Whoop MCP Server

Whoop MCP Server

Your WHOOP data in whichever AI you use, or, soon, in your own code. Self-hosted, private, and open source.

Ask Claude, ChatGPT or another MCP app "How did I sleep this week?" and get the answer from your own recovery, sleep, strain and workouts. You run the server yourself: it fetches your data from WHOOP when you ask and keeps no copy, and only the apps you've allowed can reach it.

This is an independent open-source project. It uses the WHOOP API to access data from WHOOP products, and is not affiliated with, endorsed by, or sponsored by WHOOP.

Two ways in

• Talk to your data. Deploy the server, connect it to your AI, and ask. Start with Setup, then Add to your AI, which also lists the apps tested so far.
• Build with it. The WHOOP client inside this server (typed, tested, and careful with WHOOP's single-use refresh tokens) is being split out as a library for your own code. It isn't published yet: watch this repository's releases to hear when it is.

Built on the Whoop Developer API v2, and the Model Context Protocol (MCP), the open standard AI apps use to call tools like these.

Features

• Everything Whoop sends, nothing hidden: every physiological field of Whoop's API, with a date on every record, zeros shown as zeros and unscored days marked as such
• Recovery: daily recovery score, HRV, resting heart rate, SpO2, skin temperature, and whether Whoop is still calibrating
• Sleep: bed and wake times, time asleep and in bed, awake and no-data time, light/deep/REM stages, sleep cycles, disturbances, performance, efficiency, consistency, respiratory rate, the sleep needed before each night (baseline, debt, strain, nap credit), and naps
• Strain: daily strain score, calories, average and max heart rate, and steps
• Workouts: activity, local start time, duration, strain, heart rate, calories, time in every heart-rate zone, distance, elevation gain and altitude change, and the share of heart-rate data recorded
• Live data: every answer is fetched from Whoop when you ask, so it's always current. The server stores only its sign-ins and your encrypted Whoop tokens, never your health data
• Private by default: each app signs in with a password you choose (OAuth 2.1), and only after you tick a box allowing it, so nobody else can read your data
• Your choice of AI: tested live with Claude and ChatGPT; other apps that sign in with OAuth should work the same way (see compatibility)

MCP Tools

Setup

Fastest: Deploy on Railway

The template is published by this project's maintainer. Railway pays template creators a share of what deployments spend, and the link carries a referral code; neither costs you anything extra. Railway's Hobby plan is enough.

One click creates a Railway project running the :1 image with a volume, auto updates and generated secrets; there's nothing to fill in. Tested live on 2026-09-29. Then:

1. Click the service card. Its address is at the top of the Deployments tab, whoop-mcp-server-production-xxxx.up.railway.app. Open it.
2. The page walks you through the rest: create a Whoop developer app (it shows every field), paste the app's two keys over the placeholders in the service's variables, add the address it shows to Claude or ChatGPT, and approve Whoop once on your first question.

To set it up by hand instead, or elsewhere, read on.

1. Deploy

Every release is published as a ready-made image, ghcr.io/yuridivonis/whoop-mcp-server. Deploy that: there's no need to fork this repository unless you want to change the code (see Changing the code). The steps below use Railway; to run it anywhere else, see Docker.

1. In a Railway project, click New, choose Docker Image, and enter ghcr.io/yuridivonis/whoop-mcp-server:1. Then, in the service's Settings → Networking → Public Networking, choose Generate Domain: that's your server's address, your-app.up.railway.app below. The server works out its Whoop callback address from it.
2. Add environment variables:

• MCP_AUTH_PASSWORD: the password each AI app asks for when you connect it. Generate one with openssl rand -base64 24 and keep it in your password manager. The server refuses to start without it (at least 16 characters).
• ENCRYPTION_SECRET (optional, recommended): generate one with openssl rand -base64 32. It encrypts your stored Whoop tokens, so rotating the Whoop client secret later won't disconnect your account.
• WHOOP_CLIENT_ID = replace-with-your-client-id and WHOOP_CLIENT_SECRET = replace-with-your-client-secret for now. The server treats those as unset; you replace them in Create a Whoop Developer App.

