the repo. Stars make the project easier for other AI builders to discover and help Delx keep shipping local-first wellness infrastructure.

Why this exists

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Fitbitmcp: common questions

Is Fitbitmcp MCP server safe?
Mostly: it is graded B (83/100). Read the Fitbitmcp safety report
How do I install Fitbitmcp?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Fitbitmcp need an API key?
Yes. The registry entry asks for FITBIT_CLIENT_SECRET.
Is Fitbitmcp maintained?
The last commit was 10 days ago (2026-11-05). The latest release is v0.4.5.
How does Fitbitmcp compare with other MCP servers?
safety score 83/100 (higher than 65% of 48,114 servers); tools 20 (the typical server has 7); tools that change things 5% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

More from davidmosiah →