Withings Mcp

io.github.partymolaPublished by GitHub account partymolav0.11.0Updated Nov 6, 2026

MCP server for the Withings Health API with OAuth, local SQLite cache, and trend analysis.

VerifiedSTDIODesktop onlyDatabasesLocation & LifestyleData & Analytics

Overview

AI-generated overview

Local MCP server for the Withings Health API that syncs body, sleep, activity, workout and heart data into a SQLite cache for trend analysis.

What you can do
  • Sync Withings data into a local SQLite cache, incrementally or for a chosen history depth
  • Query body composition, daily activity and workouts from the cache, with optional live fetch
  • Read sleep summaries or minute-by-minute phase detail, and ECG/AFib recordings
  • List connected devices with battery status
  • Compute period averages, weekly/monthly/quarterly trends and period comparisons
When to use it
Useful when you want an assistant to answer questions about your own Withings measurements — weight and body composition, sleep, steps, workouts, ECG — and to compare periods or spot trends over time, including offline from cached data.
Requirements
Python 3.13+ with pip or uv, run as a local stdio process. A Withings developer account and registered application with a localhost callback, plus a one-time interactive OAuth authorization that stores tokens locally. Optional environment variables WITHINGS_MCP_CONFIG_DIR and WITHINGS_MCP_DB_PATH set the credential and database locations. Network access is needed for syncing and live queries.
Before you install
OAuth tokens are saved in the config directory, so protect that folder and keep it out of version control. Personal health data is written to a local SQLite database. The tools are described as read-only toward Withings, but syncing and live queries send requests to the Withings API. The manifest declares no authentication or environment variables, so setup relies on the CLI auth flow.

Installation

In SourceWeft

  1. Open Withings Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

withings-mcp

[CI] [License: GPL v3] [Python 3.13+] [PyPI] [Glama MCP Server]

MCP server for the Withings Health API with OAuth, local SQLite cache, and trend analysis.

What makes this different from other Withings MCP servers:

  • Local SQLite cache for fast offline queries and historical trend analysis
  • Incremental sync - only fetches new data since last sync
  • Broad Withings coverage: 17 body-composition metrics plus sleep, daily activity, workouts, and ECG/AFib
  • Automatic OAuth token refresh (access tokens: 3h, refresh tokens: 1 year)
  • Zero dependencies beyond mcp (HTTP via stdlib)
  • Python 3.13+ (tested on 3.13, 3.14 and 3.15, on Linux, macOS and Windows, in CI)

Tools

ToolDescriptionData source
withings_syncSync data from Withings API to local cacheLive API -> SQLite
withings_get_bodyBody composition (weight, fat%, muscle, bone, BP, SpO2)Local cache (auto-syncs if stale)
withings_get_sleepSleep summaries, or detailed phase time-series with detail=TrueCache (summary) / live (detail)
withings_get_activityDaily steps, distance, calories, active timeLocal cache (auto-syncs if stale)
withings_get_workoutsWorkout sessions with type, duration, HRLocal cache (auto-syncs if stale)
withings_get_heartECG recordings and AFib detectionLive API (always)
withings_get_devicesConnected devices with battery statusLive API (always)
withings_trendsPeriod averages, weekly/monthly/quarterly trends, comparisonsLocal cache (auto-syncs if stale)

The cache-backed query tools auto-sync when their data is stale, and accept live=True to bypass the cache and fetch straight from the Withings API. withings_get_heart and withings_get_devices are always live. withings_get_sleep(detail=True) returns minute-by-minute sleep phases (live, up to 7 days per request).

Prerequisites

  • Python 3.13+ (tested on 3.13, 3.14 and 3.15, on Linux, macOS and Windows, in CI)
  • uv (recommended) or pip
  • A Withings developer account and registered application

Installation

bash
pip install withings-mcp

Or run it without installing with uvx withings-mcp. For development from a clone:

bash
git clone https://github.com/partymola/withings-mcp.gitcd withings-mcpuv venv --python 3.13 .venvuv pip install -e .

Setup

1. Register a Withings app

  1. Go to https://developer.withings.com/dashboard
  2. Create a new application
  3. Set the callback URL to http://localhost:8585
  4. Note your Client ID and Client Secret

2. Authenticate

bash
.venv/bin/withings-mcp auth

This opens your browser for Withings authorization. After approving, tokens are saved locally in config/.

3. Register with Claude Code

bash
claude mcp add -s user withings -- /path/to/withings-mcp/.venv/bin/withings-mcp

4. First sync

In Claude Code, say: "Sync my Withings data"

This runs withings_sync to populate the local cache. Subsequent syncs only fetch new data.

If anything does not work - no data where you expect it, a sync that stops happening - run withings-mcp doctor. It reports the paths and credentials actually in use and what needs fixing, without making an API call.

You can also sync from the command line without an MCP client:

bash
.venv/bin/withings-mcp sync                      # all data types, last 30 days.venv/bin/withings-mcp sync --types body,sleep   # a subset.venv/bin/withings-mcp sync --days 90            # deeper history on first sync

CLI

withings-mcp              Start the MCP server (stdio transport)withings-mcp auth         Interactive OAuth setup (opens the browser)withings-mcp sync         Sync data to the local cache (--types, --days)withings-mcp doctor       Check the setup and report what needs fixingwithings-mcp --version    Print the installed package version

Configuration

Environment VariableDefaultDescription
WITHINGS_MCP_CONFIG_DIR./config/Directory for credentials and tokens
WITHINGS_MCP_DB_PATH./withings.dbSQLite database path

Example Prompts

  • "Sync my Withings data"
  • "Show my weight for the last 3 months"
  • "How has my sleep changed this year?"
  • "Compare my body composition this month vs last month"
  • "What workouts did I do in March?"
  • "What Withings devices do I have connected?"
  • "Show my sleep trends quarterly"

Development

bash
# Install with dev dependenciesuv pip install -e . && uv pip install pytest
# Run tests (all use in-memory SQLite with fictional data).venv/bin/python -m pytest tests/ -v      # .venv\Scripts\python on Windows

Security

  • Read-only: No tools modify data on Withings servers
  • Local storage: Health data stays in your local SQLite database
  • Token storage: OAuth tokens stored in config/ (gitignored; created 0600 on POSIX - Windows ignores the mode and governs access by ACLs)
  • Error messages: Never contain health data values - only status codes
  • Pre-commit hook: An optional hook (scripts/check-no-data.sh) blocks database files, files under config/ and large files from commits. It does not read file contents. Install it with the one-liner in CONTRIBUTING.md

Contributing

See CONTRIBUTING.md for development setup, the test workflow, and the pre-commit hook. Changes are tracked in CHANGELOG.md.

License

GPL-3.0-or-later

Source: README.md at commit 55228d9

Tools

0
SourceWeft started this package once in an isolated sandbox, without credentials, to list its tools. That failed: the package did not install.

Version history

6
  1. v0.11.0LatestNov 6, 2026
  2. v0.10.2Nov 6, 2026
  3. v0.10.1Nov 5, 2026
  4. v0.10.0Nov 4, 2026
  5. v0.9.0Nov 3, 2026
  6. v0.8.0Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts