Skip to main content
Glama

Whoop MCP Server

CI OpenSSF Scorecard Latest release License: MIT

Your WHOOP data in whichever AI you use, or, soon, in your own code. Self-hosted, private, and open source.

Ask Claude, ChatGPT or another MCP app "How did I sleep this week?" and get the answer from your own recovery, sleep, strain and workouts. You run the server yourself: it fetches your data from WHOOP when you ask and keeps no copy, and only the apps you've allowed can reach it.

This is an independent open-source project. It uses the WHOOP API to access data from WHOOP products, and is not affiliated with, endorsed by, or sponsored by WHOOP.

Two ways in

  • Talk to your data. Deploy the server, connect it to your AI, and ask. Start with Setup, then Add to your AI, which also lists the apps tested so far.

  • Build with it. The WHOOP client inside this server (typed, tested, and careful with WHOOP's single-use refresh tokens) is being split out as a library for your own code. It isn't published yet: watch this repository's releases to hear when it is.

Built on the Whoop Developer API v2, and the Model Context Protocol (MCP), the open standard AI apps use to call tools like these.

Related MCP server: Apple Health MCP Server

Features

  • Recovery: daily recovery score, HRV, resting heart rate, SpO2, skin temperature

  • Sleep: duration, stages, efficiency, performance, respiratory rate

  • Strain: daily strain score and calories burned

  • Workouts: activity, local start time, duration, strain, heart rate, calories, and time in heart-rate zones 4–5

  • Live data: every answer is fetched from Whoop when you ask, so it's always current. The server stores only its sign-ins and your encrypted Whoop tokens, never your health data

  • Private by default: each app signs in with a password you choose (OAuth 2.1), and only after you tick a box allowing it, so nobody else can read your data

  • Your choice of AI: tested live with Claude and ChatGPT; other apps that sign in with OAuth should work the same way (see compatibility)

MCP Tools

Tool

Description

get_today

Morning briefing with recovery, sleep, and strain

get_recovery_trends

Recovery patterns over time with HRV/RHR

get_sleep_analysis

Sleep trends: time asleep, performance, and efficiency

get_strain_history

Daily strain and calorie trends

get_workouts

Recent workouts with activity, duration, strain, heart rate, and calories

get_auth_url

Link to connect your Whoop account (works once, expires in 10 minutes)

Setup

1. Create a Whoop Developer App

  1. In the Whoop Developer Dashboard, create an app and fill in:

    • Contacts: your email. Only Whoop sees it.

    • Privacy Policy: this project's PRIVACY.md, https://github.com/yuridivonis/whoop-mcp-server/blob/main/PRIVACY.md, or your own adapted copy if you run the server for someone else. People see this link when they approve the app.

    • Redirect URL: your server's callback, e.g. https://your-app.up.railway.app/callback. If you don't have the address yet, fill this in after step 2 creates it.

    • Scopes: read:recovery, read:cycles, read:sleep, and read:workout. The server doesn't use the others. The login also asks for offline, which lets the server renew its Whoop access without you logging in again; the dashboard doesn't list it.

    • Webhooks: leave empty.

  2. Note your Client ID and Client Secret.

2. Deploy

Every release is published as a ready-made image, ghcr.io/yuridivonis/whoop-mcp-server. Deploy that: there's no need to fork this repository unless you want to change the code (see Changing the code). The steps below use Railway; to run it anywhere else, see Docker.

  1. In a Railway project, click New, choose Docker Image, and enter ghcr.io/yuridivonis/whoop-mcp-server:1.4.1. Then, in the service's Settings → Networking → Public Networking, choose Generate Domain: that's your server's address, your-app.up.railway.app below.

  2. Add environment variables:

    • WHOOP_CLIENT_ID: Your Whoop app client ID

    • WHOOP_CLIENT_SECRET: Your Whoop app client secret

    • WHOOP_REDIRECT_URI: https://your-app.up.railway.app/callback

    • MCP_AUTH_PASSWORD: the password each AI app asks for when you connect it. Generate one with openssl rand -base64 24 and keep it in your password manager. The server refuses to start without it (at least 16 characters).

