A Remote MCP Server vs a File on Your Mac: What "Your Data Never Leaves Your Device" Actually Means
It is the most repeated sentence in health AI and the least defined. It is not a vibe and it is not a badge. It is a statement about a data path, and a data path is something you can look at. Here is the real difference between a hosted health connector and one that reads a file on your own machine.
AI-assisted, human reviewed. How we use AI
Quick answer
A remote MCP server runs on infrastructure you do not own, and your agent reaches it over HTTPS with a token, so the health data it answers from sits on that machine. A local MCP server runs as a process on your own computer and reads a file there over stdio, so there is no server of theirs in the path at all. Same protocol, different place the bytes live. "Your data never leaves your device" is only true in the second shape, and the way to tell which one you are looking at is to read the config entry: a command means local, a URL means remote.
Why this is a data-path question, not a promise question
Every health connector makes the same promise in slightly different words: private, secure, yours. Promises are not comparable, because they are all written by the party you would have to trust. The data path is comparable, because it is a fact about where a request goes and where an answer comes from.
So drop the adjectives and ask one question instead: when my agent asks "how did I sleep last week", which machine reads the numbers? If the answer is "your laptop", you can check it yourself. If the answer is "a server we run", then the privacy claim is a policy, and policies can change with a changelog entry you did not read.
Two shapes of health connector
MCP is one protocol with more than one transport, and the transport is what decides the architecture.
- Remote, over Streamable HTTP. The connector is a service. You get a URL and a token, your agent calls that URL, and the service reads your health data from wherever it stored it. It works from a phone, it works when your laptop is shut, and you never install anything. The cost is structural: the data it answers from is on someone else's disk, and a copy that exists on someone else's disk is a copy you do not control.
- Local, over stdio. The connector is a program that your MCP client starts as a child process and talks to over standard input and output. It reads a file on your machine. Nothing is hosted, there is no URL, and there is no account in the middle. Your computer has to be on, and you carry the setup.
That is the whole trade. Remote buys convenience with custody. Local keeps custody and pays in setup. Neither is dishonest, but only one of them makes "it never leaves your device" literally true, and you should know which you picked.
The one-line test. Open the connector's config block. If it has "command" and reads a folder you choose, it is local. If it has "url" and a token, it is remote. That single detail tells you more than the privacy page does, because it is the architecture talking.
Four questions to ask any hosted connector
If you are weighing a hosted option, these are answerable in writing, and vague answers are themselves an answer:
- Where is the data stored? A remote server has to hold the data somewhere to answer from it. Ask where, and in which region.
- How long is it kept, and what deletes it? Retention is a number. "As long as needed" is not a number.
- Who can read it? You, or you and the operator, and under what policy. Encryption at rest does not change who holds the key.
- What happens if the service closes? If the account is the data path, the data path ends with the account. A file on your disk does not have this failure mode.
None of this makes hosted services bad. It makes them a different deal, and one you should sign knowingly rather than by reading a green padlock and a "zero knowledge" line.
What we can actually verify about ours
We run the local shape, so the claim is checkable rather than asserted. On 4 November 2026 we scanned the shipped server, version 1.10.2: 22 tools, 20 read-only, 194 metrics, zero dependencies, and no HTTP client anywhere in the read path. The only socket in the entire repository is an optional inbound LAN receiver, and you have to start it yourself.
You do not have to take our word for that either. The server is MIT and on GitHub: clone it, run one grep for a network call, and see nothing. Then add the config block, point HEALTH_DATA_DIR at your export folder, and watch that the process only ever touches that folder. That is what a falsifiable privacy claim looks like, and it is why we shipped it as open source instead of a dashboard.
Stated exactly, because "private" is a word people overreach with: your health data never reaches us or a cloud AI. The MCP server makes zero network calls, so an export goes only where you point it. The iOS app reports install, trial-start and purchase events to Meta for ad attribution, never health data, and only if you allow tracking when iOS asks. And once you export, the file travels wherever you send it, because a file you own is a file you can move.
The honest cost of local
Local is not free, and pretending otherwise is how you end up with a post nobody trusts. You install the app and set the export. You keep a computer that can run Node available when you want to ask. If your export is on iCloud Drive, your data is on Apple's servers too, which is a path you chose and can point elsewhere. It is minutes of setup and a small amount of maintenance, and the maintenance is mostly "is the export still running".
Where remote genuinely wins
Be honest about this one too. If you ask your agent from a phone, or from a work laptop that will never hold your health export, a remote connector is the only thing that works. If you want zero setup and you trust the operator and their retention policy, that is a legitimate call. The mistake is not choosing remote. The mistake is choosing remote while believing you chose local, because the marketing said "private" and you never read which shape you installed.
And a boundary that applies to every shape, local or remote: none of this is a medical device. A connector reads your own data and describes it against your own baseline. It does not detect, treat or monitor a condition, and it should not be asked to.
FAQ
What is the difference between a remote MCP server and a local one?
A remote MCP server runs on infrastructure you do not own and your agent reaches it over HTTPS with a token, so the health data lives on that machine. A local MCP server runs as a process on your own computer and reads a file there over stdio, so there is no server of theirs in the data path at all. Same protocol, different place the bytes live.
Does a hosted health connector always store my data?
If the connector is remote, yes: by definition the data it answers from is on a machine someone else runs, because your agent's question reaches that machine over the network. How long they keep it and whether they can read it are policy decisions. A local server does not have that question, because the answer never leaves the machine.
How can I tell whether a health connector is local or remote?
Read its config entry. A local server has a command that runs on your machine, often npx or node, and reads a folder you point it at. A remote one has a URL instead of a command, and a token, and it keeps working when your laptop is closed. That one detail, command versus URL, tells you where your data goes.
Is a local MCP server harder to set up?
Slightly. You install the app, set an export destination, and add one config block to your MCP client. It is minutes, not seconds, and it is on your machine. A remote connector is quicker to start because someone else already runs the server, which is exactly the trade: convenience against where the data sits.
Keep the data path on your own machine
Export all 194 metrics on the iPhone, then let Claude, Cursor or any MCP client read them locally over stdio. No URL, no token, no server of ours in the middle.
Where it goes: the app reads Apple Health read-only and writes JSON to a folder you pick. Your health data never reaches us or a cloud AI; the MCP server makes zero network calls. What you get: all 194 metrics, on-device Ask with a provenance card on every answer, the Weekly Brief, and the Mac and Apple Watch apps. Price: $24.99 one time after a 7-day free trial, not a subscription. Wellness, not medical advice.