Strava MCP server
# Strava MCP server
A local, read-only Model Context Protocol server for an athlete's Strava profile and activities. It uses standard input/output, so it works with MCP hosts that can launch a local command.
## What it can do
- `get_my_profile` — retrieve the authenticated athlete's profile
- `list_my_activities` — retrieve recent activities, with paging and date filters
- `get_activity` — retrieve a detailed activity by its Strava ID
## Set up
1. In [Strava API Settings](https://www.strava.com/settings/api), create an application. Copy the client ID and client secret.
2. In the app settings, set **Authorization Callback Domain** to `localhost`.
3. Copy `.env.example` to `.env` and fill in `STRAVA_CLIENT_ID` and `STRAVA_CLIENT_SECRET`.
4. Run `npm run authorize`. Open the printed sign-in link and authorize `read,activity:read`. The helper verifies activity access and saves the issued tokens to `.env` automatically.
5. Install and check the project:
```sh
npm install
npm run build
```
6. Configure your MCP host to run:
```json
{
"command": "npx",
"args": ["tsx", "C:/absolute/path/to/strava-mcp/src/index.ts"]
}
```
The server reads credentials from the project's `.env` file. Do not duplicate
tokens in the MCP host configuration, because copied values become stale when
Strava rotates a refresh token.
Use the server's `inspect` script to test it interactively before connecting it to a host.
## Security
- Never place `.env` or a refresh token in source control.
- The server only registers read-only tools. Add activity-creating or activity-editing tools only after deciding how you want human confirmation to work.
- OAuth access may be narrower than requested if the athlete declined a scope; tool calls then receive a Strava error.
## Token refresh
Strava issues a refresh token plus a short-lived access token. The authorization helper saves the initial token set to `.env`, and the server writes newly rotated tokens back to `.env` before continuing. This ensures that restarts use the most recent refresh token.
TDQS
Scored across 3 tools
The three tools are clearly distinct: one returns the athlete profile, one lists activities, and one returns a single activity's detail. Minor potential confusion between list_my_activities and get_activity, but their purposes are obvious and descriptions clarify the distinction.
All tools use a consistent verb_noun pattern (get_my_profile, list_my_activities, get_activity) with snake_case throughout. Minor inconsistency: 'my' is included in two names but not in get_activity, which slightly breaks the symmetry.
Three tools is on the lower end of the acceptable range and feels thin for a server covering an activity-tracking platform like Strava. It's borderline — sufficient to demonstrate the server works, but not a rich surface.
The surface only offers read operations: profile retrieval, activity listing, and activity detail. Notable gaps include no ability to create/upload activities, update activity records (e.g., change title or privacy), delete activities, manage segments, access clubs, or handle friends/athletes. It's a purely read-only view with no lifecycle operations.