MCP server for accessing Oura Ring data via OAuth2
This HTTP-based MCP server for Oura Ring data exhibits a mixed quality profile. All 9 tools are explicitly defined with proper JSON Schema inputs and descriptions, which is a strong foundation. However, several tools have minimal or generic descriptions (e.g., 'Get daily readiness scores' is only 27 characters), and no tools document their output schemas, a critical gap for LLM planning. Parameter descriptions are present but terse. The server lacks tool annotations (readOnlyHint, idempotentHint), error handling guidance, and security documentation. All tools are read-only (low risk), but the narrow scope and missing output schemas prevent this from reaching a higher tier.
Get activity data for a date range
Get AI-powered insights based on recent data
Get heart rate data (5-minute intervals)
Get user's personal information and ring details
Get daily readiness scores
Get detailed sleep period data (multiple sleep sessions per day)
No output schemas documented for any tool. LLMs cannot plan downstream operations or extract relevant fields without knowing what structure each tool returns. The tools.ts file shows input schemas but no corresponding output documentation.
Minimal/generic descriptions for 3 tools: 'get_readiness_score' (27 chars), 'get_workouts' (19 chars), 'get_health_insights' (44 chars). Descriptions should be 50 - 200 chars and explain WHAT, WHEN, and WHY. These are too terse to guide LLM selection.
No tool annotations (readOnlyHint, idempotentHint). All tools are read-only and idempotent, the server should declare this via tool annotations in the MCP protocol (MCP spec 2026-07-28). This helps clients optimize caching and retry logic.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-21 | D | 59 | <=2025-11-25 | v2 |
| 2026-03-09 | D | 53 | - | v1 |
Get sleep data for a date range
Get user-created tags (notes/comments on specific days)
Get workout sessions
Error handling lacks recovery guidance. The executeToolCall() function in tools.ts catches errors and logs them, but there's no structured error response that tells the LLM what went wrong or what to try next (e.g., 'Invalid date format: use YYYY-MM-DD', 'Rate limit exceeded, retry in 60s').
Missing parameter constraints. 'start_date' and 'end_date' parameters are documented as strings with format 'YYYY-MM-DD', but no regex pattern or example is provided in the schema. Parameters like 'days' (number) lack min/max bounds, allowing LLMs to pass invalid values like -1 or 365000.
No pagination support visible. Tools like get_sleep_summary, get_workouts, and get_health_insights have no limit, page, or offset parameters. If a date range returns hundreds of records, the response could exceed context limits and degrade LLM reasoning.
No security documentation or permission declarations. The server integrates with Oura's OAuth2 API (per package.json), but there's no indication of what scopes, permissions, or data classifications apply to each tool. No audit trail or logging of which operations were performed by which caller.