# fitbitmcp [Health: Active]

**Category:** 🏃 Sports  
**Repository:** https://github.com/davidmosiah/fitbitmcp  
**GitHub Stars:** 5  
**npm Downloads (last month):** 207  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/fitbitmcp

## Description
Privacy-first, unofficial Fitbit MCP server for AI health, sleep, activity and heart-rate agents.

## Tools
Capabilities this server exposes over MCP:

- **fitbit_data_inventory** — Inventory supported Fitbit data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call Fitbit APIs or expose user data.
- **fitbit_agent_manifest** — Machine-readable install, runtime and client guidance for AI agents. Does not call Fitbit or expose secrets.
- **fitbit_capabilities** — Explain supported Fitbit data, privacy boundaries, recommended agent workflow and project links.
- **fitbit_quickstart** — Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Fitbit?'
- **fitbit_demo** — Returns realistic example payloads of fitbit_daily_summary, fitbit_wellness_context, and fitbit_get_heart_day so agents see the contract before calling real Fitbit APIs.
- **fitbit_get_auth_url** — Generate a Fitbit OAuth authorization URL. Use this first when no local token exists.
- **fitbit_exchange_code** — Exchange a Fitbit OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned. Requires explicit user action: the user must complete browser OAuth and supply the authorization code (agents must not invent codes).
- **fitbit_get_profile** — Get the authenticated Fitbit user profile. Requires profile scope.
- **fitbit_list_devices** — List devices connected to the authenticated Fitbit account. Requires settings scope.
- **fitbit_list_activities** — List Fitbit activity logs. Supports before/after cursor, pagination and privacy modes. Requires activity scope.
- **fitbit_list_sleep** — List Fitbit sleep logs. Supports before/after cursor, pagination and privacy modes. Requires sleep scope. Not medical advice.
- **fitbit_get_activity** — Get detailed Fitbit activity log by id. Requires activity scope.
- **fitbit_get_activity_day** — Get daily activity summary, goals and distances for a date. Requires activity scope.
- **fitbit_get_sleep_day** — Get sleep logs and stages for a date. Requires sleep scope. Not medical advice.
- **fitbit_get_heart_day** — Get daily heart-rate zones and resting heart rate. Requires heartrate scope. Not medical advice.
- **fitbit_get_hrv_day** — Get HRV summary for a date when available. Requires heartrate scope and supported device/data. Not medical advice.
- **fitbit_get_breathing_rate_day** — Get breathing-rate summary for a date when available. Requires heartrate scope. Not medical advice.
- **fitbit_get_spo2_day** — Get SpO2 summary for a date when available. Requires heartrate scope. Not medical advice.
- **fitbit_get_weight_day** — Get weight logs for a date. Requires weight scope. Not medical advice.
- **fitbit_get_food_day** — Get food logs for a date. Requires nutrition scope.
- **fitbit_get_water_day** — Get water logs for a date. Requires nutrition scope.
- **fitbit_get_heart_intraday** — Get raw heart-rate intraday samples for a date. For agent work prefer fitbit_heart_series (agent-safe-series/v1 with hard point caps and exact stats). Personal apps can access their own intraday data; third-party apps may require Fitbit approval. Requires heartrate scope. Not medical advice.
- **fitbit_heart_series** — Bounded heart-rate time-series for one civil day (agent-safe-series/v1). Exact stats on full-resolution samples plus a downsampled series capped at 500 points. Prefer fitbit_get_heart_day / daily summary first; use this when you need the shape of HR over the day. Shared contract with garmin_activity_series / strava_activity_series / Kindred workout_series. Not medical advice.
- **fitbit_connection_status** — Check local Fitbit config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Fitbit or exposing secrets.
- **fitbit_cache_status** — Show optional local SQLite cache status. Enable with FITBIT_CACHE=sqlite or FITBIT_CACHE=true.
- **fitbit_privacy_audit** — Return local privacy, cache, token-path and env-presence posture without revealing secret values.
- **fitbit_revoke_access** — Revoke the current Fitbit OAuth grant and delete the local token file. Use only when the user explicitly wants to disconnect Fitbit. Gated by explicit_user_intent: true (requires explicit user intent).
- **fitbit_daily_summary** — Build a practical daily summary from Fitbit activity, sleep, heart-rate, HRV and weight data when available. Read-only and non-medical.
- **fitbit_weekly_summary** — Build a weekly Fitbit scorecard with activity, sleep, heart-rate, HRV availability, bottlenecks and actions. Read-only and non-medical.
- **fitbit_wellness_context** — Normalize Fitbit sleep and activity load into the shared wellness_context shape for recommendation engines.
- **fitbit_profile_get** — Read the canonical Delx Wellness profile shared with the other wellness MCP connectors (Nourish, Cycle Coach, CGM, etc.). Read-only. Profile stores only what the user typed during onboarding — never OAuth tokens, API keys, or biomarkers.
- **fitbit_profile_update** — Persist a partial patch to the canonical Delx Wellness profile. Requires explicit_user_intent=true after the user confirms they want to save. Rejects secret-like fields (oauth, token, api_key, password, cookie, refresh, session).
- **fitbit_onboarding** — Read-only. Return the 11-question Delx Wellness onboarding flow (en or pt-BR), the current shared profile, missing critical fields, and a cross-connector hint. Use this when the user starts a fresh wellness session and you need to fill out preferred_name, goals, devices, training context, nutrition, preferences, and safety.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "fitbitmcp": {
    "command": "npx",
    "args": ["-y","fitbit-mcp-unofficial"],
    "env": {
      "FITBIT_MCP_HOST": "",
      "FITBIT_MCP_PORT": "",
      "FITBIT_MCP_TRANSPORT": "",
      "FITBIT_PRIVACY_MODE": ""
    }
  }
}
```

**Requires environment variables:** `FITBIT_MCP_HOST`, `FITBIT_MCP_PORT`, `FITBIT_MCP_TRANSPORT`, `FITBIT_PRIVACY_MODE` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What fitbitmcp does

fitbitmcp exposes user-authorized Fitbit data through the Model Context Protocol. Its coverage includes daily activity, logged workouts, sleep and sleep stages, resting heart rate, heart-rate zones, HRV, overnight SpO2, breathing rate, weight, body composition, food and water logs, when those records are available from Fitbit.

The main summary tools turn Fitbit records into agent-ready context. `fitbit_daily_summary` combines readiness, activity, sleep and heart information for the current day. `fitbit_weekly_summary` produces a scorecard, compares the previous week and suggests a plan for the following week. Additional prompts support daily check-ins, weekly reviews and investigations of intraday heart-rate samples.

## How it works

The package uses Fitbit's official Web API and performs OAuth locally. Access and refresh tokens are kept in `~/.fitbit-mcp/tokens.json` with restrictive `0600` permissions, are not printed, and are not returned by MCP tools. The server normalizes API responses before exposing them to an agent.

stdio is the default transport. An optional Streamable HTTP mode runs on loopback, without session IDs, with a health endpoint at `/health` and MCP requests at `/mcp`. The default host and port can be adjusted with `FITBIT_MCP_HOST` and `FITBIT_MCP_PORT`.

Privacy mode defaults to `structured`. This removes GPS and secret-bearing fields while retaining complete upstream physiological records and response metadata. Raw Fitbit JSON can be enabled globally with `FITBIT_PRIVACY_MODE=raw` or selected for an individual call.

## Setup and configuration

Create a Fitbit app and set its redirect URI to `http://127.0.0.1:3000/callback`. The interactive setup flow accepts the Fitbit client ID and secret:

