google-health-mcp

A read-only MCP server for the Google Health API (v4) — the successor to the Fitbit Web API. Gives an LLM access to steps, sleep, heart rate, workouts, calories, nutrition, body metrics, and paired-device info from Fitbit trackers and Pixel Watches.

Tools

Tool	Purpose
get_identity	Health user id (+ legacy Fitbit id)
list_paired_devices	Trackers/watches, battery, last sync
list_data_points	Raw intraday samples of any data type
reconcile_data_points	Deduplicated stream across data sources
rollup_data_points	Sub-daily aggregation (e.g. hourly heart rate)
daily_rollup_data_points	Daily/multi-day totals in local civil time

Google Cloud setup (once)

The Health API only accepts Google OAuth user credentials, and all of its scopes are "Restricted" — unverified clients are capped at 100 (test) users, which is plenty for personal use.

1. Create/pick a Google Cloud project and enable the Google Health API.
2. Create an OAuth client (type Web application) and add http://localhost:8035/ as an authorized redirect URI.
3. On the Data Access page, add the googlehealth.*.readonly scopes you want (the defaults used here: activity_and_fitness, sleep, health_metrics_and_measurements, nutrition, profile).
4. Add your Google account as a test user on the Audience page.
5. Download the client credentials JSON.

Authorize

export GOOGLE_HEALTH_CLIENT_SECRETS_FILE=~/path/to/client_secret.json
google-health-mcp auth

A browser opens for Google consent; tokens land in ~/.config/google-health-mcp/token.json (override with GOOGLE_HEALTH_TOKEN_FILE). Access tokens are refreshed automatically. Heads-up: while the OAuth client is in Testing status, Google expires the refresh token after 7 days — re-run auth when that happens.

Run

google-health-mcp                 # stdio (default)
google-health-mcp serve --transport http --port 8000

For a shared HTTP deployment, skip the auth step entirely and set GOOGLE_HEALTH_EXTERNAL_URL: the server then protects itself with the MCP OAuth 2.1 flow, with Google as the identity provider. Connecting clients run the Google consent flow natively and every tool call uses that user's own Google token, so each user only reaches their own health data. Add <external-url>/auth/callback as a redirect URI on the OAuth client; who can connect is bounded by the client's test-user list (or Internal, for a Workspace org).

Claude Code:

claude mcp add google-health \
  -e GOOGLE_HEALTH_CLIENT_SECRETS_FILE=$HOME/path/to/client_secret.json \
  -- google-health-mcp

Environment variables

Variable	Meaning
GOOGLE_HEALTH_CLIENT_SECRETS_FILE	OAuth client JSON from the console
GOOGLE_HEALTH_CLIENT_ID / GOOGLE_HEALTH_CLIENT_SECRET	Alternative to the file
GOOGLE_HEALTH_TOKEN_FILE	Token store, default ~/.config/google-health-mcp/token.json
GOOGLE_HEALTH_REFRESH_TOKEN	Headless bootstrap: seeds the token store when it doesn't exist yet (run auth locally, copy the refresh_token from token.json)
GOOGLE_HEALTH_SCOPES	Space-separated scope override for auth
GOOGLE_HEALTH_EXTERNAL_URL	Public URL of the server; enables the OAuth 2.1 flow on the http transport
GOOGLE_HEALTH_BASE_URL	Default https://health.googleapis.com

Development

nix develop -c pytest
nix develop -c ruff check src tests

Notes

• Read-only by design: no write scopes are requested and no write endpoints are exposed. (The API does support writes for some data types.)
• The Google Health API is still evolving; Google has said breaking changes are possible through May 2026, and the legacy Fitbit Web API shuts down in September 2026.