io.github.r-huijts/strava-mcp
NPM · STRAVA-MCP-SERVER
MCP server for accessing Strava API
Available components
Last scanned (3 hours ago)
Scores higher than 55% of npm servers
Category Health and Science
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 33 of 107 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency44
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (ISC).Pass
- Actively maintained (last published 295 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability78
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1919 tokens (~101/item across 19 items; 19 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 19 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 −2
- Stability: pass → 0.83 functional
- 29 Oct 26 0
- Stability: 0.97 → pass security
- 28 Oct 26 0
- Stability: pass → 0.97 functional
- 24 Oct 26 −5
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 22 Oct 26 0
- Stability: 0.97 → pass security
- 21 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 20 Oct 26 −1
- Stability: pass → 0.93 functional
- 17 Oct 26 +3
- Stability: 0.80 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/strava-mcp-server@1.0.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 107 packages
| Packages resolved | 107 |
|---|---|
| Stale | 33 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
explore-segments ~133
Searches for popular segments within a given geographical area.
| Name | Type | Req | Description |
|---|---|---|---|
| activityType | string | – | Filter segments by activity type (optional: 'running' or 'riding'). |
| bounds | string | yes | The geographical area to search, specified as a comma-separated string: south_west_lat,south_west_lng,north_east_lat,north_east_lng |
| maxCat | integer | – | Filter by maximum climb category (optional, 0-5). Requires riding activityType. |
| minCat | integer | – | Filter by minimum climb category (optional, 0-5). Requires riding activityType. |
No output schema declared.
No examples provided.
export-route-gpx ~49
Exports a specific Strava route in GPX format and saves it to a pre-configured local directory.
| Name | Type | Req | Description |
|---|---|---|---|
| routeId | string | yes | The ID of the Strava route to export. |
No output schema declared.
No examples provided.
export-route-tcx ~49
Exports a specific Strava route in TCX format and saves it to a pre-configured local directory.
| Name | Type | Req | Description |
|---|---|---|---|
| routeId | string | yes | The ID of the Strava route to export. |
No output schema declared.
No examples provided.
get-activity-details ~40
Fetches detailed information about a specific activity using its ID.
| Name | Type | Req | Description |
|---|---|---|---|
| activityId | integer | yes | The unique identifier of the activity to fetch details for. |
No output schema declared.
No examples provided.
get-activity-laps ~251
Retrieves detailed lap data for a specific Strava activity. Use Cases: - Get complete lap data including timestamps, speeds, and metrics - Access raw values for detailed analysis or visualization - Extract specific lap metrics for comparison or tracking Parameters: - id (required): The unique identifier of the Strava activity. Output Format: Returns both a human-readable summary and complete JSON data for each lap, including: 1. A text summary with formatted metrics 2. Raw lap data containing all fields from the Strava API: - Unique lap ID and indices - Timestamps (start_date, start_date_local) - Distance and timing metrics - Speed metrics (average and max) - Performance metrics (heart rate, cadence, power if available) - Elevation data - Resource state information - Activity and athlete references Notes: - Requires activity:read scope for public/followers activities, activity:read_all for private activities - Returns complete data as received from Strava API without omissions - All numeric values are preserved in their original precision
| Name | Type | Req | Description |
|---|---|---|---|
| id | number|string | yes | The identifier of the activity to fetch laps for. |
No output schema declared.
No examples provided.
get-activity-streams ~625
Retrieves detailed time-series data streams from a Strava activity. Perfect for analyzing workout metrics, visualizing routes, or performing detailed activity analysis. Key Features: 1. Multiple Data Types: Access various metrics like heart rate, power, speed, GPS coordinates, etc. 2. Flexible Resolution: Choose data density from low (~100 points) to high (~10000 points) 3. Smart Pagination: Get data in manageable chunks or all at once 4. Rich Statistics: Includes min/max/avg for numeric streams 5. Formatted Output: Data is processed into human and LLM-friendly formats Common Use Cases: - Analyzing workout intensity through heart rate zones - Calculating power metrics for cycling activities - Visualizing route data using GPS coordinates - Analyzing pace and elevation changes - Detailed segment analysis Output Format: 1. Metadata: Activity overview, available streams, data points 2. Statistics: Summary stats for each stream type (max/min/avg where applicable) 3. Stream Data: Actual time-series data, formatted for easy use Notes: - Requires activity:read scope - Not all streams are available for all activities - Older activities might have limited data - Large activities are automatically paginated to handle size limits
| Name | Type | Req | Description |
|---|---|---|---|
| id | number|string | yes | The Strava activity identifier to fetch streams for. This can be obtained from activity URLs or the get-activities tool. |
| page | number | – | Optional page number for paginated results. Use with points_per_page to retrieve specific data ranges. Example: page=2 with points_per_page=100 gets points 101-200. |
| points_per_page | number | – | Optional number of data points per page. Special values: - Positive number: Returns that many points per page - -1: Returns ALL data points split into multiple messages (~1000 points each) Use -1 whe… |
| resolution | string | – | Optional data resolution. Affects number of data points returned: - low: ~100 points - medium: ~1000 points - high: ~10000 points Default varies based on activity length. |
| series_type | string | – | Optional base series type for the streams: - time: Data points are indexed by time (seconds from start) - distance: Data points are indexed by distance (meters from start) Useful for comparing differ… |
| types | array | – | Array of stream types to fetch. Available types: - time: Time in seconds from start - distance: Distance in meters from start - latlng: Array of [latitude, longitude] pairs - altitude: Elevation in m… |
No output schema declared.