    • ENCRYPTION_SECRET (optional, recommended): generate one with openssl rand -base64 32. It encrypts your stored Whoop tokens, so rotating the Whoop client secret later won't disconnect your account.

  3. Add a volume mounted at /data. It holds the sign-ins and your encrypted Whoop tokens; without it, every redeploy signs your apps out and disconnects Whoop.

  4. Turn on updates: in the service's Settings, under Source, choose Configure Auto Updates, pick minor updates and patches, and a maintenance window (for example Night). Railway then moves the service to each new 1.x release by itself, and on the Pro plan backs up the volume first.

  5. Deploy, then open https://your-app.up.railway.app/health to check it's running.

Already running a fork on Railway? Switch it to the image: open the service's Settings, change Service Source to ghcr.io/yuridivonis/whoop-mcp-server:1.4.1, and turn on auto updates as in step 4. Keep the same variables and volume, so Whoop stays connected. If your fork is older than 1.3.0, read Upgrading to 1.3.0 first: every app signs in once more. Your fork is then no longer used.

3. Connect your AI

Add your server's address, https://your-app.up.railway.app/mcp, to your AI app as a custom connector. It opens your server's sign-in page: check it names the app you're connecting, enter your MCP_AUTH_PASSWORD, and tick the box allowing it to read your Whoop data. For example, in Claude.ai: Customize → Connectors → + → Add custom connector.

Add to your AI has the steps for Claude, ChatGPT, Claude Code, Cursor, VS Code and Windsurf, and which have been tested. Apps stay signed in across redeploys; anyone without the password gets 401 Unauthorized from /mcp.

4. Connect your Whoop account

  1. In a chat, ask your AI to connect Whoop. It calls get_auth_url and gives you a link.

  2. Open the link, log in to Whoop, and authorize the app. You're redirected back, and your AI can answer right away.

  3. Ask away: "How did I sleep last night?"

Upgrading to 1.3.0

1.3.0 stops keeping a copy of your Whoop data, and asks you before each app receives it. To upgrade:

  1. Get the new version: with the image, Railway's auto updates do it for you, or change the tag under Service Source to the new version (Docker with :1: pull it again and restart). With a fork, use GitHub's Sync fork button, then redeploy, or switch to the image as described in Deploy.

  2. On its first start, the server deletes the recovery, sleep, strain and workout data earlier versions stored, and rewrites the database file so none of it is left on disk. Your Whoop connection is kept. The log says Deleted the WHOOP data stored by an earlier version.

  3. Every app is signed out once. The next time you use one, it opens the sign-in page: enter your password and tick the box allowing it to read your Whoop data.

  4. sync_data is gone. If your app still lists it, remove the connector and add it again.

  5. If your host keeps backups or snapshots of the volume, delete the ones from before the upgrade. They still hold the old copy.

There's no going back to 1.2.x on the upgraded database: it can't sign apps in with the new sign-in tables.

Upgrading from 1.0.0

1.1.0 puts a sign-in in front of /mcp. Version 1.0.0 had no authentication there, so any 1.0.0 server that worked with Claude over HTTP served its data to anyone who knew the URL. (Unmodified 1.0.0 also had a request-parsing bug that stopped Claude from connecting over HTTP at all; 1.1.0 fixes both.) To upgrade:

  1. Update your fork (GitHub's Sync fork button, or merge the upstream main branch), or switch the service to the image as described in Deploy.

  2. Set MCP_AUTH_PASSWORD in your Railway variables (see Setup, step 2). Without it, the new version won't start. That's deliberate.

  3. Redeploy.

  4. In Claude.ai → Settings → Connectors, remove the Whoop connector and add it again with the same URL. Claude shows the sign-in page once.

  5. If a tool says your Whoop authorization expired, run get_auth_url once to reconnect.

  6. Optional: in your Whoop app, untick read:profile and read:body_measurement. 1.1.0 no longer uses them.

If your 1.0.0 server worked with Claude on a public URL, assume your data could have been read. As a precaution, rotate your client secret in the Whoop developer dashboard, update WHOOP_CLIENT_SECRET, and run get_auth_url once afterwards. Unless ENCRYPTION_SECRET is set, the stored Whoop tokens were encrypted with the old client secret. The server starts anyway and treats Whoop as disconnected until you reconnect.

