← Back to search

mcp-server-whoop

GitHub Actions Scanned 5d ago

Local-first, read-only WHOOP MCP server with secure OAuth and AI-ready health signals

npm
C
74.3 / 100

Versions

0.2.2latest
Jul 17, 2026
0.2.1
Jul 15, 2026
0.2.0
Jul 15, 2026
0.1.1
Jul 15, 2026
0.1.0
Jul 15, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 5

whoop_latest_overview
annotations: none low

Compact local-time coaching overview with newest sleep status, matching current recovery only when ready, finalized strain or explicitly provisional live current-cycle strain, latest workout, recent activity types, and body measurement.

whoop_recovery_history
annotations: none low

Recent recovery processing state and, only when WHOOP marks a record SCORED, recovery score, HRV, resting heart rate, SpO2, and skin temperature.

whoop_sleep_history
annotations: none low

Recent local bedtime/wake time, sleep or nap type, processing state, and finalized sleep metrics only when WHOOP marks a record SCORED.

whoop_cycle_strain_history
annotations: none low

Recent local physiological-cycle processing state and finalized metrics for SCORED records; a PENDING_SCORE current cycle may expose only provisional_strain.

whoop_workout_history
annotations: none low

Recent workout sport, local time, duration, and processing state, with score-derived metrics only when WHOOP marks a record SCORED.

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 24

info
package.json metadata manifest_parser · 100%
low
Tool 'whoop_latest_overview' has no annotations annotation_checker · 100%
low
Tool 'whoop_recovery_history' has no annotations annotation_checker · 100%
low
Tool 'whoop_sleep_history' has no annotations annotation_checker · 100%
low
Tool 'whoop_cycle_strain_history' has no annotations annotation_checker · 100%
low
Tool 'whoop_workout_history' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client secret in Yadheedhya06-mcp-server-whoop-f0926f4/test/whoop.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in Yadheedhya06-mcp-server-whoop-f0926f4/test/config.test.ts auth_checker · 95%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
info
Tool: whoop_latest_overview manifest_parser · 85%
info
Tool: whoop_recovery_history manifest_parser · 85%
info
Tool: whoop_sleep_history manifest_parser · 85%
info
Tool: whoop_cycle_strain_history manifest_parser · 85%
info
Tool: whoop_workout_history manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (9) manifest_parser · 80%
medium
OAuth authorization code flow without PKCE oauth_scope_analyzer · 75%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 124 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%