hybridlog
OCI · GHCR.IO/IMGRUND/HYBRIDLOG:0.1.13 · 2 COMPONENTS
Reads your own Garmin mirror: readiness, training load, muscle freshness, and read-only SQL.
Available components
Last scanned (21 hours ago)
Scores higher than 93% of OCI servers
Category Health and Science
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security0
- No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
- Known CVEs could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.Unverified
- Install-script risk not yet assessed.Unverified
- Dependency health could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.Unverified
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 62 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability76
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3163 tokens (~243/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 1 Nov 26 0
- Stability: 0.97 → pass security
- 31 Oct 26 0
- Stability: pass → 0.97 functional
- 25 Oct 26 0
- Stability: 0.97 → pass security
- 24 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 22 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 21 Oct 26 0
- Provenance: unverified → fail ▼ security
- 20 Oct 26 +1
- Provenance: fail → unverified ▼ security
- 17 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed oci/ghcr.io/imgrund/hybridlog:0.1.13
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | oci |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
delete-symptom-tool Delete Symptom Tool ~73
Delete a symptom log entry by id when the user corrects or retracts it. Ids come from the log-symptom-tool response or from get-health-summary (last 3 days). Log the corrected entry afterwards when there is one.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Id of the entry to delete. |
No output schema declared.
No examples provided.
describe-schema-tool Describe Schema Tool ~90
Describe the Garmin mirror schema: every table with its commented CREATE statement, how well it is filled (row count, date range, missing days, columns this device never records), plus open fetch errors and semantic notes (units, enums, quirks). Call this once per conversation before writing SQL. Never build a query on a column listed under never_filled: it returns nulls, not a finding.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get-activity-detail-tool Get Activity Detail Tool ~205
One session in depth: the summary, its heart-rate zones as seconds, minutes and shares next to the zone floors the athlete's profile carried on that date (hard_minutes is zones 4 and 5 together), the laps, the strength sets per exercise category, the heart-rate curve in a few dozen buckets, and how the session compares with the earlier ones of the same type: medians, the deviation from them, the rank by training load. Without an activity_id it reads the most recent session. Use this rather than rebuilding zones from hr_zones_json or the curve from intraday in SQL.
| Name | Type | Req | Description |
|---|---|---|---|
| activity_id | integer | – | Which activity to read. Omit for the most recent one. |
| compare_with | integer | – | How many earlier sessions of the same type_key to compare against (default 6, max 20). |
| include_hr_curve | boolean | – | Whether to include the heart-rate curve from the intraday samples (default true). |
No output schema declared.
No examples provided.
get-health-summary-tool Get Health Summary Tool ~70
Curated snapshot of the athlete's current state: readiness, HRV, sleep, recent activities with training load. Fastest way to ground a coaching conversation; use query-health-data for anything deeper.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Lookback window in days (default 7, max 30). |
No output schema declared.
No examples provided.
get-insights-tool Get Insights Tool ~110
The app's own reading of the body systems: cardiovascular, sleep, breathing, autonomic recovery and metabolism, each with a status (good / warning / serious / critical), the facts behind it and a concrete recommendation. Carries the early illness pattern across resting heart rate, nightly breathing and HRV. These are the rules the dashboard and the morning briefing run on, so call this instead of inventing thresholds in SQL: a verdict derived ad hoc will contradict what the athlete was told this morning.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get-muscle-map-tool Get Muscle Map Tool ~117
The muscle map as the dashboard computes it: per-zone freshness (0 = just hammered, 100 = fully fresh) with exponential per-zone decay, what each zone saw in the last 7 and 28 days (volume, fractional sets, measured share, the sessions behind it), and a recovery forecast. Call this instead of re-deriving muscle load in SQL: the model self-calibrates against the athlete's own history, and an ad-hoc SQL version will disagree with what the athlete sees on their map.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get-race-splits-tool Get Race Splits Tool ~200
Lap-by-lap breakdown of one race-style session: every lap classified as running or station work, pace per running lap, how far the pace drifted from the first lap to the last, and the time the clock ran while nobody moved. Built for sessions that alternate between the two, which is what a HYROX race or simulation is (8 x 1 km with a station between each), but it reads any activity carrying laps: an interval session, a multi-sport day, a road race with manual splits. Without an activity_id it takes the most recent session that has enough laps to be worth splitting.
| Name | Type | Req | Description |
|---|---|---|---|
| activity_id | integer | – | Which activity to split. Omit for the most recent one carrying at least min_laps laps. |
| min_laps | integer | – | How many laps an activity needs before it counts as race-style when picking one (default 4). Ignored when activity_id is given. |
No output schema declared.
No examples provided.
get-strength-progress-tool Get Strength Progress Tool ~132
Week by week strength progression per exercise category as the dashboard computes it: reps, tonnage where the sets really carry a weight, the weekly top weight, the bests inside the window and a "holds at X kg for N weeks" reading. Answers "am I getting stronger". Call this instead of summing strength_sets in SQL: weights are grams, most categories come back UNKNOWN, and a naive sum mixes weightless reps into a tonnage that was never lifted.
| Name | Type | Req | Description |
|---|---|---|---|
| weeks | integer | – | How many trailing ISO weeks to report, the running one included (default 8, max 26). |
No output schema declared.
