MCP for Oura

link.smirnovPublished by smirnov.linkOfficial publisherv0.1.1Updated Nov 4, 2026

Multi-tenant hosted MCP server for Oura Ring — 21 read-only tools, OAuth per user.

VerifiedStreamable HTTPWeb executableLocation & LifestyleData & Analytics

Overview

AI-generated overview

Hosted Oura Ring connector that lets an assistant read your sleep, readiness, activity and biometric data through 21 read-only tools after OAuth sign-in.

What you can do
  • Read daily snapshots and single metrics over date ranges: daily summary, last night's sleep, date-range series, morning briefing and weekly recap.
  • Review activity and tagging data: workouts, mindfulness sessions, intraday heart-rate series, custom tags, and comparison against personal baselines.
  • Check daily health metrics: stress, SpO2, resilience, cardio age, VO2 max, recommended sleep time and rest-mode periods.
  • Run analytics: flag anomalous days and correlate a logged tag with a chosen metric.
  • Run diagnostics to confirm the connector is authenticated and the Oura API responds.
When to use it
Useful when you wear an Oura Ring and want to ask an assistant plain-language questions about your sleep, recovery, stress and long-term trends, or want tag-versus-metric correlations and anomaly flags without opening the Oura app.
Requirements
A remote MCP endpoint; no local install. An Oura account and OAuth authorization through the server's consent page, then Oura's own consent. An MCP client that supports custom connectors and OAuth. The connector is currently capped at 10 authorized users under Oura's development-mode limit.
Before you install
The server holds your Oura OAuth tokens and reads your ring data on your behalf; the README says tokens are encrypted at rest and ring data is not logged, but your health data passes through a third-party hosted service. All tools are read-only, so nothing is written back to Oura. Cycle analytics are not available because Oura's public API does not expose them. The service is a small independent project, not affiliated with Oura.

Installation

In SourceWeft

  1. Open MCP for Oura in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/link.smirnov%2Fmcp-oura/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "for-oura": {
      "type": "http",
      "url": "https://mcp-oura.smirnov.link/mcp"
    }
  }
}

README

mcpforoura

[smithery badge] [mcp registry]

Ask your AI assistant about your Oura Ring data in plain language. mcpforoura is a hosted, multi-tenant Model Context Protocol server for Oura Ring, live at https://mcp-oura.smirnov.link/mcp. Connect it to Claude (or any MCP-compatible client), authorize once with Oura, and query your sleep, readiness, activity, biometrics, and long-term trends across 21 read-only tools. Multi-tenant OAuth: each user authenticates to their own Oura account. Read-only. Built on Cloudflare Workers.

[Add to Claude]

Listed on Smithery and the official MCP Registry.

Small-scale connector — currently in Oura's development-mode 10-user cap; production application is pending. Not affiliated with Oura Health Oy.

Status: deployed and serving. 21 tools live — core sleep/readiness/activity data plus biometrics, composite snapshots, and analytics. Phase 5 cycle tools removed pending Oura API support (see "Not available" below). Full build history is in the milestone table.

What you can ask

Once connected, your assistant can answer questions like:

  • "How did I sleep last night?" — stages, timing, HR and HRV
  • "Is my HRV normal for me this week?" — compared against your personal baseline
  • "How am I today?" — a morning briefing of readiness, recommended sleep, and yesterday's stats
  • "Does alcohol hurt my recovery?" — correlate a logged tag against any metric
  • "Flag any days this month that were unusual for me." — statistical anomaly detection

Those map onto 21 tools across 4 phases (Phase 5 cycle tools removed — see "Not available" below):

Core (M6 originals)

ToolWhen to use
get_daily_summary"How was my Saturday?" / "Show me yesterday's readiness." A single-day snapshot of sleep + readiness + activity.
get_date_range"How was my sleep this week?" / "Show me my HRV over the past month." A single metric over up to 180 days.
get_last_night_sleep"How did I sleep last night?" Most recent night's score, stage breakdown, timing, HR/HRV.
pingDiagnostic. Verifies the connector is authenticated and reachable.
_internal_personal_infoDiagnostic. Verifies the Oura token works and the API is responding.

