Inventory supported Fitbit data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call Fitbit APIs or expose user data.

Machine-readable install, runtime and client guidance for AI agents. Does not call Fitbit or expose secrets.

Explain supported Fitbit data, privacy boundaries, recommended agent workflow and project links.

Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Fitbit?'

Returns realistic example payloads of fitbit_daily_summary, fitbit_wellness_context, and fitbit_get_heart_day so agents see the contract before calling real Fitbit APIs.

Generate a Fitbit OAuth authorization URL. Use this first when no local token exists.

Exchange a Fitbit OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned. Requires explicit user action: the user must complete browser OAuth and supply the authorization code (agents must not invent codes).

Get the authenticated Fitbit user profile. Requires profile scope.

List devices connected to the authenticated Fitbit account. Requires settings scope.

List Fitbit activity logs. Supports before/after cursor, pagination and privacy modes. Requires activity scope.

List Fitbit sleep logs. Supports before/after cursor, pagination and privacy modes. Requires sleep scope. Not medical advice.

Get detailed Fitbit activity log by id. Requires activity scope.

Get daily activity summary, goals and distances for a date. Requires activity scope.

Get sleep logs and stages for a date. Requires sleep scope. Not medical advice.

Get daily heart-rate zones and resting heart rate. Requires heartrate scope. Not medical advice.

Get HRV summary for a date when available. Requires heartrate scope and supported device/data. Not medical advice.

Get breathing-rate summary for a date when available. Requires heartrate scope. Not medical advice.

Get SpO2 summary for a date when available. Requires heartrate scope. Not medical advice.

Get weight logs for a date. Requires weight scope. Not medical advice.

Get food logs for a date. Requires nutrition scope.

Get water logs for a date. Requires nutrition scope.

Get raw heart-rate intraday samples for a date. For agent work prefer fitbit_heart_series (agent-safe-series/v1 with hard point caps and exact stats). Personal apps can access their own intraday data; third-party apps may require Fitbit approval. Requires heartrate scope. Not medical advice.

Bounded heart-rate time-series for one civil day (agent-safe-series/v1). Exact stats on full-resolution samples plus a downsampled series capped at 500 points. Prefer fitbit_get_heart_day / daily summary first; use this when you need the shape of HR over the day. Shared contract with garmin_activity_series / strava_activity_series / Kindred workout_series. Not medical advice.

Check local Fitbit config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Fitbit or exposing secrets.

Show optional local SQLite cache status. Enable with FITBIT_CACHE=sqlite or FITBIT_CACHE=true.

Return local privacy, cache, token-path and env-presence posture without revealing secret values.

Revoke the current Fitbit OAuth grant and delete the local token file. Use only when the user explicitly wants to disconnect Fitbit. Gated by explicit_user_intent: true (requires explicit user intent).

Build a practical daily summary from Fitbit activity, sleep, heart-rate, HRV and weight data when available. Read-only and non-medical.

Build a weekly Fitbit scorecard with activity, sleep, heart-rate, HRV availability, bottlenecks and actions. Read-only and non-medical.

Normalize Fitbit sleep and activity load into the shared wellness_context shape for recommendation engines.

Read the canonical Delx Wellness profile shared with the other wellness MCP connectors (Nourish, Cycle Coach, CGM, etc.). Read-only. Profile stores only what the user typed during onboarding — never OAuth tokens, API keys, or biomarkers.

Persist a partial patch to the canonical Delx Wellness profile. Requires explicit_user_intent=true after the user confirms they want to save. Rejects secret-like fields (oauth, token, api_key, password, cookie, refresh, session).

Read-only. Return the 11-question Delx Wellness onboarding flow (en or pt-BR), the current shared profile, missing critical fields, and a cross-connector hint. Use this when the user starts a fresh wellness session and you need to fill out preferred_name, goals, devices, training context, nutrition, preferences, and safety.