Is io.github.Yadheedhya06/mcp-server-whoop safe to use?

io.github.Yadheedhya06/mcp-server-whoop has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install io.github.Yadheedhya06/mcp-server-whoop?

io.github.Yadheedhya06/mcp-server-whoop can be installed by cloning its GitHub repository and following the setup instructions in the README.

What AI clients work with io.github.Yadheedhya06/mcp-server-whoop?

io.github.Yadheedhya06/mcp-server-whoop is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

io.github.Yadheedhya06/mcp-server-whoop

Local-first, read-only WHOOP MCP server for recovery, sleep, strain, workouts, and body signals

GitHub

No known CVEs

No license

Maintenance unknown

No commit data

Works with most clients

Transport: stdio

0 tools

Grade F

Edit this pageView history

Health

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-yadheedhya06-mcp-server-whoop": {
      "command": "<see-readme>",
      "args": []
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-yadheedhya06-mcp-server-whoop)](https://mcppedia.org/s/io-github-yadheedhya06-mcp-server-whoop)

Read me

What io.github.Yadheedhya06/mcp-server-whoop does

Local-first, read-only WHOOP MCP server for recovery, sleep, strain, workouts, and body signals

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

14/100across 5 weighted dimensions

How we score →

0255075100

−86

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Help improve this page

This server is missing a description. Tools and install config are also missing.If you've used it, help the community.

Add information

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.Yadheedhya06/mcp-server-whoop safe to use?: io.github.Yadheedhya06/mcp-server-whoop has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.Yadheedhya06/mcp-server-whoop?: io.github.Yadheedhya06/mcp-server-whoop can be installed by cloning its GitHub repository and following the setup instructions in the README.
What AI clients work with io.github.Yadheedhya06/mcp-server-whoop?: io.github.Yadheedhya06/mcp-server-whoop is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Similar servers

Others in health

View all →

Clinicaltrialsgov Mcp Server90

MCP server for the ClinicalTrials.gov v2 API. Search trials, retrieve study details and results, and match patients to eligible trials.

81 7

Withings MCP Server88

MCP server for Withings health data — sleep, activity, heart, and body metrics.

28 11

io.github.SidneyBissoli/cid10-br-mcp87

MCP Server for Brazilian ICD-10 (DATASUS) - International Classification of Diseases

1 6

io.github.domdomegg/openfoodfacts-mcp87

Search and contribute to the Open Food Facts database.

3 9

MCP Security Weekly

Get CVE alerts and security updates for io.github.Yadheedhya06/mcp-server-whoop and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Health

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-yadheedhya06-mcp-server-whoop": {
      "command": "<see-readme>",
      "args": []
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-yadheedhya06-mcp-server-whoop)](https://mcppedia.org/s/io-github-yadheedhya06-mcp-server-whoop)

Read me

What io.github.Yadheedhya06/mcp-server-whoop does

Local-first, read-only WHOOP MCP server for recovery, sleep, strain, workouts, and body signals

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

README

mcp-server-whoop

A local-first, read-only Model Context Protocol server for WHOOP. It gives MCP-compatible AI clients compact recovery, sleep, strain, HRV, heart-rate, workout, and body-measurement signals without sending your WHOOP credentials through a hosted third party.

Why this server

Standard MCP over stdio, usable by any client that supports local MCP servers
Local WHOOP OAuth flow with each user's own WHOOP developer application
Access and rotating refresh tokens remain on the user's machine
Five focused read-only tools instead of a noisy API dump
Per-record local timestamps, so travel does not shift sleep or workout dates
Explicit processing status, with no older recovery substituted while a new sleep is pending
Score-derived metrics appear only for SCORED records; live current-cycle strain is labeled provisional_strain
Human-scale hours, minutes, calories, and heart-rate-zone minutes
No raw identifiers, OAuth secrets, or raw continuous heart-rate claims in tool output
No hosted relay, telemetry, database, generic HTTP tool, raw SQL, or install lifecycle scripts
Reproducible tarball security audit, CycloneDX SBOM, CodeQL, Gitleaks, dependency review, and OpenSSF Scorecard

This is an independent community project. It is not affiliated with or endorsed by WHOOP. WHOOP data is useful coaching context, not medical advice.

Requirements

Node.js 18 or newer
A WHOOP account
A free application in the WHOOP Developer Dashboard
An MCP-compatible AI client

Quick start

Create a WHOOP developer application and register http://127.0.0.1:8765/callback.
Enable the five read scopes and offline listed below.
Run npx -y mcp-server-whoop@0.2.2 auth in a terminal and approve WHOOP access.
Run npx -y mcp-server-whoop@0.2.2 status to confirm the local grant exists.
Add the stdio command npx -y mcp-server-whoop@0.2.2 to your AI client's MCP configuration.
Restart or reload the client, then ask: Use WHOOP to summarize my recovery and sleep from the last 7 days.

The authorization command and the AI client must run as the same operating-system user, or both must set WHOOP_CREDENTIALS_FILE to the same private file. The package never asks you to paste WHOOP tokens into an AI conversation.

The documentation pins an exact reviewed version by default. Use @latest only if you explicitly want your client to follow future releases without reviewing them first.

1. Create your WHOOP application

Create an application in the WHOOP Developer Dashboard and register this exact redirect URL:

http://127.0.0.1:8765/callback

Enable these scopes:

offline
read:recovery
read:cycles
read:sleep
read:workout
read:body_measurement

offline is required because WHOOP access tokens expire and WHOOP rotates refresh tokens.

2. Authorize locally

Run:

npx -y mcp-server-whoop@0.2.2 auth

The command prompts for your WHOOP client ID and masks the client secret, opens WHOOP consent in your browser, validates the OAuth state, and saves the resulting grant locally.

Credentials are stored at:

~/.config/mcp-server-whoop/credentia

... [View full README on GitHub](https://github.com/yadheedhya06/mcp-server-whoop#readme)

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

14/100across 5 weighted dimensions

How we score →

0255075100

−86

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Help improve this page

This server is missing a description. Tools and install config are also missing.If you've used it, help the community.

Add information

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.Yadheedhya06/mcp-server-whoop safe to use?: io.github.Yadheedhya06/mcp-server-whoop has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.Yadheedhya06/mcp-server-whoop?: io.github.Yadheedhya06/mcp-server-whoop can be installed by cloning its GitHub repository and following the setup instructions in the README.
What AI clients work with io.github.Yadheedhya06/mcp-server-whoop?: io.github.Yadheedhya06/mcp-server-whoop is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.