← Back to search

Withings Health Data

akutishevsky streamable_http Scanned 14d ago

MCP server for Withings health data — sleep, activity, heart, and body metrics.

D
40 / 100

Versions

1.3.0latest
first seen May 19, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 14

echo
annotations: none low

Returns its input, so tools/call has something to assert.

list_heart_records
annotations: none low

Get a list of ECG (electrocardiogram) records with Afib (atrial fibrillation) classification for a given time period. Returns ECG metadata including signal IDs, timestamps, heart rate, Afib detection results, and blood pressure measurements (if taken with BPM Core). Use the signal ID from this list with get_heart_signal to retrieve the full ECG waveform data. IMPORTANT: Before executing this tool, if the user's request references relative dates (like 'today', 'yesterday', 'last week', 'this month'), check if there is a date/time MCP tool available to detect the current date and time first.

get_heart_signal
annotations: none low

Get detailed ECG (electrocardiogram) signal data in micro-volts (μV) for a specific recording. Returns high-frequency waveform data with sampling information. Recording duration: BPM Core (20s), Move ECG/ScanWatch (30s). Sampling frequency: BPM Core (500 Hz), Move ECG/ScanWatch (300 Hz). First use list_heart_records to get the signal ID.

get_hrv
annotations: none low

Get heart rate variability (HRV) captured during sleep at minute-level resolution. Returns timestamp-keyed maps of RMSSD (root mean square of successive differences), SDNN (standard deviation of NN intervals), and HRV quality scores. RMSSD and SDNN values are in milliseconds; sample-map keys are Unix timestamps in seconds. Use one sleep period per request: Withings returns at most the first 24 hours after startdate. IMPORTANT: Before executing this tool, if the user's request references relative dates (like 'today', 'yesterday', or 'last night'), check if there is a date/time MCP tool available to detect the current date and time first.

get_sleep
annotations: none low

Get high-frequency sleep data captured during sleep, including sleep stages and health metrics at minute-level resolution. Use this for detailed analysis of sleep patterns. For aggregated summaries, use get_sleep_summary instead. Note: If startdate and enddate are separated by more than 24h, only the first 24h after startdate will be returned. IMPORTANT: Before executing this tool, if the user's request references relative dates (like 'today', 'yesterday', 'last week', 'this month'), check if there is a date/time MCP tool available to detect the current date and time first.

get_sleep_summary
annotations: none low

Get aggregated sleep activity summaries for specified date range. Returns comprehensive sleep metrics including duration, stages, quality scores, heart rate, breathing analysis, and sleep apnea indicators. Use this for daily/weekly sleep reports. For detailed minute-by-minute data, use get_sleep instead. IMPORTANT: Before executing this tool, if the user's request references relative dates (like 'today', 'yesterday', 'last week', 'this month'), check if there is a date/time MCP tool available to detect the current date and time first.

list_stetho_records
annotations: none low

Get a list of stethoscope recordings for a given time period. Returns metadata including signal IDs, timestamps, device IDs, valve heart disease (VHD) indicators, and timezone information. Use the signal ID from this list with get_stetho_signal to retrieve the full audio signal data. IMPORTANT: Before executing this tool, if the user's request references relative dates (like 'today', 'yesterday', 'last week', 'this month'), check if there is a date/time MCP tool available to detect the current date and time first.

get_stetho_signal
annotations: none low

Get detailed stethoscope audio signal data for a specific recording. Returns the raw audio signal array along with technical metadata including frequency, duration, format, size, resolution, channel information, device model, stethoscope position, and valve heart disease (VHD) indicators. First use list_stetho_records to get the signal ID.

get_measures
annotations: none low

Get health measures including weight, height, body composition, blood pressure, heart rate, temperature, and more. Supports single or multiple measure types. IMPORTANT: Before executing this tool, if the user's request references relative dates (like 'today', 'yesterday', 'last week', 'this month'), check if there is a date/time MCP tool available to detect the current date and time first.

get_workouts
annotations: none low

Get workout summaries including calories burned, heart rate data, distance, steps, elevation, and swimming metrics. Returns aggregated data for each workout session. By default returns ALL available data fields. IMPORTANT: Before executing this tool, if the user's request references relative dates (like 'today', 'yesterday', 'last week', 'this month'), check if there is a date/time MCP tool available to detect the current date and time first.

get_activity
annotations: none low

Get daily aggregated activity data including steps, distance, elevation, heart rate, calories, and activity durations (soft/moderate/intense). Returns summary data aggregated per day. IMPORTANT: Before executing this tool, if the user's request references relative dates (like 'today', 'yesterday', 'last week', 'this month'), check if there is a date/time MCP tool available to detect the current date and time first.

get_intraday_activity
annotations: none low

Get high-frequency intraday activity data captured throughout the day. Returns time-series data with timestamps. Note: If startdate and enddate are separated by more than 24h, only the first 24h after startdate will be returned. If no dates provided, returns most recent activity data. IMPORTANT: Before executing this tool, if the user's request references relative dates (like 'today', 'yesterday', 'last week', 'this month'), check if there is a date/time MCP tool available to detect the current date and time first.

get_user_devices
annotations: none low

Get the list of devices linked to the user's account. Returns device information including type, model, battery level, MAC address, firmware version, network status, timezone, and session dates.

get_user_goals
annotations: none low

Get the user's health and fitness goals. Returns goals for steps (daily step count target), sleep (daily sleep duration target in seconds), and weight (target weight with value and unit).