```bash
npx -y fitbit-mcp-unofficial setup
npx -y fitbit-mcp-unofficial auth
npx -y fitbit-mcp-unofficial doctor
```

Recommended OAuth scopes include `activity`, `heartrate`, `profile`, `settings`, `sleep`, `weight` and `nutrition`. After authorization, configure an MCP client to launch:

```json
{
  "mcpServers": {
    "fitbit": {
      "command": "npx",
      "args": ["-y", "fitbit-mcp-unofficial"]
    }
  }
}
```

Claude Desktop users can run `setup --client claude` to write the client configuration. For HTTP mode, start the package with `--http`; `FITBIT_MCP_TRANSPORT=http` also selects that transport.

## Tools and capabilities

Connection and discovery tools help an agent check readiness before making Fitbit requests. `fitbit_connection_status` verifies the local setup, while `fitbit_data_inventory` reports supported domains, scopes, privacy modes and recommended first calls without contacting Fitbit. Capability, manifest, privacy-audit and cache-status tools provide further diagnostics.

Domain-specific tools include:

- Profile and device inspection with `fitbit_get_profile` and `fitbit_list_devices`.
- Activity retrieval with `fitbit_get_activity_day`, `fitbit_list_activities` and `fitbit_get_activity`.
- Sleep retrieval with `fitbit_get_sleep_day` and `fitbit_list_sleep`.
- Heart, HRV, SpO2 and breathing-rate access through the corresponding daily, series and intraday tools.
- Weight, food and water retrieval by date.
- OAuth URL generation, code exchange and access revocation.

Intraday heart-rate data depends on Fitbit app and API access. Continuous device telemetry is outside the public API coverage. The project is unofficial and is not affiliated with Fitbit or Google; Fitbit's migration toward the Google Health API may affect OAuth, scopes, endpoints or reconnection behavior.

_Full upstream README: https://allmcps.com/mcp/fitbitmcp/readme_