Link/manage a Hevy Pro account, then read or optionally write training data.
Auth: connect via one-time link to paste a Hevy Pro API key, check status, disconnect, and search available capabilities.
Read: list/get/count workouts and incremental workout events, exercise history, routines and routine folders, exercise templates, user info, and body measurements.
Write only when HEVY_ENABLE_WRITES=true: create/update workouts, create/update routines, create routine folders, create exercise templates.
Body measurements are deliberately read-only (Withings is source of truth).
Hevy API constraints: no DELETE or PATCH, PUT replaces whole records, creates are not idempotent, weights in kg, durations in seconds, small page limits.
Provides tools for interacting with the Hevy strength-training API, enabling users to manage workouts, routines, exercise templates, and view exercise history and body measurements.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-server-hevy show my recent workouts"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server for the Hevy strength-training API — workouts, routines, exercise history and progression data.
Self-hosted alternative to the public hosted Hevy MCP, built to the same shape as our other personal connectors: one shared instance, per-user credentials encrypted at rest, access gated by the identity the gateway verifies.
Independent, unofficial project. Not affiliated with Hevy.
Hevy Pro. The Hevy developer API is only available to Pro subscribers — the API key simply doesn't exist on a free account, so nothing here will work without one.
Related MCP server: Hevy MCP
The key never passes through the conversation. Instead:
Ask Claude to connect Hevy → hevy_connect returns a one-time link
Open it, check that it shows your gateway identity, tick the confirmation box, then paste the Hevy API key into the form and submit
The server validates it against Hevy before storing it, so a wrong key fails immediately rather than as a confusing 401 later
The key is found at hevy.com/settings?developer — in a browser, not the mobile app.
This mirrors mcp-server-garmin: the enrollment route is reached directly
(bypassing the gateway) and is secured by a single-use, user-bound state token
plus an explicit identity confirmation that is bound to the confirming browser
(HttpOnly cookie), so a link opened by someone else cannot silently attach their
key to another identity.
Unlike an OAuth code, a Hevy API key is long-lived, which is exactly why it
shouldn't sit in a chat transcript.
Auth: hevy_connect, hevy_status, hevy_disconnect, hevy_search_capabilities
Read: hevy_get_workouts, hevy_get_workout, hevy_get_workout_count,
hevy_get_workout_events (incremental sync), hevy_get_exercise_history,
hevy_get_routines, hevy_get_routine, hevy_get_routine_folders,
hevy_search_exercise_templates, hevy_get_exercise_template,
hevy_get_user_info, hevy_get_body_measurements
Write (only registered when HEVY_ENABLE_WRITES=true):
hevy_create_workout, hevy_update_workout, hevy_create_routine,
hevy_update_routine, hevy_create_routine_folder,
hevy_create_exercise_template
These are properties of Hevy's API, not choices made here:
No DELETE, no PATCH. Nothing can be deleted through the API, and there is no partial update.
PUT replaces the whole record. Any exercise or set omitted from an update
is erased. Always read the current object first and resend it complete — the
update tools are annotated destructiveHint for this reason.
Creates are not idempotent. A retried create makes a duplicate, so this client retries GET only; failed writes surface to the caller instead of silently double-posting.
Units are fixed: weights in kilograms, durations in seconds.
Small pages. Max 10 per page for workouts/routines/folders, 100 for exercise templates.
Hevy's own docs describe the API as unstable and subject to change.
Hevy can store body weight and composition, and its API can write them — this server intentionally doesn't. Withings is the source of truth for body metrics in our setup; writing them here too would create a second competing record with no defined winner. Reading is exposed so existing Hevy data stays visible.
HEVY_ENCRYPTION_KEY= # AES-256-GCM key for the credential store (openssl rand -hex 32)
HEVY_STORE_PATH=/data/store.json
HEVY_PUBLIC_BASE_URL= # public origin, used to build the enrollment link
HEVY_TRUST_FORWARDED_USER=true
HEVY_ENABLE_WRITES=true
HEVY_AUDIT_LOG=
HEVY_TIMEOUT_MS=30000
MCP_HTTP_TOKEN= # REQUIRED with HEVY_TRUST_FORWARDED_USER=true (see below)MCP_HTTP_TOKEN is the shared bearer the gateway sends on /mcp
(Authorization: Bearer <token>), compared in constant time. When
HEVY_TRUST_FORWARDED_USER=true the server refuses to start without it,
because otherwise anyone who can reach the port could claim any X-MCP-User.
Keep /mcp reachable only from the gateway.
No app-level API credentials exist — every credential is per user.
npm run typecheck && npm test && npm run buildApache-2.0
Start linking YOUR Hevy account. Returns a one-time link to a form where you paste your Hevy API key — the key is never sent through this conversation. Get the key from hevy.com/settings?developer in a BROWSER (it is not in the mobile app) — it requires an active Hevy Pro subscription.
Inputs: no named parameters.
Remove your stored Hevy API key from this server.
Inputs: no named parameters.
Body measurements stored in Hevy. READ-ONLY here by design: Withings is the source of truth for body weight and composition, so this server deliberately does not write measurements and create a second competing record.
Inputs: page, pageSize.
Every recorded set for one exercise template over time — the right tool for judging progression on a specific lift.
Inputs: exerciseTemplateId (required), endDate, startDate.
One exercise template by id.
Inputs: exerciseTemplateId (required).
One routine by id. Always fetch this before hevy_update_routine — updates replace the entire routine.
Inputs: routineId (required).
Your routine folders.
Inputs: page, pageSize.
Your saved routines (training templates). Max 10 per page.
Inputs: page, pageSize.
Your Hevy profile (id, name, profile URL).
Inputs: no named parameters.
One workout by id.
Inputs: workoutId (required).
Total number of workouts you have logged.
Inputs: no named parameters.
Workouts updated or deleted since a timestamp — use for incremental sync rather than re-reading everything.
Inputs: page, since, pageSize.
Your logged workouts, newest first, with full exercise and set detail. Max 10 per page.
Inputs: page, pageSize.
Find the right Hevy tool. Use first.
Inputs: limit, query.
Find exercise templates by name to get the exercise_template_id needed for creating workouts/routines. Hevy has no server-side search, so this pages through templates and filters locally.
Inputs: query, maxPages, pageSize.
Whether your Hevy account is linked.
Inputs: no named parameters.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 16 tools
Each tool has a clearly distinct purpose: account management (connect/status/disconnect), workouts (list/single/count/events), routines (list/single/folders), exercise templates (search/get), plus dedicated tools for history, user info, and body measurements. No tools appear to overlap or cause confusion.
All tools use the consistent hevy_ prefix and snake_case, with the vast majority following a verb_noun pattern (get_workouts, search_exercise_templates). Even the exceptions (connect, status, disconnect) are clear and fit the overall style without mixing conventions.
16 tools is slightly above the typical 3-15 well-scoped range, but each tool serves a distinct purpose in covering Hevy's account, workout, routine, and template data. The count is still reasonable and not bloated.
The tool set has significant gaps: it references hevy_update_routine (which is missing) and mentions creating workouts/routines via template IDs, but offers no create or update tools for workouts or routines. This leaves critical actions unavailable and creates a dead end for agents.
Remote MCP server for training, nutrition, wellness, and performance data with OAuth 2.0.
Track meals, nutrition, recipes, and grocery lists privately from any MCP client.
MCP server for Withings health data — sleep, activity, heart, and body metrics.
Fitness MCP for coaches and gyms: build workouts and read clients' training from live Superset data.