Skip to main content
Glama
emilniclashofseth

Personal Health Data (community)

Personal Health Data (community)

Compatible with Withings.

A personal, community-built plugin. It is not made, endorsed, or supported by Withings. It reads only your own data, through the official Withings Public API (https://developer.withings.com), using a Withings developer app that you create for yourself. It is read-only: it cannot change anything in your Withings account or on your devices.

Withings is a trademark of Withings. The name is used here only to say which service the plugin is compatible with. No Withings logo or artwork is used.

It is a Cursor plugin with a small stdio MCP server (Node.js 18+, no dependencies) and one skill that tells the agent when to use the tools.

Tools

Tool

What it returns

Withings endpoint (POST)

Scope

get_body_measurements

one row per weigh-in: weight, fat %, fat mass, fat-free mass, muscle, hydration, bone, visceral fat, extra/intracellular water, BMR, metabolic age, pulse wave velocity, vascular age, standing heart rate

/measure getmeas

user.metrics

get_blood_pressure

systolic, diastolic, pulse

/measure getmeas (types 9, 10, 11)

user.metrics

get_daily_activity

steps, distance, floors, activity minutes, calories, HR and HR zones per day

/v2/measure getactivity

user.activity

get_sleep_summary

per night: total sleep, time in bed, stages, efficiency, latency, wake-ups, sleep score, HR, breathing rate, snoring

/v2/sleep getsummary

user.activity

list_devices

linked devices: type, model, battery, firmware, last sync (no serial numbers or ids)

/v2/user getdevice

user.info

auth_status

is it configured and authorized, token file path, minutes left on the access token

(local)

start_authorization / exchange_code

one-time authorization (see Setup)

/v2/oauth2 requesttoken

Range tools take start_date / end_date (YYYY-MM-DD, your local dates; up to 366 days per call). Values are decoded from Withings' value × 10^unit format into the units named in each field. Metrics your device didn't measure are null, never 0. Every result carries data_source: "Withings".

The plugin asks only for the read scopes user.info, user.metrics and user.activity. It never requests anything that can write. (user.sleepevents only drives webhook notifications, which this plugin doesn't use.)

Related MCP server: Withings MCP Server

Setup (about 5 minutes, once)

You need a Withings account with your devices synced in the Withings app. Withings' current terms say that sharing data with a third-party service may require an active Withings+ subscription (Terms of Use §6.4.1); check this if authorization works but data calls fail.

1. Create your own Withings developer app

  1. Open the Withings Developer Dashboard: https://developer.withings.com/dashboard/ and sign in. You can use your normal Withings account. Withings' guide: https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/developer-account/create-your-accesses-no-medical-cloud

  2. Create an application: Public API integration on the Public Cloud (free; endpoint https://wbsapi.withings.net).

  3. Give it any name and description that is your own, e.g. "My health data". Don't call it "Withings …".

  4. Callback URL — pick one:

    • Recommended: http://localhost:8765/callback. Withings accepts http/localhost callbacks for apps in the integration (development) phase, which is limited to 10 users. That's fine because the only user is you. With this callback the plugin finishes the setup by itself: it listens on 127.0.0.1:8765 for up to 10 minutes after you start authorization. Use a different port by registering it and setting WITHINGS_REDIRECT_URI to the same value.

    • If the dashboard rejects localhost: register any HTTPS URL you control (e.g. a page on your own website). The page doesn't have to do anything. After you approve, your browser lands on https://your-url?code=…&state=…. Copy that whole address within 30 seconds (Withings codes are valid for 30 s and work once) and give it to the setup CLI or the exchange_code tool. Set WITHINGS_REDIRECT_URI to exactly the URL you registered.

  5. Save. The dashboard shows your Client ID and Secret (you can look them up there again later).

2. Install the plugin and paste the client id and secret

Install the plugin in Cursor. When it asks for settings, paste the Client ID into WITHINGS_CLIENT_ID and the Secret into WITHINGS_CLIENT_SECRET (and the callback URL into WITHINGS_REDIRECT_URI if you didn't use the default). To change them later: Plugins → Personal Health Data (community) → Configure, then reload the window. Never paste the secret into chat, a project file or a commit.

3. Authorize once

Ask the agent to "set up Withings" (it calls start_authorization), or run it yourself:

WITHINGS_CLIENT_ID=... WITHINGS_CLIENT_SECRET=... node server/cli.mjs authorize

Open the printed URL, sign in to Withings and approve. With the localhost callback the page says "Connected" and you're done. With your own HTTPS callback, paste the full redirect URL when the CLI asks (within 30 seconds). Check with auth_status or node server/cli.mjs status.

