Whoop MCP

Findings (5)

• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@7.29.1: 8 known vulnerabilities

  GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6 +3 more

  collector/package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.6.5: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  collector/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@2.1.1: 1 known vulnerability

  GHSA-rmxm-3fg6-px4f

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.5: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  WHOOP_REDIRECT_URI, APPDATA, WHOOP_MCP_TELEMETRY_ENDPOINT, DO_NOT_TRACK, WHOOP_MCP_PRIVACY_MODE, WHOOP_MCP_TELEMETRY, MCP_TRANSPORT, MCP_PORT, LOG_FORMAT, MCP_ALLOWED_ORIGINS, WHOOP_MCP_DISABLE_RESOURCES, MCP_HOST, MCP_TRUST_PROXY, MCP_CONNECTOR_PASSWORD, PUBLIC_URL

Network activity

Tools exposed (25)

• get_profile

  Get the authenticated user's basic profile — name and email.

• get_body_measurement

  Get the user's body measurements — height, weight, and max heart rate.

• get_recovery_collection

  Get recovery scores for a date range. Accepts ISO 8601 or relative dates ("today", "last 7 days", "this week"). Returns HRV, resting heart rate, SpO2, and skin temp for each day.

• get_sleep_collection

  Get sleep records for a date range. Accepts ISO 8601 or relative dates ("today", "last 7 days", "this week"). Returns sleep stages, duration, respiratory rate, and performance scores.

• get_workout_collection

  Get workout records for a date range. Accepts ISO 8601 or relative dates ("today", "last 7 days", "this week"). Returns strain, heart rate zones, calories, and sport type.

• get_cycle_collection

  Get physiological cycles for a date range. Accepts ISO 8601 or relative dates ("today", "last 7 days", "this week"). Returns strain, calories, and heart rate data per cycle.

• get_sleep_by_id

  Get a single sleep record by its ID. Returns sleep stages, duration, respiratory rate, and performance scores.

• get_workout_by_id

  Get a single workout record by its ID. Returns strain, heart rate zones, calories, and sport type.

• get_cycle_by_id

  Get a single physiological cycle by its ID. Returns strain, calories, and heart rate data.

• get_weekly_summary

  Get a summarized health report for a given week — average recovery, HRV, RHR, sleep duration and quality, workout count and strain, plus recovery trend direction.

• compare_periods

  Compare health metrics between two time periods — shows improvement or regression in recovery, sleep, and strain.

• get_trend

  Analyze a health metric trend over time — detects direction (improving/declining/stable), variability, and anomalies using linear regression.

• get_today

  Get today's complete health snapshot — recovery score, last night's sleep, current strain, and last workout in one call.

• get_calendar

  Get a day-by-day grid of recovery, sleep, and strain for a date range. Perfect for weekly/monthly overviews.

• get_baselines

  Personal rolling distributions for HRV, RHR, sleep and recovery. Excludes latest observations from baselines; not medical advice.

• get_sleep_debt

  Observed nightly sleep deficits, standing debt and local clock consistency. Deficit sum is not outstanding debt or a recovery prediction.

• get_hyrox_session_report

  Breaks one HYROX-style session (chained runs + ergs) into segments with HR, strain, transitions, deterministic insights and 'before you trust these numbers' caveats. Defaults to the most recent workout day in the last 7 days. Derived from WHOOP heart-rate data plus your local corrections; check `dat

• get_hyrox_performance

  HYROX training load by week, logged race results, station strengths/weaknesses and PRs. Unconfirmed Functional Fitness/HIIT sessions are listed as candidates, never counted. Derived from WHOOP heart-rate data plus your local corrections; check `data_quality` and caveats. Not medical advice.

• get_triathlon_performance

  Swim/bike/run volume, distance, zone mix, discipline balance, bricks and logged triathlon results by week. Derived from WHOOP heart-rate data plus your local corrections; check `data_quality` and caveats. Not medical advice.

• get_race_readiness

  Readiness for a HYROX or triathlon race from activity logs: fitness/fatigue/form (TRIMP), load spike, discipline balance, taper, today's recovery and sleep debt. Every component shows its inputs and rule. Derived from WHOOP heart-rate data plus your local corrections; check `data_quality` and caveat

• audit_performance_data

  Lists what could make the performance numbers wrong: suspect workouts (bad HR, GPS drift, mislabelled segments, overlaps), unconfirmed HYROX candidates, your relabels/exclusions and the append-only audit log.

• verify_claim

  Fact-checks a number an assistant stated (e.g. 'bike was 40% of training') by recomputing it from WHOOP data. Returns confirmed, contradicted or unverifiable with the tolerance and the workout ids used.

• log_race_result

  Saves an official HYROX or triathlon result (total, optional splits) to the local race log (~/.whoop-mcp, 0600). Validates station order and split sums; every save is recorded in the audit log.

• annotate_workout

  Corrects how a WHOOP workout is counted: relabel its discipline (e.g. confirm a HYROX sim), exclude it, or restore it. WHOOP data is never changed; each change appends an audit entry with before/after.

• open_performance_dashboard

  Opens the local HYROX/triathlon dashboard (127.0.0.1 only) in the browser: session report, trends, readiness with evidence, and an audit tab to relabel/exclude workouts and check claims. Returns the URL; the server stops after 30 idle minutes.