Whoop Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Whoop Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Connect WHOOP data to Claude Desktop through MCP. This server authenticates with WHOOP, fetches fitness/recovery datasets, and exposes them as MCP tools.
get_whoop_auth_status: token/auth health.get_whoop_profile: WHOOP profile.get_whoop_body_measurements: body measurement record.get_whoop_workouts(limit, start_date, end_date, next_token): workouts.get_whoop_recovery(limit, start_date, end_date, next_token): recovery records.get_whoop_sleep(limit, start_date, end_date, next_token): sleep records.get_whoop_cycles(limit, start_date, end_date, next_token): cycle records.get_whoop_dashboard_snapshot(refresh): aggregated dashboard payload.get_whoop_full_history(refresh): raw history payload.analyze_whoop_trends(metric, days): trend stats for recovery|sleep|hrv|strain|rhr.compare_whoop_periods(start_date_1, end_date_1, start_date_2, end_date_2): side-by-side period comparison.get_whoop_correlations(days): pairwise metric correlations (sleep/recovery/strain/HRV relationships).get_whoop_insights(days): dashboard-style narrative insights for the selected trailing window.Dates use YYYY-MM-DD.
git clone https://github.com/arpitarunkumaar/whoop-mcp-server.git
cd whoop-mcp-server
python3.11 -m venv .venv311
source .venv311/bin/activate
pip install -r requirements.txtUse the direct local OAuth flow (no third-party auth broker):
python3.11 setup.py --client-id YOUR_CLIENT_IDIf WHOOP_CLIENT_SECRET is not set, setup prompts for it securely.
Claude config file:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json~/.config/claude/claude_desktop_config.jsonUse absolute paths:
{
"mcpServers": {
"whoop": {
"command": "/absolute/path/to/python3",
"args": ["/absolute/path/to/whoop-mcp-server/src/whoop_mcp_server.py"],
"env": {
"PYTHONPATH": "/absolute/path/to/whoop-mcp-server/src"
}
}
}
}Restart Claude Desktop after saving config.
Ask Claude:
get_whoop_auth_status."python3.11 src/whoop_dashboard_server.py to start the local dashboard API server (loopback-only by default).npm run dev to start the Next.js dashboard.http://localhost:3000 in your browser to view the dashboard UI.Refresh in the dashboard UI to force a fresh WHOOP pull.--allow-remote explicitly.If the dashboard is not showing current data, run these steps in order:
pkill -f 'src/whoop_dashboard_server.py'rm -f ~/.whoop-mcp-server/cache.jsonpython3.11 setup.py --client-id YOUR_CLIENT_ID --redirect-uri http://127.0.0.1:8786/callbackpython3.11 src/whoop_dashboard_server.py --host 127.0.0.1 --port 8765http://localhost:3000 and click Refresh.Generate JSON + CSV in one run:
python3.11 scripts/export_whoop_data.py --csvGenerate only JSON:
python3.11 scripts/export_whoop_data.pyCSV files are written into the selected export directory (for example storage/exports/whoop-export-YYYYMMDDTHHMMSSZ/):
recovery.csvsleep.csvworkouts.csvcycles.csvdaily_summary.csvcsv_manifest.json (row counts + metadata)~/.whoop-mcp-server/LOG_LEVEL and optional LOG_FILE environment variables.python scripts/export_whoop_data.pydrop_exports/; incremental runs auto-select the newest dropped export.drop_exports/ is scaffolded in Git, but files you drop there are gitignored.python scripts/export_whoop_data.py --drop-base /path/to/exportsWHOOP_CLIENT_IDWHOOP_CLIENT_SECRET~/.whoop-mcp-server/tokens.json was created before client credentials were persisted, re-run setup once so refresh remains stable:python3.11 setup.py --client-id YOUR_CLIENT_IDNo valid access token available:invalid_client:claude_desktop_config.jsonPYTHONPATH points to <repo>/srcMIT. See LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.