Security

  • /mcp only answers signed-in clients. Sign-in codes and refresh tokens work once and are stored as hashes; if one is ever used twice, the whole sign-in is revoked.

  • Failed sign-ins are limited to 10 per address every 15 minutes, and 50 per hour in total.

  • Sign-in codes only go to Claude, ChatGPT, desktop apps on your own computer, or web clients you add with MCP_ALLOWED_REDIRECT_HOSTS. The sign-in page shows where you'll return: only sign in if you started the connection yourself.

  • Each app is signed in only after you tick a box allowing it to read your Whoop data.

  • Whoop tokens are encrypted at rest (AES-256-GCM). Your health data isn't stored: the server fetches it from Whoop for each question and sends it only to the client you signed in.

  • Changing MCP_AUTH_PASSWORD signs every client out.

  • The server asks Whoop only for recovery, cycles, sleep, and workouts.

See SECURITY.md for the full security model and how to report a vulnerability privately, and PRIVACY.md for what a deployment stores and shares.

WHOOP's terms: what the server does, and what's up to you

When you deploy this server, you register your own Whoop developer app, so you are the developer (the "Company") under WHOOP's API Terms of Use, effective 6 October 2026. The terms number their sections but not the paragraphs inside them, so this cites each paragraph by its section and heading. It's a summary of the obligations that touch how the server handles data, not legal advice, and not a promise that any deployment complies: read the terms before you deploy.

WHOOP's terms

What they require

What the server does, and what's up to you

4. WHOOP Data, Prohibitions on WHOOP Data

Explicit opt-in consent before WHOOP data reaches a third party

Every app you connect is a third party. The sign-in page names where the data goes, and doesn't sign the app in until you tick the box allowing it.

4. WHOOP Data, Prohibitions on WHOOP Data

No databases or permanent copies, and no cached copies kept longer than WHOOP's cache headers allow

Nothing is stored. Each answer is fetched from WHOOP when you ask; tools that ask at the same moment share one request, and nothing is kept once it's done.

4. WHOOP Data, Prohibitions on WHOOP Data

No using WHOOP data to create, develop, test, train, fine-tune or improve AI

The server trains nothing, and this project's tests use synthetic data only. Before you connect an app, turn off any setting that lets its provider use your conversations to improve its models.

2. Company Applications, Application Security

WHOOP data encrypted in transit and at rest; security incidents reported to WHOOP within 48 hours

The server refuses to run on a public address without https, and the only WHOOP data it stores is your encrypted tokens. Reporting an incident is your job: see below.

1. Use of WHOOP APIs, Permitted Access

One set of WHOOP credentials per application

Give each deployment its own Whoop developer app.

3. Restrictions; Confidentiality, Confidentiality

Developer credentials kept confidential, and never embedded in open-source projects

The server reads them from environment variables. Never commit them to a repository, including a fork.

3. Restrictions; Confidentiality, API Prohibitions

No medical, legal or other professional advice, and no medical devices

The tools report WHOOP's numbers. They don't give advice or diagnose anything, and neither should anything you build on them.

If you run it for someone else

Each deployment serves one Whoop account. If you deploy it for someone else, they're your end user, and under 2. Company Applications you're responsible for:

  • Consent: they connect their own Whoop account through Whoop's login, and tick the box for each app themselves, so they need the server password (MCP_AUTH_PASSWORD). Don't tick it for them (End User Authorization and Consent).

  • A privacy policy: adapt PRIVACY.md with your contact details, and link it from your Whoop app (End User Privacy).

  • Support: give them an easy way to reach you (End User Authorization and Consent, Application Support).

  • Security incidents: if anyone gets unauthorized access to their data, notify WHOOP within 48 hours of discovering it, at security-notifications@whoop.com, and tell them as the law requires (Application Security). See SECURITY.md.

  • Updates: keep the deployment on a supported version.

  • AI: never use their data to test or improve any AI system, including your own experiments.