Then ask something like "How has my weight and body fat changed this month?"

Running the server outside Cursor (any MCP client): set WITHINGS_CLIENT_ID and WITHINGS_CLIENT_SECRET in the server's env (not in args) and run node server/index.mjs.

Tokens, lifetime and re-authorizing

  • Tokens are stored in ~/.config/personal-health-data-mcp/tokens.json ($XDG_CONFIG_HOME if set; on Windows %APPDATA%\personal-health-data-mcp\tokens.json), outside any project, with the folder at mode 700 and the file at 600. Override with WITHINGS_TOKEN_FILE. Your Withings user id is not stored.

  • Per Withings' docs (https://developer.withings.com/developer-guide/v3/integration-guide/public-health-data-api/get-access/access-and-refresh-tokens-no-recover): the access token expires after 3 hours; the refresh token expires after 1 year; and every refresh returns a new refresh token. The old one stops working 8 hours later or as soon as the new access token is used.

  • The server refreshes the access token automatically when it has less than 10 minutes left (or when Withings rejects it) and saves the new pair straight away, under a file lock, so two processes don't race on the rotating token.

  • Re-authorize (run step 3 again) if the refresh token expired (about a year without use), if you revoked access in the Withings app, if you changed the app's secret, or if a tool says the token was rejected. Running authorization again simply replaces the token file.

  • Revoke access at any time in the Withings app (connected apps/partners), or delete the app in the developer dashboard. Deleting the token file removes local access.

Privacy and security

  • The client secret is stored by your MCP client (Cursor's plugin settings) and passed to the local server as an environment variable. It is sent only to Withings (wbsapi.withings.net), and only when tokens are issued or refreshed.

  • Errors are redacted. The secret, codes and tokens are never logged or returned by any tool.

  • No telemetry, no third-party servers. Your data goes from Withings to your computer and to the AI model you use in your client. Make sure you are comfortable sharing health data with that model.

  • This is for your own data. Don't use it to run a service for other people, and don't share your app's secret. Each person who installs the plugin creates their own Withings app, so nobody's data passes through anyone else.

Limits and caveats

  • Withings asks partners not to poll more than about once every 10 minutes per user and reports rate limiting as status 601. The server spaces calls, retries 601/HTTP 5xx with backoff, and only calls the API when you ask.

  • Body composition from a scale is an estimate. One step-on can be stored as several measurement groups a few seconds apart; the server merges groups from the same device that are at most 2 minutes apart into one row.

  • Not included: writing or deleting data, ECG waveforms, intraday streams, webhooks/notifications.

  • Field meanings follow Withings' API reference (https://developer.withings.com/api-reference) and may change when Withings updates it.

Development

npm test                     # offline tests (mocked Withings HTTP; no credentials needed)
npm run test:live            # a few real read-only calls against your own account (needs env + a token file)
npm run authorize            # one-time authorization (CLI)

No dependencies. The code: server/client.mjs (OAuth, token file, refresh, retries), server/auth-flow.mjs (localhost callback listener), server/tools.mjs (tools and output shapes), server/index.mjs (MCP stdio JSON-RPC), server/cli.mjs (setup CLI).

License

MIT. See LICENSE. Not affiliated with Withings.

Available Tools

8 tools
auth_statusSetup statusA
Read-onlyIdempotent

Shows whether the Withings app credentials are configured and whether you have authorized access: token file location, granted scopes, minutes left on the current access token. Never shows the secret or tokens.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint, idempotentHint, destructiveHint=false, openWorldHint=false), so the bar is lower; the description still adds real value by disclosing the output boundary and a security guarantee ('Never shows the secret or tokens'). It does not mention that no network call is needed or what happens when credentials are partially configured, but for a zero-parameter local status probe this is strong.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One front-loaded sentence names the two conditions checked and enumerates the returned details, and a second short sentence delivers the confidentiality boundary. No filler, nothing restated from the schema or annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no input schema, no output schema, and no annotations gaps beyond the standard safety hints, the description carries the whole burden of explaining what comes back and it does so concretely. An agent knows enough to call it and interpret the result without further documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to clarify; baseline 4 applies. The description's field list refers to return values rather than inputs, which is appropriate here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb-resource pair: reports whether Withings credentials are configured and whether access has been authorized, plus exactly which fields come back (token file location, scopes, minutes remaining). This is clearly distinguishable from the sibling auth tools start_authorization and exchange_code, which perform the flow rather than report on it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: an agent can infer this is the diagnostic step for the Withings auth flow, but the description never says when to call it versus start_authorization or exchange_code (e.g., 'call this first to decide whether authorization is needed'). No exclusions or prerequisites are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

exchange_codeFinish authorization (non-localhost callback)A

Finishes the one-time authorization when the callback URL is not on localhost: pass the full URL the browser was redirected to (or just its code). Withings codes expire after 30 seconds and work once, so the CLI (node server/cli.mjs authorize) is easier. Saves the tokens to the local token file (chmod 600); never returns them.

