Personal Health Data (community)

Finish authorization (non-localhost callback)

exchange_code

Completes Withings OAuth by exchanging a redirected URL or authorization code for tokens saved to a local file, enabling CLI authorization when the callback isn't localhost.

Instructions

Finishes the one-time authorization when the callback URL is not on localhost: pass the full URL the browser was redirected to (or just its code). Withings codes expire after 30 seconds and work once, so the CLI (node server/cli.mjs authorize) is easier. Saves the tokens to the local token file (chmod 600); never returns them.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "redirect_url_or_code": "<redirect_url_or_code>"
    },
    "name": "exchange_code"
  }
}

Input Schema

Name	Required	Description	Default
`redirect_url_or_code`	Yes	The URL you were redirected to (contains ?code=...&state=...), or the code itself.

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Oct 23, 2026

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial context beyond the annotations: codes expire in 30 seconds, are single-use, and the resulting tokens are written to a local file with chmod 600 and never returned. This makes the non-idempotent, non-readable outcome concrete. It does not explain failure modes (e.g., what happens on an expired or already-used code).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the scoping condition, and each subsequent sentence contributes distinct information (input form, expiry/churn caveat, side effect). No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with no output schema, the description covers where the result goes (local token file), why nothing is returned, and the operational risk of short-lived one-time codes. An agent has everything needed to call it correctly or route to the CLI.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema description already documents that the URL contains ?code=...&state=... or the code alone. The description restates the same flexibility ("full URL ... or just its code") without adding format or validation detail, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (finishes the one-time authorization) plus the precise scope condition (callback URL is not on localhost). Combined with sibling names like start_authorization and auth_status, an agent can immediately place this as the second step of the OAuth flow.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit when-condition (non-localhost callback), implies the inverse case where it isn't needed, and names a concrete alternative invocation (`node server/cli.mjs authorize`) with the reason to prefer it. The accepted input forms are stated inline.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server