← Back to search

io.github.davidmosiah/garminmcp

davidmosiah Scanned 18h ago

Privacy-first MCP server for Garmin Connect health, sleep, recovery and activities.

B
83.5 / 100

Versions

0.5.8latest
Jul 30, 2026
0.5.7
Jul 30, 2026
0.5.6
Jul 30, 2026
0.5.5
Jul 30, 2026
0.5.4
Jul 16, 2026
+ show 18 moreshow less
0.5.3
Jun 27, 2026
0.5.2
Jun 27, 2026
0.5.1
May 29, 2026
0.5.0
May 29, 2026
0.4.5
May 24, 2026
0.4.4
May 24, 2026
0.4.3
May 20, 2026
0.4.2
May 20, 2026
0.4.1
May 11, 2026
0.4.0
May 11, 2026
0.3.0
May 10, 2026
0.2.1
May 6, 2026
0.2.0
May 4, 2026
0.1.4
May 4, 2026
0.1.3
May 4, 2026
0.1.2
May 4, 2026
0.1.1
May 4, 2026
0.1.0
May 4, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 18

garmin_cache_status
annotations: verified low

Show optional local SQLite cache status. Enable with GARMIN_CACHE=sqlite or GARMIN_CACHE=true.

response_format enum
readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
garmin_privacy_audit
annotations: verified low

Return local privacy, cache, token-path and env-presence posture without revealing secret values.

response_format enum
readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
garmin_disconnect_local
annotations: verified low

Delete the local Garmin token file. This does not change the Garmin account; use only when the user explicitly wants to disconnect this MCP. Gated by explicit_user_intent: true (requires explicit user intent).

response_format enum
readOnlyHint false openWorldHint false idempotentHint false destructiveHint true
garmin_daily_summary
annotations: verified low

Build a practical daily summary from Garmin activity, sleep, heart-rate, HRV, stress and Body Battery when available. Read-only and non-medical.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
garmin_data_inventory
annotations: verified low

Inventory supported Garmin data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call Garmin APIs or expose user data.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
garmin_agent_manifest
annotations: verified low

Machine-readable install, runtime and client guidance for AI agents. Does not call Garmin or expose secrets.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
garmin_capabilities
annotations: verified low

Explain supported Garmin data, privacy boundaries, recommended agent workflow and project links.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
garmin_quickstart
annotations: verified low

Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Garmin?'

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
garmin_demo
annotations: verified low

Returns realistic example payloads of garmin_daily_summary, garmin_wellness_context, and garmin_get_body_battery_day so agents see the contract before any real Garmin Connect call.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
garmin_profile_get
annotations: verified low

Read the shared Delx wellness profile (~/.delx-wellness/profile.json). Returns the user's preferred name, body basics, goals, devices, training context, nutrition context, agent preferences, and missing critical fields. Cross-connector — the same profile is also available from other Delx Wellness MCPs (WHOOP, Oura, Nourish, Fitbit, etc). Read-only.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
garmin_profile_update
annotations: verified low

Persist a partial patch to the shared Delx wellness profile (~/.delx-wellness/profile.json). REQUIRES explicit_user_intent=true. Top-level fields stored: profile (preferred_name, language, timezone, units, age_or_birth_year, height, weight, sex_or_gender_context), goals, devices, training, nutrition, preferences, safety, notes. NEVER stores OAuth tokens, API keys, refresh tokens, cookies, or any secret-shaped field — writes will be rejected at validation time. Cross-connector — the same profile is read by other Delx Wellness MCPs.

readOnlyHint false openWorldHint false idempotentHint false destructiveHint false
garmin_onboarding
annotations: verified low

Return the 11-question Delx wellness onboarding flow (in English or pt-BR) plus the current shared profile state and missing critical fields. Read-only. The agent should ask these questions one-by-one, then call garmin_profile_update with explicit_user_intent=true to save. The same profile is reused by every Delx Wellness connector (WHOOP, Oura, Nourish, etc.) — agents can call the equivalent {connector}_onboarding tools to cover their respective domains, or rely on this one since all connectors share the same questions.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
garmin_auth_instructions
annotations: verified low

Explain the local Garmin Connect authentication flow without asking the user to paste secrets into an agent.

readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
garmin_get_weight_range
annotations: verified low

Get Garmin weight/body-composition logs for a date range. Not medical advice.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
garmin_activity_series
annotations: verified low

Bounded time-series for one activity metric. Returns exact stats computed on full-resolution samples plus a downsampled series capped at

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
garmin_connection_status
annotations: verified low

Check local Garmin config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Garmin or exposing secrets.

response_format enum
readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
garmin_weekly_summary
annotations: verified low

Build a weekly Garmin scorecard with movement, sleep, HRV, stress, Body Battery, bottlenecks and actions. Read-only and non-medical.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false
garmin_wellness_context
annotations: verified low

Normalize Garmin readiness, sleep score, Body Battery and recent movement load into the shared wellness_context shape for recommendation engines.

readOnlyHint true openWorldHint true idempotentHint true destructiveHint false

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 50

info
Tool 'garmin_data_inventory' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_agent_manifest' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_capabilities' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_quickstart' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_demo' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_profile_get' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_profile_update' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_onboarding' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_auth_instructions' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_get_weight_range' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_activity_series' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_connection_status' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_cache_status' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_privacy_audit' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_disconnect_local' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_daily_summary' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_weekly_summary' annotations are consistent annotation_checker · 80%
info
Tool 'garmin_wellness_context' annotations are consistent annotation_checker · 80%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Buffer.from base64 in davidmosiah-garmin-mcp-14a0d0d/src/services/garmin-client.ts:305 entropy_analyzer · 75%
medium
Buffer.from base64 in davidmosiah-garmin-mcp-14a0d0d/src/services/connection-status.ts:221 entropy_analyzer · 75%
medium
Buffer.from base64 in davidmosiah-garmin-mcp-14a0d0d/src/cli/garmin-login.ts:393 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: garmin_data_inventory manifest_parser · 85%
info
Tool: garmin_agent_manifest manifest_parser · 85%
info
Tool: garmin_capabilities manifest_parser · 85%
info
Tool: garmin_quickstart manifest_parser · 85%
info
Tool: garmin_demo manifest_parser · 85%
info
Tool: garmin_profile_get manifest_parser · 85%
info
Tool: garmin_profile_update manifest_parser · 85%
info
Tool: garmin_onboarding manifest_parser · 85%
info
Tool: garmin_auth_instructions manifest_parser · 85%
info
Tool: garmin_get_weight_range manifest_parser · 85%
info
Tool: garmin_activity_series manifest_parser · 85%
info
Tool: garmin_connection_status manifest_parser · 85%
info
Tool: garmin_cache_status manifest_parser · 85%
info
Tool: garmin_privacy_audit manifest_parser · 85%
info
Tool: garmin_disconnect_local manifest_parser · 85%
info
Tool: garmin_daily_summary manifest_parser · 85%
info
Tool: garmin_weekly_summary manifest_parser · 85%
info
Tool: garmin_wellness_context manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (10) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 172 components sbom_generator · 100%
high
Hardcoded Password found in davidmosiah-garmin-mcp-14a0d0d/src/cli/auth.ts secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%