MCP.Market

Hevy MCP server

by diecoscai·io.github.diecoscai/hevy-mcp·v0.5.0

MCP server for the Hevy fitness API — spec-generated schemas, dry-run-safe writes, easy setup.

A92/100grade A
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
Growing

0 stars85 downloads/wk

Reviews

Write one

Nobody has reviewed Hevy MCP yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Hevy MCP tools (23, 8 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • hevy_create_body_measurementwrite action

    Create one body-measurements record (POST /v1/body_measurements). Required: date (YYYY-MM-DD). All metric fields are optional and nullable: weight_kg, lean_mass_kg, fat_percent, neck_cm, shoulder_cm, chest_cm, left_bicep_cm, right_bicep_cm, left_forearm_cm, right_forearm_cm, abdomen, waist, hips, left_thigh, right_thigh, left_calf, right_calf. If a record already exists for that date, the server r

  • hevy_create_exercise_templatewrite action

    Create a custom exercise template (POST /v1/exercise_templates). Required: title, exercise_type, muscle_group, equipment_category. exercise_type enum (8): weight_reps, reps_only, bodyweight_reps, bodyweight_assisted_reps, duration, weight_duration, distance_duration, short_distance_weight. muscle_group enum (20): abdominals, shoulders, biceps, triceps, forearms, quadriceps, hamstrings, calves, glu

  • hevy_create_routinewrite action

    Create a routine (POST /v1/routines). Required: title, exercises[]. Each exercise needs an exercise_template_id — call hevy_list_exercise_templates to find it. Optional folder_id (positive integer) places the routine in a folder (use hevy_list_routine_folders to discover folder ids). Set types: warmup|normal|failure|dropset. rep_range { start, end } is accepted on routine sets (NOT on workout sets

  • hevy_create_routine_folderwrite action

    Create a routine folder (POST /v1/routine_folders). Takes only `title`. The new folder is inserted at index 0; existing folders shift down by one. There is no update or delete tool for folders — once created, the title is fixed. Dry-run by default: returns { dry_run: true, executed: false, ... } unless HEVY_MCP_ALLOW_WRITES=1 is set on the server process.

  • hevy_create_workoutwrite action

    Create a workout (POST /v1/workouts). Required: title, start_time (ISO-8601), end_time (ISO-8601), exercises[]. Each exercise needs an exercise_template_id — call hevy_search_exercise_templates to resolve it from a name, or hevy_get_exercise_template if you already know the id. Set types: warmup|normal|failure|dropset. RPE is null or one of 6, 7, 7.5, 8, 8.5, 9, 9.5, 10. Superset ids must be conti

  • hevy_get_body_measurement

    Fetch one body-measurements record by date (GET /v1/body_measurements/{date}). Returns 404 if no record exists for that date.

  • hevy_get_exercise_history

    List every logged set for the given exercise template (one row per set, includes warmups/dropsets/failures). Two filter modes, combinable: pagination via page (1-indexed) and pageSize (1-10), and date-range filtering via start_date / end_date (ISO-8601 datetimes). Without start_date/end_date, results span all time, newest-first.

  • hevy_get_exercise_template

    Fetch one exercise template by id. Accepts both 8-char uppercase hex (built-in) and lowercase UUID (custom).

  • hevy_get_routine

    Fetch one routine by UUID.

  • hevy_get_routine_folder

    Fetch one routine folder by its positive integer id.

  • hevy_get_user_info

    Return the authenticated user (name, id, profile URL). Reads GET /v1/user/info. Requires a Hevy Pro api-key.

  • hevy_get_workout

    Fetch one workout by UUID. Returns the full record including exercises and sets.

  • hevy_get_workout_count

    Return { workout_count }: the total number of workouts on the account.

  • hevy_get_workout_events

    Delta sync feed: events newer than `since` (ISO-8601). Each event is either { type: "updated", workout } or { type: "deleted", id, deleted_at }. To incrementally sync a local cache: on first call pass since=1970-01-01T00:00:00Z, then for each subsequent call pass the timestamp of the newest event you have seen. This is the ONLY way to detect deletions — the Hevy API has no DELETE endpoint, so dele

  • hevy_list_body_measurements

    List body measurements (GET /v1/body_measurements). Envelope: { page, page_count, body_measurements }. pageSize 1-10. Records are keyed by date (YYYY-MM-DD), not by id. No DELETE endpoint exists.

  • hevy_list_exercise_templates

    List exercise templates (built-in + custom). Envelope: { page, page_count, exercise_templates }. pageSize is 1-100 — this is the ONE endpoint with a larger cap; every other list is capped at 10. Built-in ids are 8-char uppercase hex; custom ids are lowercase UUIDs.

  • hevy_list_routine_folders

    List routine folders. pageSize 1-10. Envelope: { page, page_count, routine_folders }. No DELETE endpoint.

  • hevy_list_routines

    List routines. pageSize 1-10 (max enforced by server). Envelope: { page, page_count, routines }. No DELETE endpoint.

  • hevy_list_workouts

    List workouts newest-first, paginated. Use this to discover workout ids; fetch a single full record with hevy_get_workout, or just the count with hevy_get_workout_count. pageSize is 1-10 (Hevy returns 400 for >10). Response envelope: { page, page_count, workouts: [...] }. Empty account returns workouts: []. No DELETE endpoint exists on the Hevy API.

