garmin-mcp

English | Русский

Unofficial. This project is not affiliated with, endorsed by or supported by Garmin Ltd. "Garmin" is a trademark of Garmin Ltd. or its subsidiaries; it is used here only to describe compatibility.

An MCP server that gives Claude (or any other MCP client) read-only access to your own Garmin Connect data: sleep, HRV, heart rate, stress, Body Battery, daily activity, workouts and weight. It uses the official Garmin Connect Personal API.

The main use case is personal advice on sleep and wellbeing. The server computes averages, sleep regularity, sleep shortfall, deviations from your own baseline and links between your day and your sleep; Claude turns that into concrete recommendations.

MCP (Model Context Protocol) is the standard an AI assistant uses to call external tools. Claude Code starts garmin-mcp as a child process and talks to it over stdin/stdout.

Quick start

1. API key. Open https://connect.garmin.com/app/settings/personalApiToken → Create Key → accept the terms → choose an expiry (30, 90, 180 days or 1 year) → copy the key. The key is shown once. Garmin emails you about a week before it expires.

2. Install — pick the option that fits your client:

   Client	How
   Claude Desktop	Download garmin-mcp.mcpb from the latest release and open it. Claude Desktop asks for the API key (stored securely) and time zone. Bundled for macOS (Intel and Apple Silicon), Windows x64 and Linux x64
   Claude Code (plugin)	/plugin marketplace add sasha-sup/garmin-mcp, then /plugin install garmin-mcp@garmin-mcp; Claude Code asks for the key. On first start the plugin downloads the release binary and verifies its SHA-256. macOS and Linux
   Claude Code (binary)	Install the binary (row below), then claude mcp add -s user garmin -- garmin-mcp -env-file /path/to/.env
   Binary	Archives for Linux, macOS and Windows on the releases page, or go install github.com/sasha-sup/garmin-mcp/cmd/garmin-mcp@latest
   Docker	docker run -i --rm -e GARMIN_API_KEY -e GARMIN_TZ ghcr.io/sasha-sup/garmin-mcp as the MCP command (images for amd64 and arm64)
   Any MCP client	Listed in the MCP Registry as io.github.sasha-sup/garmin-mcp
   From source	make build (Go 1.27.4+; Go 1.21+ downloads it automatically) → bin/garmin-mcp

3. Configure (binary and source installs; the plugin and the bundle ask for the values instead):

   cp .env.example .env
   chmod 600 .env        # only your user can read the key
   $EDITOR .env          # set GARMIN_API_KEY and GARMIN_TZ

4. Check:

   garmin-mcp -env-file .env -check
   # auth ok: access token valid until 2026-11-13 10:33:12
   # profile ok: Garmin time zone Europe/Berlin, server time zone Europe/Berlin (CET +01:00)
   # data ok: 7 of the last 7 days have a daily summary

   Claude Desktop, in claude_desktop_config.json, if you prefer the binary over the bundle:

   {
     "mcpServers": {
       "garmin": {
         "command": "/absolute/path/garmin-mcp",
         "args": ["-env-file", "/absolute/path/.env"]
       }
     }
   }

5. Ask Claude, for example:

   • "Analyse my sleep over the last month and give me recommendations"

   • "How recovered am I today? Is a hard workout a good idea?"

   • "How have my resting heart rate and HRV changed over six months?"

   • "What hurts my sleep more: stress or late workouts?"

   Or run a ready-made prompt. In Claude Code they are /mcp__garmin__sleep_review, /mcp__garmin__wellbeing_review (both take an optional number of days) and /mcp__garmin__readiness_check.

Related MCP server: garmin-mcp

Tools

All dates are local calendar dates (YYYY-MM-DD). Sleep is filed under the wake-up date: the night from 10 to 11 November is 2026-11-11.

Not in the API

The Personal API does not expose Training Readiness, Training Status, Acute Load or a VO2max trend. garmin_recovery_status computes comparable signals itself (HRV, resting HR, sleep, the sum of activityTrainingLoad over 7 and 28 days) and labels them as computed by this server, not by Garmin.

