Hevy MCP server
io.github.diecoscai/hevy-mcp·v0.5.0MCP server for the Hevy fitness API — spec-generated schemas, dry-run-safe writes, easy setup.
0 stars85 downloads/wk
Reviews
Write oneNobody has reviewed Hevy MCP yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Hevy MCP tools (23, 8 write)
write = sends, deletes, buys or postsRead from the package source without running it. The installed server may list more.
hevy_create_body_measurementwrite actionCreate one body-measurements record (POST /v1/body_measurements). Required: date (YYYY-MM-DD). All metric fields are optional and nullable: weight_kg, lean_mass_kg, fat_percent, neck_cm, shoulder_cm, chest_cm, left_bicep_cm, right_bicep_cm, left_forearm_cm, right_forearm_cm, abdomen, waist, hips, left_thigh, right_thigh, left_calf, right_calf. If a record already exists for that date, the server r
hevy_create_exercise_templatewrite actionCreate a custom exercise template (POST /v1/exercise_templates). Required: title, exercise_type, muscle_group, equipment_category. exercise_type enum (8): weight_reps, reps_only, bodyweight_reps, bodyweight_assisted_reps, duration, weight_duration, distance_duration, short_distance_weight. muscle_group enum (20): abdominals, shoulders, biceps, triceps, forearms, quadriceps, hamstrings, calves, glu
hevy_create_routinewrite actionCreate a routine (POST /v1/routines). Required: title, exercises[]. Each exercise needs an exercise_template_id — call hevy_list_exercise_templates to find it. Optional folder_id (positive integer) places the routine in a folder (use hevy_list_routine_folders to discover folder ids). Set types: warmup|normal|failure|dropset. rep_range { start, end } is accepted on routine sets (NOT on workout sets
hevy_create_routine_folderwrite actionCreate a routine folder (POST /v1/routine_folders). Takes only `title`. The new folder is inserted at index 0; existing folders shift down by one. There is no update or delete tool for folders — once created, the title is fixed. Dry-run by default: returns { dry_run: true, executed: false, ... } unless HEVY_MCP_ALLOW_WRITES=1 is set on the server process.
hevy_create_workoutwrite actionCreate a workout (POST /v1/workouts). Required: title, start_time (ISO-8601), end_time (ISO-8601), exercises[]. Each exercise needs an exercise_template_id — call hevy_search_exercise_templates to resolve it from a name, or hevy_get_exercise_template if you already know the id. Set types: warmup|normal|failure|dropset. RPE is null or one of 6, 7, 7.5, 8, 8.5, 9, 9.5, 10. Superset ids must be conti
hevy_get_body_measurementFetch one body-measurements record by date (GET /v1/body_measurements/{date}). Returns 404 if no record exists for that date.
hevy_get_exercise_historyList every logged set for the given exercise template (one row per set, includes warmups/dropsets/failures). Two filter modes, combinable: pagination via page (1-indexed) and pageSize (1-10), and date-range filtering via start_date / end_date (ISO-8601 datetimes). Without start_date/end_date, results span all time, newest-first.
hevy_get_exercise_templateFetch one exercise template by id. Accepts both 8-char uppercase hex (built-in) and lowercase UUID (custom).
hevy_get_routineFetch one routine by UUID.
hevy_get_routine_folderFetch one routine folder by its positive integer id.
hevy_get_user_infoReturn the authenticated user (name, id, profile URL). Reads GET /v1/user/info. Requires a Hevy Pro api-key.
hevy_get_workoutFetch one workout by UUID. Returns the full record including exercises and sets.
hevy_get_workout_countReturn { workout_count }: the total number of workouts on the account.
hevy_get_workout_eventsDelta sync feed: events newer than `since` (ISO-8601). Each event is either { type: "updated", workout } or { type: "deleted", id, deleted_at }. To incrementally sync a local cache: on first call pass since=1970-01-01T00:00:00Z, then for each subsequent call pass the timestamp of the newest event you have seen. This is the ONLY way to detect deletions — the Hevy API has no DELETE endpoint, so dele
hevy_list_body_measurementsList body measurements (GET /v1/body_measurements). Envelope: { page, page_count, body_measurements }. pageSize 1-10. Records are keyed by date (YYYY-MM-DD), not by id. No DELETE endpoint exists.
hevy_list_exercise_templatesList exercise templates (built-in + custom). Envelope: { page, page_count, exercise_templates }. pageSize is 1-100 — this is the ONE endpoint with a larger cap; every other list is capped at 10. Built-in ids are 8-char uppercase hex; custom ids are lowercase UUIDs.
hevy_list_routine_foldersList routine folders. pageSize 1-10. Envelope: { page, page_count, routine_folders }. No DELETE endpoint.
hevy_list_routinesList routines. pageSize 1-10 (max enforced by server). Envelope: { page, page_count, routines }. No DELETE endpoint.
hevy_list_workoutsList workouts newest-first, paginated. Use this to discover workout ids; fetch a single full record with hevy_get_workout, or just the count with hevy_get_workout_count. pageSize is 1-10 (Hevy returns 400 for >10). Response envelope: { page, page_count, workouts: [...] }. Empty account returns workouts: []. No DELETE endpoint exists on the Hevy API.