Permissions 2

network medium
Server uses network capabilities via: fetch()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 63

low
Tool 'echo' has no annotations annotation_checker · 100%
low
Tool 'list_heart_records' has no annotations annotation_checker · 100%
low
Tool 'get_heart_signal' has no annotations annotation_checker · 100%
low
Tool 'get_hrv' has no annotations annotation_checker · 100%
low
Tool 'get_sleep' has no annotations annotation_checker · 100%
low
Tool 'get_sleep_summary' has no annotations annotation_checker · 100%
low
Tool 'list_stetho_records' has no annotations annotation_checker · 100%
low
Tool 'get_stetho_signal' has no annotations annotation_checker · 100%
low
Tool 'get_measures' has no annotations annotation_checker · 100%
low
Tool 'get_workouts' has no annotations annotation_checker · 100%
low
Tool 'get_activity' has no annotations annotation_checker · 100%
low
Tool 'get_intraday_activity' has no annotations annotation_checker · 100%
low
Tool 'get_user_devices' has no annotations annotation_checker · 100%
low
Tool 'get_user_goals' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client secret in akutishevsky-withings-mcp-a7f78f5/tests/oauth.test.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: hono@4.12.31 (GHSA-54fx-42gc-7vw4) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.31 (GHSA-79qm-7rj5-m7r9) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.31 (GHSA-8j4g-w8fx-2239) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.31 (GHSA-crvj-82cr-hjcx) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.31 (GHSA-f23p-vx2j-j53r) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.31 (GHSA-g6gw-c38x-mqfc) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.31 (GHSA-gqvv-2mrq-wpjv) dependency_analyzer · 95%
medium
Vulnerable dependency: hono@4.12.31 (GHSA-hxh3-vqpv-xpqv) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in akutishevsky-withings-mcp-a7f78f5/tests/oauth.test.ts:22 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in akutishevsky-withings-mcp-a7f78f5/tests/session-ownership.test.ts:38 entropy_analyzer · 70%
medium
Buffer.from base64 in akutishevsky-withings-mcp-a7f78f5/tests/encryption.test.ts:48 entropy_analyzer · 75%
medium
Buffer.from base64 in akutishevsky-withings-mcp-a7f78f5/tests/encryption.test.ts:52 entropy_analyzer · 75%
medium
Buffer.from base64 in akutishevsky-withings-mcp-a7f78f5/tests/encryption.test.ts:54 entropy_analyzer · 75%
medium
Buffer.from base64 in akutishevsky-withings-mcp-a7f78f5/tests/encryption.test.ts:70 entropy_analyzer · 75%
medium
Buffer.from base64 in akutishevsky-withings-mcp-a7f78f5/tests/encryption.test.ts:71 entropy_analyzer · 75%
medium
Buffer.from base64 in akutishevsky-withings-mcp-a7f78f5/tests/encryption.test.ts:87 entropy_analyzer · 75%
medium
Buffer.from base64 in akutishevsky-withings-mcp-a7f78f5/tests/encryption.test.ts:111 entropy_analyzer · 75%
medium
Buffer.from base64 in akutishevsky-withings-mcp-a7f78f5/tests/encryption.test.ts:117 entropy_analyzer · 75%
medium
Buffer.from base64 in akutishevsky-withings-mcp-a7f78f5/tests/encryption.test.ts:123 entropy_analyzer · 75%
medium
Buffer.from base64 in akutishevsky-withings-mcp-a7f78f5/tests/encryption.test.ts:124 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in akutishevsky-withings-mcp-a7f78f5/tests/encryption.test.ts:13 entropy_analyzer · 70%
medium
Buffer.from base64 in akutishevsky-withings-mcp-a7f78f5/src/utils/encryption.ts:76 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: echo manifest_parser · 85%
info
Tool: list_heart_records manifest_parser · 85%
info
Tool: get_heart_signal manifest_parser · 85%
info
Tool: get_hrv manifest_parser · 85%
info
Tool: get_sleep manifest_parser · 85%
info
Tool: get_sleep_summary manifest_parser · 85%
info
Tool: list_stetho_records manifest_parser · 85%
info
Tool: get_stetho_signal manifest_parser · 85%
info
Tool: get_measures manifest_parser · 85%
info
Tool: get_workouts manifest_parser · 85%
info
Tool: get_activity manifest_parser · 85%
info
Tool: get_intraday_activity manifest_parser · 85%
info
Tool: get_user_devices manifest_parser · 85%
info
Tool: get_user_goals manifest_parser · 85%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (3) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: env_vars access detected permission_analyzer · 90%
critical
Tool poisoning in 'get_heart_signal': Cross-tool prerequisite: 'first call/use' poisoning · 85%
critical
Tool poisoning in 'get_stetho_signal': Cross-tool prerequisite: 'first call/use' poisoning · 85%
info
SBOM generated: 8 components sbom_generator · 100%
critical
Database URL with Password found in akutishevsky-withings-mcp-a7f78f5/package.json secret_scanner · 85%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%