No examples provided.
get-training-load-tool Get Training Load Tool ~154
The fitness/fatigue/form model as the dashboard computes it: CTL (42-day EWMA), ATL (7-day), TSB, today's acute:chronic workload ratio with its corridor verdict, plus the weekly load split by stimulus (run / strength / other). Call this instead of re-deriving CTL, ATL or the ratio in SQL: the EWMAs start where the athlete's history starts, and an ad-hoc SQL version will disagree with the dashboard's numbers.
| Name | Type | Req | Description |
|---|---|---|---|
| series_days | integer | – | How many trailing days of the CTL/ATL/TSB series to return (default 28, max 120). Today's values are always included and never depend on this window. |
No output schema declared.
No examples provided.
give-feedback-tool Give Feedback Tool ~189
Store feedback the user just gave about how this connector should behave (tone, format, defaults), so it sticks. The guideline (English, imperative, one or two sentences) becomes part of the server instructions from the next conversation on; pass retire_guideline_id instead of a guideline to withdraw a rule the user takes back (ids are the [gN] markers in the instructions). Use only for feedback the user explicitly voiced, never on your own initiative.
| Name | Type | Req | Description |
|---|---|---|---|
| feedback | string | yes | The user's feedback in their own words, in whatever language they said it; kept verbatim so a rule can always be traced back to what was actually said. |
| guideline | string | – | The distilled standing rule, English, imperative, max 300 chars. |
| retire_guideline_id | integer | – | Id of the guideline to withdraw (the [gN] marker), instead of passing a new guideline. |
No output schema declared.
No examples provided.
log-symptom-tool Log Symptom Tool ~435
Log a symptom or complaint ("kratziger Hals", "Kopfschmerzen"), but ONLY when the user mentions it unprompted. Capture it in passing with a one-sentence confirmation and move on; NEVER ask the user how they feel or whether they have symptoms. severity is optional: 1 mild, 2 moderate, 3 severe. Pass body_zone whenever the user named a place ("knee hurts", "sore hamstrings") so the report lands on the body map next to that zone's training load; omit it for anything without a place ("scratchy throat"). Entries surface on the dashboard as context on the illness early-warning banner and, with a body_zone, as a marker on the body map. To correct an entry, delete it (delete-symptom-tool) and log the corrected one.
| Name | Type | Req | Description |
|---|---|---|---|
| body_zone | string | – | Optional body region, only when the user named one. Joint regions: KNEE, HIP, GROIN, ANKLE, FOOT, ACHILLES, SHIN, SHOULDER, ELBOW, WRIST, HAND, NECK, UPPER_ARM. Muscle zones: CHEST, FRONT_DELTOIDS, B… |
| date | string | – | Day YYYY-MM-DD; omit for today. Use for late mentions ('since yesterday'). |
| note | string | – | Optional short context, e.g. "since waking up". |
| severity | integer | – | Optional severity: 1 mild, 2 moderate, 3 severe. |
| side | string | – | Optional side when the user named one: left, right or both. |
| symptom | string | yes | The symptom, short, in the user's language, e.g. "scratchy throat". |
| time | string | – | Time HH:MM local; omit for now. |
No output schema declared.
No examples provided.
query-health-data-tool Query Health Data Tool ~69
Run a single read-only SELECT (or WITH ... SELECT) against the Garmin mirror and get the rows back (max 500). PostgreSQL dialect. Use describe-schema first for table and column names.
| Name | Type | Req | Description |
|---|---|---|---|
| sql | string | yes | A single SELECT or WITH...SELECT statement, PostgreSQL dialect. |
No output schema declared.
No examples provided.
refresh-data-tool Refresh Data Tool ~227
Trigger a fresh Garmin Connect sync of today and yesterday and wait for it to finish (the same job as the dashboard's refresh button, narrowed to two days: the scheduled runs cover the week, this one exists for "now"). Use when the user asks about today and last_fetch is stale (e.g. after a workout). The call blocks until the run is over, up to about half a minute per call; a still_running answer means the run needs longer, so call this tool again to keep waiting, that never starts a second sync. completed means the whole run is done, activities included, so re-query and answer with the fresh numbers instead of asking the user to come back. A not_started answer means the previous run only just finished and the start window has not reopened: use the data as it is, or wait retry_in_seconds and call again if something the user expects is still missing. Refuses while there is no working Garmin session (data_status not_connected or auth_broken): fetching cannot succeed then, and the answer carries the URL where the user signs in.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the hybridlog MCP server?
hybridlog runs locally as a container image, launched with docker run --rm -i -e DATABASE_URL -e APP_KEY ghcr.io/imgrund/hybridlog:0.1.13. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.
oci · ghcr.io/imgrund/hybridlog:0.1.13
claude mcp add imgrund-hybridlog -- docker run --rm -i -e DATABASE_URL -e APP_KEY ghcr.io/imgrund/hybridlog:0.1.13
This image reads DATABASE_URL and APP_KEY. Set them in your client's env block for this server; docker run -e passes each one through to the container.
What is the hybridlog MCP server?
hybridlog is an MCP server listed in the public MCP registry as io.github.Imgrund/hybridlog. Reads your own Garmin mirror: readiness, training load, muscle freshness, and read-only SQL. This page covers its container image (ghcr.io/imgrund/hybridlog:0.1.13).
Is the hybridlog MCP server safe to use?
hybridlog scores 55 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the hybridlog MCP server expose?
hybridlog exposes 13 tools: describe-schema-tool, get-health-summary-tool, get-insights-tool, get-muscle-map-tool, get-training-load-tool, and 8 more. Their descriptions and schemas cost roughly 2,071 tokens of context every time the server is loaded.
Is the hybridlog MCP server still maintained?
hybridlog is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the hybridlog MCP server under?
hybridlog declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.