The HealthOS MCP server

With a personal token

Create a token in the HealthOS iPhone app under Settings → Account → API access, pick its scopes, and send it as a bearer header. Tokens cannot be created on the web yet. Any MCP client that can send a header works this way.

POST https://api.healthosx.com/api/mcp
Authorization: Bearer hos_…

With OAuth

Claude, ChatGPT and other assistants connect with OAuth 2.1: the person signs in to HealthOS, ticks what to share, and the assistant gets a token for that grant only.

https://mcp.healthosx.com/mcp

GET https://mcp.healthosx.com/.well-known/oauth-protected-resource/mcp
GET https://mcp.healthosx.com/.well-known/oauth-authorization-server
POST https://mcp.healthosx.com/oauth/register    (RFC 7591)
GET  https://mcp.healthosx.com/oauth/authorize   (PKCE S256)
POST https://mcp.healthosx.com/oauth/token
POST https://mcp.healthosx.com/oauth/revoke

• Discovery: 401 with WWW-Authenticate → /.well-known/oauth-protected-resource/mcp → /.well-known/oauth-authorization-server.
• Clients: dynamic client registration (RFC 7591) or a client ID metadata document. PKCE with S256 is required.
• Tokens: access tokens last 1 hour; refresh tokens rotate on every use. A connection lasts up to 365 days, then the person approves again.
• Scopes: grouped into families on the consent screen. Reading is on by default; writes, DNA, Ask, community, export and account changes are off until ticked.
• Limits: 60 calls a minute and 2,000 tool calls a day (UTC) per connection.
• No raw genome: over OAuth, DNA tools return findings and lookups, never the whole genome.
• Revoke: POST /oauth/revoke, or the person disconnects in Settings → Connected apps.
• No payments: over OAuth, assistants get no checkout or payment tools. Buying stays in the HealthOS app and on personal tokens.

Rules every client gets

Set up a developer tool

Replace hos_… with your token. Claude Code takes the command below; clients configured with an mcp.json that accepts a URL and headers take the second form.

claude mcp add --transport http healthos https://api.healthosx.com/api/mcp \
  --header "Authorization: Bearer hos_…"

{
  "mcpServers": {
    "healthos": {
      "url": "https://api.healthosx.com/api/mcp",
      "headers": { "Authorization": "Bearer hos_…" }
    }
  }
}

Tools

Generated from the tool list the live server returns. Every tool is listed; a call only succeeds when the token holds the tool’s scope. (225 tools)