Docker

Each release is published as an image for amd64 and arm64 on GitHub's container registry. It runs the same server as the Railway setup above:

docker run -d --name whoop-mcp -p 3000:3000 -v whoop-data:/data \
  -e WHOOP_CLIENT_ID=your_client_id \
  -e WHOOP_CLIENT_SECRET=your_client_secret \
  -e WHOOP_REDIRECT_URI=https://your-server.example.com/callback \
  -e MCP_AUTH_PASSWORD=a-password-of-16-or-more-characters \
  ghcr.io/yuridivonis/whoop-mcp-server:1
  • On a server with a public https address: set WHOOP_REDIRECT_URI to that address's /callback, and connect your AI app to its /mcp, as with Railway.

  • On your own computer: Whoop's login still needs an https address, so point a tunnel at port 3000 (see below) and use the tunnel's /callback. Add -e PUBLIC_URL=http://localhost:3000, so MCP clients on the same computer connect to http://localhost:3000/mcp.

  • The sign-ins and Whoop tokens live in the whoop-data volume, so restarts and upgrades keep you connected.

  • Tags: :1 always points to the newest 1.x release, so pulling it again (or redeploying) picks up fixes and new features without breaking changes. :1.3.0 and the like pin one exact version; :latest follows every release, including a future 2.0.

To check that an image was built by this repository's release workflow, run gh attestation verify oci://ghcr.io/yuridivonis/whoop-mcp-server:1 --owner yuridivonis.

The server is also listed in the official MCP Registry as io.github.yuridivonis/whoop-mcp-server.

Running on Your Own Computer

Requires Node.js 22 or later.

# Install dependencies
npm install

# Create .env file (npm run dev loads it)
cat > .env << EOF
WHOOP_CLIENT_ID=your_client_id
WHOOP_CLIENT_SECRET=your_client_secret
# Whoop needs an https address: use your tunnel's (see below)
WHOOP_REDIRECT_URI=https://your-tunnel.example.com/callback
MCP_AUTH_PASSWORD=choose-a-local-password
MCP_MODE=http
EOF

# Run in development mode (restarts on changes)
npm run dev

# Run the tests and the type check
npm test
npm run typecheck

Whoop's redirect URLs must be https (or an app scheme), so a server on your computer needs an https tunnel, for example cloudflared tunnel --url http://localhost:3000 or ngrok http 3000. Then:

  1. Set WHOOP_REDIRECT_URI to the tunnel's /callback address.

  2. Add that address to your Whoop app.

  3. Connect your MCP client to the tunnel's /mcp address.

Quick tunnels get a new address every time they start, so you'd repeat steps 1 to 3; a named tunnel keeps one address. The tunnel provider carries the traffic, including the tools' answers.

MCP_MODE=stdio runs the server for MCP clients that start it as a local command. It has no sign-in, because only the app that started it can reach it. It can't receive the Whoop login either, so connect Whoop once with the server in http mode and the same DB_PATH, stop it, then start the stdio server. Don't run both at once: Whoop replaces the refresh token on every use, so two servers sharing one database log each other out.

Changing the code

To run your own changes, fork this repository and deploy the fork instead of the image: on Railway, New → GitHub Repo, which builds the Dockerfile. A fork doesn't update itself: to pick up new releases, use GitHub's Sync fork button and redeploy, and merge your changes as you go. If you don't need changes, the image is simpler and keeps itself up to date.

Environment Variables

Variable

Description

Default

WHOOP_CLIENT_ID

Whoop OAuth client ID

Required

WHOOP_CLIENT_SECRET

Whoop OAuth client secret

Required

WHOOP_REDIRECT_URI

OAuth callback URL

http://localhost:3000/callback

MCP_AUTH_PASSWORD

Password for the sign-in page that protects /mcp (16+ characters)

Required in http mode

PUBLIC_URL

Public address of the server, if it differs from WHOOP_REDIRECT_URI's. AI apps must connect to PUBLIC_URL/mcp.

