MCP Marketplace
BrowseHow It WorksFor CreatorsDocs
Sign inSign up
MCP Marketplace

The curated, security-first marketplace for AI tools.

Product

Browse ToolsSubmit a ToolDocumentationHow It WorksBlogFAQ

Legal

Terms of ServicePrivacy PolicyCommunity Guidelines

Connect

support@mcp-marketplace.ioTwitter / XDiscord

MCP Marketplace © 2026. All rights reserved.

Back to Browse

Delx Living Body MCP Server

by davidmosiah
Developer ToolsUse Caution4.2Local
Free

Meta-MCP that auto-detects installed wellness connectors and composes them into one body data layer.

About

Meta-MCP that auto-detects installed wellness connectors and composes them into one body data layer.

Security Report

4.2
Use Caution4.2High Risk

delx-living-body is a well-architected meta-MCP server with thoughtful security practices for a developer/wellness tool. It properly strips secrets before spawning child processes, implements reasonable timeouts, and uses rule-based synthesis to avoid unnecessary LLM calls. However, there are concerns around subprocess spawning without strict validation, broad shell command construction, and reliance on detection heuristics that could be circumvented. The tool's permissions broadly match its purpose, but the subprocess spawning capability and broad environment variable filtering (rather than allowlisting) introduce moderate risk. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

6 files analyzed · 11 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

process_spawn

Check that this permission is expected for this type of plugin.

system_info

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

Detection cache TTL in seconds. Defaults to 60.Optional

Environment variable: DELX_LIVING_BODY_DETECT_TTL

Set to true/1/yes to disable the SQLite response cache.Optional

Environment variable: DELX_LIVING_BODY_NO_CACHE

Override the default cache path (~/.delx-living-body/cache.sqlite).Optional

Environment variable: DELX_LIVING_BODY_CACHE_PATH

Override the npm runner binary used to spawn child connectors (default: npx).Optional

Environment variable: DELX_LIVING_BODY_NPM_RUNNER

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-davidmosiah-delx-living-body": {
      "env": {
        "DELX_LIVING_BODY_NO_CACHE": "your-delx-living-body-no-cache-here",
        "DELX_LIVING_BODY_CACHE_PATH": "your-delx-living-body-cache-path-here",
        "DELX_LIVING_BODY_DETECT_TTL": "your-delx-living-body-detect-ttl-here",
        "DELX_LIVING_BODY_NPM_RUNNER": "your-delx-living-body-npm-runner-here"
      },
      "args": [
        "-y",
        "delx-living-body"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

delx-living-body

Meta-MCP that turns 15 wellness MCPs into one unified body data layer for AI agents.

npm license

Today, answering "should I train hard today?" forces an agent to orchestrate WHOOP recovery, Garmin Body Battery, Oura sleep, Nourish nutrition, and cycle phase across five separate MCP servers. That's brittle for users and confusing for the agent.

delx-living-body is one MCP server that:

  1. Auto-detects which of 15 Delx Wellness connectors you already have installed locally — no manual config
  2. Composes parallel calls to the right subset
  3. Synthesizes a natural-language answer plus a structured reasoning trace and per-source confidence — using rule-based reasoning, no LLM calls

Install it once. Get a unified body data layer. Works with whatever wellness MCPs you already have.

Install

npx -y delx-living-body

That's the whole install. No OAuth flow, no API keys — delx-living-body has no auth of its own. Each child connector handles its own credentials.

See it answer "What should I do today?" (no accounts needed)

git clone https://github.com/davidmosiah/delx-living-body && cd delx-living-body
npm install && npm run build
npm run demo

The demo boots the real MCP server, fakes three installed connectors (WHOOP + Oura + Garmin, backed by a bundled stub child that carries synthetic body data), and drives it over stdio exactly the way an agent does. No real accounts, API keys, or network. Captured output lives at examples/demo-what-should-i-do-today.txt:

2) living_body_ask  question="What should I do today?"
────────────────────────────────────────────────────────────────
Recommendation:
   Today at a glance: recovery 74, sleep 83, body battery 68.

Confidence: high   Sources: whoop, oura, garmin

3) living_body_ask  question="Should I train hard today?"
────────────────────────────────────────────────────────────────
Recommendation:
   Green light for a hard session. Recovery and sleep both support high intensity.

Confidence: high   Sources: whoop, oura, garmin

Reasoning trace (rule-based, no LLM):
   Intent classified as: training_readiness
   - (rec_high) Recovery 74 supports a high-intensity day.
   - (sleep_good) Sleep score 83 is supporting recovery.

One question in → one synthesized answer composed across all three connectors, with a stable reasoning trace and zero LLM calls. This is the Body-vertical entrypoint: install once, ask in plain language, get a unified answer.

Tools (6)

ToolPurpose
living_body_statusWhich connectors are detected? Safe; no subprocess spawning.
living_body_askMain tool. Spawns detected children in parallel, returns synthesized answer. Requires explicit_user_intent: true.
living_body_daily_briefMarkdown brief built from each connector's daily_summary.
living_body_compose_contextNormalized delx-wellness-context/v1 shape merged across sources.
living_body_health_checkAll 15 known connectors with install hints for missing ones.
living_body_capabilitiesSelf-description + per-connector availability matrix.

How detection works

For each known connector, delx-living-body checks:

  1. ~/.<vendor>-mcp/tokens.json exists
  2. ~/.<vendor>-mcp/config.json exists (password-based connectors like Eight Sleep)
  3. An export file at the path in the vendor's env var (Apple Health, Samsung Health)
  4. ~/.delx-wellness/profile.json lists the device

If any check passes → detected. Otherwise → missing (with install hint). Stateless connectors (Cycle Coach) are always considered available.

