whoop-mcp-server

Your WHOOP shows you charts. It can't answer "should I train hard today" or "what actually hurts my recovery". This server can.

It connects your WHOOP data to Claude, ChatGPT, and any MCP client. You ask in plain English. It computes the answer from your own records and lets the AI explain it.

You: should I train hard today?

AI:  Recovery 81% (green). HRV trending up. Sleep debt cleared.
     Your 7-day load is 0.94x your 28-day base.
     You are conditioned for more.

Runs on your machine. Read-only. The only network peer is api.prod.whoop.com. No telemetry. MIT.

What you need

• A WHOOP account. Any membership works.

• uv or pipx, to install one command line tool.

• An MCP client: Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, or ChatGPT.

One constraint to know before you start. WHOOP has no shared developer app, so during setup you create your own free one. It takes about two minutes of clicking, and it is the reason this is private by design: your tokens belong to your app, on your machine, and your health data never routes through anyone else's server. Including mine.

Related MCP server: WHOOP MCP Server

Set it up

Install the tool:

uv tool install whoop-mcp-server

(pipx install whoop-mcp-server works the same.)

Then run the one command that does everything:

whoop-mcp-server setup

Here is what happens, in order, so nothing surprises you:

1. Your WHOOP app. The wizard opens WHOOP's developer dashboard and tells you exactly what to click: create a team, create an app, enable every scope including offline, set the redirect URL to exactly http://localhost:8765/callback. The form requires a privacy policy URL. Use this repo's: https://github.com/rajdeepmondaldotcom/whoop-mcp-server/blob/main/PRIVACY.md. Copy the Client ID and Secret, paste them into the terminal. They're stored locally with 0600 permissions.

2. Authorize. Your browser opens WHOOP's consent screen. Approve it. Tokens land in ~/.whoop-mcp and refresh themselves from then on. You never do this again.

3. Proof. The wizard makes a live API call and prints your actual latest recovery. If anything is misconfigured, you find out here, in the terminal, not later in a chat window.

4. Your clients. It detects Claude Desktop, Cursor, Windsurf, VS Code, and Claude Code, and writes their configs for you. Existing config is backed up before any edit. If Claude Desktop is running, the wizard asks to quit it first, because Desktop silently overwrites config edits made while it's open. Then it launches the configured command once and confirms the server answers. "Done" means verified, not hopeful.

Restart your client. Ask it: "How did I sleep last night?" Then ask the better question: "Give me the full picture of my health this quarter."

Two useful asides. If you want to see the tools work before connecting anything, whoop-mcp-server serve --demo serves 150 days of realistic generated data through the same pipeline. And if anything misbehaves later, whoop-mcp-server doctor names what's wrong and the fix.

What you can ask

24 tools cover every public user-readable endpoint in WHOOP's API, plus the analysis layer that turns records into answers.

Dates are plain English everywhere: yesterday, last 30 days, this week, 2 years ago, 2026-05.

ChatGPT's required search and fetch tools are implemented too, plus 4 resources and 4 ready-made prompts (morning_readiness, weekly_review, sleep_coach, training_planner).

More questions worth asking: docs/PROMPTS.md.

Works with

ChatGPT connects to remote MCP servers, so expose the HTTP transport and tunnel it:

whoop-mcp-server serve --transport http --port 8000    # endpoint: /mcp
ngrok http 8000

Then in ChatGPT: Settings, Apps & Connectors, Advanced settings, enable Developer mode, create a connector with https://<your-tunnel>/mcp and no auth.

Be careful here: a no-auth tunnel means anyone with the URL can read your health data. Keep the URL private and the tunnel short-lived. Claude's stdio setup never exposes anything.

Why the answers hold up

The model is maybe 20% of this product. The other 80% is making the numbers right. Models are bad at arithmetic over 90 days of records, so this server computes first and lets the model explain.

• Trend lines are fit to date-sorted series. WHOOP returns records newest-first. Fit arrival order instead and every trend reads backwards.

• Direction respects what the metric means. Rising HRV is improvement. Rising resting heart rate is not.

• Records land on calendar days using their own timezone offset. A sleep belongs to the morning you woke up, even when you travel.

• WHOOP rotates both OAuth tokens on every refresh. Refreshes here are serialized, saved before use, and shared across concurrent requests. Re-running auth rescues a live server without a restart.

• The client honors WHOOP's rate-limit headers, retries with backoff, and caps pagination. When a result is truncated or approximate, the output says so instead of pretending it's complete.

What it can't do: WHOOP's public API has no endpoints yet for Peak features like the stress monitor and healthspan. When WHOOP ships them, they land here. The overnight sensor stream isn't enabled for every account, and the tool reports that instead of failing. Bulk export intentionally fetches the collection endpoints; raw sleep streams are available per sleep with get_sleep_stream(include_raw=true).

105 tests, all offline against a faked WHOOP API. CI on Python 3.10 to 3.13.

CLI

whoop-mcp-server setup     Guided setup: app, authorize, auto-configure clients
whoop-mcp-server serve     Run the server (--demo, --transport stdio|http|sse, --host, --port)
whoop-mcp-server status    Config and token state
whoop-mcp-server doctor    Diagnose setup and connectivity
whoop-mcp-server auth      Scriptable OAuth flow
whoop-mcp-server logout    Delete tokens (--revoke also revokes at WHOOP)

Configuration

Nothing required after whoop-mcp-server setup. Overrides, in priority order: process env, ./.env, ~/.whoop-mcp/.env, ~/.whoop-mcp/config.json.

Privacy

Read-only against WHOOP. Tokens stored locally with 0600 permissions. The only writes are local files you ask for (export_data) and the OAuth flow you trigger. One thing worth knowing: aggregates like trends and correlations can reveal more about you than single records. Connect this only to AI clients you trust with health data. Full policy: PRIVACY.md. Vulnerabilities: SECURITY.md.

Contributing

uv venv && uv pip install -e ".[dev]" && pytest && ruff check .

The whole test suite runs offline. CONTRIBUTING.md lists the invariants that keep the data honest. The short version of the architecture: client.py talks to WHOOP, transform.py cleans the records, summaries.py and analytics.py do the math, server.py exposes the tools. oauth.py and tokens.py own auth. demo.py is the generated account.

Troubleshooting

License

MIT. See LICENSE. Not affiliated with or endorsed by WHOOP. WHOOP is a trademark of WHOOP, Inc.