# io.github.r-huijts/strava-mcp (npm · strava-mcp-server)

MCP server for accessing Strava API

- Trust score: 67/100 (medium)
- Change this week: +21
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `strava-mcp-server`: 67/100 (this document), [markdown](https://verifymcp.io/servers/r-huijts-strava-mcp/strava-mcp-server.md), [page](https://verifymcp.io/servers/r-huijts-strava-mcp/strava-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `strava-mcp-server`
- Version: `1.0.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (109 of 110), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (ISC).
  - Actively maintained (last published 202 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1919 tokens (~101/item across 19 items; 19 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add r-huijts-strava-mcp -- npx -y strava-mcp-server
```

### Codex

```bash
codex mcp add r-huijts-strava-mcp -- npx -y strava-mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "r-huijts-strava-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "strava-mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add r-huijts-strava-mcp --command npx --arg -y --arg strava-mcp-server
```

### Hermes

```yaml
mcp_servers:
  r-huijts-strava-mcp:
    command: "npx"
    args: ["-y", "strava-mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "r-huijts-strava-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "strava-mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 67, +3)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail
- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 64, +38)

- [security regression] Provenance: unverified → fail
- [security improvement] Malware scan: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: ISC

### 2026-08-01 (score 26, +5)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass

### 2026-07-31 (score 21, −25)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (19)

### `get-athlete-profile` (~36 tokens)

Fetches the profile information for the authenticated athlete, including their unique numeric ID needed for other tools like get-athlete-stats.

### `get-athlete-stats` (~77 tokens)

Fetches the activity statistics (recent, YTD, all-time) for a specific athlete using their ID. Requires the athleteId obtained from the get-athlete-profile tool.

Input parameters:

- `athleteId` (integer, required): The unique identifier of the athlete to fetch stats for. Obtain this ID first by calling the get-athlete-profile tool.

### `get-activity-details` (~40 tokens)

Fetches detailed information about a specific activity using its ID.

Input parameters:

- `activityId` (integer, required): The unique identifier of the activity to fetch details for.

### `get-recent-activities` (~40 tokens)

Fetches the most recent activities for the authenticated athlete.

Input parameters:

- `perPage` (integer): Number of activities to retrieve (default: 30)

### `list-athlete-clubs` (~22 tokens)

Lists the clubs the authenticated athlete is a member of.

### `list-starred-segments` (~20 tokens)

Lists the segments starred by the authenticated athlete.

### `get-segment` (~37 tokens)

Fetches detailed information about a specific segment using its ID.

Input parameters:

- `segmentId` (integer, required): The unique identifier of the segment to fetch.

### `explore-segments` (~133 tokens)

Searches for popular segments within a given geographical area.

Input parameters:

- `activityType` (string): Filter segments by activity type (optional: 'running' or 'riding').
- `bounds` (string, required): The geographical area to search, specified as a comma-separated string: south_west_lat,south_west_lng,north_east_lat,north_east_lng
- `maxCat` (integer): Filter by maximum climb category (optional, 0-5). Requires riding activityType.
- `minCat` (integer): Filter by minimum climb category (optional, 0-5). Requires riding activityType.

### `star-segment` (~60 tokens)

Stars or unstars a specific segment for the authenticated athlete.

Input parameters:

- `segmentId` (integer, required): The unique identifier of the segment to star or unstar.
- `starred` (boolean, required): Set to true to star the segment, false to unstar it.

### `get-segment-effort` (~41 tokens)

Fetches detailed information about a specific segment effort using its ID.

Input parameters:

- `effortId` (integer, required): The unique identifier of the segment effort to fetch.

### `list-segment-efforts` (~114 tokens)

Lists the authenticated athlete's efforts on a specific segment, optionally filtering by date.

Input parameters:

- `endDateLocal` (string): Filter efforts ending before this ISO 8601 date-time (optional).
- `perPage` (integer): Number of efforts to return per page (default: 30, max: 200).
- `segmentId` (integer, required): The ID of the segment for which to list efforts.
- `startDateLocal` (string): Filter efforts starting after this ISO 8601 date-time (optional).

### `list-athlete-routes` (~51 tokens)

Lists the routes created by the authenticated athlete, with pagination.

Input parameters:

- `page` (integer): Page number for pagination
- `perPage` (integer): Number of routes per page (max 50)

### `get-route` (~36 tokens)

Fetches detailed information about a specific route using its ID.

Input parameters:

- `routeId` (string, required): The unique identifier of the route to fetch.

### `export-route-gpx` (~49 tokens)

Exports a specific Strava route in GPX format and saves it to a pre-configured local directory.

Input parameters:

- `routeId` (string, required): The ID of the Strava route to export.

### `export-route-tcx` (~49 tokens)

Exports a specific Strava route in TCX format and saves it to a pre-configured local directory.

Input parameters:

- `routeId` (string, required): The ID of the Strava route to export.

