MCP.Market

Strava MCP server

by davidmosiah·io.github.davidmosiah/strava-mcp·v0.4.6·3 stars
No reviews yet

Privacy-first MCP server for Strava activities, streams, routes and training.

B83/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B83/100

full report

Adoption
Growing

3 stars418 downloads/wk

Reviews

Write one

Nobody has reviewed Strava yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Strava tools (21, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • strava_agent_manifest

    Machine-readable install, runtime and client guidance for AI agents. Includes Hermes direct tool names and anti-gateway-restart guidance. Does not call Strava or expose secrets.

  • strava_cache_status

    Show optional local SQLite cache status. Enable with STRAVA_CACHE=sqlite or STRAVA_CACHE=true.

  • strava_capabilities

    Explain supported Strava data, privacy boundaries, GPS handling, recommended agent workflow and project links. Does not call Strava or expose secrets.

  • strava_connection_status

    Check local Strava config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Strava or exposing secrets.

  • strava_daily_summary

    Build a practical daily training/load summary from recent Strava activities. Read-only and non-medical.

  • strava_data_inventory

    Inventory supported Strava data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call Strava APIs or expose user data.

  • strava_demo

    Returns realistic example payloads of strava_daily_summary, strava_training_context, and strava_list_activities so agents see the contract before calling real Strava APIs.

  • strava_exchange_code

    Exchange a Strava OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned.

  • strava_get_activity_streams

    Get Strava activity streams such as time, distance, heartrate, cadence, watts and altitude. GPS latlng is withheld unless include_gps=true or privacy_mode=raw.

  • strava_get_athlete

    Get the authenticated Strava athlete profile. Requires read/profile scope depending on requested fields.

  • strava_get_athlete_stats

    Get public-visible aggregate Strava stats for the authenticated athlete.

  • strava_get_auth_url

    Generate a Strava OAuth authorization URL. Use this first when no local token exists.

  • strava_get_zones

    Get the authenticated athlete heart-rate and power zones when available.

  • strava_onboarding

    Read-only. Return the 11-question Delx Wellness onboarding flow (en or pt-BR), the current shared profile, missing critical fields, and a cross-connector hint. Use this when the user starts a fresh wellness session and you need to fill out preferred_name, goals, devices, training context, nutrition, preferences, and safety. Strava continues to redact GPS by default — onboarding does not change tha

  • strava_privacy_audit

    Return local privacy, cache, token-path, GPS redaction and env-presence posture without revealing secret values.

  • strava_profile_get

    Read the canonical Delx Wellness profile shared with the other wellness MCP connectors (Nourish, Cycle Coach, CGM, etc.). Read-only. Profile stores only what the user typed during onboarding — never OAuth tokens, API keys, or biomarkers. Note: this profile does NOT change Strava's GPS-redaction default; Strava continues to redact latlng and route geometry unless STRAVA_GPS_INCLUDE=true or include_

  • strava_profile_updatewrite action

    Persist a partial patch to the canonical Delx Wellness profile. Requires explicit_user_intent=true after the user confirms they want to save. Rejects secret-like fields (oauth, token, api_key, password, cookie, refresh, session). Strava's GPS-redaction default is unaffected by profile changes.

  • strava_quickstart

    Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Strava?'

  • strava_revoke_access

    Revoke the current Strava OAuth access grant and delete the local token file. Use only when the user explicitly wants to disconnect Strava.

  • strava_training_context

    Normalize recent Strava activity load into a compact training_context for workout recommendation engines. Includes fallback guidance when recent Strava activity is missing.

  • strava_weekly_summary

    Build a weekly Strava scorecard with volume, intensity, sport mix, bottlenecks and next-week actions. Read-only and non-medical.

Public scan report

scanner v0.1.10 · 2026-11-10 · same rubric, same numbers if you re-run it

no findings
  • Code scan58 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 5 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Strava compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
83/100
higher than 65% of 48,114 servers
Tools
21
the typical server has 7
Tools that change things
5%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
3
more than 80% of 28,851 servers
Downloads a week
418
more than 86% of 15,093 servers with a package

What its tools let an agent do: 20 read · 1 change

Install Strava in Claude Code, Cursor or VS Code

Runs npx -y strava-mcp-unofficial on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add strava-mcp -- npx -y strava-mcp-unofficial
Add to Cursor

What the publisher says

From the Strava repository's README, as published. We do not edit it. Read it on GitHub

<!-- delx-wellness header v2 --> Strava MCP

Give your AI agent your Strava activities, streams, segments and routes &mdash; locally. Local-first MCP server &mdash; tokens never leave your machine.

⚡ One-command install with Delx Wellness for Hermes:

npx -y delx-wellness-hermes setup &mdash; preconfigures this connector and the other 8 in a dedicated Hermes profile.

Or wire it standalone into Claude Desktop / Cursor / ChatGPT Desktop &mdash; see the install section below.

HTTP (v2 stateless)

Default is stdio. Optional Streamable HTTP — no session id, JSON responses, loopback only:

npx -y strava-mcp-unofficial --http
# GET  http://127.0.0.1:3000/health
# POST http://127.0.0.1:3000/mcp   (sessionless)

Env: STRAVAMCPHOST, STRAVAMCPPORT, STRAVAMCPTRANSPORT=http.

<!-- /delx-wellness header v2 -->

Local-first MCP server that connects AI agents to your Strava activities, routes, streams and training context.

Unofficial project. Not affiliated with, endorsed by or supported by Strava, Inc. Strava is a trademark of its respective owner. Use this only with your own Strava account and in line with Strava's API agreement.

Built by David Mosiah for people who use Claude, Cursor, Hermes, OpenClaw or other MCP-compatible agents to think about training, endurance and performance — without copy-pasting numbers from Strava.

Part of Delx Wellness, a registry of local-first wellness MCP connectors.

If this connector helps your agent workflow, please star the repo. Stars make the project easier for other AI builders to discover and help Delx keep shipping local-first wellness infrastructure.

Why this exists

Strava holds the long memory of your training — every ride, run, swim, segment, route and stream. But it lives behind an OAuth API with strict rate limits (200 req/15min, 2k/day per app) and GPS data that's privacy-sensitive by default.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Strava: common questions

Is Strava MCP server safe?
Mostly: it is graded B (83/100). Read the Strava safety report
How do I install Strava?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Strava need an API key?
Yes. The registry entry asks for STRAVA_CLIENT_SECRET.
Is Strava maintained?
The last commit was 10 days ago (2026-11-05). The latest release is v0.4.6.
How does Strava compare with other MCP servers?
safety score 83/100 (higher than 65% of 48,114 servers); tools 21 (the typical server has 7); tools that change things 5% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

More from davidmosiah →