← Back to search

google-health-mcp-unofficial

davidbatista Scanned 19d ago

Unofficial local-first Google Health API v4 MCP server for AI health, sleep and activity agents.

C
70.8 / 100

Versions

0.5.7latest
Jul 30, 2026
0.5.6
Jul 30, 2026
0.5.5
Jul 30, 2026
0.5.4
Jul 30, 2026
0.5.3
Jul 16, 2026
+ show 22 moreshow less
0.5.2
Jul 12, 2026
0.5.1
Jun 27, 2026
0.5.0
Jun 27, 2026
0.4.9
Jun 27, 2026
0.4.8
Jun 27, 2026
0.4.7
May 24, 2026
0.4.6
May 24, 2026
0.4.5
May 20, 2026
0.4.4
May 20, 2026
0.4.3
May 19, 2026
0.4.2
May 19, 2026
0.4.1
May 11, 2026
0.4.0
May 11, 2026
0.3.0
May 11, 2026
0.2.2
May 10, 2026
0.2.1
May 10, 2026
0.2.0
May 10, 2026
0.1.4
May 10, 2026
0.1.3
May 7, 2026
0.1.2
May 7, 2026
0.1.1
May 7, 2026
0.1.0
May 7, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 26

google_health_data_inventory
annotations: verified low

Inventory supported Google Health data types, auth scopes, privacy modes and recommended first calls without calling Google APIs.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
google_health_list_data_types
annotations: verified low

List the canonical kebab-case data_type slugs accepted by the data point, reconcile and rollup tools, with each slug's unit, OAuth scope family, and which endpoint verbs (list/reconcile/rollup) support it. Call this before list_data_points, reconcile_data_points, daily_rollup or rollup to choose a valid data_type instead of guessing a slug. Static metadata; does not call Google APIs.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
google_health_data_type_coverage
annotations: verified low

Build a data-type coverage plan from the official Google Health API data-type table, or run explicit live read-only checks against a real OAuth account. Live mode returns only redacted status and point-count buckets, never raw health payloads.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
google_health_agent_manifest
annotations: verified low

Machine-readable install, runtime and client guidance for AI agents. Does not call Google Health or expose secrets.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
google_health_capabilities
annotations: verified low

Explain supported Google Health data, privacy boundaries, beta status and recommended agent workflow.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
google_health_quickstart
annotations: verified low

Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Google Health?'

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
google_health_demo
annotations: verified low

Returns realistic Pixel-Watch-style example payloads of google_health_daily_summary, google_health_wellness_context, and google_health_daily_rollup so agents see the contract before calling real Google Health APIs.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
google_health_get_auth_url
annotations: verified low

Generate a Google OAuth authorization URL for Google Health API. Use this first when no local token exists.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
google_health_exchange_code
annotations: verified low

Exchange a Google OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned. Gated: requires explicit user intent — agents must not call this autonomously.

readOnlyHint false openWorldHint true idempotentHint false destructiveHint false
google_health_get_identity
annotations: verified low

Get the Google Health identity mapping for the authenticated user. Useful for Fitbit-to-Google migrations.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
google_health_get_profile
annotations: verified low

Get authenticated user profile details from Google Health. Requires profile scope.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
google_health_get_settings
annotations: verified low

Get authenticated user settings such as units and timezone. Requires settings scope.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
google_health_list_data_points
annotations: verified low

Query detailed data points for a Google Health data type. Use kebab-case endpoint data types, e.g. steps, sleep, heart-rate.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
google_health_reconcile_data_points
annotations: verified low

Read a reconciled stream for one data type across sources. Supports all-sources, google-wearables and google-sources data source families.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
google_health_daily_rollup
annotations: verified low

Aggregate a data type over civil days using Google Health dailyRollUp. Useful for steps, distance, calories, active minutes, weight and heart summaries.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
google_health_rollup
annotations: verified low

Aggregate a data type over physical time intervals using Google Health rollUp.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
google_health_connection_status
annotations: verified low

Check local Google Health config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Google APIs or exposing secrets.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
google_health_cache_status
annotations: verified low

Show optional local SQLite cache status. Enable with GOOGLE_HEALTH_CACHE=sqlite or GOOGLE_HEALTH_CACHE=true.

response_format enum
readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
google_health_privacy_audit
annotations: verified low

Return local privacy, cache, token-path and env-presence posture without revealing secret values.

response_format enum
readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
google_health_revoke_access
annotations: verified low

Revoke the current Google OAuth grant and delete the local token file. Use only when the user explicitly wants to disconnect Google Health. Gated: requires explicit user intent — agents must not call this autonomously.

response_format enum
readOnlyHint false openWorldHint true idempotentHint false destructiveHint true
google_health_daily_summary
annotations: verified low

Build a practical daily summary from Google Health rollups and reconciled streams when available. Read-only, beta, non-medical.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
google_health_weekly_summary
annotations: verified low

Build a weekly Google Health scorecard with activity, sleep, heart context and missing-data awareness. Read-only, beta, non-medical.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
google_health_wellness_context
annotations: verified low