### `get-activity-streams` (~625 tokens)

Retrieves detailed time-series data streams from a Strava activity. Perfect for analyzing workout metrics, visualizing routes, or performing detailed activity analysis.

Key Features:
1\. Multiple Data Types: Access various metrics like heart rate, power, speed, GPS coordinates, etc.
2\. Flexible Resolution: Choose data density from low (~100 points) to high (~10000 points)
3\. Smart Pagination: Get data in manageable chunks or all at once
4\. Rich Statistics: Includes min/max/avg for numeric streams
5\. Formatted Output: Data is processed into human and LLM-friendly formats

Common Use Cases:
\- Analyzing workout intensity through heart rate zones
\- Calculating power metrics for cycling activities
\- Visualizing route data using GPS coordinates
\- Analyzing pace and elevation changes
\- Detailed segment analysis

Output Format:
1\. Metadata: Activity overview, available streams, data points
2\. Statistics: Summary stats for each stream type (max/min/avg where applicable)
3\. Stream Data: Actual time-series data, formatted for easy use

Notes:
\- Requires activity:read scope
\- Not all streams are available for all activities
\- Older activities might have limited data
\- Large activities are automatically paginated to handle size limits

Input parameters:

- `id` (number|string, required): The Strava activity identifier to fetch streams for. This can be obtained from activity URLs or the get-activities tool.
- `page` (number): Optional page number for paginated results. Use with points_per_page to retrieve specific data ranges. Example: page=2 with points_per_page=100 gets points 101-200.
- `points_per_page` (number): Optional number of data points per page. Special values: - Positive number: Returns that many points per page - -1: Returns ALL data points split into multiple messages (~1000 points each) Use -1 whe…
- `resolution` (string): Optional data resolution. Affects number of data points returned: - low: ~100 points - medium: ~1000 points - high: ~10000 points Default varies based on activity length.
- `series_type` (string): Optional base series type for the streams: - time: Data points are indexed by time (seconds from start) - distance: Data points are indexed by distance (meters from start) Useful for comparing differ…
- `types` (array): Array of stream types to fetch. Available types: - time: Time in seconds from start - distance: Distance in meters from start - latlng: Array of [latitude, longitude] pairs - altitude: Elevation in m…

### `get-activity-laps` (~251 tokens)

Retrieves detailed lap data for a specific Strava activity.

Use Cases:
\- Get complete lap data including timestamps, speeds, and metrics
\- Access raw values for detailed analysis or visualization
\- Extract specific lap metrics for comparison or tracking

Parameters:
\- id (required): The unique identifier of the Strava activity.

Output Format:
Returns both a human-readable summary and complete JSON data for each lap, including:
1\. A text summary with formatted metrics
2\. Raw lap data containing all fields from the Strava API:
   \- Unique lap ID and indices
   \- Timestamps (start_date, start_date_local)
   \- Distance and timing metrics
   \- Speed metrics (average and max)
   \- Performance metrics (heart rate, cadence, power if available)
   \- Elevation data
   \- Resource state information
   \- Activity and athlete references

Notes:
\- Requires activity:read scope for public/followers activities, activity:read_all for private activities
\- Returns complete data as received from Strava API without omissions
\- All numeric values are preserved in their original precision

Input parameters:

- `id` (number|string, required): The identifier of the activity to fetch laps for.

### `get-athlete-zones` (~35 tokens)

Retrieves the authenticated athlete's configured heart rate and power zones.

Output includes both a formatted summary and the raw JSON data.

### `get-all-activities` (~203 tokens)

Fetches complete activity history with optional filtering by date range and activity type. Supports pagination to retrieve all activities.

Input parameters:

- `activityTypes` (array): Array of activity types to filter (e.g., ['Run', 'Ride'])
- `endDate` (string): ISO date string for activities before this date (e.g., '2024-12-31')
- `maxActivities` (integer): Maximum activities to return after filtering (default: 500)
- `maxApiCalls` (integer): Maximum API calls to prevent quota exhaustion (default: 10 = ~2000 activities)
- `perPage` (integer): Activities per API call (default: 200, max: 200)
- `sportTypes` (array): Array of sport types for granular filtering (e.g., ['MountainBikeRide', 'TrailRun'])
- `startDate` (string): ISO date string for activities after this date (e.g., '2024-01-01')

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/r-huijts-strava-mcp/strava-mcp-server#diagnostics

## Score history

- 2026-08-04: 67
- 2026-08-03: 64
- 2026-08-02: 64
- 2026-08-01: 26
- 2026-07-31: 21
- 2026-07-30: 46
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/strava-mcp-server
- Socket report: https://socket.dev/npm/package/strava-mcp-server
- Repository: https://github.com/r-huijts/strava-mcp
- Changelog RSS feed: https://verifymcp.io/servers/r-huijts-strava-mcp/strava-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/r-huijts-strava-mcp/strava-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/r-huijts-strava-mcp/strava-mcp-server