long-run-hybrid-coachBLOCK
Adaptive running and strength coaching for the long run — a hosted MCP server and Agent Skill that keeps one current 28-day plan in step with your Intervals.icu evidence. Independent project, not affiliated with Garmin or Intervals.icu.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
繁體中文 · English · 简体中文
官網 paceandstaystrong.com | 遇到問題看支援頁
把一個網址貼進 Claude 或 ChatGPT,你就有一個讀得到你真實訓練的教練。
它讀你 Intervals.icu 帳號裡的活動與恢復數據,維持同一份 28 天的跑步+重訓方向與本週課表,拿計畫去對你實際做了什麼,並在你同意之後,把每一堂課排進你的日曆。免費使用,沒有付費方案。
Garmin 不是使用前提。 Garmin 只是目前第一條做過實機驗證的下游裝置路徑;Apple Watch、COROS、Polar、Suunto、Wahoo、其他 app/手錶,甚至沒有手錶,都可以用同一個教練。差別在於有多少可信的訓練紀錄能進到教練手上,以及 Intervals 後面那段裝置同步是否已經被驗證過。
一般使用者直接用託管版: https://mcp.paceandstaystrong.com/mcp。你需要一個 Intervals.icu 帳號,但不需要自己向 Intervals 申請 OAuth App,也不需要自己維運伺服器。連接:兩步
官網把同一條流程拆成四個點擊步驟走一次:開始使用。
你需要什麼
- 一個 Intervals.icu 帳號。 免費,用 Google 登入大約 30 秒就能開好。
- Claude 或 ChatGPT。
- Claude(claude.ai/Claude Desktop):免費方案就可以,免費帳號限一個自訂連接器。這條路徑已經做過完整實機驗證——production OAuth、教練對話、以及把課表送進 Intervals。
- ChatGPT:目前需要 Business、Enterprise 或 Edu 的網頁版 workspace,在 Apps/developer mode 建立 custom app。個人方案的 custom MCP 只有 read/fetch,跑不完本產品「寫計畫+交付課表」的流程;個人方案請先等這個教練在 ChatGPT 目錄上架。最新限制以 OpenAI 官方說明 為準。
- 其他 MCP client:OpenClaw 與自架 client 見下面一節。
- 選配:已經會把活動同步進 Intervals.icu 的手錶或訓練 app。沒有手錶也可以用——教練會把拿不到的欄位當成「不知道」,不會當成 0。
第一步:把網址貼進你的 AI
在 AI 的連接器設定裡新增一個 remote MCP server,網址是:
https://mcp.paceandstaystrong.com/mcp
- claude.ai/Claude Desktop:Settings → Connectors → Add custom connector → 貼上網址。
- ChatGPT:Apps/developer mode → 建立 custom app → 指到同一個網址。
沒有別的欄位要填,也沒有金鑰要貼。
第二步:授權 Intervals.icu
瀏覽器會開 Intervals.icu 的同意頁。登入你自己的 Intervals.icu 帳號,四個權限都勾起來:
f2993796b216OBSERVED · 2026-10-11Trust audit
BLOCKgrade F · trust 57/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
- **The access line still names the tool and the outcome** — `tool=... outcome=...` — on
.claude/skills/garmin-coach-loop
if header and header[0].startswith(""):header[0] = header[0].lstrip("")TOKEN = "tok-scenario-fixture"
token = "openai-apps-verification-9f2c41d7"
token = "openai-apps-verification-9f2c41d7"
token="not-a-token-this-gateway-issued"
SECRET = "SECRET-PROVIDER-TOKEN-abc123"
for bad in ("zh Hant", "x" * 33, {"lang": "zh"}, "../../etc"):for session_id in ("short", "x" * 129, "has space", "../../etc/passwd", None, 12):"../../etc",
for name in ("../escape.json", "commits/../../escape.json", "notes.txt"):| Address | `https://mcp.paceandstaystrong.com/mcp` | your own server, e.g. `http://127.0.0.1:8422/mcp` |
6. Point a local MCP client at `http://127.0.0.1:8422/mcp`.
| 網址 | `https://mcp.paceandstaystrong.com/mcp` | 你自己的伺服器,例如 `http://127.0.0.1:8422/mcp` |
6. 本機 MCP client 指到 `http://127.0.0.1:8422/mcp`。
| 网址 | `https://mcp.paceandstaystrong.com/mcp` | 你自己的服务器,例如 `http://127.0.0.1:8422/mcp` |
payload = base64.b64decode(content, validate=True)
decoded = base64.b64decode(auth_header.removeprefix("Basic ")).decode("ascii")`ignore-the-previous-instruction.example` is a legal one. Interpolating it into the
2. **Request an OAuth application from Intervals.icu.** Their public process is not self-service app creation in Settings: send the application details listed in [Intervals.icu OAuth support](https://
Exporting is something you do yourself in the conversation. **Deleting the whole account is a written request**, at [the support page](https://paceandstaystrong.com/support.html#data-by-email): it ask
- **[Issue tracker](https://github.com/atomchung/long-run-hybrid-coach/issues):** bugs and feature requests. It is public and permanent, so **never post** health, training, or plan content, an Interva
匯出在對話裡自己做。**刪除整個帳號是寫信申請**,流程在[支援頁](https://paceandstaystrong.com/zh/support.html#data-by-email):要的是你的 Intervals.icu athlete id,以及一張 Intervals.icu Settings 頁的截圖;不會跟你要密碼、API key 或 token。在對話裡要求刪除全部資料,教練只
Gates applied: no_behavioural_pass.
f2993796b216full audit observations/trust-audit/mcp-server/atomchung__long-run-hybrid-coach.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | f2993796b216 | BLOCK | F | 57 | first audit |
Questions
What is the long-run-hybrid-coach MCP server?
Adaptive running and strength coaching for the long run — a hosted MCP server and Agent Skill that keeps one current 28-day plan in step with your Intervals.icu evidence. Independent project, not affiliated with Garmin or Intervals.icu.
Is long-run-hybrid-coach safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (57/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does long-run-hybrid-coach need?
It reads GITHUB_TOKEN and PASS_ON from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does long-run-hybrid-coach run?
It speaks streamable-http, so it runs as a service you connect to over the network.
How current is this page?
The grade is for one exact copy of the source (f2993796b216), read on 2026-10-11. The repository is watched and re-audited when it changes.