EFFECTIVE OCTOBER 22, 2026

Your connection.
Your control.

WHOOP MCP is independent, self-hosted software by Das Kreb. There is no vendor-operated health-data collection service, advertising, analytics or telemetry.

With your authorization, your local server reads WHOOP recovery, cycles, sleep, workouts, body measurements and profile data. Requested records are shared with your chosen assistant, whose provider handles the conversation under its own terms. A tunnel provider may process traffic when you enable remote access.

OAuth configuration and tokens are encrypted locally using a key in your operating system's credential manager. Health records are processed in memory rather than archived by this server. Profile identity fields are omitted from ordinary training responses; the explicit profile tool returns them when requested.

You can remove local tokens with logout, revoke remote grants with remote reset, and withdraw upstream authorization in WHOOP account settings. Uninstall preserves private state. Remove that state and the OS-keyring entry separately after revocation if you want complete local deletion.

This website is static documentation. It accepts no account credentials or health records. GitHub hosts it; Google Fonts supplies the typefaces, so those providers receive normal browser requests under their own privacy policies.

Read the full privacy policy or contact the project without sharing personal data. Report security issues privately through the repository's Security tab.

Not affiliated with WHOOP or OpenAI. A third-party deployment must provide its own operator identity and processing terms.