Strava Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Strava Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server that exposes your Strava data to Claude. Ask Claude about your training load, compare blocks, dig into lap splits, or analyze activity streams — all from a conversation.
https://www.strava.com/oauth/authorize?client_id=YOUR_CLIENT_ID&response_type=code&redirect_uri=http://localhost&approval_prompt=force&scope=read,activity:read_allcode from the redirect URL. curl -X POST https://www.strava.com/oauth/token \
-d client_id=YOUR_CLIENT_ID \
-d client_secret=YOUR_CLIENT_SECRET \
-d code=YOUR_CODE \
-d grant_type=authorization_codeaccess_token, refresh_token, and expires_at.git clone https://github.com/your-username/strava-mcp.git
cd strava-mcp
npm installcp .env.example .envEdit .env with your credentials:
STRAVA_CLIENT_ID=your_client_id
STRAVA_CLIENT_SECRET=your_client_secret
STRAVA_ACCESS_TOKEN=your_access_token
STRAVA_REFRESH_TOKEN=your_refresh_token
STRAVA_TOKEN_EXPIRES_AT=1234567890 # unix timestamp from token exchange
DEBUG=false # set to "true" for verbose stderr loggingTokens are held in memory only and auto-refreshed before expiry. Nothing is written back to .env.
npm run build # compile TypeScript → build/
npm start # start the MCP server on stdioFor development without a build step:
npm run devAdd this server to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"strava": {
"command": "node",
"args": ["/absolute/path/to/strava-mcp/build/index.js"],
"env": {
"STRAVA_CLIENT_ID": "your_client_id",
"STRAVA_CLIENT_SECRET": "your_client_secret",
"STRAVA_ACCESS_TOKEN": "your_access_token",
"STRAVA_REFRESH_TOKEN": "your_refresh_token",
"STRAVA_TOKEN_EXPIRES_AT": "0"
}
}
}
}Restart Claude Desktop after saving.
| Tool | Description |
|---|---|
get_athlete | Profile: name, location, weight, FTP, membership type |
get_athlete_stats | Activity totals (recent / YTD / all-time) for rides, runs, swims |
get_athlete_zones | Heart rate and power training zones from your Strava settings |
| Tool | Description |
|---|---|
list_activities | Recent activities with optional date range and count cap |
get_activity | Full detail for a single activity by ID |
get_activity_laps | Lap splits (pace, HR, power) for a single activity |
get_activity_zones | HR and power zone distributions for a single activity (Strava Summit required) |
search_activities | Filter recent activities by name keyword and/or sport type |
| Tool | Description |
|---|---|
analyze_training_load | Volume, time, elevation, and weekly breakdown over a date range |
compare_training_blocks | Side-by-side comparison of two training periods with deltas |
get_training_timeseries | Week-by-week or day-by-day volume trend over a date range |
get_activity_streams | Raw sensor data (HR, pace, power, altitude, cadence) with summary stats |
src/
index.ts — MCP server entry point
types.ts — TypeScript interfaces and error classes
utils.ts — Unit conversion helpers (imperial: miles, min/mile, feet)
logger.ts — Debug logger (writes to stderr only)
token-manager.ts — In-memory OAuth token lifecycle (refresh, expiry)
strava-client.ts — Authenticated HTTP client with pagination
tools/
athlete.ts — Athlete profile and stats tools
activities.ts — Activity listing and detail tools
analysis.ts — Training load and trend analysis toolsutils.ts.maxItems to cap results.DEBUG=true.MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.