Google Health MCP

Google Health MCP

Read user-authorized Google Health API v4 data — Fitbit, Pixel Watch and partners — locally via OAuth. Beta .

Local-first MCP server — tokens never leave your machine .

⚡ One-command install with Delx Wellness for Hermes:

npx -y delx-wellness-hermes setup — preconfigures this connector and the other 8 in a dedicated Hermes profile.

Or wire it standalone into Claude Desktop / Cursor / ChatGPT Desktop — see the install section below.

What's new in 0.7.3 (2026-08-03): headless OAuth (auth --manual) for SSH /

containers / WSL · real-account rollup/filter fixes from external testers ·

opt-in clinical scopes for ECG/IRN · pins live in Hermes/living-body.

Full notes in CHANGELOG.md.

Highest-leverage contribution — real-account coverage

If you have Fitbit, Pixel Watch, Android health data or Google Health API v4 access, the most useful help is a redacted coverage report:

npx -y google-health-mcp-unofficial coverage --live --json

Review the output, remove anything you do not want public, then post the report on issue #2 (or a new issue). The timed proof loop on #21 closed 1/2 — see docs/proof-loop-status.md. The command is read-only and is designed to omit OAuth secrets, local paths and raw health measurements. A static preflight is available before OAuth with coverage --json.

Other ways to help (no account required)

HTTP (v2 stateless)

Default is stdio. Optional Streamable HTTP — no session id, JSON responses, loopback only:

npx -y google-health-mcp-unofficial --http

GET http://127.0.0.1:3000/health

POST http://127.0.0.1:3000/mcp (sessionless)

Env: GOOGLE_HEALTH_MCP_HOST, GOOGLE_HEALTH_MCP_PORT, GOOGLE_HEALTH_MCP_TRANSPORT=http.

Google Health MCP

Local-first MCP server that gives your AI agent user-authorized Google Health API v4 data — Fitbit, Pixel Watch and partners — over OAuth.

• Install one connector — npx -y google-health-mcp-unofficial setup
• Run it in Claude · Cursor · ChatGPT · Hermes · OpenClaw — see the client examples.
• Local-first — your tokens never leave your machine (privacy).
• Which connector should I use? — see the front-door guide.

Beta status: Google Health API v4 is live for builders but still evolving. Google's release notes show scope and data-type changes continuing after launch, so this connector stays in early beta and points testers to safe read-only validation paths before public production use.

Unofficial project. Not affiliated with, endorsed by or supported by Google, Fitbit or Alphabet. Not a medical device. Not medical advice.

Why this exists

Google Health API is the successor to Fitbit Web API: new OAuth, new base URL, v4 endpoint schema, standardized data types, reconciled streams and rollups.

This MCP gives agents a clean way to discover the API, check setup, authenticate locally and query data without pasting tokens into prompts or agent configs.

Quickstart in 60 seconds

Create a Google Cloud OAuth client, enable the Google Health API, and add the redirect http://127.0.0.1:3000/callback. Then:

npx -y google-health-mcp-unofficial setup --scope-preset full   # writes local config

npx -y google-health-mcp-unofficial auth # OAuth, tokens saved locally npx -y google-health-mcp-unofficial doctor # verifies you're ready

doctor --live calls safe Google Health identity/profile/settings endpoints after auth to prove the API is reachable — the connection proof for this beta. That does not prove Claude Desktop can invoke tools: Desktop validates outputSchema as JSON Schema 2020-12. Use google-health-mcp-unofficial@0.7.6+ (see #23). Full install details (scope presets, MFA, recovery) are in the Install section below.

Try it with your agent

Three things to ask first, based on tools this connector actually ships:

Use google_health_connection_status to check setup, then run

google_health_data_inventory. Tell me which Google Health domains and scopes I have authorized.

Call google_health_daily_summary for today, then google_health_weekly_summary.

Separate observed data from suggestions and stay non-medical.

Run google_health_privacy_audit, then summarize exactly what is stored

locally and what would be sent to Google on the next call.

Tools

Start here:

• google_health_connection_status — local config, token, scope and client readiness
• google_health_data_inventory — supported domains, scopes, data type naming and agent flow
• google_health_data_type_coverage — static coverage plan, or explicit live read-only validation for issue #21
• google_health_daily_summary — daily beta summary from rollups and reconciled streams
• google_health_weekly_summary — weekly beta review
• google_health_privacy_audit — what is stored locally and what is sent to Google

The full tool catalog — Google Health API methods, agent manifest, diagnostics and data-type naming notes (kebab-case endpoints, snake_case filters, source families) — lives in docs/tools.md.

Privacy & what runs offline

• OAuth tokens are stored locally at ~/.google-health-mcp/tokens.json with 0600 permissions.
• Secrets can live in ~/.google-health-mcp/config.json or GOOGLE_HEALTH_* environment variables.
• Tools never return access tokens, refresh tokens or client secrets.
• GOOGLE_HEALTH_PRIVACY_MODE=structured is the default; raw mode is explicit and should be used only for debugging or deep analysis. An agent asking for privacy_mode=raw is refused unless it passes explicit_user_intent=true; setting GOOGLE_HEALTH_PRIVACY_MODE=raw yourself is your own call and needs no per-call intent.
• Structured mode preserves complete upstream physiological fields and future v4 additions while removing identity, location and secret-bearing values.
• "Location redaction" means a concrete key list, not a slogan. Coordinate-bearing leaf keys, always dropped in structured and summary (matched ignoring case, _ and -, so latitude_e7 and latitudeE7 are the same key):

startLatitude, startLongitude, start_latlng, endLatitude, endLongitude, end_latlng, latitude, longitude, lat, lon, lng, latlng, coordinates, coordinate, gps, gpx, geoPolylineDTO, map, polyline, summary_polyline, activities-tracker-gps, latitudeE7, longitudeE7, latE7, lngE7, lonE7, startLatitudeE7, startLongitudeE7, endLatitudeE7, endLongitudeE7, lat_deg, lng_deg, lon_deg, latitudeDegrees, longitudeDegrees

Location container keys, dropped as a whole object — with their address/city/placeId siblings and any coordinate spelling this list never anticipated — whenever they hold a place record (an object, or an array containing objects). A container holding only scalars is a label, not a place, and survives: location: ["gym", "home"] stays, location: { latitudeE7: … } does not.

location, locations, geoLocation, geoLocations, geo, geoJson, route, routes, position, positions, waypoint, waypoints, trackPoint, trackPoints, placeVisit

google_health_privacy_audit returns both live lists in gps_redacted_keys and gps_redacted_container_keys, and gps_redaction_default is measured at call time by pushing a synthetic record through both non-raw modes and scanning the output by key and by coordinate value — it is not a hardcoded true. npm run test:redaction-docs fails the build if these two blocks stop matching the code, so the published promise cannot drift from the enforcement list again. Google Health API v4 does not currently document a location/route data type, so this is a forward-compatible guard rather than a patch for an observed leak.

• Limits of that promise, stated instead of implied. Every line below is proved by a behavioural test (npm run test:declared-limits) that fails if the behaviour changes; a line marked **NOT VERIF