open-health-syncBLOCK
Self-hosted, open-source API for wearable and health data, in Go. Syncs Apple Health, Health Connect, Oura, WHOOP, Withings, Strava, Fitbit, Dexcom and more into one model, served over REST, FHIR R4, Open mHealth, CSV/Parquet, webhooks and a read-only MCP server. Docker, Helm, Raspberry Pi. AGPL-3.0
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
<img src="docs/assets/readme/hero-light.png" width="100%" alt="Open Health Sync: thirteen sources flow into one Go binary (background sync, raw store, normalize, Postgres). Apple Health and Withings are in v0.0.2; Oura, WHOOP, Fitbit, Polar, Strava, Suunto, Ultrahuman, intervals.icu, Dexcom, OMRON and Health Connect ship in the next release. Outputs: REST API and read-only MCP in v0.0.2; FHIR R4, Open mHealth, CSV/Parquet exports and outgoing webhooks in the next release. Garmin, Coros and Samsung Health via Health Connect are planned. The JSON shown is a real heart rate sample read back from the API.">
One open API for wearable and health data. On your own server.
Apple Health and Withings in today; Oura, WHOOP, Fitbit, Health Connect, Dexcom, OMRON and five more in the next release. One clean model out, over REST and a read-only MCP server for AI agents, with FHIR R4 in the next release. Free, one Go binary plus Postgres, runs on a Raspberry Pi.
[](https://github.com/soma-intelligence/open-health-sync/actions/workflows/ci.yml) [](https://github.com/soma-intelligence/open-health-sync/releases) [](https://github.com/soma-intelligence/open-health-sync/releases) [](go.mod) [](LICENSE)
7b2551898b47OBSERVED · 2026-10-13Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add open-health-sync:0.0.2 --env OHS_MCP_KEY=${OHS_MCP_KEY} -- docker run -i --rm ghcr.io/soma-intelligence/open-health-sync:0.0.2:None mcpTrust audit
BLOCKgrade F · trust 36/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (7 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
Exec(ctx context.Context, sql string, args ...any) (pgconn.CommandTag, error)
Exec(ctx context.Context, sql string, args ...any) (pgconn.CommandTag, error)
OHS_DATABASE_URL=postgres://ohs:ohs@localhost:5432/ohs?sslmode=disable
ai-agent.cpython-313.pyc
compare-sources.cpython-313.pyc
connect.cpython-313.pyc
dashboard.cpython-313.pyc
INSERT INTO ohs_sync.inbound_subscriptions (tenant_id, user_id, provider, topic, callback_url, status)
callback_url = EXCLUDED.callback_url, status = 'pending', attempts = 0,
SELECT id, tenant_id, user_id, provider, callback_url
rows, err := tx.Query(ctx, `SELECT id, callback_url, status, attempts FROM ohs_sync.inbound_subscriptions
helm lint --strict deploy/helm/ohs --set database.url=postgres://ohs:ohs@db:5432/ohs
helm template ohs deploy/helm/ohs --set database.url=postgres://ohs:ohs@db:5432/ohs > default.yaml
url: postgres://ohs:ohs@postgres:5432/ohs?sslmode=disable&pool_max_conns=20
export OHS_DATABASE_URL='postgres://ohs:secret@localhost:5432/ohs?sslmode=disable&pool_max_conns=20'
gradle-wrapper.jar
.gitleaks.toml
.helmignore
func (e *env) exec(sql string, args ...any) {exec(`INSERT INTO ohs_data.quantity_samples (tenant_id, user_id, provider, quantity_type, value, start_date, content_hash)
exec(`INSERT INTO ohs_data.quantity_samples (tenant_id, user_id, provider, quantity_type, value, start_date, content_hash)
console.log(`minted a user token with scopes ${userToken.scopes.join(",")}`);path: ../../sdks/swift
const sdkRoot = path.resolve(projectRoot, "../../sdks/react-native");
raw, err := os.ReadFile("../../connectors/applehealth/testdata/ios_upload_lines.ndjson")Gates applied: no_behavioural_pass.
7b2551898b47full audit observations/trust-audit/mcp-server/soma-intelligence__open-health-sync.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-13 | 7b2551898b47 | BLOCK | F | 36 | first audit |
Questions
What is the open-health-sync MCP server?
Self-hosted, open-source API for wearable and health data, in Go. Syncs Apple Health, Health Connect, Oura, WHOOP, Withings, Strava, Fitbit, Dexcom and more into one model, served over REST, FHIR R4, Open mHealth, CSV/Parquet, webhooks and a read-only MCP server. Docker, Helm, Raspberry Pi. AGPL-3.0
Is open-health-sync safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (36/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does open-health-sync need?
It reads OHS_KEY and OHS_MCP_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does open-health-sync run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as open-health-sync-react-native at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (7b2551898b47), read on 2026-10-13. The repository is watched and re-audited when it changes.