WHOOP — MissingMCP MCP server

MissingMCP

The MCP servers exist. Connecting them shouldn't be complicated.

A multi-user, OAuth 2.1–protected gateway that hosts the connectors Claude is missing, so a small trusted circle can connect their own accounts from any Claude client (iOS, Android, Web, Desktop). The flagship connector is Garmin Connect: the gateway wraps the unmodified garminmcp worker and adds OAuth, per-user token isolation, and a reverse proxy. WHOOP is served the same way but in-process, on WHOOP's own official OAuth v2 API. The core is adapter-based and supports three forward strategies — worker (garmin), local (whoop, in-process, no subprocess), and remote** (MCP + header injection, for services with a hosted MCP that lacks its own OAuth) — see Connectors. The reference deployment runs at missingmcp.com.

Claude → POST /garmin/mcp (Bearer) → Gateway → 127.0.0.1:<port>/mcp (per-user garmin_mcp) → connect.garmin.com

Why

garminmcp is a great MCP server, but it's single-user and stdio-only: each person has to run it locally with their own Garmin tokens. This gateway makes it a remote MCP server** any Claude client can connect to over HTTP, with a proper OAuth sign-in flow — so non-technical users just click "connect" and log in with their Garmin credentials, and never touch a terminal or a token file.

Features

Registration. Connect from any Claude client; no manual token wrangling.

• OAuth 2.1 — Authorization Code + PKCE (S256) with Dynamic Client

only the resulting session tokens are persisted.

• Garmin password is never stored — used once to sign in (MFA supported);

GATEWAY_SECRET. Bearer tokens are stored only as SHA-256 hashes.

• Encrypted at rest — tokens sealed with AES-256-GCM; the DB is useless without

127.0.0.1, started on demand and reaped when idle.

• Per-user isolation — each account gets its own garmin_mcp worker bound to

limits, the garmin_mcp worker pinned to a reviewed commit.

• Hardened — one-time 10-min auth codes, CSRF on forms, per-IP/-token rate

bucket (see Backups).

• Off-box backups — periodic encrypted SQLite snapshots to an S3-compatible

unknown paths.

• Instructional landing page served on / and as a friendly fallback for

Deploy

Railway (how missingmcp.com runs): one service built from the Dockerfile, a volume mounted at /data, a single replica (the gateway keeps process-local state by design), and TLS terminated at the Railway edge. Set the env vars from Configuration on the service; pushes to main deploy automatically once the service is connected to the GitHub repo. An optional Railway bucket enables Backups (railway bucket create backups, then wire its credentials as the BACKUPS3 variables).

Self-hosted (plain Docker):

cp .env.example .env          # set GATEWAY_SECRET, PUBLIC_URL, pin GARMIN_MCP_REF
docker build -t missingmcp .
docker run -d --name missingmcp --restart unless-stopped --env-file .env \
  -p 127.0.0.1:8080:8080 -v missingmcp-data:/data missingmcp

Put any TLS-terminating proxy in front (Caddy, nginx, Traefik). One non-obvious requirement: /​/mcp streams SSE, so disable response buffering and raise the read timeout (nginx: proxybuffering off; proxyread_timeout 3600s;). Then add https:///garmin/mcp as a remote MCP server in Claude.

Local development

uv pip install -e ".[dev]"
uv run --extra dev pytest -q                 # run the test suite

# Run the gateway locally (no Garmin account needed to exercise the OAuth surface).

Shortened. The full README is on GitHub.