MCP.Market

Strava MCP server

by ljcl·io.github.ljcl/strava-mcp·v3.0.0

Remote MCP server for your Strava activities, segments, and routes

B73/100grade B
What users say
No reviews yet
Be the first
Safety scan
B73/100

full report

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed Strava yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Strava tools

No tool declarations could be read from the package source. They show once the server is installed.

Public scan report

scanner v0.1.10 · 2026-11-01 · same rubric, same numbers if you re-run it

no findings
  • –Code scanpackage could not be scannedn/a
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 7 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 73/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Strava compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
73/100
higher than 39% of 48,255 servers

Install Strava in Claude Code, Cursor or VS Code

claude mcp add strava-mcp -- docker run -i --rm ghcr.io/ljcl/strava-mcp:3.0.0
Add to Cursor

What the publisher says

From the Strava repository's README, as published. We do not edit it. Read it on GitHub

Strava MCP

A Model Context Protocol (MCP) server that supplements the official Strava MCP connector. It adds write access, segments, routes, photos, derived analysis, and interactive visualizations that the official connector does not provide.

Features

  • Write and update activities (title, description, sport type, gear, flags)
  • Create manual activities for sessions with no device recording (strength, yoga, treadmill)
  • Explore, view, star, and manage segments
  • Fetch per-activity photos, zone breakdowns, and running summaries
  • List and view details of saved routes
  • Export routes (GPX/TCX) and activity tracks (GPX built from streams)
  • Derived analysis Strava does not expose: interval detection, climb/descent breakdown, aerobic decoupling, training load, fitness/fatigue/form (CTL/ATL/TSB), and a solved taper to a target race-day form
  • AI-friendly JSON responses via MCP
  • Nine interactive visualizations rendered in MCP-compatible hosts — activity chart, cadence trends, route map, activity segments, training load, compare activities, activity zones, segment progress, and fitness trend
  • Guided prompts for weekly reviews, annotating a run, and segment hunting (docs/tools.md)
  • Automatic token refresh
  • Streamable HTTP transport for remote deployment

Browse the UI components in the live Storybook.

The full tool catalog, prompts, permission behaviour, and example requests live in docs/tools.md.

Quick Start (Docker)

1. Create a Strava API Application

  1. Go to strava.com/settings/api
  2. Create a new application:
  • Enter your application details (name, website, description)
  • Set "Authorization Callback Domain" to your public URL hostname (e.g., strava-mcp.example.com)
  • Note your Client ID and Client Secret

2. Configure Environment

cp .env.example .env

Edit .env with your values:

STRAVA_CLIENT_ID=your_client_id
STRAVA_CLIENT_SECRET=your_client_secret
PUBLIC_URL=https://your-public-url.example.com

All variables are listed in docs/operations.md. Prefer the prebuilt image? Pull ghcr.io/ljcl/strava-mcp:latest (also on the MCP registry as io.github.ljcl/strava-mcp) and point your compose image: at it instead of building; you still supply the Strava credentials yourself. Published images carry SBOM/provenance attestations you can verify — see operations.md.

Note on the ./data bind mount: tokens persist there, and the distroless image runs as non-root UID 65534, so the directory must be writable by that UID or token persistence fails on first run:

mkdir -p data
sudo chown -R 65534:65534 data

Alternatively use a named volume in docker-compose.yml (e.g. strava-data:/app/data), which Docker initializes with correct ownership. More detail in operations.md.

3. Start the Server

docker compose up -d

GET /health reports liveness without spending a Strava API request; with MCPAUTHTOKEN it also reports auth and rate-limit state. Response shapes and monitoring guidance: operations.md.

4. Authorize with Strava

Visit https://your-public-url/auth/start in your browser. After authorizing, tokens are saved automatically and refreshed from then on. Check status anytime at /auth/status.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Strava: common questions

Is Strava MCP server safe?
Mostly: it is graded B (73/100). Read the Strava safety report
How do I install Strava?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Strava need an API key?
Yes. The registry entry asks for STRAVA_CLIENT_SECRET, STRAVA_ACCESS_TOKEN, STRAVA_REFRESH_TOKEN, MCP_AUTH_TOKEN.
Is Strava maintained?
The last commit was 9 days ago (2026-10-25). The latest release is v3.0.0.

More from ljcl →