totem

Model Context Protocol server giving Claude (or any MCP client) full read + write access to your Whoop fitness data via the private reverse-engineered iOS API. 47 tools: recovery, sleep, strain, HRV trends, Strength Trainer, journal, Whoop Coach, and smart alarm. TypeScript + zod, auto-refresh Cognito auth.

→ briangaoo/totem · listed on github_topic

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

github_topic

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 2 credentials: AUTH_PASSWORD, WHOOP_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretAUTH_PASSWORD— A password you'll type once when adding the Claude connector

configFLY_APP

configMCP_HTTP_PORT

configMCP_TRANSPORT— =http, MCP_AUTH_TOKEN=$(openssl rand -hex 32)

configNO_COLOR

configPORT— In your Space → Settings → Variables and Secrets, add the following. The token values go in as Secrets (hidden, never shown in logs); and PUBLIC_URL aren't sensitive, so they can be plain Variables:

configPUBLIC_URL— In your Space → Settings → Variables and Secrets, add the following. The token values go in as Secrets (hidden, never shown in logs); PORT and aren't sensitive, so they can be plain Variables:

configWHOOP_AUTH_TOKENS_ONLY

configWHOOP_EMAIL— yes Your Whoop login email

configWHOOP_INSTALLATION_ID— no (auto) The per-install device identifier sent as x-whoop-installation-identifier. Generated once and written to .env on first run — don't set it by hand.

🔐 secretWHOOP_PASSWORD— yes (bootstrap only) Your Whoop login password (used only during bootstrap)

configWHOOP_TIMEZONE— no IANA timezone (e.g., America/Los_Angeles). If unset, auto-detected from your Whoop profile and refreshed hourly. Set explicitly to override.

configWHOOP_TOKEN_STORE— no envfile (default — persists refreshed tokens back to .env) or memory (for read-only filesystems; re-bootstrap every ~30 days).

configWHOOP_USER_ID— no Your Whoop user ID — used by whoop_profile, whoop_leaderboard. Avoids one bootstrap call per session.

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/briangaoo-totem-1uwwmc)](https://m8ven.ai/mcp/briangaoo-totem-1uwwmc)

commit: a98e8cfaf2e43f8f87d9204bcfc734e834305ccb

code hash: 86fc600cd31085672fc3eb703371ae2bff87a70414b04a70bc4c3b6777f61f70

verified: 6/16/2026, 11:39:42 AM

view raw JSON →