← Back to search

io.github.davidmosiah/wellness-cgm-mcp

davidmosiah Scanned 1d ago

Local-first CGM MCP for AI agents: Dexcom Developer API + FreeStyle Libre via LibreLink Up.

B
84 / 100

Versions

0.4.0latest
first seen Jun 5, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 19

cgm_glucose_now
annotations: none low

Returns the most recent EGV (estimated glucose value) plus trend arrow if available.

cgm_connection_status
annotations: none low

Reports the active CGM provider (dexcom | libre), why it was selected, whether credentials are present, and whether the connector will return mock vs live data. For Dexcom it includes the env (sandbox/production); for FreeStyle Libre it includes the LibreLink Up region.

cgm_privacy_audit
annotations: none low

Returns what wellness-cgm-mcp stores locally, what is sent to Dexcom, what is never logged, and agent rules.

cgm_agent_manifest
annotations: none low

Returns the wellness-cgm-mcp agent manifest: tool list, supported clients, env vars, recommended first calls, capabilities, privacy posture, and community links.

cgm_capabilities
annotations: none low

Lists supported providers, configured providers (via env vars), available metrics, and privacy modes.

cgm_data_inventory
annotations: none low

Returns the metric catalog plus thresholds (TIR ranges, GMI formula reference).

cgm_glucose_window
annotations: none low

Returns all EGVs over the last N hours (default 24). `hours` is the window REQUESTED; `hours_covered` and `observed_window` state what the provider actually returned. FreeStyle Libre (LibreLink Up) caps a live read at ~12h regardless of the request, so any wider ask comes back short and `notes` says so — read the covered window, not the requested one.

hours number
cgm_hypo_events
annotations: none low

v0.3.3 — Detect hypoglycemia events between `from` and `to` ISO dates. Returns an array of contiguous below-threshold runs lasting ≥ `min_duration_minutes`, each with `started_at`, `ended_at`, `duration_minutes`, `min_glucose_mg_dl`, `mean_glucose_mg_dl`, `severity` (level_1 = <70 ADA Level 1, level_2 = <54 ADA Level 2), and `recovery_time_minutes` (time to first reading ≥ threshold+10). Also returns `total_events`, `total_minutes_below`, `mean_min_glucose`, `events_per_day`, a `summary` string, and `recommendations` grounded in what was actually observed. `window` is the span REQUESTED; `hours_covered`, `observed_window` and `window_truncated_by_provider` state what the provider actually returned — FreeStyle Libre (LibreLink Up) caps a live read at ~12h, so a 3-day question can be answered from half a day and `notes` says so. \"No hypos\" is only true for `hours_covered`. **MEDICAL DISCLAIMER: NOT medical advice. Do not use for treatment decisions. Hypo events should be discussed with your clinician.**

to string from string
cgm_daily_summary
annotations: none low

Returns daily glucose stats: mean, median, min/max, stdev, GMI (estimated A1C), CV, time-in-range (diabetic 70-180 + metabolic-health 70-140). `window_hours` is what was REQUESTED; every stat is computed over `hours_covered` / `observed_window`, which can be shorter — FreeStyle Libre (LibreLink Up) caps a live read at ~12h, so a 72h request yields a half-day metric and `notes` flags it. Never report these numbers as covering more than `hours_covered`.

hours number
cgm_time_in_range
annotations: none low

Compute Time in Range (TIR), Time Below Range, and Time Above Range over a specific time window with a customizable target range. Use this for mealtime TIR (e.g. 7am-10am breakfast window), overnight TIR (e.g. 23:00-07:00), or specific date-range comparisons. Returns total_readings, readings_in_window, mean_glucose, median_glucose, and GMI (Glucose Management Indicator, estimated A1C per ADA / Bergenstal 2018: GMI% = 3.31 + 0.02392 × mean_mg_dL). Supports a `time_window` preset (\"wake\" = 06:00-22:00, \"sleep\" = 22:00-06:00, \"all\") OR explicit `start_hour` / `end_hour` (0-24, UTC) for recurring hour-of-day filtering. Defaults: 24h load, ADA 70-180 mg/dL, time_window=all. Pulls from cgm_glucose_window data; falls back to mock in unauth mode.

cgm_meal_response
annotations: verified low

Compute glucose response to a meal: baseline → peak → return-to-baseline. Returns peak delta, peak time (min after meal), and a band (excellent/good/moderate/poor).

meal_time string window_hours number
readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
cgm_authorize_url
annotations: verified low

Read-only OAuth URL generation; does not exchange tokens. Not a state mutation of glucose data. Gated by: user must open URL themselves (explicit user action). Builds the Dexcom OAuth authorize URL. The user opens it, grants access, and Dexcom redirects to your registered DEXCOM_REDIRECT_URI with an auth code. If credentials are missing, returns a hint with the exact env vars needed.

state string
readOnlyHint true openWorldHint false idempotentHint true destructiveHint false
cgm_quickstart
annotations: none low

