Apple Health MCP Server — live sleep, cycle, weight & more for your AI agent

Connect Apple Health to Claude Code

uvx vaultbeat-apple-health@latest status

uvx vaultbeat-apple-health@latest bind

claude mcp add vaultbeat-health -- uvx vaultbeat-apple-health@latest serve --transport stdio

Claude Desktop — and any other agent framework

After binding (steps 1–2 above), add this to your claude_desktop_config.json:

{
  "mcpServers": {
    "vaultbeat-health": {
      "command": "uvx",
      "args": ["vaultbeat-apple-health@latest", "serve", "--transport", "stdio"]
    }
  }
}

Using Hermes, OpenClaw, or your own harness? Use the same split as above: command is just the executable (uvx, or its absolute path if the framework does not inherit your shell PATH), and everything else goes in args as a list. Putting the full command line into command is the most common way this fails: the server starts, prints its help, and exits — which the host reports as Connection closed, as though the server were broken.

Works with any MCP client

The server speaks standard MCP over two transports. For clients that spawn a subprocess, use stdio:

uvx vaultbeat-apple-health@latest serve --transport stdio

For clients that connect over HTTP, a streamable-HTTP endpoint is available:

uvx vaultbeat-apple-health@latest serve --transport http

HTTP binds to loopback only by default and requires a bearer token; binding a non-loopback address fails closed unless explicitly allowed. Hermes, OpenClaw, and any other MCP-capable agent connect the same way.

What your agent can do

The server currently exposes 29 tools — 22 that read and 7 that write. Most read tools take an owner filter, so you can ask about one person at a time. Sensitive categories reach the server only if the data owner explicitly opts in from the iOS app — they are off by default and never re-exported.

Read

Every read tool also returns a coverageblock — how many distinct days the answer actually rests on, the span they fall across, and how many days inside that span are missing. It is there so an agent can say “this is based on 3 days” rather than presenting a three-day average and a thirty-day one in the same words: they are the same shape and the same number of digits, and nothing else in the result tells them apart.

Write

Your agent can log four kinds of record for you — food, strength training, weight and free-text notes — useful when you would rather say “I did 5×5 squats at 80kg” than open the app and tap it in. Three of those kinds come as a pair, and the names say which is which: a log_ tool replaces a whole day, while its _appendtwin only adds and cannot delete — so an agent that cannot see what you have already recorded has a safe option. Writes are encrypted on your machine before upload, exactly like the ones your iPhone makes, so our cloud still only ever receives ciphertext. None of these tools takes an owner argument: an agent can write to your own account and nowhere else, never your partner's. Sleep, cycle and symptom records stay read-only.

Only log_weight_entry can reach Apple Health, and only when you enable Settings → Data & AI → “Allow AI to update Apple Health” — off by default. The full detail is in the Privacy Policy. The authoritative tool list lives in the GitHub README.

And 8 prompts, so it does not have to guess how

Tools are what your agent can call. prompts/list is how it asks what the server is for — and every MCP client can read it. Without one, each agent invents its own routine, and the two mistakes that do real damage with health data get left to whichever agent happened to connect: calling an association a cause, and reading a gap as a zero. Each entry below names the tools to call for it and carries the same two rules — say what the data covers before concluding anything, describe rather than prescribe, invent no scores or grades; and where a read can come back empty, never treat that emptiness as a measurement of zero.

Every argument is optional. Omit one and it is filled with a default written into the prompt itself, so asking for a prompt with no arguments is a supported call rather than a degraded one.

Why not just export my Apple Health XML?

Most Apple Health MCP servers work on a manual export: you generate an XML or CSV dump, import it, and query a snapshot that is stale the moment it lands. Vaultbeat takes a different approach — the iOS app syncs continuously in the background, so your agent always reads current data.

How the end-to-end encryption works

Every health record is encrypted on your iPhone before it leaves the device: the record is sealed with AES-GCM, and its key is wrapped for each authorized recipient using Curve25519 ECDH with HKDF-SHA256 — one envelope for you, one for your partner if sharing is on, one for each machine you pair. The cloud stores and routes ciphertext only; we hold no decryption keys and cannot read your health data — architecturally, not just by policy. When you bind a machine, it generates its own Curve25519 keypair. The private key never leaves that machine: it lives in your system keyring, or in an owner-only file beside the config when the machine has no keyring at all, and is never uploaded anywhere. Decryption happens in exactly the places you chose: your own devices, an opted-in partner's device, and the machine your agent runs on. The decryption code is open source — audit it.

Frequently asked questions

Not here for the agent? Vaultbeat also lets you share sleep data with your partner — that part is free. Questions? Email support@vaultbeat.app or open an issue on vaultbeat-community.