Normalize Google Health activity/sleep context into the shared wellness_context shape for recommendation engines.

patch record response_format enum explicit_user_intent boolean
readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
google_health_profile_get
annotations: verified low

Read the shared Delx Wellness profile from ~/.delx-wellness/profile.json. Returns preferred name, goals, devices, training/nutrition/exercise/agent preferences and safety flags. NEVER contains OAuth tokens or API secrets. Read-only.

patch record response_format enum explicit_user_intent boolean
readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
google_health_profile_update
annotations: verified low

Persist a partial patch to ~/.delx-wellness/profile.json. Requires explicit_user_intent=true (otherwise returns USER_ACTION_REQUIRED). Rejects secret-like fields (oauth, token, secret, password, cookie, refresh, api_key, session) at write time. Use to record preferred name, goals, devices, training context, nutrition context, exercise preferences, agent preferences, and safety flags.

patch record response_format enum explicit_user_intent boolean
readOnlyHint false openWorldHint false idempotentHint false destructiveHint false
google_health_onboarding
annotations: verified low

Return the 11-question onboarding flow plus the current profile state and missing fields. Read-only — does NOT persist anything. Pair with google_health_profile_update once the user answers. Cross-connector: the same profile is shared by every Delx Wellness MCP (whoop, garmin, oura, fitbit, strava, polar, withings, apple-health, samsung-health, google-health, nourish, cycle-coach, cgm, air).

locale enum response_format enum
readOnlyHint true openWorldHint false idempotentHint true destructiveHint false

Permissions 3

shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
network medium
Server uses network capabilities via: fetch()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 68

info
Tool 'google_health_get_auth_url' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_data_inventory' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_list_data_types' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_data_type_coverage' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_agent_manifest' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_capabilities' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_quickstart' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_demo' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_exchange_code' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_get_identity' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_get_profile' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_get_settings' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_list_data_points' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_reconcile_data_points' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_daily_rollup' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_rollup' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_connection_status' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_cache_status' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_privacy_audit' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_revoke_access' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_daily_summary' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_weekly_summary' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_wellness_context' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_profile_get' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_profile_update' annotations are consistent annotation_checker · 80%
info
Tool 'google_health_onboarding' annotations are consistent annotation_checker · 80%
high
Hardcoded OAuth client secret in davidmosiah-google-health-mcp-7f701a9/scripts/declared-limits-test.mjs auth_checker · 95%
high
Hardcoded OAuth client secret in davidmosiah-google-health-mcp-7f701a9/scripts/headless-auth-test.mjs auth_checker · 95%
high
Hardcoded OAuth client secret in davidmosiah-google-health-mcp-7f701a9/scripts/cli-ux-test.mjs auth_checker · 95%
high
Hardcoded OAuth client secret in davidmosiah-google-health-mcp-7f701a9/scripts/agent-readiness-test.mjs auth_checker · 95%
high
Hardcoded OAuth client secret in davidmosiah-google-health-mcp-7f701a9/scripts/endpoint-contract-test.mjs auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
info
package.json metadata manifest_parser · 100%
info
Tool: google_health_data_inventory manifest_parser · 85%
info
Tool: google_health_list_data_types manifest_parser · 85%
info
Tool: google_health_data_type_coverage manifest_parser · 85%
info
Tool: google_health_agent_manifest manifest_parser · 85%
info
Tool: google_health_capabilities manifest_parser · 85%
info
Tool: google_health_quickstart manifest_parser · 85%
info
Tool: google_health_demo manifest_parser · 85%
info
Tool: google_health_get_auth_url manifest_parser · 85%
info
Tool: google_health_exchange_code manifest_parser · 85%
info
Tool: google_health_get_identity manifest_parser · 85%
info
Tool: google_health_get_profile manifest_parser · 85%
info
Tool: google_health_get_settings manifest_parser · 85%
info
Tool: google_health_list_data_points manifest_parser · 85%
info
Tool: google_health_reconcile_data_points manifest_parser · 85%
info
Tool: google_health_daily_rollup manifest_parser · 85%
info
Tool: google_health_rollup manifest_parser · 85%
info
Tool: google_health_connection_status manifest_parser · 85%
info
Tool: google_health_cache_status manifest_parser · 85%
info
Tool: google_health_privacy_audit manifest_parser · 85%
info
Tool: google_health_revoke_access manifest_parser · 85%
info
Tool: google_health_daily_summary manifest_parser · 85%
info
Tool: google_health_weekly_summary manifest_parser · 85%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%
info
Tool: google_health_wellness_context manifest_parser · 85%
info
Tool: google_health_profile_get manifest_parser · 85%
info
Tool: google_health_profile_update manifest_parser · 85%
info
Tool: google_health_onboarding manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (7) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
critical
Tool poisoning in 'google_health_list_data_types': Cross-tool sequencing directive poisoning · 85%
info
SBOM generated: 173 components sbom_generator · 100%