Origin of WHOOP_REDIRECT_URI

ENCRYPTION_SECRET

Key for encrypting stored Whoop tokens

WHOOP_CLIENT_SECRET

MCP_ALLOWED_REDIRECT_HOSTS

Extra web clients allowed to receive sign-in codes, as host names separated by commas (e.g. app.example.com). Claude, ChatGPT, and desktop apps on your own computer (local addresses, and Cursor, VS Code, and Windsurf links) are always allowed.

None

TRUST_PROXY

Proxies allowed to report the client's IP (used by the sign-in rate limits): a hop count, false, or addresses/subnets

1 on Railway, otherwise false

DB_PATH

SQLite database path (sign-ins and encrypted Whoop tokens)

./whoop.db

PORT

HTTP server port

3000

MCP_MODE

http for a server, or stdio for an MCP client that starts it as a local command (see Running on Your Own Computer)

http

UPDATE_CHECK

Once a day, ask GitHub for the latest release number, and end get_today's answer with a one-line notice when a newer version is out. The request carries nothing about you or your data. false turns it off.

true

Architecture

┌─────────────────────────────────────────────────┐
│  Your AI app (Claude, ChatGPT, ...)             │
│  "How did I sleep last night?"                  │
└────────────────────────┬────────────────────────┘
                         │  signs in once (OAuth 2.1),
                         │  then calls tools on /mcp
                         ▼
┌─────────────────────────────────────────────────┐
│                Whoop MCP Server                 │
│                                                 │
│  ┌─────────────┐      ┌──────────────────┐      │
│  │ Sign-in     │─────►│  SQLite Database │      │
│  │ (OAuth 2.1) │      │  - sign-ins      │      │
│  └─────────────┘      │  - Whoop tokens  │      │
│  ┌─────────────┐      │    (encrypted)   │      │
│  │ MCP tools   │      └──────────────────┘      │
│  └──────┬──────┘               ▲                │
│         ▼                      │                │
│  ┌─────────────┐               │                │
│  │ Whoop API   │─── tokens ────┘                │
│  │ Client      │   (no health data is stored)   │
│  └─────────────┘                                │
└─────────┬───────────────────────────────────────┘
          │  Whoop OAuth + API v2, live on every call
          ▼
┌─────────────────────────────────────────────────┐
│  Whoop API                                      │
└─────────────────────────────────────────────────┘

Whoop API Endpoints Used

  • GET /v2/cycle - Physiological cycles (strain data)

  • GET /v2/recovery - Recovery scores

  • GET /v2/activity/sleep - Sleep records

  • GET /v2/activity/workout - Workout records

Contributing

Issues and pull requests are welcome. Before opening a pull request, run npm test and npm run typecheck; CI runs both, along with a Docker smoke test.

Synthetic data only. The tests run against a fake Whoop API that serves made-up records (test/fake-whoop.ts), and future evaluations will too. Never put real Whoop data, yours or anyone else's, in tests, fixtures, issues or pull requests: WHOOP's terms forbid using it to test AI systems, and it's personal health data.

Changelog

See CHANGELOG.md.

License

MIT - See LICENSE for details.

Available Tools

6 tools
get_auth_urlConnect WHOOP accountA
Read-only

Returns a one-time link that connects the user's WHOOP account to this server through WHOOP's own login. Use it when a data tool such as get_today says WHOOP isn't connected or its authorization expired. Give the link to the user to open in a browser: it works once and expires in 10 minutes. Once they have logged in, get_today and the other data tools work. It doesn't read any WHOOP data. A server running in stdio mode can't receive WHOOP's login, so there it returns setup instructions instead.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses one-time use, a 10-minute expiry, the need to open the link in a browser, the fact that it reads no WHOOP data, and the alternate behavior in stdio mode. This goes well beyond the annotations and is consistent with readOnlyHint=true.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core result, then gives usage context, user instructions, and a caveat. Every sentence contributes necessary information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no parameters and no output schema, the description fully covers invocation context, user action required, expected effect on other tools, and environment-specific behavior. Nothing an agent needs is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema already reflects that completely, so there is nothing for the description to add. This matches the baseline for a parameter-less tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource: it returns a one-time link that connects the user's WHOOP account. It also clearly distinguishes itself from the sibling data tools by stating it doesn't read any WHOOP data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says when to use the tool: when a data tool reports WHOOP isn't connected or authorization has expired. It also covers the stdio-mode exception and explains the expected outcome, so the agent knows when it applies and when it doesn't.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_sleep_analysisSleep analysisA
Read-onlyIdempotent

