FitnessPeak vs self-hosting a WHOOP MCP server
There are good open-source WHOOP MCP servers. They are free. Here is exactly what you take on by running one, and exactly what you give up by not.
The short version. Self-hosting is free and private. Hosting is instant and stays working. If you'd enjoy the setup, self-host — genuinely. If you want to ask your assistant a question tonight, that's what $39 a year buys.
| Self-hosted open-source MCP | FitnessPeak | |
|---|---|---|
| Time to first answer | 30–60 minutes | ~2 minutes |
| WHOOP developer app required | Yes | No |
| Client secret in a local file | Yes | No |
| Node/Python runtime needed | Yes | No |
| Works with your laptop closed | No | Yes |
| Works from a phone assistant | No | Yes |
| Works in mobile and browser clients | No | Yes |
| Refresh-token rotation handled | Varies by project | Yes |
| Told when the connection breaks | No | Yes |
| Survives WHOOP API v2-style changes | You update it | Yes |
| Multiple clients share one connection | Copy config to each | Yes |
| Tokens never leave your hardware | Yes | No |
| Modify the tool code | Yes | No |
| Cost | Free | $39/year |
What self-hosting actually involves
Not a strawman — this is the real sequence, and it's the same for every open-source WHOOP MCP server we've looked at.
1. Register a WHOOP developer app
Sign in to WHOOP's developer dashboard, create an app, choose scopes, and register a redirect URI. Get the redirect URI wrong by one character and the OAuth exchange fails with an error that doesn't say which character.
2. Run the OAuth flow on your own machine
npm install && npm run build
node dist/cli.js auth # opens a browser, listens on localhost:8788This writes tokens to ~/.whoop-mcp/credentials.json. Now those tokens exist on that machine and nowhere else.
3. Wire it into every client separately
Each MCP client needs an absolute path to the built CLI. Move the folder, upgrade Node, or switch laptops and every client breaks at once.
4. Keep it alive
A stdio MCP server is spawned by the client and dies with it. Nothing runs when the laptop sleeps, which rules out scheduled agents and anything on your phone.
5. Maintain it
WHOOP's v1 → v2 migration changed sleep and workout IDs from integers to UUIDs and deprecated sport_id in favour of sport_name. Every self-hoster had to notice and update. Anyone hosted had nothing to do.
What you give up by hosting
We'd rather say this plainly than have you discover it later.
Your tokens sit on our servers
They're encrypted at rest with AES-256-GCM and never returned to a model or a client — but they are on infrastructure you don't control. Self-hosting is the only way to avoid that, and if it's your requirement it's the right answer. Read exactly how we store them.
You can't change the tools
Want a custom aggregation, a different date-bucketing rule, or a sixth WHOOP endpoint? Self-hosting means editing a file. Here it means emailing us and waiting.
It costs money
$39 a year against free. If your time is genuinely free and you enjoy this kind of setup, the maths favours self-hosting.
You depend on us existing
If FitnessPeak shuts down, your connection stops. Your data is unaffected — it lives at WHOOP — but you'd be back to self-hosting. Worth weighing.
What the money buys
01No WHOOP developer account
Self-hosting means registering your own app on WHOOP's developer dashboard, naming a redirect URI, and copying a client secret into a config file. With FitnessPeak you click Connect WHOOP, approve, done.
02Nothing to keep running
A stdio MCP server only exists while your laptop is awake and the client that spawned it is open. Ours answers over HTTPS from a server that stays up — so the same key works from your phone's assistant, your work laptop, and a scheduled agent at 6am.
03Token refresh is our problem
WHOOP access tokens last about an hour and the refresh token rotates on every use. Get that wrong once and the connection silently dies. We serialise refreshes per account and tell you by email if one ever fails for good.
04Works in clients that can't spawn processes
Mobile assistants, browser-based clients and scheduled agents cannot launch a local binary. A hosted HTTPS endpoint is the only thing they can talk to at all.
05Updates without a git pull
WHOOP moved from API v1 to v2 and changed sleep and workout IDs from integers to UUIDs. Self-hosters had to notice, read the changelog, and update. Hosted users had nothing to do.
Which one are you?
Self-host if…
- Your health tokens must stay on your own hardware
- You want to modify or extend the tools
- You only ever use one desktop MCP client
- Running a small service is something you enjoy
Search GitHub for “whoop mcp” — there are several, and they're MIT-licensed.
Use FitnessPeak if…
- You want it working in the next five minutes
- You use a phone assistant, or more than one client
- You'd rather not own a token-refresh bug
- $39 a year is cheaper than an evening of your time
Is self-hosting a WHOOP MCP server actually hard?
So why would I ever self-host?
Can I move from self-hosted to FitnessPeak?
Do you contribute back to the open-source servers?
Try hosted for seven days
14-day free trial. Card required so there's no second signup at the end; cancel before day 14 and you're charged nothing.