# LoseIt local MCP

A local pipeline: Playwright scrapes your LoseIt data daily → stores it in
SQLite → an MCP server reads it into Claude Desktop. There is no public
LoseIt API, so this reads your own account through the web UI and keeps
the data on your machine. Login goes through the token endpoint the LoseIt
iOS app uses, and the scraper refreshes that token on every run, so the
daily job stays signed in without a manual re-login every 14 days. The
scraper may need updates if LoseIt changes their site.

**License:** MIT (see [LICENSE](LICENSE)).

## Dependency updates

Dependabot opens weekly PRs for Python packages and GitHub Actions, plus
security updates as they appear. CI runs the unit tests on every PR (including
Dependabot’s). When that CI run succeeds, a separate workflow auto-approves
and squash-merges Dependabot PRs — so broken bumps never merge, and tests
are only defined in one place. Re-run `pip install -r requirements.txt` (and
`playwright install chromium` after Playwright bumps) on machines that
already have a checkout.

## Privacy note

Login tokens (`tokens.json`), session cookies (`state.json`), SQLite
food/weight history, and logs live under `~/.loseit-data/` (outside this
repo). Do not commit that directory, any `tokens.json` or `state.json`, or
`*.db` files. Your password is never stored. The included `.gitignore` is set up to keep
them out.

## 1. Install dependencies

```bash
cd /path/to/loseit-mcp-local
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
playwright install chromium
```

## 2. Log in once

```bash
python src/scraper.py login
```

Enter your LoseIt email and password at the prompt (the password is not
shown or stored). This logs in through the same token endpoint the iOS app
uses, which has no CAPTCHA, and saves an access/refresh token pair to
`~/.loseit-data/tokens.json` (mode 600). Every `run` trades the refresh
token for a new 14-day access token and writes it into the browser session
at `~/.loseit-data/state.json`, so daily runs stay logged in on their own.

`python src/scraper.py login --browser` is the old flow: log in by hand in
a real browser window. It gets no refresh token, so it lasts 14 days.

## 3. Run the scraper

Selectors in `src/scraper.py` were captured against LoseIt's GWT web UI and
**will break** when that DOM changes. If a run fails after a LoseIt deploy,
re-record with:

```bash
playwright codegen --load-storage=~/.loseit-data/state.json https://www.loseit.com
```

…and update the locators in `src/scraper.py`.

Test on a small range first, with a visible browser:

```bash
python src/scraper.py run --since 2026-07-10 --headed
```

Check the data landed correctly:

```bash
sqlite3 ~/.loseit-data/loseit.db "SELECT * FROM daily_summary ORDER BY date DESC LIMIT 5;"
```

Headless (how the scheduled job runs):

```bash
python src/scraper.py run
```

## 4. Schedule the daily run (+ optional email alerts)

Two launchd jobs (macOS):

| Job | When | What |
|-----|------|------|
| `com.loseit-mcp.scraper` | 06:00 | Scrape via `scripts/run-scraper.sh`. On failure, emails you if configured. On success, writes `~/.loseit-data/last_success`. |
| `com.loseit-mcp.scraper-health` | 12:00 | If `last_success` is older than 36h (or missing and DB is stale), emails a STALE alert (at most once per day) if configured. |

Alerts send through local sendmail/postfix when `LOSEIT_ALERT_EMAIL` is
set. Attempts are logged to `~/.loseit-data/logs/alert.log`. Test with:

```bash
LOSEIT_ALERT_EMAIL=you@example.com bash scripts/send-alert.sh --test
```

Install the agents (paths are filled in from this checkout — nothing
machine-specific is stored in the repo):

```bash
# recommended: pass your alert address at install time
bash scripts/install-launchd.sh --email you@example.com

# or without email (failures only show up in local logs)
bash scripts/install-launchd.sh
```

`install-launchd.sh` copies the shell wrappers to `~/.loseit-data/bin/` and
points launchd at those copies. macOS TCC blocks launchd from *executing*
scripts under `~/Documents` (Python in the project tree is fine). Re-run
the installer after you edit the scripts so the copies stay in sync.

Test immediately:

```bash
launchctl start com.loseit-mcp.scraper
tail -f ~/.loseit-data/logs/scraper.log
```

Test the health check:

```bash
launchctl start com.loseit-mcp.scraper-health
# or: bash scripts/health-check.sh
```

Uninstall:

```bash
bash scripts/uninstall-launchd.sh
```

## 5. Wire the MCP server into Claude Desktop

Add to `~/Library/Application Support/Claude/claude_desktop_config.json`
(merge into `mcpServers` if the file already has other entries). Use the
**absolute** path to this checkout:

```json
{
  "mcpServers": {
    "loseit": {
      "command": "/ABSOLUTE/PATH/TO/loseit-mcp-local/.venv/bin/python",
      "args": ["/ABSOLUTE/PATH/TO/loseit-mcp-local/src/loseit_mcp.py"]
    }
  }
}
```

Fully quit and reopen Claude Desktop. You should see 4 tools under a
`loseit` connector: `get_daily_summary`, `get_food_log`,
`get_weight_history`, `get_water_log`.

## Notes

- The MCP server only ever reads local SQLite — it never talks to LoseIt
  itself. All the network activity is in `scraper.py`, run on its own
  schedule.
- Scope: daily summary (including aggregate exercise calories burned),
  food log, weight, and water. Individual exercise entries are not scraped.
- Persistent logs live under `~/.loseit-data/logs/`. Success stamp:
  `~/.loseit-data/last_success`.
- If LoseIt rejects the saved refresh token (for example after a password
  change, or if the Mac was off long enough for the access token to expire),
  `run` fails with a message saying so; redo step 2
  (`.venv/bin/python src/scraper.py login`), then
  `.venv/bin/python src/scraper.py run` to catch up.
- After a Playwright version bump, run `.venv/bin/python -m playwright install chromium`
  or the next `run` fails with "Executable doesn't exist".