Returns nightly sleep for the last days days (default 14), newest first, as a Markdown table: time asleep in hours (light, deep and REM sleep, not time in bed), sleep performance (%) and efficiency (%), then averages. Naps and nights WHOOP hasn't scored are left out, and each night counts toward the day the user woke up. Use it for sleep patterns. For last night's stages, use get_today; for the recovery those nights produced, use get_recovery_trends. Set days to match the question: 7 for the last week, 30 for the last month, up to 90. Read-only: it never changes the user's WHOOP data. It fetches the data live from WHOOP on every call and keeps no copy, so the answer is current; if WHOOP can't be reached, it says so. If WHOOP isn't connected yet, it returns a message asking to call get_auth_url.

ParametersJSON Schema
NameRequiredDescriptionDefault
daysNoHow many days to cover, counting back from today: 1 to 90, default 14.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already indicate read-only, open-world, idempotent, and non-destructive behavior, but the description adds valuable context beyond that: it fetches live data each call, keeps no copy, reports if WHOOP is unreachable, and instructs the user to call get_auth_url if not connected. This is exactly the kind of behavioral disclosure that helps an agent anticipate outcomes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph but every sentence carries useful information: output format, inclusions/exclusions, usage purpose, alternatives, parameter guidance, read-only nature, live fetching, error handling, and auth. It is front-loaded with the core function and remains efficient without padding. Slightly long but justifiably so.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, but the description fully specifies the return format (Markdown table with sleep stage hours, performance %, efficiency %, and averages) and covers edge cases (naps excluded, nights without score, day attribution, connectivity errors, auth requirement). Nothing an agent needs to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema fully documents the `days` parameter (range, default, meaning), so the baseline is 3. The description adds extra value by explaining the effect of different values ('7 for the last week, 30 for the last month, up to 90') and clarifying that it counts back from today, which is not explicit in the schema. This elevates it slightly above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states exactly what the tool does: returns nightly sleep for a specified number of days, newest first, in a Markdown table. It clearly distinguishes itself from siblings by naming get_today for last night's stages and get_recovery_trends for recovery, and it specifies the exact data included (sleep stages, performance, efficiency) and excluded (naps, unscored nights, time in bed).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says when to use this tool ('Use it for sleep patterns') and when to use alternatives ('For last night's stages, use get_today; for the recovery those nights produced, use get_recovery_trends'). It also gives concrete guidance on setting the days parameter (7 for last week, 30 for last month, up to 90), leaving no ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_strain_historyStrain historyA
Read-onlyIdempotent

Returns daily strain for the last days days (default 14), including today so far, newest first, as a Markdown table: WHOOP day strain (0–21, covering all activity that day) and calories burned (kcal), then averages. Days without a strain score are left out. Use it for overall load and activity trends. For individual training sessions, use get_workouts; for how the body coped, use get_recovery_trends. Set days to match the question: 7 for the last week, 30 for the last month, up to 90. Read-only: it never changes the user's WHOOP data. It fetches the data live from WHOOP on every call and keeps no copy, so the answer is current; if WHOOP can't be reached, it says so. If WHOOP isn't connected yet, it returns a message asking to call get_auth_url.

ParametersJSON Schema
NameRequiredDescriptionDefault
daysNoHow many days to cover, counting back from today: 1 to 90, default 14.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, but the description adds valuable behavior: live fetch, no copy, error handling if WHOOP unreachable, and handling of missing connection by asking for auth. This goes beyond the annotation's minimal read-only flag.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than necessary but well-structured: core return, use case, alternatives, parameter advice, and behavioral notes. It's not tautological, and each sentence adds value, though it could be tightened slightly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Without an output schema, the description details the return format (Markdown table, averages, omitted days) and covers failure modes. Combined with annotations, an agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents the `days` parameter fully, but the description adds meaningful usage semantics: '7 for the last week, 30 for the last month, up to 90' and explains the default and max. This enhances the schema information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States clearly it returns daily strain for a period, newest first, as a Markdown table with strain and calories. Explicitly distinguishes from get_workouts and get_recovery_trends, so an agent knows exactly what it does and what it doesn't.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage context: 'Use it for overall load and activity trends' and names alternatives for different needs. Also gives parameter guidance on how to set days for different time spans, and notes it's read-only.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_todayToday's WHOOP summaryA
Read-onlyIdempotent

