StravaCAUTION
A Model Context Protocol (MCP) server that connects to Strava API, providing tools to access Strava data through LLMs
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Talk to your Strava data using AI.
Connect Claude to your Strava account and ask questions in plain English: "How far did I run this month?", "Analyze my last ride", or "Show me my fastest segments."
[](https://mseep.ai/app/r-huijts-strava-mcp)
What Can You Do With This?
Once connected, just talk to Claude like you're talking to a friend who has access to all your Strava data:
🏃 Track Your Progress
"How many kilometers did I run this month?" "Compare my running stats from January to December" "What's my longest ride ever?"
📊 Analyze Your Workouts
"Break down my last cycling workout - show me power, heart rate, and cadence" "How did my heart rate zones look during yesterday's run?" "What was my average pace for each lap in my interval training?"
🗺️ Explore Routes & Segments
"What are the most popular cycling segments near Central Park?" "Show me my starred segments" "Export my Sunday morning route as a GPX file"
🏆 Get Coaching Insights
"Analyze my training load this week" "How does my current fitness compare to last month?" "Give me a summary of my cycling performance this year"
Quick Start (3 Steps)
Step 1: Add to Claude Desktop
Open your Claude Desktop configuration file:
- Mac:
~/Library/Application Support/Claude/claude_desktop_config.json - Windows:
%APPDATA%\Claude\claude_desktop_config.json
Add this to the file:
{
"mcpServers": {
"strava": {
"command": "npx",
"args": ["-y", "@r-huijts/strava-mcp-server"]
}
}
}Step 1 (alternative): Add to Claude Code
You can add this MCP server to claude code with the followi
3d2556713bceOBSERVED · 2026-09-30Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add strava-mcp-server --env STRAVA_ACCESS_TOKEN=${STRAVA_ACCESS_TOKEN} --env STRAVA_CLIENT_SECRET=${STRAVA_CLIENT_SECRET} --env STRAVA_REFRESH_TOKEN=${STRAVA_REFRESH_TOKEN} -- npx -y @r-huijts/[email protected]{
"mcpServers": {
"strava-mcp-server": {
"command": "npx",
"args": [
"-y",
"@r-huijts/[email protected]"
],
"env": {
"STRAVA_ACCESS_TOKEN": "${STRAVA_ACCESS_TOKEN}",
"STRAVA_CLIENT_SECRET": "${STRAVA_CLIENT_SECRET}",
"STRAVA_REFRESH_TOKEN": "${STRAVA_REFRESH_TOKEN}"
}
}
}
}Exposed tools (24)
22 read · 1 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
check-strava-connection | read | Check if Strava is connected and show the current connection status. Use this when the user asks about their connection status. |
connect-strava | write | Connect your Strava account to enable activity tracking. This will open a browser window for secure authentication. Use this when the user asks to connect, link, or authenticate their Strava account. |
disconnect-strava | destructive | Disconnect your Strava account and remove stored credentials. Use this when the user wants to logout, disconnect, or remove their Strava connection. |
explore-segments | read | Searches for popular segments within a given geographical area. |
export-route-gpx | read | Exports a specific Strava route in GPX format and saves it to a pre-configured local directory. |
export-route-tcx | read | Exports a specific Strava route in TCX format and saves it to a pre-configured local directory. |
format-workout-file | read | Formats a workout plan into a structured file format (currently supports Zwift .zwo) |
get-activity-details | read | Fetches detailed information about a specific activity using its ID. |
get-activity-streams | read | Retrieves detailed time-series data streams from a Strava activity. Perfect for analyzing workout metrics, |
get-all-activities | read | Fetches complete activity history with optional filtering by date range and activity type. Supports pagination to retrieve all activities. |
get-athlete-profile | read | Fetches the profile information for the authenticated athlete, including their unique numeric ID needed for other tools like get-athlete-stats. |
get-athlete-shoes | read | Fetches the authenticated athlete |
get-athlete-stats | read | Fetches the activity statistics (recent, YTD, all-time) for a specific athlete using their ID. Requires the athleteId obtained from the get-athlete-profile tool. |
get-recent-activities | read | Fetches the most recent activities for the authenticated athlete. |
get-route | read | Fetches detailed information about a specific route using its ID. |
get-segment | read | Fetches detailed information about a specific segment using its ID. |
get-segment-effort | read | Fetches detailed information about a specific segment effort using its ID. |
get-segment-leaderboard | read | Retrieves the leaderboard for a specific Strava segment. Shows top performances with times, |
get-server-version | read | Returns the Strava MCP server version and related metadata. |
list-athlete-clubs | read | Lists the clubs the authenticated athlete is a member of. |
list-athlete-routes | read | Lists the routes created by the authenticated athlete, with pagination. |
list-segment-efforts | read | Lists the authenticated athlete |
list-starred-segments | read | Lists the segments starred by the authenticated athlete. |
star-segment | read | Stars or unstars a specific segment for the authenticated athlete. |
Trust audit
CAUTIONgrade B · trust 84/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (9)
console.log(`i️ Using Client Secret from .env.`);
console.log(`Access Token: ${access_token}`);console.log(`Refresh Token: ${refresh_token}`);console.log(`Access Token Expires At: ${new Date(expires_at * 1000).toLocaleString()}`);console.log(`[TEST] Using token: ${accessToken.substring(0, 5)}...${accessToken.slice(-5)}`);<div class="logo">🏃♂️</div>
<div class="logo">🏃♂️</div>
disconnect-strava
@modelcontextprotocol/sdk, axios, dotenv, open, zod, @types/node, @typescript-eslint/eslint-plugin, @typescript-eslint/parser
Gates applied: no_behavioural_pass.
3d2556713bcefull audit observations/trust-audit/mcp-server/r-huijts__strava-6.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-30 | 3d2556713bce | CAUTION | B | 84 | first audit |
Questions
What is the Strava MCP server?
A Model Context Protocol (MCP) server that connects to Strava API, providing tools to access Strava data through LLMs
What tools does Strava expose?
24 in total: 22 read-only, 1 that write, and 1 that can delete or overwrite (disconnect-strava). Every one is listed on this page with its risk.
Is Strava safe to connect to an agent?
With care. The audit graded it B (84/100) and found 9 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Strava need?
It reads STRAVA_ACCESS_TOKEN, STRAVA_CLIENT_SECRET and STRAVA_REFRESH_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Strava run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @r-huijts/strava-mcp-server at 1.2.1.
How current is this page?
The grade is for one exact copy of the source (3d2556713bce), read on 2026-09-30. The repository is watched and re-audited when it changes.