← Back to search

io.github.anup-shesh/garmin-local-mcp

anup-shesh Scanned 1d ago

Local-first Garmin data warehouse: sync once to SQLite, analyze trends and correlations offline.

C
69.2 / 100

Versions

0.1.1latest
first seen Jul 8, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 12

auth_status
annotations: none low

Check whether stored Garmin Connect tokens exist. Use before sync, or when a sync failed with an auth error.

sync
annotations: none low

Fetch up to 60 days from Garmin Connect into the local store. Default: last 30 days ending yesterday. Use for catch-ups; multi-month backfills belong in the CLI.

end string start string endpoints string
sync_status
annotations: none low

Show local data coverage per table, last sync time, and pending sync errors. Use to see what date ranges are queryable.

get_day
annotations: none low

One merged view of a single day (YYYY-MM-DD): wellness, sleep, HRV, training status, activities, and data-quality flags. Use for 'how was <date>' questions.

date str
query_metrics
annotations: none low

Columnar time series for one or more metrics (e.g. resting_hr, sleep_score, steps) between two dates. Prefer weekly/monthly aggregate for ranges over ~60 days; stats=True adds mean/min/max/sd per metric.

end str start str stats bool metrics string aggregate str
correlate
annotations: none low

Pearson/Spearman correlation between two metrics (default: last 30 days). Positive lag_days pairs metric_a on day D with metric_b on D+lag; scan_lags=True searches lags -7..+7 for the strongest relationship.

end string start string lag_days int metric_a str metric_b str scan_lags bool
baselines
annotations: none low

Personal mean +/- sd band per metric over a trailing window (default 28 days; default metrics: resting_hr, hrv, sleep_score, skin_temp_dev_c, stress_avg, steps). Use to judge whether today's value is normal *for this user*.

metrics string window_days string
anomalies
annotations: none low

Outlier days (>= z standard deviations from the range mean) and sustained streaks (5+ consecutive days on one side of it). Default: last 30 days of the core wellness metrics.

z float end string start string metrics string
list_activities
annotations: none low

List recent activities newest-first as a compact table, filterable by type (e.g. 'running'), date range, and minimum distance. truncated=true means more rows exist beyond the limit.

end string type string limit int start string min_distance_m string
get_activity
annotations: none low

Full stored summary row for one activity by id (from list_activities). Summary fields only - no GPS or sample streams.

activity_id int
gaps
annotations: none low

Missing days per table plus unresolved sync errors (default: first synced date through yesterday). Use to find holes worth re-syncing before drawing conclusions.

end string start string
import_fit
annotations: none low

Import one manually exported Garmin wellness FIT bundle (folder of .fit files) - zero-auth offline ingest. Existing API-sourced rows are never overwritten.

folder str

Permissions 3

filesystem low
Server uses filesystem capabilities via: open(), os, pathlib, shutil
database medium
Server uses database capabilities via: sqlite3
env_vars low
Server uses env_vars capabilities via: os.environ

Scan Findings 47

low
Tool 'auth_status' has no annotations annotation_checker · 100%
low
Tool 'sync' has no annotations annotation_checker · 100%
low
Tool 'sync_status' has no annotations annotation_checker · 100%
low
Tool 'get_day' has no annotations annotation_checker · 100%
low
Tool 'query_metrics' has no annotations annotation_checker · 100%
low
Tool 'correlate' has no annotations annotation_checker · 100%
low
Tool 'baselines' has no annotations annotation_checker · 100%
low
Tool 'anomalies' has no annotations annotation_checker · 100%
low
Tool 'list_activities' has no annotations annotation_checker · 100%
low
Tool 'get_activity' has no annotations annotation_checker · 100%
low
Tool 'gaps' has no annotations annotation_checker · 100%
low
Tool 'import_fit' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: mcp@1.0,<2 (GHSA-3qhf-m339-9g5v) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0,<2 (GHSA-9h52-p55h-vw2f) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0,<2 (GHSA-j975-95f5-7wqh) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0,<2 (GHSA-jpw9-pfvf-9f58) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0,<2 (GHSA-vj7q-gjh5-988w) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0,<2 (PYSEC-2026-1616) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0,<2 (PYSEC-2026-1617) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0,<2 (PYSEC-2026-1618) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0,<2 (PYSEC-2026-3482) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0,<2 (PYSEC-2026-3483) dependency_analyzer · 95%
medium
Vulnerable dependency: garminconnect@0.3.6,<0.4 (GHSA-wjhr-76vg-2hvc) dependency_analyzer · 95%
medium
Vulnerable dependency: garminconnect@0.3.6,<0.4 (PYSEC-2026-3467) dependency_analyzer · 95%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: auth_status manifest_parser · 90%
info
Tool: sync manifest_parser · 90%
info
Tool: sync_status manifest_parser · 90%
info
Tool: get_day manifest_parser · 90%
info
Tool: query_metrics manifest_parser · 90%
info
Tool: correlate manifest_parser · 90%
info
Tool: baselines manifest_parser · 90%
info
Tool: anomalies manifest_parser · 90%
info
Tool: list_activities manifest_parser · 90%
info
Tool: get_activity manifest_parser · 90%
info
Tool: gaps manifest_parser · 90%
info
Tool: import_fit manifest_parser · 90%
info
Required env vars (5) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
low
Permission: filesystem access detected permission_analyzer · 90%
medium
Permission: database access detected permission_analyzer · 90%
low
Permission: env_vars access detected permission_analyzer · 90%
info
No dependency files found for SBOM generation sbom_generator · 100%
high
Hardcoded Password found in anup-shesh-garmin-local-mcp-8a716f5/src/garmin_mcp/login.py secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%