Fitbit MCP
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| FITBIT_CACHE | No | Cache backend (e.g., sqlite) | |
| FITBIT_SCOPES | No | Space-separated list of Fitbit API scopes | activity heartrate profile settings sleep weight nutrition |
| FITBIT_CLIENT_ID | Yes | Fitbit application client ID | |
| FITBIT_PRIVACY_MODE | No | Privacy mode: summary, structured, or raw | structured |
| FITBIT_REDIRECT_URI | No | OAuth redirect URI | http://127.0.0.1:3000/callback |
| FITBIT_CLIENT_SECRET | Yes | Fitbit application client secret |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": true
} |
| resources | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| fitbit_data_inventoryA | Inventory supported Fitbit data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call Fitbit APIs or expose user data. |
| fitbit_agent_manifestA | Machine-readable install, runtime and client guidance for AI agents. Does not call Fitbit or expose secrets. |
| fitbit_capabilitiesA | Explain supported Fitbit data, privacy boundaries, recommended agent workflow and project links. |
| fitbit_quickstartA | Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Fitbit?' |
| fitbit_demoA | Returns realistic example payloads of fitbit_daily_summary, fitbit_wellness_context, and fitbit_get_heart_day so agents see the contract before calling real Fitbit APIs. |
| fitbit_get_auth_urlA | Generate a Fitbit OAuth authorization URL. Use this first when no local token exists. |
| fitbit_exchange_codeA | Exchange a Fitbit OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned. Requires explicit user action: the user must complete browser OAuth and supply the authorization code (agents must not invent codes). |
| fitbit_get_profileB | Get the authenticated Fitbit user profile. Requires profile scope. |
| fitbit_list_devicesA | List devices connected to the authenticated Fitbit account. Requires settings scope. |
| fitbit_list_activitiesA | List Fitbit activity logs. Supports before/after cursor, pagination and privacy modes. Requires activity scope. |
| fitbit_list_sleepA | List Fitbit sleep logs. Supports before/after cursor, pagination and privacy modes. Requires sleep scope. Not medical advice. |
| fitbit_get_activityA | Get detailed Fitbit activity log by id. Requires activity scope. |
| fitbit_get_activity_dayA | Get daily activity summary, goals and distances for a date. Requires activity scope. |
| fitbit_get_sleep_dayA | Get sleep logs and stages for a date. Requires sleep scope. Not medical advice. |
| fitbit_get_heart_dayC | Get daily heart-rate zones and resting heart rate. Requires heartrate scope. Not medical advice. |
| fitbit_get_hrv_dayA | Get HRV summary for a date when available. Requires heartrate scope and supported device/data. Not medical advice. |
| fitbit_get_breathing_rate_dayA | Get breathing-rate summary for a date when available. Requires heartrate scope. Not medical advice. |
| fitbit_get_spo2_dayB | Get SpO2 summary for a date when available. Requires heartrate scope. Not medical advice. |
| fitbit_get_weight_dayA | Get weight logs for a date. Requires weight scope. Not medical advice. |
| fitbit_get_food_dayA | Get food logs for a date. Requires nutrition scope. |
| fitbit_get_water_dayA | Get water logs for a date. Requires nutrition scope. |
| fitbit_get_heart_intradayA | Get raw heart-rate intraday samples for a date. For agent work prefer fitbit_heart_series (agent-safe-series/v1 with hard point caps and exact stats). Personal apps can access their own intraday data; third-party apps may require Fitbit approval. Requires heartrate scope. Not medical advice. |
| fitbit_heart_seriesA | Bounded heart-rate time-series for one civil day (agent-safe-series/v1). Exact stats on full-resolution samples plus a downsampled series capped at 500 points. Prefer fitbit_get_heart_day / daily summary first; use this when you need the shape of HR over the day. Shared contract with garmin_activity_series / strava_activity_series / Kindred workout_series. Not medical advice. |
| fitbit_connection_statusB | Check local Fitbit config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Fitbit or exposing secrets. |
| fitbit_cache_statusA | Show optional local SQLite cache status. Enable with FITBIT_CACHE=sqlite or FITBIT_CACHE=true. |
