
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
health-export-mcp
Advanced tools
Open-source, zero-dependency Model Context Protocol (MCP) server to query Apple Health / HealthKit data (190 metrics) from Claude, ChatGPT, Cursor, OpenClaw, Hermes and any MCP agent.
Query your Apple Health data from Claude, ChatGPT, Cursor, OpenClaw, Hermes — and any other AI agent.
health-export-mcp is an open-source, zero-dependency Model Context Protocol (MCP) server that lets any MCP-compatible AI agent query your Apple Health / HealthKit data — 190 metrics as clean JSON — in plain language. Local-first, read-only, no accounts, and no developer server in the path. It's the open-source server for the Health Export AI iOS app — available on the App Store.
Ask your agent: "Compare my HRV this week vs last week and tell me if I'm recovering." — it calls the tools and answers from your actual numbers.
It's an MCP server that turns your Apple Health export into a tool your AI agent can query in natural language — HRV, sleep, resting heart rate, steps, workouts, VO₂ max, and 180+ more.
Try it with no iPhone needed:
git clone https://github.com/PhilipAD/health-export-mcp.git && cd health-export-mcp && npm testwrites a 14-day sample cache and exercises every tool.
The companion iOS app Health Export AI exports your Apple Health data — read-only, automatic, private. For this MCP server, export to a destination it can read:
| Destination | Notes |
|---|---|
| iCloud Drive (default) | Your Mac reads the synced folder automatically |
| Local folder | Any folder that syncs to your Mac (Dropbox, Google Drive, OneDrive, …) |
| LAN (HTTP / WebSocket) | Direct push to the server — great over Tailscale |
Using a non-MCP tool (ChatGPT, n8n, Home Assistant)? The app can also POST to a webhook those tools read directly — see Works with.
Fastest — auto-configure:
git clone https://github.com/PhilipAD/health-export-mcp.git
cd health-export-mcp
node apply-mcp-config.mjs # detects installed clients and writes the config for you
Manual — Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"health-export": {
"command": "node",
"args": ["REPLACE_WITH_ABSOLUTE_PATH/server.mjs"],
"env": { "HEALTH_DATA_DIR": "~/Library/Mobile Documents/iCloud~ai~healthexport~app/Documents" }
}
}
}
Get the absolute path to paste above:
node -e "console.log(process.cwd()+'/server.mjs')"(run inside the repo). Or skip JSON entirely — draghealth-export.mcpbinto Claude Desktop → Settings → Extensions.
Cursor / VS Code: node gen-deeplinks.mjs prints one-click install links.
opencode / OpenClaw / Hermes: see AGENTS.md for the exact block — same shape, one per client.
Restart the client and try:
"Use health-export: what's my average HRV this week vs last week?"
| Client / Agent | Integration | How |
|---|---|---|
| Claude Desktop | Native MCP | .mcpb bundle, or mcpServers block |
| Cursor | Native MCP | One-click deeplink, or ~/.cursor/mcp.json |
| opencode | Native MCP | opencode.json mcp block |
| OpenClaw | Native MCP | Add the server block to your MCP config |
| Hermes | Native MCP | Add the server block to your agent's MCP config |
| VS Code (Copilot / Continue) | Native MCP | One-click deeplink |
| ChatGPT · Gemini · Grok | Webhook* | Consume the app's webhook export |
| n8n · Home Assistant | Webhook* | Trigger automations on the exported JSON |
*MCP clients query this server directly over stdio. ChatGPT / Gemini / Grok / n8n / Home Assistant don't speak MCP — they consume the same Apple Health data via the iOS app's token-authenticated webhook export.
| Tool | What it does |
|---|---|
get_mcp_status | Health check — source, metric/workout counts, latest data date. Call first. |
list_metrics | Every available metric with unit, day count, and date range. |
get_health_metrics | Daily values for a metric (or all) over a date range + an aggregate (avg/sum/min/max/latest). |
get_trends | Recent N-day window vs the prior N days — change, % change, direction. |
compare_periods | A metric across two arbitrary date periods (A vs B). |
get_structured_export | Clean JSON for chosen metrics/range — drop straight into context. |
query_health_data | Natural-language convenience: "average HRV last month" → routed structured results. |
Coverage: 190 Apple Health metrics across activity, heart, HRV, mobility, respiratory, body, sleep, hearing, and nutrition — plus workouts.
"What has my resting heart rate done over the last 30 days?"
"Compare my deep sleep this week vs last week."
"Is my VO₂ max trending up or down this quarter?"
"Give me a clean JSON export of HRV, RHR and sleep for the last 14 days."
