Google Health MCP

Name: Google Health MCP
Author: davidmosiah

by davidmosiahversion 0.5.2i★ 79iRuns on your computer

Registry nameio.github.davidmosiah/google-health-mcp

Overview

Description from the maker (original English)

Privacy-first unofficial Google Health API v4 MCP server for health, sleep, activity, HR agents

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi3 of 3 passedChecked from public information; code not scanned yet
UsageiVery new★ 79

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Clinics & health
You need to fill in: GOOGLE_HEALTH_CLIENT_SECRET

Install

Pick the AI app you use, then copy the settings.

You need

npmNode.js installed (for the npx command)

Claude DesktopClaude CodeCursorVS Code

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "google-health": {
      "command": "npx",
      "args": [
        "-y",
        "google-health-mcp-unofficial"
      ],
      "env": {
        "GOOGLE_HEALTH_CLIENT_ID": "your-value",
        "GOOGLE_HEALTH_CLIENT_SECRET": "your-value",
        "GOOGLE_HEALTH_REDIRECT_URI": "your-value",
        "GOOGLE_HEALTH_TOKEN_PATH": "your-value",
        "GOOGLE_HEALTH_PRIVACY_MODE": "your-value",
        "GOOGLE_HEALTH_CACHE": "your-value",
        "GOOGLE_HEALTH_CACHE_PATH": "your-value",
        "GOOGLE_HEALTH_NO_CACHE": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add google-health --env GOOGLE_HEALTH_CLIENT_ID=your-value --env GOOGLE_HEALTH_CLIENT_SECRET=your-value --env GOOGLE_HEALTH_REDIRECT_URI=your-value --env GOOGLE_HEALTH_TOKEN_PATH=your-value --env GOOGLE_HEALTH_PRIVACY_MODE=your-value --env GOOGLE_HEALTH_CACHE=your-value --env GOOGLE_HEALTH_CACHE_PATH=your-value --env GOOGLE_HEALTH_NO_CACHE=your-value -- npx -y google-health-mcp-unofficial

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "google-health": {
      "command": "npx",
      "args": [
        "-y",
        "google-health-mcp-unofficial"
      ],
      "env": {
        "GOOGLE_HEALTH_CLIENT_ID": "your-value",
        "GOOGLE_HEALTH_CLIENT_SECRET": "your-value",
        "GOOGLE_HEALTH_REDIRECT_URI": "your-value",
        "GOOGLE_HEALTH_TOKEN_PATH": "your-value",
        "GOOGLE_HEALTH_PRIVACY_MODE": "your-value",
        "GOOGLE_HEALTH_CACHE": "your-value",
        "GOOGLE_HEALTH_CACHE_PATH": "your-value",
        "GOOGLE_HEALTH_NO_CACHE": "your-value"
      }
    }
  }
}

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "google-health": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "google-health-mcp-unofficial"
      ],
      "env": {
        "GOOGLE_HEALTH_CLIENT_ID": "your-value",
        "GOOGLE_HEALTH_CLIENT_SECRET": "your-value",
        "GOOGLE_HEALTH_REDIRECT_URI": "your-value",
        "GOOGLE_HEALTH_TOKEN_PATH": "your-value",
        "GOOGLE_HEALTH_PRIVACY_MODE": "your-value",
        "GOOGLE_HEALTH_CACHE": "your-value",
        "GOOGLE_HEALTH_CACHE_PATH": "your-value",
        "GOOGLE_HEALTH_NO_CACHE": "your-value"
      }
    }
  }
}

Values you fill in

GOOGLE_HEALTH_CLIENT_ID env
Google Cloud OAuth client ID for Google Health API. Optional when configured with google-health-mcp-server setup.
GOOGLE_HEALTH_CLIENT_SECRET secret env
Google Cloud OAuth client secret. Prefer google-health-mcp-server setup so this secret is stored in ~/.google-health-mcp/config.json instead of MCP client config.
GOOGLE_HEALTH_REDIRECT_URI env
Redirect URI configured in the Google Cloud OAuth client. Optional when configured with google-health-mcp-server setup.
GOOGLE_HEALTH_TOKEN_PATH env
Optional local path for OAuth tokens. Defaults to ~/.google-health-mcp/tokens.json.
GOOGLE_HEALTH_PRIVACY_MODE env
Optional payload mode: summary, structured, or raw. Defaults to structured. raw means full Google Health API payloads, not continuous 24/7 raw sensor telemetry.
GOOGLE_HEALTH_CACHE env
Optional SQLite cache toggle. Set to true or sqlite to enable.
GOOGLE_HEALTH_CACHE_PATH env
Optional local SQLite cache path. Defaults to ~/.google-health-mcp/cache.sqlite.
GOOGLE_HEALTH_NO_CACHE env
Set to true to bypass the in-memory HTTP response cache (60s TTL for GET only). POST/PUT/DELETE and 4xx/5xx responses are never cached regardless.