Returns the user's latest WHOOP status as Markdown: the most recent recovery (score %, Green/Yellow/Red zone, HRV in ms, resting heart rate, SpO2, skin temperature), last night's sleep (time asleep, performance, efficiency, light/deep/REM stages, respiratory rate) and today's strain so far (0–21) with calories and heart rate. Use it first for questions like "how am I today?" or "should I train hard?". For more than one day, use get_recovery_trends, get_sleep_analysis, get_strain_history or get_workouts. When a newer version of this server is out, the answer ends with a one-line notice to pass on to the user. Read-only: it never changes the user's WHOOP data. It fetches the data live from WHOOP on every call and keeps no copy, so the answer is current; if WHOOP can't be reached, it says so. If WHOOP isn't connected yet, it returns a message asking to call get_auth_url.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only and idempotent safety, but the description adds substantial context: it fetches live data on every call and keeps no copy, reports a newer-version notice to pass on, explains the failure message when WHOOP is unreachable, and instructs to call get_auth_url when not connected. This is rich behavioral disclosure beyond the structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with what is returned, then usage and alternatives, then behavioral notes. Every sentence adds operational value: the return contents, sibling routing, live-fetch semantics, version notice, and connection fallback all matter to an agent deciding whether and how to call this tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description carries the full burden of explaining return values and does so in detail (Markdown format, exact fields included). It also covers preconditions (WHOOP connected) and failure behavior, making it complete for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the schema carries no parameter meaning to supplement; the baseline for no parameters is 4. The description correctly does not invent arguments, instead describing the returned payload.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource (latest WHOOP status) and enumerates precisely what is returned: recovery score/zone/HRV/RHR/SpO2/skin temp, last night's sleep details, and today's strain with calories and heart rate. It also distinguishes itself from siblings by naming the trend/analysis tools for multi-day questions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use it first ('how am I today?', 'should I train hard?') and when to use alternatives instead ('For more than one day, use get_recovery_trends, get_sleep_analysis, get_strain_history or get_workouts'). No inference is required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_workoutsRecent workoutsA
Read-onlyIdempotent

Returns individual workouts from the last days days (default 14), newest first, as a Markdown table: local date and start time, activity, duration, strain (or "unscored" when WHOOP hasn't scored it), average and max heart rate, time in heart-rate zones 4–5 and calories, then totals. Use it for questions about specific sessions or training volume; for whole-day strain including activity outside workouts, use get_strain_history. Set days to match the question: 7 for the last week, 30 for the last month, up to 90. Read-only: it never changes the user's WHOOP data. It fetches the data live from WHOOP on every call and keeps no copy, so the answer is current; if WHOOP can't be reached, it says so. If WHOOP isn't connected yet, it returns a message asking to call get_auth_url.

ParametersJSON Schema
NameRequiredDescriptionDefault
daysNoHow many days to cover, counting back from today: 1 to 90, default 14.