Configuration

Flags: -env-file PATH (the environment wins over the file; the file may only set GARMIN_*), -check, -clear-cache, -version.

How it works

• Authentication. The key is exchanged for an access token (a JWT valid for 24 hours; there is no refresh token): POST /personalapitoken-service/personal-api/personal-api-key/token with Authorization: ApiKey <key>. Every other request carries Authorization: Bearer <token>. The token lives only in memory and is renewed 5 minutes before expiry, and once on HTTP 401. One request performs the renewal; concurrent requests wait for it, but never longer than their own timeout.

• Range limits. Garmin answers 400 when a period is too long: sleep and Body Battery 31 days, stress and steps 28, daily summaries 1 year. The dedicated tools split requests into chunks and run them in parallel (at most 4 at a time). garmin_api_get passes dates through unchanged, so raw stress_daily/steps_daily requests must stay within 28 days.

• Cache. Responses are stored per day in GARMIN_CACHE_DIR. A day with data that was fetched more than 72 hours after it ended is final and never requested again; more recent days are cached for 10 minutes because the watch keeps syncing. A day without data (watch not worn or not synced yet) is re-checked every 6 hours and becomes final only after 30 days. Re-analysing a year costs a handful of requests, not hundreds. If the watch synced very late and past days came in partially, run garmin-mcp -clear-cache.

• Retries. On 429 and 5xx: up to 3 retries with exponential backoff, honouring Retry-After. Garmin does not document a rate limit.

Privacy and security

• The server only reads: the API has no write methods and every tool is marked readOnlyHint.

• The key and token are sent only to Garmin's host; redirects are not followed, so the key cannot leak to another address. Logs and error messages never contain the key or token.

• The cache holds health data: the v1 directory inside GARMIN_CACHE_DIR gets mode 0700, files 0600; symlinks and oversized files in the cache are ignored. Clear it with garmin-mcp -clear-cache or by deleting the directory.

• -env-file accepts only GARMIN_* variables, so a tampered file cannot set HTTPS_PROXY or SSL_CERT_FILE to intercept the key.

• Nutrition and menstrual-cycle data never reach the model unless you set GARMIN_ALLOW_SENSITIVE=1.

• Whatever the tools return is sent to the model provider (Anthropic for Claude) as part of the conversation.

• .env and *.db are in .gitignore. If the key leaks, delete it on the Personal API Key page; every token issued for it stops working too.

• Recommendations based on this data are not medical advice.

Development

make test    # unit tests with -race against a synthetic fake Garmin API (no real data needed)
make lint    # golangci-lint v2
make vuln    # govulncheck
make live    # every tool against the real API (needs .env); prints response sizes only
make all     # lint + test + vuln + build
make ci-lint # validate the GitHub Actions workflows (actionlint)

Releases

Push a tag vX.Y.Z from a commit where plugin/.claude-plugin/plugin.json has version X.Y.Z. .github/workflows/release.yml then builds the archives and garmin-mcp.mcpb (GoReleaser), pushes ghcr.io/sasha-sup/garmin-mcp:X.Y.Z (amd64 and arm64) and publishes server.json to the MCP Registry with GitHub OIDC (no stored secrets).

CI

GitHub Actions (.github/workflows/ci.yml) runs on pushes to main, on pull requests, weekly (new vulnerabilities appear without code changes) and on demand:

Actions are pinned to commit SHAs, the workflow has only contents: read, and checkout does not persist the token. Dependabot proposes Go module and action updates weekly. The live test against the real API does not run in CI: no key is given to CI.

Layout:

cmd/garmin-mcp/      entry point: flags, config, stdio server
internal/config/     environment and .env loading
internal/garmin/     HTTP client (token, retries, limits), response models, cached range-aware service
internal/cache/      file cache with atomic writes
internal/tools/      MCP tools, sleep and recovery analysis, prompts
internal/civil/      calendar date without time

Garmin's official OpenAPI spec is embedded in https://developer.garmin.com/gc-developer-program/personal/swagger-docs/; the response formats in internal/garmin/models.go were checked against live API responses (November 2026).

License

MIT. Contributor and AI-agent guide: AGENTS.md.