MCP

google-health-mcp: read authorized health data on this machine with OAuth

For people who want a client to read their own authorized Google Health API v4 data, using local OAuth, and using only read-only coverage on the first try without opening the clinical scope.

Official source · google-health-mcp

Install

npx -y delx-wellness-hermes setup

Who it is for

You already use Fitbit, Pixel Watch, or a Google Health partner and want to read Health API v4 data you have authorized, on this machine, through OAuth. Official text calls it local-first: tokens do not leave this machine. It is currently Beta.

The recommended install targets Hermes: one command preconfigures this connector plus 8 others into a dedicated Hermes config. The source title also names Claude and Cursor. For people who accept health data going out to Google while tokens stay on this machine.

If you cannot complete OAuth, or do not want any health-related request to leave this machine, this guide cannot help you. Current notes do not name specific MCP tools (for example steps or heart rate). Do not invent tool names.

First try in 3 minutes

Prerequisites: this machine can run npx; you plan to use Hermes (or connect another client later). The official one-command install is:

npx -y delx-wellness-hermes setup

It comes from Delx Wellness for Hermes

https://github.com/davidmosiah/delx-wellness-hermes

and preconfigures this connector plus 8 others. On the first try do not open the clinical scope.

The first try uses the named read-only command coverage. The static precheck before OAuth is written as coverage --json; do not add --live. The official example with the full package name only shows the live-account version:

npx -y google-health-mcp-unofficial coverage --live --json

On the first try, run coverage --json on the same package. Observable success: a coverage report prints, and you should not see OAuth secrets, local paths, or raw health measurements — official text says the command is designed for that. It may still reach network dependencies; do not read it as "no network, no privacy boundary." After the precheck passes, add --live if you want a real account. That is also read-only, but it touches a real account; before you start, confirm it is your own authorized account.

SSH / containers / WSL can use auth --manual for headless OAuth; that is not the first-try path.

Use cases

Case 1: look at coverage before wiring. Run coverage --json as a static precheck before OAuth. The excerpt does not list report fields, so success is "you get JSON coverage and see no secrets or raw measurements." Do not treat the precheck as already connected to Fitbit.

Case 2: a read-only check against a real account. Run npx -y google-health-mcp-unofficial coverage --live --json. Official text says read-only and deliberately omits OAuth secrets, local paths, and raw health measurements. The excerpt gives no filter parameters or time window; do not treat this output as a clinical record. The clinical scope (ECG/IRN) is optional; do not open it in the first case.

Limits

This is the unofficial npm package name google-health-mcp-unofficial, status Beta. Tokens should stay on this machine, but Health API requests still leave this machine. Coverage is designed to omit raw measurements; that is not the same as data never being requested. There are no steps to revoke authorization, delete local tokens, or turn off the Hermes config. The other 8 preconfigured connectors are not named. Official repository:

https://github.com/davidmosiah/google-health-mcp