Google Health MCP

Read user-authorized Google Health API v4 data — Fitbit, Pixel Watch and partners — locally via OAuth. Beta.
Local-first MCP server — tokens never leave your machine.

⚡ One-command install with Delx Wellness for Hermes: npx -y delx-wellness-hermes setup — preconfigures this connector and the other 8 in a dedicated Hermes profile.

Or wire it standalone into Claude Desktop / Cursor / ChatGPT Desktop — see the install section below.

What's new in 0.7.3 (2026-08-03): headless OAuth (auth --manual) for SSH / containers / WSL · real-account rollup/filter fixes from external testers · opt-in clinical scopes for ECG/IRN · pins live in Hermes/living-body. Full notes in CHANGELOG.md.

Highest-leverage contribution — real-account coverage

If you have Fitbit, Pixel Watch, Android health data or Google Health API v4 access, the most useful help is a redacted coverage report:

npx -y google-health-mcp-unofficial coverage --live --json

Review the output, remove anything you do not want public, then post the report on issue #2 (or a new issue). The timed proof loop on #21 closed 1/2 — see docs/proof-loop-status.md. The command is read-only and is designed to omit OAuth secrets, local paths and raw health measurements. A static preflight is available before OAuth with coverage --json.

Other ways to help (no account required)

HTTP (v2 stateless)

Default is stdio. Optional Streamable HTTP — no session id, JSON responses, loopback only:

npx -y google-health-mcp-unofficial --http
# GET  http://127.0.0.1:3000/health
# POST http://127.0.0.1:3000/mcp   (sessionless)

Env: GOOGLE_HEALTH_MCP_HOST, GOOGLE_HEALTH_MCP_PORT, GOOGLE_HEALTH_MCP_TRANSPORT=http.

Google Health MCP

Local-first MCP server that gives your AI agent user-authorized Google Health API v4 data — Fitbit, Pixel Watch and partners — over OAuth.

• Install one connector — npx -y google-health-mcp-unofficial setup
• Run it in Claude · Cursor · ChatGPT · Hermes · OpenClaw — see the client examples.
• Local-first — your tokens never leave your machine (privacy).
• Which connector should I use? — see the front-door guide.

Beta status: Google Health API v4 is live for builders but still evolving. Google's release notes show scope and data-type changes continuing after launch, so this connector stays in early beta and points testers to safe read-only validation paths before public production use.

Unofficial project. Not affiliated with, endorsed by or supported by Google, Fitbit or Alphabet. Not a medical device. Not medical advice.

Why this exists

Google Health API is the successor to Fitbit Web API: new OAuth, new base URL, v4 endpoint schema, standardized data types, reconciled streams and rollups.

This MCP gives agents a clean way to discover the API, check setup, authenticate locally and query data without pasting tokens into prompts or agent configs.

Quickstart in 60 seconds

Create a Google Cloud OAuth client, enable the Google Health API, and add the redirect http://127.0.0.1:3000/callback. Then:

npx -y google-health-mcp-unofficial setup --scope-preset full   # writes local config
npx -y google-health-mcp-unofficial auth                        # OAuth, tokens saved locally
npx -y google-health-mcp-unofficial doctor                      # verifies you're ready

doctor --live calls safe Google Health identity/profile/settings endpoints after auth to prove the API is reachable — the connection proof for this beta. That does not prove Claude Desktop can invoke tools: Desktop validates outputSchema as JSON Schema 2020-12. Use google-health-mcp-unofficial@0.7.6+ (see #23). Full install details (scope presets, MFA, recovery) are in the Install section below.

Try it with your agent

Three things to ask first, based on tools this connector actually ships:

Use google_health_connection_status to check setup, then run
google_health_data_inventory. Tell me which Google Health domains
and scopes I have authorized.

Call google_health_daily_summary for today, then google_health_weekly_summary.
Separate observed data from suggestions and stay non-medical.

Run google_health_privacy_audit, then summarize exactly what is stored
locally and what would be sent to Google on the next call.

Tools

Start here:

• google_health_connection_status — local config, token, scope and client readiness
• google_health_data_inventory — supported domains, scopes, data type naming and agent flow
• google_health_data_type_coverage — static coverage plan, or explicit live read-only validation for issue #21
• google_health_daily_summary — daily beta summary from rollups and reconciled streams
• google_health_weekly_summary — weekly beta review
• google_health_privacy_audit — what is stored locally and what is sent to Google

The full tool catalog — Google Health API methods, agent manifest, diagnostics and data-type naming notes (kebab-case endpoints, snake_case filters, source families) — lives in docs/tools.md.

Privacy & what runs offline

• OAuth tokens are stored locally at ~/.google-health-mcp/tokens.json with 0600 permissions.
• Secrets can live in ~/.google-health-mcp/config.json or GOOGLE_HEALTH_* environment variables.
• Tools never return access tokens, refresh tokens or client secrets.
• GOOGLE_HEALTH_PRIVACY_MODE=structured is the default; raw mode is explicit and should be used only for debugging or deep analysis. An agent asking for privacy_mode=raw is refused unless it passes explicit_user_intent=true; setting GOOGLE_HEALTH_PRIVACY_MODE=raw yourself is your own call and needs no per-call intent.
• Structured mode preserves complete upstream physiological fields and future v4 additions while removing identity, location and secret-bearing values.
• "Location redaction" means a concrete key list, not a slogan. Coordinate-bearing leaf keys, always dropped in structured and summary (matched ignoring case, _ and -, so latitude_e7 and latitudeE7 are the same key):