# io.github.davidmosiah/strava-mcp (npm · strava-mcp-unofficial)

Privacy-first MCP server for Strava activities, streams, routes and training.

- Trust score: 69/100 (medium)
- Change this week: +18
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `strava-mcp-unofficial`: 69/100 (this document), [markdown](https://verifymcp.io/servers/davidmosiah-strava-mcp/strava-mcp-unofficial.md), [page](https://verifymcp.io/servers/davidmosiah-strava-mcp/strava-mcp-unofficial)

## Channel facts

- Registry: `npm`
- Package: `strava-mcp-unofficial`
- Version: `0.4.6`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 82/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2579 tokens (~73/item across 35 items; 28 tools + 7 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 89/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 60% of tool parameters carry a description.
  - Structured output schemas are declared (82% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add davidmosiah-strava-mcp -- npx -y strava-mcp-unofficial
```

### Codex

```bash
codex mcp add davidmosiah-strava-mcp -- npx -y strava-mcp-unofficial
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "davidmosiah-strava-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "strava-mcp-unofficial"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add davidmosiah-strava-mcp --command npx --arg -y --arg strava-mcp-unofficial
```

### Hermes

```yaml
mcp_servers:
  davidmosiah-strava-mcp:
    command: "npx"
    args: ["-y", "strava-mcp-unofficial"]
```

### Other

```json
{
  "mcpServers": {
    "davidmosiah-strava-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "strava-mcp-unofficial"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 69, +44)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-07-31 (score 25, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 25, −26)

- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional improvement] Dependency health: unverified → partial

### 2026-07-27 (score 51)

First indexed and scored.

## MCP tools (28)

### `strava_data_inventory` (~47 tokens)

Strava Data Inventory

Inventory supported Strava data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call Strava APIs or expose user data.

Input parameters:

- `response_format` (string)

Output parameters:

- `api_boundary`
- `auth`
- `categories` (array)
- `data_access_model` (string)
- `first_tools` (array)
- `generated_at` (string)
- `kind` (string)
- `links` (object)
- `mcp_name` (string)
- `notes` (array)
- `privacy_modes` (array)
- `recommended_agent_flow` (array)
- `scopes` (array)
- `source` (string)
- `totals` (object)
- `unofficial` (boolean)

### `strava_agent_manifest` (~59 tokens)

Strava Agent Manifest

Machine-readable install, runtime and client guidance for AI agents. Includes Hermes direct tool names and anti-gateway-restart guidance. Does not call Strava or expose secrets.

Input parameters:

- `client` (string)
- `response_format` (string)

Output parameters:

- `agent_rules` (array)
- `client` (string)
- `hermes` (object)
- `links` (object)
- `mcp_name` (string)
- `oauth` (object)
- `package` (object)
- `project` (string)
- `recommended_first_calls` (array)
- `resources` (array)
- `standard_tools` (array)
- `troubleshooting` (array)
- `unofficial` (boolean)

### `strava_capabilities` (~46 tokens)

Strava MCP Capabilities

Explain supported Strava data, privacy boundaries, GPS handling, recommended agent workflow and project links. Does not call Strava or expose secrets.

Input parameters:

- `response_format` (string)

Output parameters:

- `api_boundary` (object)
- `auth_model` (object)
- `client_aliases` (object)
- `contribution_paths` (array)
- `creator` (object)
- `links` (object)
- `mcp_name` (string)
- `privacy_modes` (array)
- `project` (string)
- `recommended_agent_flow` (array)
- `supported_data` (array)
- `unofficial` (boolean)

### `strava_quickstart` (~63 tokens)

Strava Quickstart

Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Strava?'

Input parameters:

- `response_format` (string)

### `strava_demo` (~51 tokens)

Strava Demo

Returns realistic example payloads of strava_daily_summary, strava_training_context, and strava_list_activities so agents see the contract before calling real Strava APIs.

Input parameters:

- `response_format` (string)

### `strava_get_auth_url` (~73 tokens)

Get Strava OAuth URL

Generate a Strava OAuth authorization URL. Use this first when no local token exists.

Input parameters:

- `response_format` (string)
- `scopes` (array): Optional scope override. Defaults to read-only Strava scopes used by this server.
- `state` (string): Optional OAuth state value generated by the caller.

Output parameters:

- `auth_url` (string)
- `next_step` (string)
- `redirect_uri` (string)
- `scopes` (array)

### `strava_exchange_code` (~63 tokens)

Exchange Strava OAuth Code

Exchange a Strava OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned.

Input parameters:

- `code` (string, required): OAuth authorization code, or a full redirect URL containing ?code=...
- `response_format` (string)

Output parameters:

- `expires_at` (number)
- `note` (string)
- `ok` (boolean)
- `scope` (string)
- `token_path` (string)

### `strava_get_athlete` (~73 tokens)

Get Authenticated Athlete

Get the authenticated Strava athlete profile. Requires read/profile scope depending on requested fields.

