Unofficial MCP server for connecting AI agents to the WHOOP API.
The WHOOP MCP server demonstrates above-average definition quality for a health/wearables domain with 30 tools. Strengths: comprehensive tool coverage, clear action-verb naming (whoop_get_*, whoop_list_*), structured parameter schemas with enums for privacy_mode and response_format across all tools, and consistent descriptions explaining what each tool does and when to use it. Weaknesses: many descriptions are at the lower end of the optimal range (10-20 chars shy of 50-200 char baseline); parameter descriptions are minimal in places (e.g., 'Cycle ID' is brief); no explicit output schemas documented; error handling and recovery guidance missing from descriptions; some tools conflate multiple responsibilities (e.g., whoop_get_profile reads from API while whoop_profile_get reads from local storage, risking LLM confusion); no per-tool security/permission documentation. Tool definitions are directly visible in source (scripts/smoke-tools.mjs), so no inference penalty applied. Average description length across all tools: ~140 chars, acceptable but below A-tier baseline of 194 chars. Schema presence is strong (all tools have typed, described parameters with enums), but output schemas are not explicitly documented in the tool metadata.
Machine-readable install, runtime and client guidance for AI agents operating the WHOOP MCP. Does not read WHOOP or expose secrets.
Check the status of the local HTTP response cache.
Explain supported WHOOP data, unavailable raw sensor streams, privacy modes, recommended agent workflow, and project links. Does not read WHOOP or expose secrets.
Diagnostic health check: environment, token, WHOOP API readiness, and next steps. Safe to call with missing env vars; returns explicit guidance.
Retrieve a summary of strain, recovery, and sleep for a specific day.
Inventory supported WHOOP data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call WHOOP APIs or expose user data.
Output schemas not explicitly documented. Tool descriptions state what tools return (e.g., 'Retrieve authenticated user's profile') but do not include the response object structure or key field names the LLM should expect. This forces the LLM to infer output fields, increasing hallucination risk and blocking effective chaining between tools.
Confusing tool pair: whoop_get_profile (reads from WHOOP API) vs whoop_profile_get (reads from local storage). Names are too similar; LLMs will conflate them. The descriptions clarify the distinction, but naming alone should make it obvious. Suggest renaming to whoop_get_profile_from_api and whoop_get_profile_local, or consolidate with a 'source' parameter.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | B | 73 | 2025-06-18+ | v2 |
Return synthetic WHOOP data payloads that match the schema of real WHOOP API responses, for agent testing before OAuth.
Exchange an OAuth authorization code for access and refresh tokens. Stores them locally for automatic API calls.
Generate the WHOOP OAuth consent URL. The user opens it in a browser, grants access, and receives a code to exchange for tokens.
Retrieve body measurement data from the WHOOP API.
Retrieve a single strain cycle by ID.
Retrieve recovery data for a specific strain cycle.
Retrieve sleep data for a specific strain cycle.
Retrieve the authenticated user's profile from the WHOOP API.
Retrieve a single sleep record by ID.
Retrieve a single workout record by ID.
List strain cycles with optional filtering by date range.
List recovery scores with optional filtering by date range.
List sleep records with optional filtering by date range.
List workout records with optional filtering by date range.
AI-friendly onboarding flow for a new WHOOP user. Returns a personalized action plan to reach data readiness.
Verify which secrets are set and where the config lives (env vars vs .whoop-mcp/config.json). For agent-internal use; does not call WHOOP APIs.
Retrieve user wellness profile settings and defaults from local storage.
Update user wellness profile settings in local storage.
Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect WHOOP?'
Analyze recovery score trends over a date range.
Revoke WHOOP API tokens and clear local storage.
Analyze sleep quality trends over a date range.
Retrieve a summary of strain, recovery, and sleep trends for a week.
Retrieve comprehensive wellness context including current recovery, sleep debt, strain capacity, and cycle progression for immediate use by downstream agents.
No error handling or recovery guidance in tool descriptions. Tools like whoop_exchange_code, whoop_revoke_access, and API-dependent tools (whoop_get_profile, whoop_list_cycles) lack guidance on what to do if they fail. Descriptions should include common failure modes and recovery steps, e.g., 'If auth fails, call whoop_get_auth_url to reinitiate OAuth.'
Missing pagination documentation in list tools. Tools like whoop_list_cycles, whoop_list_sleeps, and whoop_list_workouts accept all_pages and max_pages parameters, but descriptions do not explain pagination behavior, default limits, or how to interpret results. A description like 'Call with all_pages=true to fetch all results; defaults to max_pages=10 for safety' is needed.
Parameter descriptions too brief in data retrieval tools. Parameters like 'Cycle ID', 'Sleep record ID', 'Workout ID' lack format guidance. Should specify: 'The unique WHOOP cycle identifier (UUID format)' or 'The integer cycle ID returned by whoop_list_cycles.' This prevents LLMs from passing invalid IDs.
No tool-level security or permission documentation. Tools that write state (whoop_exchange_code, whoop_profile_update, whoop_revoke_access) or read sensitive health data do not declare required scopes or permissions. Descriptions should state: 'Requires: oauth:write scope. Revokes user's WHOOP API access, irreversible.'
Date/time parameter formats not rigorously specified. Tools accepting date ranges (whoop_list_cycles, whoop_sleep_trend, whoop_recovery_trend, whoop_daily_summary) accept 'ISO 8601' or 'YYYY-MM-DD' but descriptions do not clarify timezone handling, whether time-of-day is parsed, or what happens if boundaries are on DST transitions. Should state: 'ISO 8601 UTC (e.g., 2024-01-15T09:00:00Z) or YYYY-MM-DD (assumes UTC midnight).'