Withings MCP Server

Help me pay for the servers on Patreon

A Model Context Protocol (MCP) server that brings your Withings health data into Claude. Access your sleep patterns, body measurements, workouts, heart data, and more through natural conversation.

🔒 Privacy First: This is my personal project, and the repository is intentionally public to demonstrate transparency. The code shows that no personal information is logged or stored maliciously. All sensitive data (tokens, user IDs) is encrypted at rest and automatically redacted from logs. You can review the entire codebase to verify this commitment to privacy.

⚠️ Disclaimer: This server is provided as-is without any guarantees or warranties. While I've made every effort to ensure security and privacy, I make no guarantees about availability, data integrity, or security. Use at your own risk. For production use cases, consider self-hosting your own instance.

Quick Setup

1. Open Claude Desktop → Customize → Connectors
2. Click + → Add Custom Connector
3. Set URL to https://withings-mcp.com/mcp → click Add
4. Click Connect and authorize with your Withings account

That's it! Ask Claude about your sleep, weight, workouts, or heart data.

Demo

Table of Contents

• Quick Setup
• Demo
• What Can You Do With This?
• For End Users: Using the Hosted Server
  • Prerequisites
  • Setup Instructions
  • Available Tools
  • Example Conversations
  • Privacy & Security
• For Developers: Self-Hosting
  • Prerequisites
  • Step 1: Create Withings Application
  • Step 2: Clone and Setup
  • Step 3: Local Development
  • Step 4: Deploy to Production
  • Step 5: Update Withings App Settings
  • Step 6: Configure Your MCP Client
  • Environment Variables Reference
  • Development Commands
  • Project Structure
• Security Features
  • Token Encryption
  • OAuth Hardening
  • Transport Security
  • Privacy-Safe Logging
• Contributing
• License
• Support
• Acknowledgments

What Can You Do With This?

This MCP server gives Claude access to your Withings health data, allowing you to:

• Analyze your sleep: Ask about sleep quality, duration, deep sleep stages, heart rate during sleep
• Track body metrics: Weight trends, body composition, blood pressure, heart rate over time
• Review workouts: Analyze exercise patterns, calories burned, heart rate zones
• Monitor heart health: Access ECG recordings and detailed heart data
• Set and track goals: Review your fitness and health goals
• Identify patterns: Find correlations between sleep, activity, and other metrics
• Generate insights: Get AI-powered analysis of your health trends

All through natural conversation with Claude or any other MCP-compatible client.

For End Users: Using the Hosted Server

If you just want to use this MCP server with Claude Desktop without hosting anything yourself, follow these steps:

Prerequisites

1. A Withings account with connected devices
2. Claude Desktop or any other MCP-compatible client installed on your computer

Setup Instructions

Step 1: Add Connector in Claude Desktop

1. Open Claude Desktop
2. Go to Customize (in the sidebar or menu)
3. Navigate to the Connectors section
4. Click the + button to add a new connector
5. Select Add Custom Connector
6. Fill in the following details:
   • Name: Withings (or any name you prefer)
   • Remote MCP server URL: https://withings-mcp.com/mcp
7. Click Add

Note: If your MCP client doesn't support UI-based connector configuration, you can manually edit the config file instead. See the manual configuration guide below.

Step 2: Connect and Authorize

1. In the Connectors settings, find the Withings connector you just added
2. Click Connect next to the connector
3. Your web browser will open with the Withings authorization page
4. Log in to your Withings account
5. Review and approve the permissions requested
6. You'll be redirected back and the connection will be complete

After authorization, Claude will have access to your Withings data!

