Totem: an MCP server for Whoop data
totem
An MCP server that gives an assistant your Whoop data through the app's private API: sleep, recovery, strain, workout logging
- 142 ★ on the repository
- Last commit
Broad access
Why this level
- Access to the account through a private API breaks Whoop terms, and suspension is possible
- Tools write workouts, journal and profile, and the login tokens sit in a file on disk
- Sleep, heart rate and health data go to the model
Install
- Works in
Manual install
git clone https://github.com/thebriangao/totem.git && cd totem && npm install && npx tsc && npm linkBuild from source per the README, Node 24 or newer needed.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Access to the account through a private API breaks Whoop terms, and suspension is possible
- Tools write workouts, journal and profile, and the login tokens sit in a file on disk
- Sleep, heart rate and health data go to the model
This is third-party code. Review the repository files before installing.
What it does
Totem runs as a local Node process and registers 55 tools. They read recovery, sleep with stages, strain, HRV and resting heart rate trends, the behavior journal, stress, heart rate zones and Strength Trainer lifts. A separate tool passes a question to the built-in Whoop AI coach. Some tools write data: they log a workout, add a journal entry, edit the profile and heart rate zones, and set up the smart alarm. Every write returns only a preview of the request by default, and the assistant repeats the call with confirmation after you answer. The server talks to the same API as the Whoop mobile app and refreshes the login token on its own. It runs over stdio for a local client, or over HTTP when deployed to a host and connected as a connector to Claude and ChatGPT.
Who it is for. Whoop owners who go through sleep, recovery and training in a conversation with an assistant.
Good fit when
- Recovery dropped and you want to line up sleep, strain and journal entries over a week
- You need to compare two periods by HRV and resting heart rate and see a 30-day trend
- You log lifts in Strength Trainer and care about records and progression per exercise
- You do not feel like opening the app in the morning and want a daily brief with a training suggestion
Not a fit when
- The public Whoop OAuth API is enough: recovery, sleep and daily workouts are there without private access
- The Whoop account is your only one and a suspension for unsupported access is unacceptable
- You want a ready service with no command line, while installation here builds from source
Example request
How am I doing today on Whoop? Compare recovery and sleep over two weeks and say what drags the numbers down.MCP
- Transport
- stdio, http
- Authentication
- key is optional
Environment variables
MCP_AUTH_TOKENsecret- Access token for HTTP mode, created by the `totem cloud` wizard.
Limitations
The server uses the private API of the iOS app, found by traffic interception. Whoop terms do not allow such access, and the author warns plainly about possible account suspension. Login tokens live about 30 days, after which you run `totem auth`.
It needs Node 24 or newer and a build from source. Adapters for Fitbit, Apple Watch and Garmin are announced but not ready. The last commit is from September 2026.
How to disable. Remove the totem entry from the client config, stop or tear down the deployed server and delete the `.env` file with tokens. Changing the Whoop password ends sessions.
FAQ
Does Whoop allow this access?
No. The server uses the private API of the mobile app, and Whoop terms reserve the right to act against accounts with unsupported integrations, including suspension. The author puts this warning at the top of the README.
How do I connect Totem to Claude Code?
Run `totem local`: the wizard asks for a Whoop login, builds the server and writes the config to the client you pick. For use from a phone there is `totem cloud`, which deploys the server to Fly, Railway, Google Cloud Run or your own host.
Can the assistant change data without my knowledge?
Not before you confirm. Every write tool returns a request preview by default, and the real write goes out only on a repeat call with `confirm: true`.
Where do the login and tokens go?
They stay in the `.env` file on your computer, and the password is wiped after login. Outgoing traffic goes only over HTTPS to `api.prod.whoop.com`, with no telemetry.
Which Whoop data can the server read?
Recovery, sleep with stages, strain, HRV and resting heart rate, stress, the behavior journal, heart rate zones, lifts and women's health data. There are 55 tools in all, 15 of them writing.
Discussion
No questions or reviews yet.
Related
MCP serversA read-only MCP server that brings WHOOP recovery, sleep, HRV, strain and workouts to Claude, Codex and Cursor.
An MCP server for workout tracking: Claude Desktop, Cursor and Cline read routines, sets, body weight and 1RM from your self-hosted openGym
coros-mcp (community)
coros-mcp
Unofficial Coros MCP server: sleep, HRV, load and workouts from Training Hub, plus scheduling sessions in the calendar.
MCP server of an open endurance training platform: calendar, sessions, load and records, queried through an assistant
An MCP server over your local Zepp and Amazfit database: agents read sleep, heart rate and workouts and draft plans
Strava MCP
Strava MCP Server
Strava MCP server: an agent reads your workouts, heart rate, power, segments and routes and exports routes to GPX and TCX
README in short
The README covers setup through two wizard commands, 55 tools with exercise and behavior catalogs, Cognito authorization, write protection and hosting options. A separate section compares the server with the public Whoop API and names the risk openly.