No examples provided.
get-all-activities ~203
Fetches complete activity history with optional filtering by date range and activity type. Supports pagination to retrieve all activities.
| Name | Type | Req | Description |
|---|---|---|---|
| activityTypes | array | – | Array of activity types to filter (e.g., ['Run', 'Ride']) |
| endDate | string | – | ISO date string for activities before this date (e.g., '2024-12-31') |
| maxActivities | integer | – | Maximum activities to return after filtering (default: 500) |
| maxApiCalls | integer | – | Maximum API calls to prevent quota exhaustion (default: 10 = ~2000 activities) |
| perPage | integer | – | Activities per API call (default: 200, max: 200) |
| sportTypes | array | – | Array of sport types for granular filtering (e.g., ['MountainBikeRide', 'TrailRun']) |
| startDate | string | – | ISO date string for activities after this date (e.g., '2024-01-01') |
No output schema declared.
No examples provided.
get-athlete-profile ~36
Fetches the profile information for the authenticated athlete, including their unique numeric ID needed for other tools like get-athlete-stats.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get-athlete-stats ~77
Fetches the activity statistics (recent, YTD, all-time) for a specific athlete using their ID. Requires the athleteId obtained from the get-athlete-profile tool.
| Name | Type | Req | Description |
|---|---|---|---|
| athleteId | integer | yes | The unique identifier of the athlete to fetch stats for. Obtain this ID first by calling the get-athlete-profile tool. |
No output schema declared.
No examples provided.
get-athlete-zones ~35
Retrieves the authenticated athlete's configured heart rate and power zones. Output includes both a formatted summary and the raw JSON data.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get-recent-activities ~40
Fetches the most recent activities for the authenticated athlete.
| Name | Type | Req | Description |
|---|---|---|---|
| perPage | integer | – | Number of activities to retrieve (default: 30) |
No output schema declared.
No examples provided.
get-route ~36
Fetches detailed information about a specific route using its ID.
| Name | Type | Req | Description |
|---|---|---|---|
| routeId | string | yes | The unique identifier of the route to fetch. |
No output schema declared.
No examples provided.
get-segment ~37
Fetches detailed information about a specific segment using its ID.
| Name | Type | Req | Description |
|---|---|---|---|
| segmentId | integer | yes | The unique identifier of the segment to fetch. |
No output schema declared.
No examples provided.
get-segment-effort ~41
Fetches detailed information about a specific segment effort using its ID.
| Name | Type | Req | Description |
|---|---|---|---|
| effortId | integer | yes | The unique identifier of the segment effort to fetch. |
No output schema declared.
No examples provided.
list-athlete-clubs ~22
Lists the clubs the authenticated athlete is a member of.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list-athlete-routes ~51
Lists the routes created by the authenticated athlete, with pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| page | integer | – | Page number for pagination |
| perPage | integer | – | Number of routes per page (max 50) |
No output schema declared.
No examples provided.
list-segment-efforts ~114
Lists the authenticated athlete's efforts on a specific segment, optionally filtering by date.
| Name | Type | Req | Description |
|---|---|---|---|
| endDateLocal | string | – | Filter efforts ending before this ISO 8601 date-time (optional). |
| perPage | integer | – | Number of efforts to return per page (default: 30, max: 200). |
| segmentId | integer | yes | The ID of the segment for which to list efforts. |
| startDateLocal | string | – | Filter efforts starting after this ISO 8601 date-time (optional). |
No output schema declared.
No examples provided.
list-starred-segments ~20
Lists the segments starred by the authenticated athlete.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
star-segment ~60
Stars or unstars a specific segment for the authenticated athlete.
| Name | Type | Req | Description |
|---|---|---|---|
| segmentId | integer | yes | The unique identifier of the segment to star or unstar. |
| starred | boolean | yes | Set to true to star the segment, false to unstar it. |
No output schema declared.
No examples provided.
How do I install the io.github.r-huijts/strava-mcp server?
io.github.r-huijts/strava-mcp runs locally as an npm package, launched with npx -y strava-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · strava-mcp-server
claude mcp add r-huijts-strava-mcp -- npx -y strava-mcp-server
What is the io.github.r-huijts/strava-mcp server?
io.github.r-huijts/strava-mcp is listed in the public MCP registry as io.github.r-huijts/strava-mcp. MCP server for accessing Strava API. This page covers its npm package (strava-mcp-server).
Is the io.github.r-huijts/strava-mcp server safe to use?
io.github.r-huijts/strava-mcp scores 77 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.r-huijts/strava-mcp server expose?
io.github.r-huijts/strava-mcp exposes 19 tools: get-athlete-profile, get-athlete-stats, get-activity-details, get-recent-activities, list-athlete-clubs, and 14 more. Their descriptions and schemas cost roughly 1,919 tokens of context every time the server is loaded.
Is the io.github.r-huijts/strava-mcp server still maintained?
io.github.r-huijts/strava-mcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.r-huijts/strava-mcp server under?
io.github.r-huijts/strava-mcp declares the ISC licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.