  • hevy_search_exercise_templates

    Find exercise templates by name. Paginates the full catalog (built-in + custom) and returns templates whose title contains the query, case-insensitive. Use this to resolve an exercise_template_id from a human name (e.g. "bench press") before composing a workout or routine. Response: { query, total_matches, exercise_templates: [...], truncated }. total_matches counts every match across the pages sc

  • hevy_update_body_measurementwrite action

    Full replace of the body-measurements record for a date (PUT /v1/body_measurements/{date}). FULL REPLACE — any metric field NOT sent in body_measurement is overwritten to NULL on the server. To "update just one metric": call hevy_get_body_measurement for that date first, modify the metric you want, then send ALL fields back. Dry-run by default: returns { dry_run: true, executed: false, ... } unles

  • hevy_update_routinewrite action

    Full replace of a routine (PUT /v1/routines/{id}). Omitted fields are dropped — to preserve a field, send it back unchanged. Each exercise needs an exercise_template_id (find via hevy_list_exercise_templates). Note: folder_id is NOT accepted on update; the Hevy API rejects it with 400. The routine's folder cannot be changed through this tool. Dry-run by default: returns { dry_run: true, executed:

  • hevy_update_workoutwrite action

    Full replace of a workout (PUT /v1/workouts/{id}). Any field not re-sent is dropped — to preserve a field, send it back unchanged. Each exercise needs an exercise_template_id (find via hevy_list_exercise_templates or hevy_get_exercise_template). Dry-run by default: returns { dry_run: true, executed: false, ... } unless HEVY_MCP_ALLOW_WRITES=1 is set on the server process. No DELETE endpoint exists

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • Code scan121 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 20 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Hevy MCP compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
92/100
higher than 95% of 48,255 servers
Tools
23
the typical server has 7
Tools that change things
35%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
85
more than 59% of 12,191 servers with a package

What its tools let an agent do: 15 read · 8 change

Install Hevy MCP in Claude Code, Cursor or VS Code

Runs npx -y @diecoscai/hevy-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add hevy-mcp -- npx -y @diecoscai/hevy-mcp
Add to Cursor

What the publisher says

From the Hevy MCP repository's README, as published. We do not edit it. Read it on GitHub

@diecoscai/hevy-mcp

Model Context Protocol server for the Hevy fitness API. Manage workouts, routines, exercises, and body measurements from any MCP-compatible client — Claude Desktop, Claude Code, Cursor, VS Code, and anything else that speaks MCP over stdio.

Overview

This MCP server exposes the public Hevy API (api.hevyapp.com/v1) as 22 strongly-typed tools. LLM agents can list workouts, create routines, look up exercise templates, track body measurements, and follow a delta-sync feed — all without bespoke glue code on the client.

Design goals:

  • Safe by default. Write operations return a { dryrun: true, wouldsend: { ... } } preview unless HEVYMCPALLOW_WRITES=1 is set. The Hevy API has no DELETE on any resource, so accidental writes are permanent; dry-run is the brake.
  • Validated at the edge. Every tool input is checked with Zod before a single byte crosses the network. Oversized titles, unknown fields, out-of-range page sizes, and invalid enums fail fast with SEP-1303-shaped errors the model can self-correct.
  • Zero extra setup. Authentication is a single environment variable — HEVYAPIKEY. No wizards, no config files; just paste the snippet for your client.

Schemas are generated from Hevy's own OpenAPI spec and re-synced automatically, so the server adapts to upstream changes instead of drifting. Writes are dry-run by default; every public endpoint is covered.

Project status

Maintenance mode. Feature-complete for Hevy's public API. Schemas are generated from Hevy's OpenAPI spec; a scheduled workflow re-syncs them weekly and opens a PR on any change, and a live integration run catches undocumented server changes. Bug reports and PRs welcome via the issue tracker.

Prerequisites

  • Node.js 20 or later (node --version).
  • A Hevy Pro subscription — the public API is a Pro feature.
  • A Hevy API key from .

Quick setup

The fastest path is the setup subcommand — it validates your key and writes a config file the server picks up automatically:

npx @diecoscai/hevy-mcp setup

It prompts for your Hevy Pro API key (from ), checks it against the live API, asks whether to enable write operations, and saves everything to ~/.config/hevy-mcp/config.json (mode 0600). Then add the server to your MCP client with no env block needed:

{
  "mcpServers": {
    "hevy": {
      "command": "npx",
      "args": ["-y", "@diecoscai/hevy-mcp"]
    }
  }
}

Restart the client — the 22 Hevy tools appear in the tools panel.

Prefer environment variables? Skip setup and pass HEVYAPIKEY (and optionally HEVYMCPALLOW_WRITES=1) in the env block instead — see Configuration. Env vars always take precedence over the config file.

Note on bare invocation. Running npx @diecoscai/hevy-mcp with no arguments starts a stdio MCP server and blocks, waiting for an MCP client to connect over its stdin/stdout. You don't run it in a terminal yourself — your MCP client spawns it. Use npx @diecoscai/hevy-mcp --help, --version, or setup for a non-blocking invocation.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Hevy MCP: common questions

Is Hevy MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the Hevy MCP safety report
How do I install Hevy MCP?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Hevy MCP need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Hevy MCP maintained?
The last commit was 58 days ago (2026-09-07). The latest release is v0.5.0.
How does Hevy MCP compare with other MCP servers?
safety score 92/100 (higher than 95% of 48,255 servers); tools 23 (the typical server has 7); tools that change things 35% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.