MCP integration

1. Endpoint

https://bioops.app/api/public/mcp

2. OAuth discovery

RFC 8414 metadata document:

GET /.well-known/oauth-authorization-server

The MCP endpoint also returns WWW-Authenticate: Bearer with a pointer to discovery when called without a token, so most clients negotiate automatically.

3. Tools exposed

• list_data_sources

  List connected health data sources and their current sync status.

  read:sleep read:workouts read:nutrition read:body read:vitals read:fitness

• get_recent_metrics

  Get final daily values and rolling baselines for a specific metric, such as VO2 max or body mass.

  read:sleep read:workouts read:nutrition read:body read:vitals read:fitness

• get_metric_timeseries

  Get final daily or hourly metric values for one or more supported metric types, with optional rolling baselines.

  read:sleep read:workouts read:nutrition read:body read:vitals read:fitness

• get_daily_summary

  Get a complete daily metrics view with preferred values, source candidates, hourly coverage, rolling baselines, z-scores, and data gaps.

  read:sleep read:workouts read:nutrition read:body read:vitals read:fitness

• list_supported_metrics

  List exact metric_type identifiers and common aliases supported by get_recent_metrics, filtered by granted scopes.

  read:sleep read:workouts read:nutrition read:body read:vitals read:fitness

• get_nutrition_summary

  Get final daily nutrition values and rolling baselines for calories, carbs, fat, protein, sodium, and related dietary metrics.

  read:nutrition

• get_sleep_summary

  Get nightly sleep summaries by local sleep date, including bedtime, wake time, stages, gap rollups, and sleep metric rolling baselines.

  read:sleep

• get_daily_timeline

  Get final timeline events for a local day, including canonical sleep, measurements, and workouts filtered by granted scopes.

  read:sleep read:workouts read:nutrition read:body read:vitals read:fitness

• get_workout_details

  Get final constructed workout event details for a local date range, including duration, distance, energy, heart rate, source, and candidate details.

  read:workouts

4. Create a scoped client

Sign in to BioOps, open the dashboard, and use the MCP Server panel to create an OAuth client. Choose only the coverage the agent should read: sleep, workouts, nutrition, body, vitals, or fitness. BioOps shows the OAuth client secret once during setup and stores only a hash.

You can revoke a client from the same dashboard panel. Revocation blocks new OAuth exchanges and also revokes active access tokens for that client.

Dashboard-created clients are confidential OAuth clients and use client_secret_post. Dynamic client registration is available for public PKCE clients that use token_endpoint_auth_method: "none".

5. Client config

{
  "mcpServers": {
    "bioops": {
      "url": "https://bioops.app/api/public/mcp",
      "oauth": {
        "client_id": "bio_...",
        "client_secret": "bio_mcp_cs_...",
        "scope": "read:sleep read:workouts read:nutrition",
        "token_endpoint_auth_method": "client_secret_post"
      }
    }
  }
}

The dashboard generates this config with your real client ID, one-time secret, and selected scope list. On first use, Claude opens the BioOps consent screen in your browser. After you approve, the MCP server gets a scoped, revocable bearer token tied to your account.