Phase 1 — Activity & tagging

ToolWhen to use
get_workoutsList logged or auto-detected workouts over a date range (up to 180 days).
get_sessionsList mindfulness sessions (meditation, breathing, relaxation).
get_heart_rate_seriesIntraday HR time-series within a 24h window, bucketed to 5min/15min/raw.
get_tagsCustom tags users log (caffeine, alcohol, custom notes).
compare_to_baseline"Is this normal for me?" Compares a day's metric to 30- and 90-day personal baselines.

Phase 2 — Tier A daily metrics

ToolWhen to use
get_stressDaily high-stress and recovery seconds for a date.
get_spo2Nightly blood-oxygen (SpO2) average and breathing disturbance index.
get_resilienceOura's long-term stress recovery capacity score for a date.
get_cardio_ageCardiovascular-age estimate derived from HRV, resting HR, and other signals.
get_vo2_maxMost recent VO2 max measurement within 30 days of the queried date.
get_recommended_sleep_timeOura's recommended bedtime window for a date.
get_rest_mode_periodsList illness/recovery rest-mode periods over a date range.

Phase 3 — Composite tools

ToolWhen to use
get_morning_briefing"How am I today?" Structured snapshot: readiness + recommended sleep time + yesterday's stats.
get_weekly_recap1–28 day window with per-metric mean/min/max. Default 7 days.

Phase 4 — Analytics

ToolWhen to use
find_anomaliesFlag days whose metric deviates >N σ from the rolling-window mean.
correlate_tag_with_metric"Does alcohol hurt my HRV?" Compare metric stats on tagged vs. untagged days.

Not available

Cycle analytics (get_cycle_phase, get_cycle_history, compare_metric_across_cycle_phases) were initially planned for Phase 5 but Oura's public v2 API does not expose menstrual cycle endpoints — the Cycle Insights feature lives in the Oura app only. The tools were removed after a beta user hit 404s; see git history (feat/phase-5-cycle and feat/remove-cycle-tools branches) for the reasoning trail. Tag-based logging via get_tags can serve as a partial workaround if users tag period start days manually.

Adding the connector in Claude

[Add to Claude]

  1. Click Add to Claude. It opens the Add custom connector dialog on claude.ai with the name (Oura) and URL filled in. Check both values, then click Add.
  2. Approve on this server's consent page → redirected to Oura → consent there → returned to Claude.

To add it by hand, go to Customize → Connectors → Add custom connector and enter https://mcp-oura.smirnov.link/mcp as the URL.

On a Team or Enterprise plan, an Owner adds custom connectors for the whole organization. Owners can use the organization version of the link. Members then connect from Customize → Connectors with their own Oura account.

The connector currently caps at 10 authorized users (Oura's default development-mode limit). To lift the cap, the Oura developer application must be approved for production by Oura.

Architecture

Two-stage OAuth on Cloudflare Workers:

  • Flow A (MCP client ↔ this server). Handled by @cloudflare/workers-oauth-provider. Standard OAuth2 + PKCE + dynamic client registration. Consent page is rendered server-side and includes a CSRF token.
  • Flow B (this server ↔ Oura). Hand-rolled. Triggered inside Flow A: redirect to cloud.ouraring.com, exchange the returned code for tokens, fetch /personal_info to derive a stable user id, store the token AES-GCM encrypted in Cloudflare KV, then complete Flow A with that user id attached as props.

The /mcp endpoint is stateless: for each request, createMcpHandler from Cloudflare's agents SDK builds an MCP server for the signed-in user, and that server routes the call to a typed tool handler. Each tool builds an OuraClient per call that handles token refresh, 401 disambiguation (re-auth vs. endpoint gated vs. account membership inactive), and 429 exponential backoff.

See CLAUDE.md for the full file-by-file walkthrough.

Setup (operator)

One-time:

  1. Oura developer app — cloud.ouraring.com → API Applications → New.

    • Redirect URI: https://<your-host>/oura/callback
    • Privacy Policy URL: https://<your-host>/privacy
    • Terms of Service URL: https://<your-host>/tos

  2. Cloudflare KV namespaces (paste IDs into wrangler.jsonc):

    bash
    npx wrangler kv namespace create mcpforoura-OAUTH_KVnpx wrangler kv namespace create OURA_TOKENSnpx wrangler kv namespace create OURA_CACHE

    The mcpforoura- prefix on OAUTH_KV avoids colliding with other workers in the same CF account that also use a binding called OAUTH_KV.

