{"name":"io.github.Zsadigzade/trainbud","slug":"zsadigzade-trainbud","title":"TrainBud","description":"Talk to your own fitness data. Findings computed in code against your own 28-day baselines.","url":"https://mcp.market/server/zsadigzade-trainbud","rating":null,"grade":"C","score":65,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":29,"stars":0,"forks":0,"downloads_week":140,"last_push_at":"2026-09-18T14:05:54.000Z","license":"MIT"},"claimed":false,"transport":"mixed","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/Zsadigzade/trainbud","website":"https://github.com/Zsadigzade/trainbud#readme","version":"0.9.0","remotes":[],"packages":[{"registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","identifier":"trainbud","version":"0.9.0","transport":{"type":"stdio"},"packageArguments":[{"value":"start","type":"positional"}],"environmentVariables":[{"description":"The email address for your Connect account. Stored only in your local .env; `npx trainbud setup` writes it for you.","isRequired":true,"name":"GARMIN_EMAIL"},{"description":"Your Connect password. Stored only in your local .env. Accounts with MFA enabled are not supported, because the unofficial library this drives cannot complete that flow.","isRequired":true,"isSecret":true,"name":"GARMIN_PASSWORD"},{"description":"Optional, and only for the watch app's Ask card and daily insight. The MCP tools themselves need no model key: every finding is computed in code, and the model only phrases it.","isSecret":true,"name":"ANTHROPIC_API_KEY"}]},{"registryType":"oci","identifier":"ghcr.io/zsadigzade/trainbud:0.9.0","transport":{"type":"stdio"},"environmentVariables":[{"description":"The email address for your Connect account.","isRequired":true,"name":"GARMIN_EMAIL"},{"description":"Your Connect password.","isRequired":true,"isSecret":true,"name":"GARMIN_PASSWORD"}]}],"tools":[],"scan":{"score":65,"grade":"C","scanned_at":"2026-09-19T04:45:49.089Z","report":{"scannerVersion":"0.1.3","scannedAt":"2026-09-19T04:45:49.021Z","components":{"code":{"score":13,"max":25,"notes":["159 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":15,"max":15,"notes":["last push 1 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[{"id":"exec.shell-concat","severity":"high","component":"code","title":"Shell command built from a string (injection risk)","evidence":"dist/history/store.js: …ame === column)) { database.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`); } } } functio…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"trainbud","version":"0.9.0","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":10,"publishedAt":"2026-09-18T14:08:39.740Z","repositoryUrl":"git+https://github.com/Zsadigzade/trainbud.git","weeklyDownloads":140}],"repo":{"found":true,"owner":"Zsadigzade","repo":"trainbud","archived":false,"pushedAt":"2026-09-18T14:05:54Z","stars":0,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/86562691?v=4","ownerCreatedAt":"2021-06-27T14:45:46Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/86562691?v=4&s=128","source":"github"},"presence":{"stars":0,"forks":0,"downloadsWeek":140,"license":"MIT","lastPushAt":"2026-09-18T14:05:54.000Z","score":29}}}},"grade_history":[],"reviews":[]}