| fitbit_privacy_auditA | Return local privacy, cache, token-path and env-presence posture without revealing secret values. |
| fitbit_revoke_accessA | Revoke the current Fitbit OAuth grant and delete the local token file. Use only when the user explicitly wants to disconnect Fitbit. Gated by explicit_user_intent: true (requires explicit user intent). |
| fitbit_daily_summaryA | Build a practical daily summary from Fitbit activity, sleep, heart-rate, HRV and weight data when available. Read-only and non-medical. |
| fitbit_weekly_summaryA | Build a weekly Fitbit scorecard with activity, sleep, heart-rate, HRV availability, bottlenecks and actions. Read-only and non-medical. |
| fitbit_wellness_contextB | Normalize Fitbit sleep and activity load into the shared wellness_context shape for recommendation engines. |
| fitbit_profile_getA | Read the canonical Delx Wellness profile shared with the other wellness MCP connectors (Nourish, Cycle Coach, CGM, etc.). Read-only. Profile stores only what the user typed during onboarding — never OAuth tokens, API keys, or biomarkers. |
| fitbit_profile_updateA | Persist a partial patch to the canonical Delx Wellness profile. Requires explicit_user_intent=true after the user confirms they want to save. Rejects secret-like fields (oauth, token, api_key, password, cookie, refresh, session). |
| fitbit_onboardingA | Read-only. Return the 11-question Delx Wellness onboarding flow (en or pt-BR), the current shared profile, missing critical fields, and a cross-connector hint. Use this when the user starts a fresh wellness session and you need to fill out preferred_name, goals, devices, training context, nutrition, preferences, and safety. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| fitbit_daily_checkin | Ask an agent to create a practical daily health and training check-in from Fitbit. |
| fitbit_weekly_review | Ask an agent to review Fitbit trends across activity, sleep and heart context. |
| fitbit_intraday_investigation | Investigate one day of Fitbit heart-rate with agent-safe series (prefer series over raw intraday dump). |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| fitbit_data_inventory | Static inventory of supported Fitbit data domains, privacy modes and recommended first calls. |
| fitbit_capabilities | Static capabilities, API boundary, privacy modes and recommended agent workflow. |
| fitbit_agent_manifest | Machine-readable install and operating instructions for AI agents. |
| fitbit_profile | Authenticated Fitbit profile using the configured privacy mode. |
| fitbit_latest_activity | Most recent Fitbit activity log in the configured privacy mode. |
| fitbit_daily_summary | Daily Fitbit health summary built from API data. |
| fitbit_weekly_summary | Weekly Fitbit health review built from API data. |
TDQS
Scored across 33 tools
Several tool clusters blur together: fitbit_data_inventory, fitbit_capabilities, and fitbit_agent_manifest all describe supported data, privacy, and guidance; fitbit_connection_status and fitbit_privacy_audit both inspect local state. The confusing fitbit_get_profile vs fitbit_profile_get pair is especially risky because one returns Fitbit profile data and the other returns the Delx wellness profile.
All tools share the fitbit_ prefix and snake_case, but the naming conventions are mixed: verb_noun forms like fitbit_get_activity_day coexist with noun-only names like fitbit_daily_summary, and reversed noun_verb forms like fitbit_profile_get and fitbit_profile_update. The near-match between fitbit_get_profile and fitbit_profile_get highlights the inconsistency and increases misselection risk.
33 tools is too many for a well-scoped MCP server. A large portion are meta, setup, and status tools—inventory, manifest, capabilities, quickstart, demo, connection status, cache status, and privacy audit—that overlap and could be consolidated without losing functional coverage.
The server covers the Fitbit wellness domain well: OAuth lifecycle, profile, devices, activity, sleep, heart rate, HRV, breathing rate, SpO2, weight, food, water, plus daily/weekly summaries and a shared wellness profile. Minor gaps exist such as lack of sleep-log-by-id detail or explicit token refresh, but core read-only Fitbit workflows have no dead ends.