Google Health Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Google Health Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- delx-wellness header v2 --> <h1 align="center">Google Health MCP</h1>
<div align="center"> <img src="assets/banner.png" alt="Google Health MCP — Google Health MCP for AI agents" width="85%" /> </div>
<h3 align="center"> Read user-authorized Google Health API v4 data — Fitbit, Pixel Watch and partners — locally via OAuth. <strong>Beta</strong>.<br> Local-first MCP server — <strong>tokens never leave your machine</strong>. </h3>
<p align="center"> <a href="https://www.npmjs.com/package/google-health-mcp-unofficial"><img src="https://img.shields.io/npm/v/google-health-mcp-unofficial?style=for-the-badge&labelColor=0F172A&color=10B981&logo=npm&logoColor=white" alt="npm version" /></a> <a href="https://www.npmjs.com/package/google-health-mcp-unofficial"><img src="https://img.shields.io/npm/dm/google-health-mcp-unofficial?style=for-the-badge&labelColor=0F172A&color=0EA5A3&logo=npm&logoColor=white" alt="npm downloads" /></a> <a href="LICENSE"><img src="https://img.shields.io/badge/LICENSE-MIT-22C55E?style=for-the-badge&labelColor=0F172A" alt="License MIT" /></a> <a href="https://wellness.delx.ai/connectors/google-health"><img src="https://img.shields.io/badge/SITE-wellness.delx.ai-0EA5A3?style=for-the-badge&labelColor=0F172A" alt="Site" /></a> </p>
<p align="center"> <a href="https://github.com/davidmosiah/google-health-mcp/stargazers"><img src="https://img.shields.io/github/stars/davidmosiah/google-health-mcp?style=for-the-badge&labelColor=0F172A&color=FBBF24&logo=github" alt="GitHub stars" /></a> <a href="https://modelcontextprotocol.io"><img src="https://img.shields.io/badge/BUILT_FOR-MCP-7C3AED?style=for-the-badge&labelColor=0F172A" alt="Built for MCP" /></a> <a href="https://github.com/davidmosiah/delx-wellness-hermes"><img src="https://img.shields.io/badge/HERMES-one--command_setup-10B981?style=for-the-badge&labelColor=0F172A" alt="Hermes one-command setup" /></a> <a href="https://github.com/davidmosiah/delx-wellness"><img src="https://img.shields.io/badge/Google%20Health-4285F4?style=for-the-badge&labelColor=0F172A&logoColor=white" alt="Google Health" /></a> </p>
⚡ One-command install with Delx Wellness for Hermes: npx -y delx-wellness-hermes setup — preconfigures this connector and the other 8 in a dedicated Hermes profile.>
Or wire it standalone into Claude Desktop / Cursor / ChatGPT Desktop — see the install section below.
<!-- /delx-wellness header v2 -->
Unofficial, local-first MCP server for the new Google Health API v4.
It lets Claude, Cursor, Hermes, OpenClaw and other MCP clients read user-authorized Google Health data from Fitbit, Pixel Watch and supported third-party sources through Google's OAuth 2.0 flow.
Beta status: Google recommends waiting until the end of May 2026 before officially launching Google Health API integrations because breaking changes may occur while developer feedback is incorporated. This connector is intentionally published as an early beta for builders who want to test the API now.
Unofficial project. Not affiliated with, endorsed by or supported by Google, Fitbit or Alphabet. Not a medical device. Not medical advice.
The highest-leverage contribution right now is real setup feedback from Fitbit, Pixel Watch, Android and Google Health API v4 users.
If you can test with a real account:
npx -y google-health-mcp-unofficial doctor and confirm the OAuth flow is clear.google_health_connection_status, google_health_data_inventory and google_health_daily_summary from your MCP client.Useful links:
Google Health API is the successor to Fitbit Web API: new OAuth, new base URL, v4 endpoint schema, standardized data types, reconciled streams and rollups.
This MCP gives agents a clean way to discover the API, check setup, authenticate locally and query data without pasting tokens into prompts or agent configs.
