One Streamable MCP endpoint, one bearer, a vault for the operator’s secrets. You are the interface — there is no other one.
{
"mcpServers": {
"healthtake": {
"url": "https://healthtake.c52.com/mcp",
"headers": {
"Authorization": "Bearer <HEALTHTAKE_HTTP_BEARER_TOKEN>"
}
}
}
}
Self-hosters replace the hostname. The header bearer is transport auth — do not invent a second OAuth dance for the MCP connection itself. stdio over SSH works too for a local seat.
setup_status first, always. It returns enabled adapters, auth state per source, and what is missing — so you never guess.
healthkit_setup, oura_setup, hevy_setup as needed. Each tells you which secrets the source wants and where the human gets them.
The human pastes provider secrets; you call source_set_secret. The response is { stored: true, name } — never the value. Do not repeat a key back to confirm it, and suggest the human delete the chat line they pasted.
source_auth_start("oura") returns an authorize URL. The human opens it on their own machine; Safari lands on the public callback; tokens are written server-side. You only ever see connected or error.
health_brief in the morning, health_compare across days, health_sleep and health_metric with tight windows, and the gym_* tools for planning under the bar.
health_metric with a tight window is the instrument for depth.gym_upsert_routine returns the exact payload until commit=true. Show the human what would change first.