Available Tools

Once connected, Claude can use these tools to access your data:

Sleep & Activity

• get_hrv - Minute-level RMSSD, SDNN, and quality scores captured during sleep
• get_sleep_summary - Sleep duration, stages (light/deep/REM), heart rate, breathing, sleep score
• get_activity - Daily steps, distance, calories, elevation, activity durations
• get_intraday_activity - High-frequency activity data throughout the day
• get_workouts - Detailed workout summaries with heart rate zones and metrics

Body Measurements

• get_measures - Weight, body composition, blood pressure, heart rate, temperature, VO2 max, and more

Devices & Goals

• get_user_devices - List of connected Withings devices
• get_user_goals - Your health and fitness goals (steps, sleep, weight)

Heart Health

• list_heart_records - List of ECG recordings
• get_heart_signal - Detailed ECG waveform data

Stethoscope (if you have BPM Core)

• list_stetho_records - List of stethoscope recordings
• get_stetho_signal - Detailed audio signal data

Example Conversations

Try asking Claude:

• "How has my sleep quality been over the past week?"
• "Show me my weight trend for the last month"
• "What's my average resting heart rate?"
• "Did I hit my step goal this week?"
• "Compare my workout intensity between this month and last month"
• "When did I sleep best this month?"

Privacy & Security

• Encrypted tokens: All authentication tokens and authorization codes are encrypted using AES-256-GCM before storage
• No logging of personal data: The code is public - you can verify that no sensitive information is logged
• Automatic redaction: All user IDs, tokens, and credentials are automatically redacted from system logs
• OAuth 2.0: Industry-standard secure authentication with PKCE support and redirect URI validation
• Session security: MCP sessions are bound to the authenticated user, preventing cross-user access
• You're in control: Revoke access anytime from your Withings account settings

---

For Developers: Self-Hosting

Want to run your own instance? Here's how to deploy this MCP server yourself.

Prerequisites

1. Bun 1.1+ installed
2. A Withings Developer Account

Step 1: Create Withings Application

1. Go to Withings Developer Portal
2. Create a new application
3. Note your Client ID and Client Secret
4. Set your Redirect URI to: https://your-domain.com/callback
   • This must be a publicly accessible URL (localhost is not supported by Withings)
   • Can be any domain where you'll host the server (e.g., Fly.io, Railway, your own server, etc.)

Important: Remove Google Analytics

The hosted version includes a Google Analytics tag (G-ZMGF9WXL3W) in the static pages under public/. If you're forking this repo, remove or replace the GA snippet in public/index.html and public/health.html, and update the CSP headers in src/server/app.ts accordingly.

Step 2: Clone and Setup

# Clone the repository
git clone https://github.com/your-username/withings-mcp.git
cd withings-mcp

# Install dependencies
bun install

# Generate encryption secret
bun run generate-secret
# Copy the output - you'll need it for environment variables

Step 2.5: Set Up Supabase Database

1. Create a free project at Supabase
2. Install the Supabase CLI: bun install -g supabase (or use brew install supabase/tap/supabase)
3. Link your project: supabase link --project-ref <your-project-ref>
4. Apply the database migrations: supabase db push
5. Get your credentials from Dashboard → Settings → API:
   • Project URL → SUPABASE_URL
   • Service role key → SUPABASE_SECRET_KEY

Step 3: Local Development

Note: Withings requires a publicly accessible URL for OAuth callbacks. For local development, use a tunneling service to expose your local server or deploy to a staging environment for testing.

# Copy environment template
cp .env.example .env

# Edit .env with your values
# WITHINGS_CLIENT_ID=your_client_id
# WITHINGS_CLIENT_SECRET=your_client_secret
# WITHINGS_REDIRECT_URI=https://your-tunnel-url.com/callback
# ENCRYPTION_SECRET=past…[redacted]
# SUPABASE_URL=https://your-project.supabase.co
# SUPABASE_SECRET_KEY=your_service_role_key
# PORT=3000

# Run locally (Bun executes TypeScript directly — no build step)
bun run dev

Make sure your redirect URI in the .env file matches the publicly accessible URL pointing to your local server.

Step 4: Deploy to Production

# The project runs TypeScript directly with Bun — no build step required.
bun run start

Deploy to DigitalOcean App Platform (its Bun buildpack detects package.json and runs bun run start automatically), or any other host that supports Bun.

Set the following environment variables on your hosting platform:

| Variable | Required | Example | |----------|----------|---------| | WITHINGS_CLIENT_ID | Yes | your_client_id | | WITHINGS_CLIENT_SECRET | Yes | your_client_secret | | WITHINGS_REDIRECT_URI | Yes | https://your-domain.com/callback | | ENCRYPTION_SECRET | Yes | Generated fr