Claudex Strava Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Claudex Strava Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server that connects Claude to your Strava fitness data. Ask Claude questions about your real training history in plain English — no dashboards, no manual exports.
Built with TypeScript, the MCP SDK, and Zod schema validation. Automatic OAuth token refresh included.
git clone https://github.com/your-username/claudex-strava-mcp
cd claudex-strava-mcp
npm installGo to strava.com/settings/api and create an app. Set the Authorization Callback Domain to localhost.
You'll receive a Client ID and Client Secret — keep these safe.
Copy the example env file and fill in your Client ID and Secret:
cp .env.example .env
# Edit .env and add your STRAVA_CLIENT_ID and STRAVA_CLIENT_SECRETThen run the OAuth helper:
npx tsx scripts/get-token.tsThis will:
STRAVA_REFRESH_TOKEN in the terminalCopy the printed refresh token into your .env:
STRAVA_CLIENT_ID=your_client_id
STRAVA_CLIENT_SECRET=your_client_secret
STRAVA_REFRESH_TOKEN=your_refresh_tokennpm run buildThis compiles TypeScript to dist/.
Add the following to your Claude Desktop config file:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"strava": {
"command": "node",
"args": ["/absolute/path/to/claudex-strava-mcp/dist/index.js"],
"env": {
"STRAVA_CLIENT_ID": "your_client_id",
"STRAVA_CLIENT_SECRET": "your_client_secret",
"STRAVA_REFRESH_TOKEN": "your_refresh_token"
}
}
}
}Restart Claude Desktop. The Strava tools will appear in Claude's tool list.
claudex-strava-mcp/
├── src/
│ ├── index.ts # MCP server entry point
│ ├── strava-client.ts # Strava API client with auto token refresh
│ └── tools.ts # 8 MCP tool definitions (Zod-validated)
├── scripts/
│ └── get-token.ts # One-time OAuth token helper
├── .env.example # Template — copy to .env and fill in values
├── .gitignore
├── package.json
└── tsconfig.json| Tool | Description |
|---|---|
get_athlete_profile | Your Strava profile and preferences |
get_athlete_stats | All-time, YTD, and recent totals by sport |
list_activities | Paginated activity list with date filters |
get_activity | Detailed stats for a single activity |
get_activity_laps | Lap-by-lap breakdown |
get_activity_zones | Heart rate zone distribution |
list_routes | Your saved routes |
get_route | Detailed route info |
The server uses the MCP SDK's McpServer class and registers tools using Zod schemas for runtime validation. The Strava client handles OAuth token refresh automatically — if your access token is within 60 seconds of expiring, it refreshes using your stored refresh token before making any API call.
Claude prompt
│
▼
MCP Tool Layer (TypeScript)
│
├── list_activities ──► GET /athlete/activities
├── get_activity ──► GET /activities/{id}
├── get_activity_zones ► GET /activities/{id}/zones
└── ...
│
▼
Strava API
│
▼
Structured JSON → Claude reasons → Natural language responsenpm run dev # Watch mode — recompiles on save
npm run build # Production build
npm start # Run compiled server.env file — it's in .gitignoreread, activity:read_all, and profile:read_all — read-only access onlyMIT
Built by [Mostafa Didar Mahdi](https://linkedin.com/in/mostafadidar) — Data Scientist, Anthropic-certified AI practitioner, Adelaide.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.