74
/ 100
1 day ago
glama

totem

Totem provides Claude with full read and write access to wearable device data, starting with Whoop, through its private iOS API.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: AUTH_PASSWORD, WHOOP_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretAUTH_PASSWORDA password you'll type once when adding the Claude connector
configFLY_APP
configMCP_HTTP_PORT
configMCP_TRANSPORT=http, MCP_AUTH_TOKEN=$(openssl rand -hex 32)
configNO_COLOR
configPORTIn your Space → Settings → Variables and Secrets, add the following. The token values go in as Secrets (hidden, never shown in logs); and PUBLIC_URL aren't sensitive, so they can be plain Variables:
configPUBLIC_URLIn your Space → Settings → Variables and Secrets, add the following. The token values go in as Secrets (hidden, never shown in logs); PORT and aren't sensitive, so they can be plain Variables:
configWHOOP_AUTH_TOKENS_ONLY
configWHOOP_EMAILyes Your Whoop login email
configWHOOP_INSTALLATION_IDno (auto) The per-install device identifier sent as x-whoop-installation-identifier. Generated once and written to .env on first run — don't set it by hand.
🔐 secretWHOOP_PASSWORDyes (bootstrap only) Your Whoop login password (used only during bootstrap)
configWHOOP_TIMEZONEno IANA timezone (e.g., America/Los_Angeles). If unset, auto-detected from your Whoop profile and refreshed hourly. Set explicitly to override.
configWHOOP_TOKEN_STOREno envfile (default — persists refreshed tokens back to .env) or memory (for read-only filesystems; re-bootstrap every ~30 days).
configWHOOP_USER_IDno Your Whoop user ID — used by whoop_profile, whoop_leaderboard. Avoids one bootstrap call per session.
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/thebriangao-totem-z44vpw)](https://m8ven.ai/mcp/thebriangao-totem-z44vpw)
commit: b1ab1f7a9511dab7314169a19cc3e6775a95ce74
code hash: edc511347afe6e4eac498dbde825661484e39bdb9e000f08d79f17d727e95481
verified: 7/30/2026, 8:53:13 AM
view raw JSON →