ParametersJSON Schema
NameRequiredDescriptionDefault
redirect_url_or_codeYesThe URL you were redirected to (contains ?code=...&state=...), or the code itself.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial context beyond the annotations: codes expire in 30 seconds, are single-use, and the resulting tokens are written to a local file with chmod 600 and never returned. This makes the non-idempotent, non-readable outcome concrete. It does not explain failure modes (e.g., what happens on an expired or already-used code).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the scoping condition, and each subsequent sentence contributes distinct information (input form, expiry/churn caveat, side effect). No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with no output schema, the description covers where the result goes (local token file), why nothing is returned, and the operational risk of short-lived one-time codes. An agent has everything needed to call it correctly or route to the CLI.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema description already documents that the URL contains ?code=...&state=... or the code alone. The description restates the same flexibility ("full URL ... or just its code") without adding format or validation detail, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (finishes the one-time authorization) plus the precise scope condition (callback URL is not on localhost). Combined with sibling names like start_authorization and auth_status, an agent can immediately place this as the second step of the OAuth flow.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit when-condition (non-localhost callback), implies the inverse case where it isn't needed, and names a concrete alternative invocation (`node server/cli.mjs authorize`) with the reason to prefer it. The accepted input forms are stated inline.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_blood_pressureBlood pressure and pulseA
Read-onlyIdempotent

Blood pressure readings (systolic, diastolic in mmHg) with pulse (bpm), from a Withings blood pressure monitor or device that measures it. Empty if you have none. Default: last 30 days; up to 366 days.

ParametersJSON Schema
NameRequiredDescriptionDefault
end_dateNoLast calendar day (inclusive), YYYY-MM-DD. Default: today (local).
start_dateNoFirst calendar day, YYYY-MM-DD. Default: 29 days before end_date.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, and open-world behavior, so the safety profile is covered. The description adds genuinely new behavioral context: empty results if no data exists, a default 30-day window, and a 366-day cap, which an agent needs and the annotations do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, front-loaded with the returned metrics, followed by the empty-result behavior and date-range defaults. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter read tool with full annotation coverage and no output schema, the description gives the important call-shaping details: what fields come back, what an empty response means, and default/max date ranges. It does not mention ordering or multiple readings per day, but nothing critical for calling the tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds a constraint not present in the schema: the 366-day maximum range. It also restates the 30-day default in a more usable form, which helps an agent set start_date/end_date correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States the exact resource and metrics returned (systolic/diastolic mmHg plus pulse bpm) and the data source (Withings BP monitor). This clearly separates it from siblings like get_body_measurements, get_sleep_summary, and get_daily_activity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when the tool applies by naming the data it returns and notes the default window (30 days) and maximum (366 days), but never states when to prefer this over get_body_measurements or other health tools. No explicit exclusions or alternatives are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_body_measurementsBody measurements (scale)A
Read-onlyIdempotent

Weigh-ins in a date range, one row per step-on: weight, fat ratio, fat mass, fat-free mass, muscle, hydration (water), bone, visceral fat, extra/intracellular water, BMR, metabolic age, and on cardio scales pulse wave velocity, vascular age and standing heart rate. Units decoded; metrics the scale did not measure are null. Default: last 30 days; up to 366 days.

ParametersJSON Schema
NameRequiredDescriptionDefault
end_dateNoLast calendar day (inclusive), YYYY-MM-DD. Default: today (local).
start_dateNoFirst calendar day, YYYY-MM-DD. Default: 29 days before end_date.
include_manualNoInclude entries typed in by hand in the Withings app (source: manual).

