MCP.Market

Whoop MCP server

by souravpn·io.github.souravpn/whoop-mcp·v1.0.2
No reviews yet

MCP server for WHOOP — gives Claude access to your recovery, sleep, strain, and workout data

D54/100grade D
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
D54/100

full report

Adoption
New

0 stars38 downloads/wk

Reviews

Write one

Nobody has reviewed Whoop yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Whoop tools (8)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • get_latest_workout

    Get the user's most recent WHOOP workout — sport type, duration, strain, heart rate zones, and calories

  • get_profile

    Get the user's WHOOP profile (name, email) and body measurements (height, weight, max heart rate)

  • get_recovery

    Get the user's most recent WHOOP recovery score, HRV, resting heart rate, and SpO2

  • get_recovery_trend

    Get the user's WHOOP recovery scores over the past N days (default 7) for trend analysis

  • get_sleep

    Get the user's most recent WHOOP sleep data including duration, sleep stages (light, deep/SWS, REM), efficiency, and respiratory rate

  • get_sleep_trend

    Get the user's WHOOP sleep data over the past N days (default 7) for trend analysis

  • get_strain

    Get the user's current day strain score, average heart rate, and calories burned from WHOOP

  • get_workout_history

    Get the user's recent WHOOP workout history — useful for understanding training load and patterns

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

1 high
  • Code scan9 source files scanned13/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 123 days ago8/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (1)

  • highShell command built from a string (injection risk)exec.shell-concat
    dist/auth-setup.js: …_process').then(({ exec }) => { exec(`open "${authUrl.toString()}"`); }).catch(() …
Overall 54/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Whoop compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
54/100
higher than 10% of 48,255 servers
Tools
8
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
38
more than 29% of 12,191 servers with a package

What its tools let an agent do: 8 read

Install Whoop in Claude Code, Cursor or VS Code

Runs npx -y @souravpn/whoop-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add whoop-mcp -- npx -y @souravpn/whoop-mcp
Add to Cursor

Whoop: common questions

Is Whoop MCP server safe?
Not recommended: it is graded D (54/100). Read the Whoop safety report
How do I install Whoop?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Whoop need an API key?
Yes. The registry entry asks for WHOOP_CLIENT_SECRET.
Is Whoop maintained?
The last commit was 161 days ago (2026-05-27). The latest release is v1.0.2.
How does Whoop compare with other MCP servers?
safety score 54/100 (higher than 10% of 48,255 servers); tools 8 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.