1. Add a volume mounted at /data. It holds the sign-ins and your encrypted Whoop tokens; without it, every redeploy signs your apps out and disconnects Whoop.
2. Turn on updates: in the service's Settings, under Source, choose Configure Auto Updates and a maintenance window (for example Night). The :1 tag moves with every 1.x release, and Railway then redeploys the service; on the Pro plan it backs up the volume first.
3. Deploy, then open https://your-app.up.railway.app/: the set-up page walks you through the rest. If the deploy fails, open its logs: the server says what's missing.

Already running a fork on Railway? Switch it to the image: open the service's Settings, change Service Source to ghcr.io/yuridivonis/whoop-mcp-server:1, and turn on auto updates as in step 4. Keep the same variables and volume, so Whoop stays connected. If your fork is older than 1.3.0, read Upgrading to 1.3.0 first: every app signs in once more. Your fork is then no longer used.

2. Create a Whoop Developer App

Your server's set-up page, https://your-app.up.railway.app/, walks through Whoop's New App form in the form's own order, with a Copy button on each value to paste. The same, in short:

1. In the Whoop Developer Dashboard, open New App and fill the form top to bottom:

• Name: anything. You see it when you approve the app.
• Logo: skip it.
• Contacts: your email. Only Whoop sees it.
• Privacy Policy: this project's PRIVACY.md, https://github.com/yuridivonis/whoop-mcp-server/blob/main/PRIVACY.md, or your own adapted copy if you run the server for someone else. People see this link when they approve the app.
• Redirect URLs: your server's callback, https://your-app.up.railway.app/callback, exactly as the set-up page shows it.
• Scopes: read:recovery, read:cycles, read:sleep and read:workout. The server doesn't use the others. The login also asks for offline, which lets the server renew its Whoop access without you logging in again; the dashboard doesn't list it.
• Webhooks: skip it.

Click Create App: Whoop shows the app's Client ID and Client Secret.

1. In the service's Variables tab, select replace-with-your-client-id in WHOOP_CLIENT_ID and paste the Client ID over it; the same for replace-with-your-client-secret in WHOOP_CLIENT_SECRET; then click Deploy at the top. The set-up page then ticks steps 2 and 3.

If you add a custom domain later, open the set-up page again: if the Redirect URL it shows changed, update it in your Whoop app, or set WHOOP_REDIRECT_URI.

3. Connect your AI

Add your server's address, https://your-app.up.railway.app/mcp, to your AI app as a custom connector. It opens your server's sign-in page: check it names the app you're connecting, enter your MCP_AUTH_PASSWORD, and tick the box allowing it to read your Whoop data. For example, in Claude.ai: Customize → Connectors → + → Add custom connector.

Add to your AI has the steps for Claude, ChatGPT, Claude Code, Cursor, VS Code and Windsurf, and which have been tested. Apps stay signed in across redeploys; anyone without the password gets 401 Unauthorized from /mcp.

4. Connect your Whoop account

1. In a chat, ask your AI about your recovery. The first answer is a Whoop link (it calls get_auth_url).
2. Open the link, log in to Whoop, and approve the app, once. You're redirected back, and your AI answers from then on.
3. Ask away: "How did I sleep last night?"

Upgrading to 1.3.0

1.3.0 stops keeping a copy of your Whoop data, and asks you before each app receives it. To upgrade:

1. Get the new version: with the image, Railway's auto updates do it for you, or switch the Service Source to the :1 tag and redeploy (Docker with :1: pull it again and restart). With a fork, use GitHub's Sync fork button, then redeploy, or switch to the image as described in Deploy.
2. On its first start, the server deletes the recovery, sleep, strain and workout data earlier versions stored, and rewrites the database file so none of it is left on disk. Your Whoop connection is kept. The log says Deleted the WHOOP data stored by an earlier version.
3. Every app is signed out once. The next time you use one, it opens the sign-in page: enter your password and tick the box allowing it to read your Whoop data.
4. sync_data is gone. If your app still lists it, remove the connector and add it again.
5. If your host keeps backups or snapshots of the volume, delete the ones from before the upgrade. They still hold the old copy.

There's no going back to 1.2.x on the upgraded database: it can't sign apps in with the new sign-in tables.

Upgrading from 1.0.0

1.1.0 puts a sign-in in front of /mcp. Version 1.0.0 had no authentication there, so any 1.0.0 server that worked with Claude over HTTP served its data to anyone who knew the URL. (Unmodified 1.0.0 also had a request-parsing bug that stopped Claude from connecting over HTTP at all; 1.1.0 fixes both.) To upgrade:

1. Update your fork