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive), yet the description adds genuinely useful behavior: units are decoded, metrics the scale didn't measure return null, and range is capped at 366 days. These details are not derivable from the annotations and prevent misinterpretation of nulls as zeros.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the resource and date-range scope, then the metric inventory, and closes with defaults. The metric list is long but each item earns its place as return-value content; otherwise no wasted prose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only, no-output-schema tool, it covers the essentials an agent needs: what rows represent (one per step-on), what fields appear, null semantics, and date-range defaults/limits. Only the manual-entry parameter behavior is left unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both date parameters are already documented, and the description's default/limit note largely reinforces 'Default: 29 days before end_date.' It adds nothing about include_manual (manual vs device entries), so it does not meaningfully exceed the schema baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Weigh-ins in a date range') and enumerates the exact metric fields returned, including cardio-scale-only extras. An agent can immediately distinguish this from get_blood_pressure or get_daily_activity without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear operating context: default window of last 30 days and a hard ceiling of 366 days, which guides how to call it. It does not explicitly name when to prefer a sibling (e.g., a blood-pressure readout) or state exclusions, so it falls short of the top band.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_daily_activityDaily activityA
Read-onlyIdempotent

One row per day: steps, distance, floors, soft/moderate/intense/active minutes, active and total calories, heart rate and HR-zone minutes (from a Withings watch or the app's step tracking). Default: last 7 days; up to 366 days.

ParametersJSON Schema
NameRequiredDescriptionDefault
end_dateNoLast calendar day (inclusive), YYYY-MM-DD. Default: today (local).
start_dateNoFirst calendar day, YYYY-MM-DD. Default: 6 days before end_date.

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and openWorld, so the safety profile is covered. The description adds genuinely new context: it discloses the data source (a Withings watch or the app's own step tracking) and the retention/query ceiling of 366 days, which the annotations cannot convey. It stops short of saying what happens when no device data exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: the first front-loads what a row contains, the second front-loads the default and the limit. There is no filler, hedging, or repetition of schema text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the burden of describing return values and does so concretely by listing the per-day fields and the row granularity. Data provenance is noted, but units, timezone handling, and behavior on empty/missing device data are left unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both date parameters are fully documented, so the schema does the heavy lifting and a 3 is the baseline. The description does contribute the 366-day cap, which is not in the schema, but adds no date-format or timezone nuance beyond what the parameter descriptions already state.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource (daily activity) and enumerates the exact per-day metrics returned — steps, distance, floors, minute buckets, calories, heart rate, HR-zone minutes — which effectively separates it from siblings like get_sleep_summary and get_body_measurements. It lacks an explicit verb but the 'one row per day' framing makes retrieval unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the default window (last 7 days) and a maximum span (366 days), which gives practical range guidance. However, it never says when to choose this tool over the other health-data siblings, nor any exclusions or prerequisites (e.g. device pairing or auth), so usage is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_sleep_summarySleep (nightly summary)A
Read-onlyIdempotent

Nightly sleep from a Withings sleep mat or watch: total sleep, time in bed, deep/light/REM/awake minutes, efficiency, latency, wake-ups, sleep score, heart and breathing rate, snoring, breathing disturbances. A night is labelled by the day it ends. Default: last 7 days; up to 366 days.

ParametersJSON Schema
NameRequiredDescriptionDefault
end_dateNoLast calendar day (inclusive), YYYY-MM-DD. Default: today (local).
start_dateNoFirst calendar day, YYYY-MM-DD. Default: 6 days before end_date.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint/idempotent/non-destructive, so safety is covered; the description adds real value beyond them with the day-labelling convention and the range cap of 366 days. It does not disclose what happens when no device/data exists for a night, which is the main remaining behavioral gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the source and contents, then defaults and limits in a short trailing sentence. The metric list is long but each item is informative for an agent deciding whether this is the right tool; no filler sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description responsibly enumerates the returned fields, and it states defaults, range cap, and date semantics. Missing only edge-case behavior (missing nights, multiple devices, per-night vs aggregated) for a full 5.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with per-param descriptions, so baseline is 3; the description adds a constraint not present in the schema (maximum 366-day span) and corroborates the 7-day default. That is modest but genuine added meaning over the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource ('Nightly sleep from a Withings sleep mat or watch') with an explicit enumeration of the metrics returned (total sleep, time in bed, stage minutes, efficiency, latency, score, HR/BR, snoring, disturbances). This clearly separates it from siblings like get_body_measurements, get_blood_pressure, and get_daily_activity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete defaults (last 7 days) and an explicit ceiling (up to 366 days), plus the non-obvious rule that a night is labelled by the day it ends. It doesn't explicitly name alternatives or when-not to use it, but the domain boundary against the other health-data siblings is evident.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_devicesLinked devicesA
Read-onlyIdempotent

