This one is not my idea. It came out of my conversation with Sebastian Loch, who runs business development at fatsecret (apis.io). I asked him what part of the vibe-coding shift he thought was understated, expecting to hear something about app stores. Instead he said this:
“It is not just people vibe coding an app and putting it on the App Store or Google Play. People can now build and host their own application.”
And then he named one:
“There is a project on GitHub called Sparky Fitness where anyone can host their own nutrition app by downloading the repository and running it locally, and there are tens of thousands of people doing it.”
I went and looked. SparkyFitness (apis.io) is a self-hosted nutrition, exercise, sleep, hydration, and body-measurement tracker — the thing you run yourself instead of renting MyFitnessPal. 5,653 stars, 5,400 commits, Docker Compose, native mobile apps, OIDC and passkeys, an MCP server, bring-your-own-LLM. Source-available and non-commercial rather than open source, which is a distinction worth keeping straight.
Sebastian’s point was not that this is cute. It is that it is a market:
“You do not rely on a mobile app provider, you do not rely on the App Store or Google Play, and you can enhance it — track whatever you want and tap into verified sources such as us… It is mind-blowing to see, and it is the part of the whole vibe-coding shift that hardly anyone talks about.”
He is describing a business model, and fatsecret is already inside it. Their Platform API signups went “almost 100x.” They built “a self-serve checkout where people come to the API, use a Stripe subscription, get their own keys, and get started — no email, no contacting anyone, fully self-managed.” The app got commoditized and the verified data underneath it got more valuable. That is the whole thesis in one company.
So I did the work. I profiled the eight companies in SparkyFitness’s integration list that were missing from the catalog, re-profiled one that was in it badly, and scored all nine.
The seed is not the code, it is the integration surface
Subtract the CRUD from SparkyFitness and what is left is the integration surface. Here is the whole of it, exactly as the project’s own README groups it:
Health & device — Apple Health (iOS), Google Health Connect (Android), Google Health API, Fitbit, Garmin Connect, Withings, Polar Flow, Oura, Hevy, Strava (partially tested), Norish.
Nutrition & food databases — OpenFoodFacts, USDA, Fatsecret, Nutritionix, Swiss Food Database.
Exercise & recipe sources — Free Exercise DB (GitHub), Wger, Mealie, Tandoor.
Third-party services — Yazio (uses an unofficial API).
Twenty providers behind one tracker. That list is the hard-won part. An LLM will write you the tracker in an afternoon. It will not tell you which of those twenty has a real contract, which lets a user delegate consent, and which will still be there in two years.
Seven of those twenty were absent from my catalog entirely — Hevy, Norish, the Swiss Food Database, Free Exercise DB, Mealie, Tandoor and Yazio — and an eighth, wger, was in the catalog on an incomplete read. I profiled those eight plus SparkyFitness itself: nine repos through the full enrichment pipeline, 185 artifacts, nine for nine, no failures, scored today against rubric 0.15.1.
| Provider | Kin Score | Band | Agent Readiness | Health Regime |
|---|---|---|---|---|
| Tandoor Recipes | 62.0 | Strong | 27.6 agent-aware | 57.4 |
| wger | 57.7 | Strong | 36.2 agent-ready | 55.0 |
| Hevy | 51.6 | Developing | 30.4 agent-ready | 31.3 |
| Swiss Food Composition Database | 47.4 | Developing | 25.0 agent-aware | 57.4 |
| SparkyFitness | 42.7 | Developing | 33.7 agent-ready | 26.3 |
| Mealie | 42.5 | Developing | 35.1 agent-ready | — |
| Norish | 26.9 | Thin | 15.3 agent-aware | — |
| Free Exercise DB | 26.4 | Thin | 9.7 agent-aware | 18.8 |
| YAZIO | 13.3 | Emerging | 6.0 agent-aware | 17.5 |
Put together with the sixteen commercial health, device, and nutrition providers already in the catalog, the full stack is twenty-five providers, mean composite 44.6, median 43.5 — the middle of the Developing band. One Exemplar in twenty-five, and that is Fitbit at 67.6.
The two providers shipping real MCP servers are the self-hosted ones
Across all twenty-five providers, exactly two ship a first-party Model Context Protocol server that a person can actually run. I counted these by hand against each project’s own deployment rather than off the score, because a provider can hold an MCP artifact that says, in its own words, that no server exists:
- SparkyFitness — in-process inside the main API server, StreamableHTTP at
POST /mcp, built on@modelcontextprotocol/sdk(confirmed in their server’s ownpackage.json). Every deployment serves its own endpoint on the operator’s host. - wger — a separate first-party server in the
wger-projectorg, published to PyPI aswger-mcp0.2.0 and shipped as a container image.
Both are self-hosted open-source projects. Fitbit, Garmin, Withings, Polar, Oura, Whoop, Strava and Nutritionix ship none between them. The seed is more agent-ready than the platforms it consumes, and that is not a fluke — it is what happens when the person building the thing is also the person who wants to point an agent at it.
What is left when you take the code away
The rest of the agent surface across all twenty-five is thin in a way that matters more than the composites. Seven of twenty-five offer delegated user identity — the rest hand you a static bearer token, for health data. Zero publish an A2A agent card, a /.well-known/api-catalog, protected-resource metadata, or dynamic client registration. Not one company in this stack can be onboarded by an agent without a human filling in a portal form.
Which brings it back to where Sebastian started. The application layer is being commoditized by the models — he watched it happen to his own category and his company got more valuable, not less, because what people needed from fatsecret was never the app. It was the verified data and a way to get at it without talking to a salesperson. Their Access Clarity score is 84.2, tied for the highest in this stack, and the catalog independently reads their access model as freemium, self-serve, try-it-now at high confidence. The self-serve checkout he described in conversation is legible in the artifacts.
That is the business model. Ship a domain-shaped seed people run themselves. Do not sell the code — the code is free now. Sell the thing the code has to connect to, the knowledge of which connections are worth making, and the work of keeping them alive when a provider deprecates, re-tiers, or quietly breaks the contract you built against.
Pick a sector, decompose it into capabilities, score the candidates, publish the stack as the seed’s bill of materials, and re-score on a cadence. Health is just where this example happened to land because a nutrition-data guy told me where to look.
Give the whole conversation a listen — API Evangelist Conversation with Sebastian Loch, also on YouTube.
