Strava MCP server
Remote MCP server for your Strava activities, segments, and routes
0 stars
Reviews
Write oneNobody has reviewed Strava yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Strava tools
No tool declarations could be read from the package source. They show once the server is installed.
Public scan report
scanner v0.1.10 · 2026-11-01 · same rubric, same numbers if you re-run it
- –Code scanpackage could not be scannedn/a
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitystatic API keys via environment variables6/15
- Maintenancelast push 7 days ago15/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
How Strava compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 73/100
- higher than 39% of 48,255 servers
Install Strava in Claude Code, Cursor or VS Code
claude mcp add strava-mcp -- docker run -i --rm ghcr.io/ljcl/strava-mcp:3.0.0
What the publisher says
From the Strava repository's README, as published. We do not edit it. Read it on GitHub
Strava MCP
A Model Context Protocol (MCP) server that supplements the official Strava MCP connector. It adds write access, segments, routes, photos, derived analysis, and interactive visualizations that the official connector does not provide.
Features
- Write and update activities (title, description, sport type, gear, flags)
- Create manual activities for sessions with no device recording (strength, yoga, treadmill)
- Explore, view, star, and manage segments
- Fetch per-activity photos, zone breakdowns, and running summaries
- List and view details of saved routes
- Export routes (GPX/TCX) and activity tracks (GPX built from streams)
- Derived analysis Strava does not expose: interval detection, climb/descent breakdown, aerobic decoupling, training load, fitness/fatigue/form (CTL/ATL/TSB), and a solved taper to a target race-day form
- AI-friendly JSON responses via MCP
- Nine interactive visualizations rendered in MCP-compatible hosts — activity chart, cadence trends, route map, activity segments, training load, compare activities, activity zones, segment progress, and fitness trend
- Guided prompts for weekly reviews, annotating a run, and segment hunting (docs/tools.md)
- Automatic token refresh
- Streamable HTTP transport for remote deployment
Browse the UI components in the live Storybook.
The full tool catalog, prompts, permission behaviour, and example requests live in docs/tools.md.
Quick Start (Docker)
1. Create a Strava API Application
- Go to strava.com/settings/api
- Create a new application:
- Enter your application details (name, website, description)
- Set "Authorization Callback Domain" to your public URL hostname (e.g., strava-mcp.example.com)
- Note your Client ID and Client Secret
2. Configure Environment
cp .env.example .envEdit .env with your values:
STRAVA_CLIENT_ID=your_client_id
STRAVA_CLIENT_SECRET=your_client_secret
PUBLIC_URL=https://your-public-url.example.comAll variables are listed in docs/operations.md. Prefer the prebuilt image? Pull ghcr.io/ljcl/strava-mcp:latest (also on the MCP registry as io.github.ljcl/strava-mcp) and point your compose image: at it instead of building; you still supply the Strava credentials yourself. Published images carry SBOM/provenance attestations you can verify — see operations.md.
Note on the ./data bind mount: tokens persist there, and the distroless image runs as non-root UID 65534, so the directory must be writable by that UID or token persistence fails on first run:
mkdir -p data
sudo chown -R 65534:65534 dataAlternatively use a named volume in docker-compose.yml (e.g. strava-data:/app/data), which Docker initializes with correct ownership. More detail in operations.md.
3. Start the Server
docker compose up -dGET /health reports liveness without spending a Strava API request; with MCPAUTHTOKEN it also reports auth and rate-limit state. Response shapes and monitoring guidance: operations.md.
4. Authorize with Strava
Visit https://your-public-url/auth/start in your browser. After authorizing, tokens are saved automatically and refreshed from then on. Check status anytime at /auth/status.
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Strava: common questions
- Is Strava MCP server safe?
- Mostly: it is graded B (73/100). Read the Strava safety report
- How do I install Strava?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does Strava need an API key?
- Yes. The registry entry asks for
STRAVA_CLIENT_SECRET,STRAVA_ACCESS_TOKEN,STRAVA_REFRESH_TOKEN,MCP_AUTH_TOKEN. - Is Strava maintained?
- The last commit was 9 days ago (2026-10-25). The latest release is v3.0.0.