Withings devices linked to your account: type, model, battery level, firmware and the last time each synced (useful when data looks missing). No serial numbers or ids.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and open-world behavior, so safety is covered. The description contributes beyond that by disclosing the freshness field ('last time each synced') and explicitly what is excluded ('No serial numbers or ids') — valuable because there is no output schema to reveal the response shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact clauses: the resource plus its returned fields first, then the diagnostic use case, then the exclusion note. Every phrase carries information and nothing is repeated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no parameters, the description must carry the return-value burden, and it does so by enumerating the fields plus what is omitted. Minor gaps remain (ordering, whether an empty list is possible, whether auth is required), but nothing critical to invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to disambiguate; the baseline for a parameterless tool is applied. The description does not waste space restating an empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names the specific resource (Withings devices linked to the account) and enumerates exactly what it exposes: type, model, battery level, firmware, last sync. The verb is only implied by the name/title rather than stated in the description, and it does not explicitly contrast itself with the data-fetching siblings, but the resource is unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The parenthetical 'useful when data looks missing' gives one concrete diagnostic scenario, which is real usage guidance. However, no alternatives are named (e.g. auth_status for connection problems) and there is no when-not guidance, so routing is only weakly supported.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

start_authorizationAuthorize (one time)A

One-time setup step. Returns the Withings authorization URL for the user to open in a browser (read-only scopes: user.info, user.metrics, user.activity). If the callback URL is on localhost, this server listens there for 10 minutes and finishes the setup by itself; otherwise the user runs exchange_code (or the CLI) with the redirect URL within 30 seconds. Writes only the local token file.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds real context beyond the annotations: the granted scopes are read-only, the local listener has a 10-minute lifetime, the manual path has a 30-second window, and the only write is the local token file. This productively reconciles readOnlyHint=false with an otherwise non-destructive flow. It does not say what the URL or returns look like on failure/timeout, leaving a small gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads 'One-time setup step' and the return value, then branches cleanly into the localhost and non-localhost paths. Dense but nearly every clause carries information; the parenthetical CLI mention is the only mild noise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly states what is returned (the authorization URL), what side effect occurs (local token file), and how the flow completes in each deployment scenario. An agent has everything needed to call it and hand off correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, so the baseline is 4. The description adds relevant meaning by naming the exact scopes (user.info, user.metrics, user.activity) the resulting token will carry, which the empty schema cannot convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (one-time setup) and resource (Withings authorization URL), and explicitly names the scopes granted. It is clearly distinguishable from siblings exchange_code (the follow-up step) and auth_status (the check), which it references by name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit routing: if the callback is on localhost the server self-completes in 10 minutes; otherwise the user must run exchange_code (or the CLI) with the redirect URL within 30 seconds. Both the alternative tool and the condition that selects it are spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 8 tool updatesv0.1.0
    • First observedauth_status
    • First observedexchange_code
    • First observedget_blood_pressure
    • First observedget_body_measurements
    • First observedget_daily_activity
    • First observedget_sleep_summary
    • First observedlist_devices
    • First observedstart_authorization

TDQS

A4.1/5.0

Scored across 8 tools

Disambiguation5/5

Each data tool targets a distinct health domain (body measurements, blood pressure, daily activity, sleep) and the auth tools clearly separate checking status, starting setup, and finishing setup. The descriptions helpfully clarify any edge overlaps, such as heart-rate data appearing in activity and sleep contexts.

Naming Consistency4/5

Most tools use a consistent snake_case verb_noun pattern (get_body_measurements, get_blood_pressure, list_devices, start_authorization, exchange_code), but auth_status breaks the pattern as a noun-only name. The convention is still predictable overall.

Tool Count5/5

Eight tools is well-scoped for a personal health data server: four data retrieval tools, one device listing tool, and three auth lifecycle tools. Each tool earns its place without obvious redundancy.

Completeness4/5

The surface covers core Withings health data domains and the full authorization lifecycle, with minor gaps such as no explicit weight goals or ECG/heart-specific retrieval beyond embedded fields. Agents can still accomplish the main workflows.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables retrieval of health data from Withings smart scales including weight measurements and comprehensive body composition metrics like fat mass, muscle mass, and hydration levels. Supports multiple users, unit preferences, and OAuth authentication for secure access to personal health data.
    2
    ISC
  • A
    license
    A
    quality
    C
    maintenance
    Enables access to Withings Health API data including body measurements, activity tracking, sleep analysis, workouts, and heart rate monitoring through OAuth2 authentication.
    8
    1
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    Provides read-only access to Withings health metrics including body composition, sleep, workouts, and ECG data with local SQLite caching and trend analysis. Features incremental synchronization, automatic OAuth token refresh, and supports all 200+ Withings measurement types for comprehensive health tracking.
    8
    83 PyPI
    1
    GPL 3.0