Values marked secret are keys to your account. Never share them or paste them into a chat.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 5, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account davidmosiah, which owns the repo
✓ Pass
Still maintained
Code last changed 3 days ago
✓ Pass
Has a licence
Uses MIT
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Needs the server’s tool list first; this check starts in the next step

Compared with others in Clinics & healthi

More stars than 33% of the other 3 servers in this category
Published to the registry more recently than 33% of the other 3 servers in this category
Basic checks equal to or better than 100% of the other 3 servers in this category

Compared only with servers in this prototype, not the whole registry.

Common questions

Is Google Health MCP safe?

It passed 3 of 3 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: GOOGLE_HEALTH_CLIENT_SECRET

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed 3 days ago, and the latest version (0.5.2) reached the registry 4 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.

What can I use instead?

In the same category: Mirobody, FHIR MCP Server, Langcare MCP FHIR

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Mirobody

by thetahealth

Lab results to LOINC codes and UCUM units, symptoms and diagnoses to ICPC-3. Offline, no API key.

Runs on your computer★ 1,408Apache-2.0Updated 4 days ago

FHIR MCP Server

by wso2

MCP server providing seamless access to FHIR APIs for AI tools and healthcare applications

Runs on your computer★ 137Apache-2.0Updated 7 days ago

Langcare MCP FHIR

by langcare

An MCP FHIR server written in Go for EMR systems like Epic and Cerner

Runs on your computer★ 70MITUpdated 9 months ago

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

Google Health MCP

Read user-authorized Google Health API v4 data — Fitbit, Pixel Watch and partners — locally via OAuth. Beta .

Local-first MCP server — tokens never leave your machine .

⚡ One-command install with Delx Wellness for Hermes:

npx -y delx-wellness-hermes setup — preconfigures this connector and the other 8 in a dedicated Hermes profile.

Or wire it standalone into Claude Desktop / Cursor / ChatGPT Desktop — see the install section below.

What's new in 0.7.3 (2026-08-03): headless OAuth (auth --manual) for SSH /

containers / WSL · real-account rollup/filter fixes from external testers ·

opt-in clinical scopes for ECG/IRN · pins live in Hermes/living-body.

Full notes in CHANGELOG.md.

Highest-leverage contribution — real-account coverage

If you have Fitbit, Pixel Watch, Android health data or Google Health API v4 access, the most useful help is a redacted coverage report:

npx -y google-health-mcp-unofficial coverage --live --json

Review the output, remove anything you do not want public, then post the report on issue #2 (or a new issue). The timed proof loop on #21 closed 1/2 — see docs/proof-loop-status.md. The command is read-only and is designed to omit OAuth secrets, local paths and raw health measurements. A static preflight is available before OAuth with coverage --json.

Other ways to help (no account required)

Action	Link
Star if the project earned it	stargazers
Docs GFI — headless auth walkthrough	#22
Compose with other wearables	`delx-living-body`
One-command Hermes pack	`delx-wellness-hermes`
Full registry	`delx-wellness`

HTTP (v2 stateless)

Default is stdio. Optional Streamable HTTP — no session id, JSON responses, loopback only:

npx -y google-health-mcp-unofficial --http

GET http://127.0.0.1:3000/health

POST http://127.0.0.1:3000/mcp (sessionless)

Env: GOOGLE_HEALTH_MCP_HOST, GOOGLE_HEALTH_MCP_PORT, GOOGLE_HEALTH_MCP_TRANSPORT=http.

Google Health MCP

Local-first MCP server that gives your AI agent user-authorized Google Health API v4 data — Fitbit, Pixel Watch and partners — over OAuth.

Install one connector — npx -y google-health-mcp-unofficial setup
Run it in Claude · Cursor · ChatGPT · Hermes · OpenClaw — see the client examples.
Local-first — your tokens never leave your machine (privacy).
Which connector should I use? — see the front-door guide.

Beta status: Google Health API v4 is live for builders but still evolving. Google's release notes show scope and data-type changes continuing after launch, so this connector stays in early beta and points testers to safe read-only validation paths before public production use.

Unofficial project. Not affiliated with, endorsed by or supported by Google, Fitbit or Alphabet. Not a medical device. Not medical advice.

Why this exists

Google Health API is the successor to Fitbit Web API: new OAuth, new base URL, v4 endpoint schema, standardized data types, reconciled streams and rollups.

This MCP gives agents a clean way to discover the API, check setup, authenticate locally and query data without pasting tokens into prompts or agent configs.