Returns a personalized 3-step walkthrough for getting wellness-cgm-mcp from mock mode → live mode (Dexcom). Call this first when the user asks 'how do I connect my CGM?'

cgm_profile_get
annotations: none low

Returns the shared Delx Wellness profile (~/.delx-wellness/profile.json). Read-only. Surfaces diabetes status / non-DM context so wellness-cgm-mcp can pick the right time-in-range profile (70-180 ADA vs 70-140 metabolic-health).

cgm_profile_update
annotations: none low

Persist a partial patch to the shared Delx Wellness profile. Requires explicit_user_intent: true. Rejects any field containing oauth/token/secret/password/cookie/refresh/api_key/session — the profile is for non-secret wellness context only.

cgm_onboarding
annotations: none low

Returns the 11-question onboarding flow for the shared Delx Wellness profile. Read-only. The agent should ask these questions next so wellness-cgm-mcp (and the rest of the wellness stack) can personalize responses — non-secret data only, stored at ~/.delx-wellness/profile.json.

locale enum
cgm_demo
annotations: none low

Returns realistic example payloads of cgm_glucose_now, cgm_daily_summary, and cgm_meal_response. Use this to help users see what the connector will return before configuring Dexcom.

cgm_libre_status
annotations: none low

Reports FreeStyle Libre (LibreLink Up) configuration: region, whether LIBRELINKUP_EMAIL/PASSWORD (or a token) are set, whether a patient id is pinned, and whether reads will be live or mock. Use this to confirm the Libre path is wired before calling glucose tools with CGM_PROVIDER=libre.

cgm_libre_login
annotations: none low

Authenticate against LibreLink Up using LIBRELINKUP_EMAIL / LIBRELINKUP_PASSWORD and list the sensors (connections) this account follows. Confirms the FreeStyle Libre path works end-to-end before reading glucose. Never returns the auth token. When credentials are missing it returns mock=true with a synthetic connection so the surface can be demoed without an Abbott account.

Permissions 2

filesystem low
Server uses filesystem capabilities via: fs, path
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 49

low
Tool 'cgm_agent_manifest' has no annotations annotation_checker · 100%
low
Tool 'cgm_capabilities' has no annotations annotation_checker · 100%
low
Tool 'cgm_connection_status' has no annotations annotation_checker · 100%
low
Tool 'cgm_privacy_audit' has no annotations annotation_checker · 100%
low
Tool 'cgm_data_inventory' has no annotations annotation_checker · 100%
low
Tool 'cgm_glucose_now' has no annotations annotation_checker · 100%
low
Tool 'cgm_glucose_window' has no annotations annotation_checker · 100%
low
Tool 'cgm_hypo_events' has no annotations annotation_checker · 100%
low
Tool 'cgm_daily_summary' has no annotations annotation_checker · 100%
low
Tool 'cgm_time_in_range' has no annotations annotation_checker · 100%
info
Tool 'cgm_meal_response' annotations are consistent annotation_checker · 80%
info
Tool 'cgm_authorize_url' annotations are consistent annotation_checker · 80%
low
Tool 'cgm_quickstart' has no annotations annotation_checker · 100%
low
Tool 'cgm_profile_get' has no annotations annotation_checker · 100%
low
Tool 'cgm_profile_update' has no annotations annotation_checker · 100%
low
Tool 'cgm_onboarding' has no annotations annotation_checker · 100%
low
Tool 'cgm_demo' has no annotations annotation_checker · 100%
low
Tool 'cgm_libre_status' has no annotations annotation_checker · 100%
low
Tool 'cgm_libre_login' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
info
package.json metadata manifest_parser · 100%
info
Tool: cgm_agent_manifest manifest_parser · 85%
info
Tool: cgm_capabilities manifest_parser · 85%
info
Tool: cgm_connection_status manifest_parser · 85%
info
Tool: cgm_privacy_audit manifest_parser · 85%
info
Tool: cgm_data_inventory manifest_parser · 85%
info
Tool: cgm_glucose_now manifest_parser · 85%
info
Tool: cgm_glucose_window manifest_parser · 85%
info
Tool: cgm_libre_status manifest_parser · 85%
info
Tool: cgm_hypo_events manifest_parser · 85%
info
Tool: cgm_daily_summary manifest_parser · 85%
info
Tool: cgm_time_in_range manifest_parser · 85%
info
Tool: cgm_meal_response manifest_parser · 85%
info
Tool: cgm_authorize_url manifest_parser · 85%
info
Tool: cgm_quickstart manifest_parser · 85%
info
Tool: cgm_profile_get manifest_parser · 85%
info
Tool: cgm_profile_update manifest_parser · 85%
info
Tool: cgm_onboarding manifest_parser · 85%
info
Tool: cgm_demo manifest_parser · 85%
info
Tool: cgm_libre_login manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (17) manifest_parser · 80%
medium
OAuth authorization code flow without PKCE oauth_scope_analyzer · 75%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
low
Permission: filesystem access detected permission_analyzer · 90%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 134 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%