74
/ 100
10 hours ago
glama

whoop-mcp

MCP server providing full read/write access to Whoop wearable data, including recovery, sleep, workouts, journal, and more, via Whoop's private iOS API.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: AUTH_PASSWORD, WHOOP_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretAUTH_PASSWORDA password you'll type once when adding the Claude connector
configFLY_APP
configMCP_HTTP_PORT
configMCP_TRANSPORT=http, MCP_AUTH_TOKEN=$(openssl rand -hex 32)
configNO_COLOR
configPORTIn your Space → Settings → Variables and Secrets, add the following. The token values go in as Secrets (hidden, never shown in logs); and PUBLIC_URL aren't sensitive, so they can be plain Variables:
configPUBLIC_URLIn your Space → Settings → Variables and Secrets, add the following. The token values go in as Secrets (hidden, never shown in logs); PORT and aren't sensitive, so they can be plain Variables:
configWHOOP_AUTH_TOKENS_ONLY
configWHOOP_EMAILyes Your Whoop login email
configWHOOP_INSTALLATION_IDno (auto) The per-install device identifier sent as x-whoop-installation-identifier. Generated once and written to .env on first run — don't set it by hand.
🔐 secretWHOOP_PASSWORDyes (bootstrap only) Your Whoop login password (used only during bootstrap)
configWHOOP_TIMEZONEno IANA timezone (e.g., America/Los_Angeles). If unset, auto-detected from your Whoop profile and refreshed hourly. Set explicitly to override.
configWHOOP_TOKEN_STOREno envfile (default — persists refreshed tokens back to .env) or memory (for read-only filesystems; re-bootstrap every ~30 days).
configWHOOP_USER_IDno Your Whoop user ID — used by whoop_profile, whoop_leaderboard. Avoids one bootstrap call per session.
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/rishi-mittal-web-whoop-mcp-10ktxg)](https://m8ven.ai/mcp/rishi-mittal-web-whoop-mcp-10ktxg)
commit: b1ab1f7a9511dab7314169a19cc3e6775a95ce74
code hash: edc511347afe6e4eac498dbde825661484e39bdb9e000f08d79f17d727e95481
verified: 7/31/2026, 9:00:29 AM
view raw JSON →