<p align="center"> <img src="assets/terminal-demo.svg" alt="Google Health MCP terminal demo showing local doctor checks" width="85%" /> </p>
npx -y google-health-mcp-unofficial setup --scope-preset full
npx -y google-health-mcp-unofficial auth
npx -y google-health-mcp-unofficial doctorThen start your agent with:
google_health_connection_statusgoogle_health_data_inventorygoogle_health_privacy_auditgoogle_health_daily_summaryCreate a Google Cloud OAuth client, enable the Google Health API, and add:
http://127.0.0.1:3000/callbackThen run:
npx -y google-health-mcp-unofficial setup --scope-preset full
npx -y google-health-mcp-unofficial auth
npx -y google-health-mcp-unofficial doctorScope presets keep OAuth consent easier to reason about:
npx -y google-health-mcp-unofficial setup --scope-preset basic
npx -y google-health-mcp-unofficial setup --scope-preset activity
npx -y google-health-mcp-unofficial setup --scope-preset sleep
npx -y google-health-mcp-unofficial setup --scope-preset fullbasic - profile and settings onlyactivity - profile, settings, activity and health metricssleep - profile, settings and sleepfull - all recommended read-only scopes, including nutritionIf setup gets stuck:
npx -y google-health-mcp-unofficial doctor --fix
npx -y google-health-mcp-unofficial doctor --live
npx -y google-health-mcp-unofficial support --redacteddoctor --fix repairs local config/token permissions where the OS supports chmod 600.doctor --live calls safe Google Health identity/profile/settings endpoints after auth to prove the API is reachable.support --redacted prints a copy-paste support bundle for GitHub issues without tokens, secrets or health measurements.Recommended read-only scopes:
https://www.googleapis.com/auth/googlehealth.profile.readonly
https://www.googleapis.com/auth/googlehealth.settings.readonly
https://www.googleapis.com/auth/googlehealth.activity_and_fitness.readonly
https://www.googleapis.com/auth/googlehealth.health_metrics_and_measurements.readonly
https://www.googleapis.com/auth/googlehealth.sleep.readonly
https://www.googleapis.com/auth/googlehealth.nutrition.readonlyStandalone MCP config:
{
"mcpServers": {
"google_health": {
"command": "npx",
"args": ["-y", "google-health-mcp-unofficial"]
}
}
}Start here:
google_health_connection_status - local config, token, scope and client readinessgoogle_health_data_inventory - supported domains, scopes, data type naming and agent flowgoogle_health_agent_manifest - machine-readable install/runtime guidegoogle_health_daily_summary - daily beta summary from rollups and reconciled streamsgoogle_health_weekly_summary - weekly beta reviewGoogle Health API methods:
google_health_get_identitygoogle_health_get_profilegoogle_health_get_settingsgoogle_health_list_data_pointsgoogle_health_reconcile_data_pointsgoogle_health_daily_rollupgoogle_health_rollupDiagnostics:
google_health_get_auth_urlgoogle_health_exchange_codegoogle_health_privacy_auditgoogle_health_cache_statusgoogle_health_revoke_accessgoogle_health_wellness_contextEndpoint paths use kebab case:
steps
sleep
heart-rate
daily-resting-heart-rate
daily-heart-rate-variability
active-zone-minutes
total-calories
weight
exerciseFilter expressions use snake case:
steps.interval.civil_start_time >= "2026-05-07"
heart_rate.sample_time.physical_time >= "2026-05-07T00:00:00Z"
sleep.interval.civil_start_time >= "2026-05-07"Source families supported by the API:
users/me/dataSourceFamilies/all-sources
users/me/dataSourceFamilies/google-wearables
users/me/dataSourceFamilies/google-sources~/.google-health-mcp/tokens.json with 0600 permissions.~/.google-health-mcp/config.json or GOOGLE_HEALTH_* environment variables.GOOGLE_HEALTH_PRIVACY_MODE=structured is the default.raw mode is explicit and should be used only for debugging or deep analysis.npx -y google-health-mcp-unofficial setup --client hermes --no-auth
npx -y google-health-mcp-unofficial auth
npx -y google-health-mcp-unofficial doctor --client hermes --fix
npx -y google-health-mcp-unofficial doctor --client hermes --live
hermes mcp test google_healthAfter config changes, use /reload-mcp or hermes mcp test google_health. Do not restart the gateway for normal data access.
git clone https://github.com/davidmosiah/google-health-mcp.git
cd google-health-mcp
npm install
npm testMIT - see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.