Detection results cache for 60s (DELX_LIVING_BODY_DETECT_TTL).

Known connectors (15)

IDPackageCategory
whoopwhoop-mcp-unofficialrecovery
ouraoura-mcp-unofficialsleep
garmingarmin-mcp-unofficialrecovery
stravastrava-mcp-unofficialtraining
fitbitfitbit-mcp-unofficialrecovery
google_healthgoogle-health-mcp-unofficialmulti
withingswithings-mcp-unofficialmulti
apple_healthapple-health-mcp-unofficialmulti
samsung_healthsamsung-health-mcp-unofficialmulti
polarpolar-mcp-unofficialtraining
eight_sleepeight-sleep-mcp-unofficialsleep
nourishwellness-nourishnutrition
airwellness-airenvironment
cycle_coachwellness-cycle-coachcycle
cgmwellness-cgm-mcpglucose

Composition flow

When living_body_ask or living_body_compose_context runs:

  1. Detect installed connectors.
  2. For each, spawn it as a child MCP via npx -y <package> over StdioClientTransport.
  3. Call the child's *_wellness_context (or *_daily_summary) tool in parallel.
  4. Normalize results into a delx-wellness-context/v1 shape with merged scores.
  5. Run the synthesizer (rule-based, offline) to produce a recommendation + reasoning trace.

Critically: delx-living-body never calls an LLM. Synthesis is deterministic so downstream agents can reason on top of a stable trace.

Synthesizer rules

14 heuristic rules, each with a stable rule_id that appears in the reasoning trace:

  • rec_low / rec_mid / rec_high — recovery score bands
  • bb_low / bb_high — Garmin Body Battery bands
  • sleep_poor / sleep_good — sleep score bands
  • strain_high — WHOOP strain ≥ 18
  • cycle_luteal / cycle_follicular — cycle phase signals
  • load_high / load_low — aggregate training load
  • no_data — nothing installed, advisory only
  • conflict — sources disagree → low confidence

Privacy & security

  • delx-living-body never reads child connector tokens or config files — children read their own credentials independently.
  • Upstream secret env vars (*_CLIENT_SECRET, *_ACCESS_TOKEN, *_REFRESH_TOKEN, *_API_KEY, *_PASSWORD) are stripped before spawning children.
  • Children are spawned with privacy_mode=structured by default. raw is only honored when the caller sets explicit_user_intent: true on living_body_ask.
  • Child responses are not logged verbatim — only counts and summary fields.
  • Per-child call timeout: 30s. A hanging child is marked timeout and skipped.
  • Cache lives at ~/.delx-living-body/cache.sqlite (chmod 600), 5 min TTL. Disable with DELX_LIVING_BODY_NO_CACHE=true.
  • No phone-home from delx-living-body itself.

See SECURITY.md for the full threat model.

Env vars

VariableDefaultPurpose
DELX_LIVING_BODY_DETECT_TTL60Detection cache TTL in seconds
DELX_LIVING_BODY_NO_CACHEunsetDisable SQLite response cache
DELX_LIVING_BODY_CACHE_PATH~/.delx-living-body/cache.sqliteOverride cache path
DELX_LIVING_BODY_NPM_RUNNERnpxOverride npm runner for child spawning
DELX_LIVING_BODY_CHILD_OVERRIDE_<ID>unsetOverride child binary path (testing only)
LIVING_BODY_MCP_HOST / LIVING_BODY_MCP_PORT127.0.0.1 / 3030HTTP transport bind address

CLI

living-body-mcp-server                # MCP stdio server (default)
living-body-mcp-server --http         # Local HTTP transport
living-body-mcp-server doctor         # Detect installed connectors
living-body-mcp-server doctor --json  # JSON output
living-body-mcp-server setup          # Print profile path + install hints
living-body-mcp-server version

Use with Claude Desktop

{
  "mcpServers": {
    "living-body": {
      "command": "npx",
      "args": ["-y", "delx-living-body"]
    }
  }
}

Use with Cursor

{
  "mcpServers": {
    "living-body": { "command": "npx", "args": ["-y", "delx-living-body"] }
  }
}

Not medical advice

Outputs are operational context for training/recovery/sleep/nutrition agents. Not for medical diagnosis or clinical use.

License

MIT — see LICENSE. Built by David Mosiah.

Reviews

No reviews yet

Be the first to review this server!

0

installs

New

no ratings yet

Links

Source CodeDocumentationnpm Package

Details

Published May 29, 2026
Version 0.2.0
0 installs
Local Plugin

More Developer Tools MCP Servers

Fetch

Free

by Modelcontextprotocol · Developer Tools

Web content fetching and conversion for efficient LLM usage

80.0K
Stars
4
Installs
5.3
Security
No ratings yet
Local

Toleno

Free

by Toleno · Developer Tools

Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.

137
Stars
521
Installs
8.0
Security
4.8
Local

mcp-creator-python

Free

by mcp-marketplace · Developer Tools

Create, build, and publish Python MCP servers to PyPI — conversationally.

-
Stars
73
Installs
10.0
Security
4.6
Local

MarkItDown

Free

by Microsoft · Content & Media

Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption

156.1K
Stars
38
Installs
6.0
Security
5.0
Local

FinAgent

Free

by mcp-marketplace · Finance

Free stock data and market news for any MCP-compatible AI assistant.

-
Stars
22
Installs
10.0
Security
No ratings yet
Local

mcp-creator-typescript

Free

by mcp-marketplace · Developer Tools

Scaffold, build, and publish TypeScript MCP servers to npm — conversationally

-
Stars
19
Installs
10.0
Security
5.0
Local