hevy_search_exercise_templatesFind exercise templates by name. Paginates the full catalog (built-in + custom) and returns templates whose title contains the query, case-insensitive. Use this to resolve an exercise_template_id from a human name (e.g. "bench press") before composing a workout or routine. Response: { query, total_matches, exercise_templates: [...], truncated }. total_matches counts every match across the pages sc
hevy_update_body_measurementwrite actionFull replace of the body-measurements record for a date (PUT /v1/body_measurements/{date}). FULL REPLACE — any metric field NOT sent in body_measurement is overwritten to NULL on the server. To "update just one metric": call hevy_get_body_measurement for that date first, modify the metric you want, then send ALL fields back. Dry-run by default: returns { dry_run: true, executed: false, ... } unles
hevy_update_routinewrite actionFull replace of a routine (PUT /v1/routines/{id}). Omitted fields are dropped — to preserve a field, send it back unchanged. Each exercise needs an exercise_template_id (find via hevy_list_exercise_templates). Note: folder_id is NOT accepted on update; the Hevy API rejects it with 400. The routine's folder cannot be changed through this tool. Dry-run by default: returns { dry_run: true, executed:
hevy_update_workoutwrite actionFull replace of a workout (PUT /v1/workouts/{id}). Any field not re-sent is dropped — to preserve a field, send it back unchanged. Each exercise needs an exercise_template_id (find via hevy_list_exercise_templates or hevy_get_exercise_template). Dry-run by default: returns { dry_run: true, executed: false, ... } unless HEVY_MCP_ALLOW_WRITES=1 is set on the server process. No DELETE endpoint exists
Public scan report
scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it
- Code scan121 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 20 days ago15/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
How Hevy MCP compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 92/100
- higher than 95% of 48,255 servers
- Tools
- 23
- the typical server has 7
- Tools that change things
- 35%
- typical: 0%. Fewer write tools means less an agent can break
- Downloads a week
- 85
- more than 59% of 12,191 servers with a package
What its tools let an agent do: 15 read · 8 change
Install Hevy MCP in Claude Code, Cursor or VS Code
Runs npx -y @diecoscai/hevy-mcp on your machine. Read the scan report first; the gateway never runs local packages.
claude mcp add hevy-mcp -- npx -y @diecoscai/hevy-mcp
What the publisher says
From the Hevy MCP repository's README, as published. We do not edit it. Read it on GitHub
@diecoscai/hevy-mcp
Model Context Protocol server for the Hevy fitness API. Manage workouts, routines, exercises, and body measurements from any MCP-compatible client — Claude Desktop, Claude Code, Cursor, VS Code, and anything else that speaks MCP over stdio.
Overview
This MCP server exposes the public Hevy API (api.hevyapp.com/v1) as 22 strongly-typed tools. LLM agents can list workouts, create routines, look up exercise templates, track body measurements, and follow a delta-sync feed — all without bespoke glue code on the client.
Design goals:
- Safe by default. Write operations return a { dryrun: true, wouldsend: { ... } } preview unless HEVYMCPALLOW_WRITES=1 is set. The Hevy API has no DELETE on any resource, so accidental writes are permanent; dry-run is the brake.
- Validated at the edge. Every tool input is checked with Zod before a single byte crosses the network. Oversized titles, unknown fields, out-of-range page sizes, and invalid enums fail fast with SEP-1303-shaped errors the model can self-correct.
- Zero extra setup. Authentication is a single environment variable — HEVYAPIKEY. No wizards, no config files; just paste the snippet for your client.
Schemas are generated from Hevy's own OpenAPI spec and re-synced automatically, so the server adapts to upstream changes instead of drifting. Writes are dry-run by default; every public endpoint is covered.
Project status
Maintenance mode. Feature-complete for Hevy's public API. Schemas are generated from Hevy's OpenAPI spec; a scheduled workflow re-syncs them weekly and opens a PR on any change, and a live integration run catches undocumented server changes. Bug reports and PRs welcome via the issue tracker.
Prerequisites
- Node.js 20 or later (node --version).
- A Hevy Pro subscription — the public API is a Pro feature.
- A Hevy API key from .
Quick setup
The fastest path is the setup subcommand — it validates your key and writes a config file the server picks up automatically:
npx @diecoscai/hevy-mcp setupIt prompts for your Hevy Pro API key (from ), checks it against the live API, asks whether to enable write operations, and saves everything to ~/.config/hevy-mcp/config.json (mode 0600). Then add the server to your MCP client with no env block needed:
{
"mcpServers": {
"hevy": {
"command": "npx",
"args": ["-y", "@diecoscai/hevy-mcp"]
}
}
}Restart the client — the 22 Hevy tools appear in the tools panel.
Prefer environment variables? Skip setup and pass HEVYAPIKEY (and optionally HEVYMCPALLOW_WRITES=1) in the env block instead — see Configuration. Env vars always take precedence over the config file.
Note on bare invocation. Running npx @diecoscai/hevy-mcp with no arguments starts a stdio MCP server and blocks, waiting for an MCP client to connect over its stdin/stdout. You don't run it in a terminal yourself — your MCP client spawns it. Use npx @diecoscai/hevy-mcp --help, --version, or setup for a non-blocking invocation.
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Hevy MCP: common questions
- Is Hevy MCP server safe?
- Yes, by our scan: it is graded A (92/100). Read the Hevy MCP safety report
- How do I install Hevy MCP?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Hevy MCP need an API key?
- Not as far as the registry entry and our scan can tell: no credentials are declared or required.
- Is Hevy MCP maintained?
- The last commit was 58 days ago (2026-09-07). The latest release is v0.5.0.
- How does Hevy MCP compare with other MCP servers?
- safety score 92/100 (higher than 95% of 48,255 servers); tools 23 (the typical server has 7); tools that change things 35% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.