Quickstart in 60 seconds

Create a Google Cloud OAuth client, enable the Google Health API, and add the redirect http://127.0.0.1:3000/callback. Then:

npx -y google-health-mcp-unofficial setup --scope-preset full   # writes local config

npx -y google-health-mcp-unofficial auth # OAuth, tokens saved locally npx -y google-health-mcp-unofficial doctor # verifies you're ready

doctor --live calls safe Google Health identity/profile/settings endpoints after auth to prove the API is reachable — the connection proof for this beta. That does not prove Claude Desktop can invoke tools: Desktop validates outputSchema as JSON Schema 2020-12. Use google-health-mcp-unofficial@0.7.6+ (see #23). Full install details (scope presets, MFA, recovery) are in the Install section below.

Try it with your agent

Three things to ask first, based on tools this connector actually ships:

Use google_health_connection_status to check setup, then run

google_health_data_inventory. Tell me which Google Health domains and scopes I have authorized.

Call google_health_daily_summary for today, then google_health_weekly_summary.

Separate observed data from suggestions and stay non-medical.

Run google_health_privacy_audit, then summarize exactly what is stored

locally and what would be sent to Google on the next call.

Tools

Start here:

google_health_connection_status — local config, token, scope and client readiness
google_health_data_inventory — supported domains, scopes, data type naming and agent flow
google_health_data_type_coverage — static coverage plan, or explicit live read-only validation for issue #21
google_health_daily_summary — daily beta summary from rollups and reconciled streams
google_health_weekly_summary — weekly beta review
google_health_privacy_audit — what is stored locally and what is sent to Google

The full tool catalog — Google Health API methods, agent manifest, diagnostics and data-type naming notes (kebab-case endpoints, snake_case filters, source families) — lives in docs/tools.md.

Privacy & what runs offline

OAuth tokens are stored locally at ~/.google-health-mcp/tokens.json with 0600 permissions.
Secrets can live in ~/.google-health-mcp/config.json or GOOGLE_HEALTH_* environment variables.
Tools never return access tokens, refresh tokens or client secrets.
GOOGLE_HEALTH_PRIVACY_MODE=structured is the default; raw mode is explicit and should be used only for debugging or deep analysis. An agent asking for privacy_mode=raw is refused unless it passes explicit_user_intent=true; setting GOOGLE_HEALTH_PRIVACY_MODE=raw yourself is your own call and needs no per-call intent.
Structured mode preserves complete upstream physiological fields and future v4 additions while removing identity, location and secret-bearing values.
"Location redaction" means a concrete key list, not a slogan. Coordinate-bearing leaf keys, always dropped in structured and summary (matched ignoring case, _ and -, so latitude_e7 and latitudeE7 are the same key):

startLatitude, startLongitude, start_latlng, endLatitude, endLongitude, end_latlng, latitude, longitude, lat, lon, lng, latlng, coordinates, coordinate, gps, gpx, geoPolylineDTO, map, polyline, summary_polyline, activities-tracker-gps, latitudeE7, longitudeE7, latE7, lngE7, lonE7, startLatitudeE7, startLongitudeE7, endLatitudeE7, endLongitudeE7, lat_deg, lng_deg, lon_deg, latitudeDegrees, longitudeDegrees

Location container keys, dropped as a whole object — with their address/city/placeId siblings and any coordinate spelling this list never anticipated — whenever they hold a place record (an object, or an array containing objects). A container holding only scalars is a label, not a place, and survives: location: ["gym", "home"] stays, location: { latitudeE7: … } does not.

location, locations, geoLocation, geoLocations, geo, geoJson, route, routes, position, positions, waypoint, waypoints, trackPoint, trackPoints, placeVisit

google_health_privacy_audit returns both live lists in gps_redacted_keys and gps_redacted_container_keys, and gps_redaction_default is measured at call time by pushing a synthetic record through both non-raw modes and scanning the output by key and by coordinate value — it is not a hardcoded true. npm run test:redaction-docs fails the build if these two blocks stop matching the code, so the published promise cannot drift from the enforcement list again. Google Health API v4 does not currently document a location/route data type, so this is a forward-compatible guard rather than a patch for an observed leak.

Limits of that promise, stated instead of implied. Every line below is proved by a behavioural test (npm run test:declared-limits) that fails if the behaviour changes; a line marked **NOT VERIF

Only the beginning is shown; read the rest in the repo

Google Health MCP

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Values you fill in

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Clinics & healthi

Common questions

Alternatives

Mirobody

FHIR MCP Server

Langcare MCP FHIR

README from the maker

Highest-leverage contribution — real-account coverage

Other ways to help (no account required)

HTTP (v2 stateless)

GET http://127.0.0.1:3000/health

POST http://127.0.0.1:3000/mcp (sessionless)

Google Health MCP

Why this exists

Quickstart in 60 seconds

Try it with your agent

Tools

Privacy & what runs offline