Whoop Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Whoop Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP (Model Context Protocol) server that provides Claude Desktop with access to your WHOOP fitness tracker data, including recovery scores, sleep metrics, and strain data.
git clone https://github.com/JasonBates/whoop-mcp-server.git
cd whoop-mcp-server
uv synchttp://localhost:8080/callbackCreate a .env file from the example:
cp .env.example .envEdit .env and add your credentials:
WHOOP_CLIENT_ID=your_client_id_here
WHOOP_CLIENT_SECRET=your_client_secret_hereRun the token acquisition script:
uv run python scripts/get_tokens.pyThis will:
.envAdd the server to your Claude Desktop config at: ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"whoop": {
"command": "uv",
"args": [
"--directory",
"/path/to/whoop-mcp-server",
"run",
"python",
"-m",
"whoop_mcp"
]
}
}
}Replace /path/to/whoop-mcp-server with the full path where you cloned the repository.
Quit and reopen Claude Desktop. You should see "whoop" in the MCP servers list.
Once configured, you can ask Claude things like:
| Tool | Description |
|---|---|
get_today_summary | Today's recovery, sleep, and strain in one call |
get_sleep_trend | Sleep history (default 7 days, unlimited) |
get_recovery_trend | Recovery history (default 7 days, unlimited) |
get_workouts | Workout history (default 5, unlimited) |
Run the token script: uv run python scripts/get_tokens.py
The server automatically refreshes tokens, but if you encounter persistent auth errors, re-run the token script.
Each machine must authorize separately with WHOOP. You cannot copy .env tokens between machines because the first API call on each session refreshes the token, which invalidates it on other machines. Run uv run python scripts/get_tokens.py on each machine you want to use.
WHOOP API allows 100 requests/minute and 10,000/day. Normal usage is unlikely to hit these limits.
# Test with MCP Inspector
npx @modelcontextprotocol/inspector uv run python -m whoop_mcpMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.