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only, idempotent, open-world, and non-destructive. The description adds substantial behavior beyond that: it fetches live data on every call, keeps no copy, reports if WHOOP can't be reached, and instructs the caller to use get_auth_url if not connected. It also explains the 'unscored' strain case, which is genuinely useful context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core result and output format, then adds usage guidance, behavioral notes, and error handling in a logical order. Every sentence earns its place, and the length is justified by the density of useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with no output schema, the description is remarkably complete: it details the return shape, sorting, field semantics, live-fetch behavior, failure mode, and authentication prerequisite. An agent has everything needed to call this correctly and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents the `days` parameter well. The description adds practical usage semantics by mapping day values to common questions ('7 for the last week, 30 for the last month') and reiterating the maximum of 90, which enriches the agent's understanding of parameter intent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Returns individual workouts from the last `days` days') with precise behavioral details like ordering ('newest first') and output format ('Markdown table'). It also distinguishes itself from the sibling get_strain_history by scoping its purpose to workouts only.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells when to use the tool ('questions about specific sessions or training volume'), gives a direct alternative ('for whole-day strain... use get_strain_history'), and provides concrete day-range mapping (7, 30, up to 90). This gives an agent clear selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool updatev1.2.0
    • Removedsync_data
  2. 5 tool updatesv1.1.2
    • Changedget_recovery_trends5 fields changed
      • addedInput schema / properties / days / default
        Added value: +14
      • changedInput schema / properties / days / description
        Previous value: -"Number of days to analyze (default: 14, max: 90)"New value: +"How many days to cover, counting back from today: 1 to 90, default 14."
      • addedInput schema / properties / days / maximum
        Added value: +90
      • addedInput schema / properties / days / minimum
        Added value: +1
      • changedInput schema / properties / days / type
        Previous value: -"number"New value: +"integer"
    • Changedget_sleep_analysis5 fields changed
      • addedInput schema / properties / days / default
        Added value: +14
      • changedInput schema / properties / days / description
        Previous value: -"Number of days to analyze (default: 14, max: 90)"New value: +"How many days to cover, counting back from today: 1 to 90, default 14."
      • addedInput schema / properties / days / maximum
        Added value: +90
      • addedInput schema / properties / days / minimum
        Added value: +1
      • changedInput schema / properties / days / type
        Previous value: -"number"New value: +"integer"
    • Changedget_strain_history5 fields changed
      • addedInput schema / properties / days / default
        Added value: +14
      • changedInput schema / properties / days / description
        Previous value: -"Number of days to analyze (default: 14, max: 90)"New value: +"How many days to cover, counting back from today: 1 to 90, default 14."
      • addedInput schema / properties / days / maximum
        Added value: +90
      • addedInput schema / properties / days / minimum
        Added value: +1
      • changedInput schema / properties / days / type
        Previous value: -"number"New value: +"integer"
    • Changedget_workouts5 fields changed
      • addedInput schema / properties / days / default
        Added value: +14
      • changedInput schema / properties / days / description
        Previous value: -"Number of days to include (default: 14, max: 90)"New value: +"How many days to cover, counting back from today: 1 to 90, default 14."
      • addedInput schema / properties / days / maximum
        Added value: +90
      • addedInput schema / properties / days / minimum
        Added value: +1
      • changedInput schema / properties / days / type
        Previous value: -"number"New value: +"integer"
    • Changedsync_data2 fields changed
      • addedInput schema / properties / full / default
        Added value: +false
      • changedInput schema / properties / full / description
        Previous value: -"Force a full 90-day sync (default: false)"New value: +"true re-downloads the last 90 days now. false (the default) syncs only if the last sync was over an hour ago."
  3. 1 tool updatev1.1.1
    • Addedget_workouts
  4. 6 tool updates
    • First observedget_auth_url
    • First observedget_recovery_trends
    • First observedget_sleep_analysis
    • First observedget_strain_history
    • First observedget_today
    • First observedsync_data

TDQS

A4.9/5.0

Scored across 6 tools

Disambiguation5/5

Each tool targets a distinct WHOOP metric domain (recovery trends, today's snapshot, auth, sleep, strain, individual workouts), and the descriptions explicitly cross-reference each other with guidance on when to prefer one over another. There is essentially no risk of misselection.

Naming Consistency5/5

All tools follow a uniform get_ verb + noun pattern in snake_case (get_recovery_trends, get_today, get_auth_url, get_sleep_analysis, get_strain_history, get_workouts). The convention is predictable and readable throughout.

Tool Count5/5

Six tools is well-scoped for a read-only health data server, with one tool per major WHOOP metric plus an auth helper. Nothing feels redundant or missing at the count level.

Completeness4/5

The surface covers recovery, sleep, strain, workouts, a daily snapshot, and authorization, which matches the domain well. Minor gaps exist (e.g., no user profile/body metrics or journal data), but these are edge concerns an agent could work around.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers