rerun-tests-when-changes — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited rerun-tests-when-changes (Rules) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Fork notice. This is an independently-maintained fork ofchrisdoc/hevy-mcp, repackaged for multi-tenant MCP gateways. It ships the same Hevy tools wrapped in supergateway as an OCI image that speaks MCP streamable-HTTP over HTTP, instead of stdio. Use the upstreamhevy-mcpnpm package for local/stdio use in Claude Desktop, Cursor, etc.
A Model Context Protocol (MCP) server for the Hevy fitness tracking app, packaged as a supergateway-wrapped OCI image for hosting behind an MCP gateway. Exposes MCP streamable-HTTP on /mcp and health on /healthz; reads HEVY_API_KEY from the container environment.
Pick the workflow that fits your setup:
| Scenario | Command | Requirements |
|---|---|---|
| One-off stdio run | HEVY_API_KEY=sk_live... npx -y hevy-mcp | Node.js ≥ 24, Hevy API key |
| Local development | npm install && npm run build && npm start | .env with HEVY_API_KEY |
.nvmrc).You can launch the server directly without cloning:
HEVY_API_KEY=your_hevy_api_key_here npx -y hevy-mcp# Clone the repository
git clone https://github.com/chrisdoc/hevy-mcp.git
cd hevy-mcp
# Install dependencies
npm install
# Create .env and add your keys
cp .env.sample .env
# Edit .env and add your HEVY_API_KEYTo use this server with Claude Desktop, add the following to your claude_desktop_config.json:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"hevy-mcp": {
"command": "npx",
"args": ["-y", "hevy-mcp"],
"env": {
"HEVY_API_KEY": "sk_live_your_key_here"
}
}
}
}Add this server under "mcpServers" in ~/.cursor/mcp.json:
{
"mcpServers": {
"hevy-mcp": {
"command": "npx",
"args": ["-y", "hevy-mcp"],
"env": {
"HEVY_API_KEY": "your-api-key-here"
}
}
}
}oxlint/oxfmt) for near-instant linting and formatting.Supply your Hevy API key via:
HEVY_API_KEY (in .env or system environment).--hevy-api-key=your_key (after -- in npm scripts).# Example .env
HEVY_API_KEY=your_hevy_api_key_herehevy-mcp includes Sentry monitoring to observe errors and usage in production. It initializes @sentry/node with tracing enabled and PII collection disabled by default.
The MCP server itself speaks stdio only. For multi-tenant gateway deployments (e.g. mcp-gateway-poc), this repo ships a Dockerfile that wraps the stdio binary with supergateway so a single container exposes MCP streamable-HTTP.
The image follows the same contract every gateway-hosted MCP uses:
0.0.0.0:$PORT at /mcp/healthzMcp-Session-Id honored)HEVY_API_KEY is read from the container environment and passed to thespawned stdio child
Images are published to ghcr.io/rwestergren/hevy-mcp from main and from any manually cut GitHub release. Build locally with:
docker build -t hevy-mcp:local .
docker run --rm -e HEVY_API_KEY=sk_live_... -p 8080:8080 hevy-mcp:local
curl http://localhost:8080/healthzEnd users running hevy-mcp directly should use the stdio/npx flow above; the Docker image is aimed at gateway operators, not individual clients.
| Category | Tools |
|---|---|
| Workouts | get-workouts, get-workout, create-workout, update-workout, get-workout-count, get-workout-events |
| Routines | get-routines, get-routine-by-id, create-routine, update-routine |
| Templates | get-exercise-templates, get-exercise-template, search-exercise-templates |
| Folders | get-routine-folders, get-routine-folder, create-routine-folder |
| Webhooks | get-webhook-subscription, create-webhook-subscription, delete-webhook-subscription |
npm run buildnpm run check (uses oxlint/oxfmt)npx vitest run --exclude tests/integration/**npm test (requires HEVY_API_KEY)For a detailed senior engineer guide, please refer to AGENTS.md.
The API client is automatically generated from the OpenAPI spec using Kubb:
npm run build:clientContributions are welcome! Please open an issue or PR for any major changes.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.