Input parameters:

- `privacy_mode` (string): Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `strava_get_zones` (~67 tokens)

Get Athlete Zones

Get the authenticated athlete heart-rate and power zones when available.

Input parameters:

- `privacy_mode` (string): Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `strava_get_athlete_stats` (~69 tokens)

Get Athlete Stats

Get public-visible aggregate Strava stats for the authenticated athlete.

Input parameters:

- `privacy_mode` (string): Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `strava_list_activities` (~183 tokens)

Strava Activities

List authenticated athlete activities. Supports after/before filters and Strava pagination. Requires activity:read or activity:read_all.

Input parameters:

- `after` (string): Only return activities after this time. Converted to Strava epoch seconds.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return activities before this time. Converted to Strava epoch seconds.
- `limit` (integer): Strava per_page value. Strava allows up to 200.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Strava page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `strava_list_routes` (~174 tokens)

Strava Routes

List authenticated athlete routes. GPS/map geometry is redacted unless raw mode is requested.

Input parameters:

- `after` (string): Only return activities after this time. Converted to Strava epoch seconds.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return activities before this time. Converted to Strava epoch seconds.
- `limit` (integer): Strava per_page value. Strava allows up to 200.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Strava page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `strava_list_clubs` (~166 tokens)

Strava Clubs

List clubs joined by the authenticated athlete.

Input parameters:

- `after` (string): Only return activities after this time. Converted to Strava epoch seconds.
- `all_pages` (boolean): Fetch multiple pages up to max_pages.
- `before` (string): Only return activities before this time. Converted to Strava epoch seconds.
- `limit` (integer): Strava per_page value. Strava allows up to 200.
- `max_pages` (integer): Maximum pages to fetch when all_pages is true.
- `page` (integer): Strava page number.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
- `response_format` (string)

Output parameters:

- `count` (integer)
- `endpoint` (string)
- `has_more` (boolean)
- `next_page` (integer)
- `pages_fetched` (integer)
- `privacy_mode` (string)
- `records` (array)

### `strava_get_activity` (~79 tokens)

Strava Activity

Get detailed activity data by id. Summary/structured modes protect raw GPS details.

Input parameters:

- `id` (required): Strava resource id.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `strava_get_activity_zones` (~77 tokens)

Strava Activity Zones

Get heart-rate/power zones for an activity when available.

Input parameters:

- `id` (required): Strava resource id.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `strava_get_route` (~78 tokens)

Strava Route

Get route details by id. Summary/structured modes avoid full route geometry.

Input parameters:

- `id` (required): Strava resource id.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `strava_get_gear` (~72 tokens)

Strava Gear

Get gear/equipment details by id.

Input parameters:

- `id` (required): Strava resource id.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `strava_get_activity_streams` (~163 tokens)

Get Activity Streams

Get Strava activity streams such as time, distance, heartrate, cadence, watts and altitude. GPS latlng is withheld unless include_gps=true or privacy_mode=raw.

Input parameters:

- `id` (required): Strava activity id.
- `include_gps` (boolean): Allow latlng stream in structured output. Raw mode always returns requested upstream payload.
- `keys` (array): Stream keys to request. latlng is withheld unless privacy_mode=raw or include_gps=true.
- `privacy_mode` (string): Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
- `resolution` (string): Optional Strava stream resolution.
- `response_format` (string)

Output parameters:

- `data`
- `endpoint` (string)
- `privacy_mode` (string)

### `strava_connection_status` (~55 tokens)

Strava Connection Status

Check local Strava config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Strava or exposing secrets.

Input parameters:

- `client` (string)
- `response_format` (string)

Output parameters:

- `automatic_auth_supported` (boolean)
- `cache` (object)
- `client` (string)
- `client_checks` (object)
- `config` (object)
- `effective_status` (string)
- `missing_env` (array)
- `next_steps` (array)
- `node` (object)
- `oauth` (object)
- `ok` (boolean)
- `privacy_mode` (string)
- `ready_for_strava_api` (boolean)
- `redirect_uri` (string)
- `required_env` (object)
- `token` (object)

### `strava_cache_status` (~38 tokens)

Strava Cache Status

Show optional local SQLite cache status. Enable with STRAVA_CACHE=sqlite or STRAVA_CACHE=true.

Input parameters:

- `response_format` (string)

Output parameters:

- `enabled` (boolean)
- `entries` (integer)
- `http_cache` (object)
- `newest_cached_at` (string)
- `path` (string)

### `strava_privacy_audit` (~42 tokens)

Strava Privacy Audit

Return local privacy, cache, token-path, GPS redaction and env-presence posture without revealing secret values.

Input parameters:

- `response_format` (string)

Output parameters:

- `cache_enabled` (boolean)
- `cache_path` (string)
- `config_source` (string)
- `gps_redaction_default` (boolean)
- `local_config_exists` (boolean)
- `local_config_path` (string)
- `local_config_secure_permissions` (boolean)
- `notes` (array)
- `privacy_mode_default` (string)
- `project` (string)
- `raw_payloads_opt_in` (boolean)
- `redacted_key_patterns` (array)
- `required_env_present` (object)
- `secret_env_vars` (array)
- `stdout_safe` (boolean)
- `token_path` (string)
- `unofficial` (boolean)

### `strava_revoke_access` (~47 tokens)

Revoke Strava OAuth Access

Revoke the current Strava OAuth access grant and delete the local token file. Use only when the user explicitly wants to disconnect Strava.

