v0.4.7

Fixed

• Fix withings_list_body_measures date-window handling for large accounts: after / before are converted to Withings startdate / enddate Unix timestamps before the upstream call.
• Stop forwarding internal MCP-only parameters such as after, before, page, privacy_mode and response_format to the Withings API.
• Cap returned collection records locally using limit, so an upstream response with hundreds of body-measure records does not exceed MCP client message limits.
• Replace silent invalid-date fallback with a clear ISO 8601 error.

Security

• Update the lockfile away from vulnerable hono and esbuild transitive versions. npm audit --audit-level=low is clean.

Verification

• npm test
• npm audit --audit-level=low
• npm pack --dry-run
• GitHub CI and CodeQL on 61f0017

v0.1.1 — First public release

Initial Withings MCP release

16 MCP tools + 6 resources + 3 prompts for Withings Public API. Signed token flow with local storage in ~/.withings-mcp/.

Coverage

• Body measures (weight, body composition, blood pressure, heart-rate, temperature)
• Daily activity, workouts
• Sleep summaries and sleep periods
• Heart records
• Daily and weekly agent-ready summaries
• Privacy modes, SQLite cache, privacy audit
• Hermes agent manifest checks

Install

npx -y withings-mcp-unofficial setup
npx -y withings-mcp-unofficial auth

{ "mcpServers": { "withings": { "command": "npx", "args": ["-y", "withings-mcp-unofficial"] } } }

Full changelog · npm · Registry