"Correlate my step count with my sleep duration this month."
Health Export AI — exports your Apple Health to your agent, automatically.
PAIRING_SECRET to the code the iOS app shows (Settings → Agent pairing) to gate access.The server artifacts hosted at healthexport.dev/mcp/ (used by the setup skill) are minisign-signed, and every download is SHA-256 checksummed. The signing public key is published in this repo (minisign.pub) and in SKILL.md — pin it from here, not only from the website, so a compromise of the website alone cannot swap both an artifact and its key.
PUBKEY='RWS6TxVWSKUblYkx7Db6ZpmvHALwHpznZpjaED/FlZj+PpxSlel0MxHZ' # = minisign.pub in this repo
curl -fsSL https://healthexport.dev/mcp/SHA256SUMS -o SHA256SUMS
curl -fsSL https://healthexport.dev/mcp/SHA256SUMS.minisig -o SHA256SUMS.minisig
minisign -Vm SHA256SUMS -P "$PUBKEY" || { echo "signature INVALID — do not run"; exit 1; } # fail closed
curl -fsSL https://healthexport.dev/mcp/server.mjs -o server.mjs
shasum -a 256 --ignore-missing -c SHA256SUMS || { echo "checksum mismatch — do not run"; exit 1; }
The pinned, checksum-verified download above is the locked-down path. npx health-export-mcp instead resolves the latest version published to npm at run time (npm provides its own package integrity). Full security overview: https://healthexport.dev/security. Report vulnerabilities to security@healthexport.dev.
node -v)..health-cache.json exported by Health Export AI — or run npm test to generate a sample one.How do I get my Apple Health data into Claude / ChatGPT / my AI agent?
Install health-export-mcp, export your Apple Health data with the Health Export AI iOS app (to iCloud, a folder, or your LAN), then add the MCP server to your AI client. Your agent can then query your Apple Health metrics in natural language. (Non-MCP tools like ChatGPT read the app's webhook export instead.)
Is my health data sent to a server? Not to us. The MCP server runs locally and reads only the export files or endpoints you configure — there's no developer server in the path. Where your iOS export is delivered (iCloud, your LAN, a webhook) is entirely your choice.
Which agents are supported? Any MCP client — Claude Desktop, Cursor, opencode, OpenClaw, Hermes, VS Code — natively. ChatGPT, Gemini, Grok, n8n, and Home Assistant consume the same data via webhook.
Do I need the iOS app?
The app is the easiest way to get Apple Health data off your iPhone in the format this server reads. You can also point HEALTH_DATA_DIR at any folder containing a compatible .health-cache.json.
HEALTH_DATA_DIR points at the folder containing .health-cache.json, and that the app has exported at least once. Run get_mcp_status to see the resolved source and latest date.server.mjs, ensure Node ≥18, and fully restart the client.# Node ≥18, no install needed
HEALTH_DATA_DIR=~/Library/Mobile\ Documents/iCloud~ai~healthexport~app/Documents node server.mjs
# integration test — writes a 14-day sample cache and exercises every tool
npm test
stdio transport (newline-delimited JSON-RPC 2.0) — the universal MCP transport. Optionally set HEALTH_LISTEN=1 to also accept LAN pushes from the iOS app in the same process (see receiver.mjs).
The iOS app reads Apple Health (read-only) and writes a compact .health-cache.json to the destination you choose. This server reads that file and exposes the 7 tools above over MCP. No bridge, no Docker, no database — just a file and stdio.
Apple Health → Health Export AI (iOS) → .health-cache.json → health-export-mcp → MCP client → you
Other Apple Health MCP servers in the ecosystem — worth a look depending on your setup:
How health-export-mcp differs: zero dependencies, clean structured JSON, 190 Apple Health metrics, and the widest agent support (Claude, Cursor, opencode, OpenClaw, Hermes, VS Code natively — plus ChatGPT/Gemini/Grok/n8n/Home Assistant via webhook).
If this helps your setup, a ⭐ makes it easier for others to find.
MIT — see LICENSE. Contributions welcome.
Apple Health MCP server · export Apple Health to AI · HealthKit MCP server · query Apple Health with Claude / ChatGPT / Cursor · Model Context Protocol health server · Apple Health to LLM · HRV, sleep & heart rate for AI agents.
FAQs
Open-source, zero-dependency Model Context Protocol (MCP) server to query Apple Health / HealthKit data (190 metrics) from Claude, ChatGPT, Cursor, OpenClaw, Hermes and any MCP agent.
The npm package health-export-mcp receives a total of 63 weekly downloads. As such, health-export-mcp popularity was classified as not popular.
We found that health-export-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.