Input parameters:

- `response_format` (string)

Output parameters:

- `local_tokens_cleared` (boolean)
- `note` (string)
- `ok` (boolean)
- `token_path` (string)

### `strava_daily_summary` (~74 tokens)

Strava Daily Training Summary

Build a practical daily training/load summary from recent Strava activities. Read-only and non-medical.

Input parameters:

- `days` (integer): Lookback window for recent training context.
- `response_format` (string)
- `timezone` (string): IANA timezone used only for display, e.g. America/New_York.

Output parameters:

- `generated_at` (string)
- `kind` (string)

### `strava_weekly_summary` (~103 tokens)

Strava Weekly Training Review

Build a weekly Strava scorecard with volume, intensity, sport mix, bottlenecks and next-week actions. Read-only and non-medical.

Input parameters:

- `compare_days` (integer): Prior comparison window in days. Use 0 to disable comparison.
- `days` (integer): Recent analysis window in days.
- `response_format` (string)
- `timezone` (string): IANA timezone used only for display, e.g. America/New_York.

Output parameters:

- `generated_at` (string)
- `kind` (string)

### `strava_training_context` (~105 tokens)

Strava Training Context

Normalize recent Strava activity load into a compact training_context for workout recommendation engines. Includes fallback guidance when recent Strava activity is missing.

Input parameters:

- `days` (integer): Lookback window for normalized Strava training context.
- `injury_flags` (array)
- `notes` (string)
- `response_format` (string)
- `soreness` (array)
- `timezone` (string): IANA timezone used only for display, e.g. America/New_York.

Output parameters:

- `context_contract_version` (string)
- `context_type` (string)
- `data_quality`
- `fallback_hint` (string)
- `generated_at` (string)
- `injury_flags` (array)
- `last_activity_type`
- `notes` (array)
- `privacy` (object)
- `recent_training_load` (string)
- `recommended_handoff` (object)
- `relative_effort` (number)
- `soreness` (array)
- `soreness_hint` (number)
- `source` (string)
- `telegram_summary` (string)
- `weekly_minutes` (number)

### `strava_profile_get` (~109 tokens)

Get Shared Wellness Profile

Read the canonical Delx Wellness profile shared with the other wellness MCP connectors (Nourish, Cycle Coach, CGM, etc.). Read-only. Profile stores only what the user typed during onboarding — never OAuth tokens, API keys, or biomarkers. Note: this profile does NOT change Strava's GPS-redaction default; Strava continues to redact latlng and route geometry unless STRAVA_GPS_INCLUDE=true or include_gps=true is explicitly passed.

Input parameters:

- `response_format` (string)

### `strava_profile_update` (~143 tokens)

Update Shared Wellness Profile

Persist a partial patch to the canonical Delx Wellness profile. Requires explicit_user_intent=true after the user confirms they want to save. Rejects secret-like fields (oauth, token, api_key, password, cookie, refresh, session). Strava's GPS-redaction default is unaffected by profile changes.

Input parameters:

- `explicit_user_intent` (boolean): Set to true ONLY after the user has explicitly confirmed they want to save this. Otherwise the tool refuses to write.
- `patch` (object, required): Partial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes.
- `response_format` (string)

### `strava_onboarding` (~116 tokens)

Wellness Onboarding Flow

Read-only. Return the 11-question Delx Wellness onboarding flow (en or pt-BR), the current shared profile, missing critical fields, and a cross-connector hint. Use this when the user starts a fresh wellness session and you need to fill out preferred_name, goals, devices, training context, nutrition, preferences, and safety. Strava continues to redact GPS by default — onboarding does not change that.

Input parameters:

- `locale` (string): Onboarding locale. Defaults to en.
- `response_format` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/davidmosiah-strava-mcp/strava-mcp-unofficial#diagnostics

## Score history

- 2026-08-03: 69
- 2026-08-02: 69
- 2026-08-01: 25
- 2026-07-31: 25
- 2026-07-30: 25
- 2026-07-28: 51
- 2026-07-27: 51

## Links

- npm package: https://www.npmjs.com/package/strava-mcp-unofficial
- Socket report: https://socket.dev/npm/package/strava-mcp-unofficial
- Repository: https://github.com/davidmosiah/strava-mcp
- Website: https://wellness.delx.ai/connectors/strava
- Changelog RSS feed: https://verifymcp.io/servers/davidmosiah-strava-mcp/strava-mcp-unofficial/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/davidmosiah-strava-mcp/strava-mcp-unofficial/changelog.json
- HTML version of this page: https://verifymcp.io/servers/davidmosiah-strava-mcp/strava-mcp-unofficial