  3. First deploy (registers the worker so secrets can attach to it):

    bash
    npx wrangler deploy

  4. Secrets:

    bash
    echo -n "$CLIENT_ID"     | npx wrangler secret put OURA_CLIENT_IDecho -n "$CLIENT_SECRET" | npx wrangler secret put OURA_CLIENT_SECRETopenssl rand -base64 32  | tr -d '\n' | npx wrangler secret put ENCRYPTION_SECRET

    Keep a copy of ENCRYPTION_SECRET somewhere safe — if it's lost, stored tokens cannot be decrypted and all users have to re-authorize.

  5. Custom domain — if the apex zone is in the same Cloudflare account, the routes block in wrangler.jsonc (with custom_domain: true) attaches the subdomain automatically on next deploy. Otherwise, configure it manually in the Cloudflare dashboard.

Discoverability

The server publishes the following metadata for MCP registry aggregators:

PathPurpose
/.well-known/oauth-authorization-serverOAuth2 authorization-server metadata (served by @cloudflare/workers-oauth-provider).
/.well-known/oauth-protected-resourceOAuth2 protected-resource metadata (served by @cloudflare/workers-oauth-provider).
/.well-known/glama.jsonGlama directory discovery — https://glama.ai/mcp.
/.well-known/mcp/server-card.jsonSmithery scan fallback (only used when their auto-scanner can't pull the tool list through OAuth).
server.json (repo root)Official MCP Registry submission file — namespace link.smirnov/mcp-oura, DNS-verified against smirnov.link. Published with mcp-publisher.

Submitting the server to the official MCP Registry (which PulseMCP, mcp.so, and other aggregators consume from):

bash
# One-time, from this repo rootgo install github.com/modelcontextprotocol/registry/cmd/mcp-publisher@latestmcp-publisher login dns smirnov.link   # prints a TXT record to add in Cloudflare DNSmcp-publisher publish                  # uses server.json in the repo root

Submitting to Smithery: paste https://mcp-oura.smirnov.link/mcp at smithery.ai/new and walk through OAuth during their scan.

Submitting to Glama: use "Add Server" on glama.ai/mcp/servers (they pick up maintainer info from /.well-known/glama.json automatically).

Development

bash
cp .dev.vars.example .dev.vars      # fill innpm installnpm run dev

Local development hits the same Oura redirect URI as production, so it's usually easier to test via wrangler dev --remote so the consent flow completes against deployed infrastructure.

Privacy & data handling

  • Oura OAuth tokens are encrypted at rest (AES-GCM, per-user HKDF-derived key) in Cloudflare Workers KV.
  • Oura ring data is fetched on demand and (when the cache layer ships) may be briefly cached in KV with TTLs ranging from 5 minutes (today's data) to 24 hours (historical).
  • Ring data is not logged.
  • Disconnecting the connector revokes the OAuth grant; tokens become unreachable.
  • See /privacy on the deployed site for the full policy.

Status

Deployed at https://mcp-oura.smirnov.link on the Smirnov Labs Cloudflare account. Custom domain mapped via the routes block in wrangler.jsonc. Three KV namespaces provisioned (mcpforoura-OAUTH_KV, OURA_TOKENS, OURA_CACHE). Three secrets set (OURA_CLIENT_ID, OURA_CLIENT_SECRET, ENCRYPTION_SECRET).

Build progress

MilestoneStatus
M1 — Worker scaffold✅
M2 — OAuth provider + Hono consent + ping✅
M3 — Oura OAuth flow B✅
M4 — OuraClient (refresh, 401 disambig, 429 backoff)✅
M5 — AES-GCM token encryption✅
M6 — Tools 1–3✅
D1 — First deploy to mcp-oura.smirnov.link✅
D2 — CLAUDE.md + expanded README + LICENSE✅
D3 — Push to Smirnov-Labs/mcpforoura on GitHub✅
M7 — KV response cache with date-aware TTLs✅
M8 — Tools 4–8 (workouts, sessions, HR series, tags, baseline)✅
Phase 1–4 — 16 additional tools (Tier A, composites, analytics)✅
Phase 5 — cycle tools (removed; Oura v2 API has no public cycle endpoints)❌
M9 — Vitest tests + deploy-docs polish✅

License

MIT. See LICENSE.

Source: README.md at commit 6669c83

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts