strava-server

Two servers over one Strava client:

• an Express HTTP server that runs the OAuth 2.0 flow and exposes the Strava v3 API as JSON endpoints;

• an MCP server (stdio) that exposes the same data as tools for an AI agent.

Both share src/strava/* and the same token file, so you authorize once in the browser and the MCP server picks the tokens up automatically.

1. Create a Strava API application

1. Sign in at https://www.strava.com/settings/api and create an app (a Strava subscription is required).

2. Set Authorization Callback Domain to localhost.

3. Copy the Client ID and Client Secret.

New apps start in single-player mode — only your own account can authorize them, which is exactly what this server needs.

Related MCP server: strava-mcp

2. Configure

Copy-Item .env.example .env
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"  # paste into SESSION_SECRET

Fill in STRAVA_CLIENT_ID and STRAVA_CLIENT_SECRET in .env.

.env and .tokens.json are gitignored — never commit them.

3. Run

npm install
npm run dev          # HTTP server, watch mode
# or
npm run build; npm start

Then open http://localhost:3000/auth/login and click Authorize. Strava redirects back to /auth/callback, the server exchanges the one-time code for a refresh token + access token, and persists them to .tokens.json (mode 600). Access tokens expire every 6 hours; the server refreshes them automatically before each request, so you only authorize once.

4. MCP server

npm run mcp          # stdio, via tsx
# or
npm run build; npm run mcp:start

VS Code picks up .vscode/mcp.json automatically — open the Chat view, switch to Agent mode and start the strava server. For other clients:

{
  "mcpServers": {
    "strava": {
      "command": "node",
      "args": ["C:/path/to/stravamcp/dist/mcp/index.js"],
      "env": {
        "STRAVA_CLIENT_ID": "...",
        "STRAVA_CLIENT_SECRET": "..."
      }
    }
  }
}

.env and the token file are resolved relative to the package directory, not the working directory, so the MCP server works no matter where the client launches it from.

Tools

All tools are read-only and annotated as such. Responses that would blow up an agent's context are trimmed by default: segment efforts and full-resolution polylines are opt-in, and streams are evenly downsampled (200 points by default).

If a tool reports "Not connected to Strava", run the HTTP server once and complete /auth/login — the MCP server reads the same .tokens.json.

HTTP endpoints

Auth

Data

Example:

curl http://localhost:3000/api/me
curl "http://localhost:3000/api/activities?per_page=50&after=1704067200"
curl "http://localhost:3000/api/activities/123456789/streams?keys=time,heartrate,watts"

Scopes

STRAVA_SCOPE defaults to read,read_all,profile:read_all,activity:read_all:

• profile:read_all — detailed athlete representation and /athlete/zones

• activity:read_all — "Only Me" activities, otherwise they are filtered out

• read_all — private routes and segments

If you change the scope you must re-run /auth/login; /auth/callback reports any scope the athlete declined under missing_scope.

Rate limits

Default limits are 200 requests / 15 min and 2,000 / day. The client records the limit headers from every response; a 429 is surfaced as a JSON error with the current usage. From the MCP server, call strava_get_rate_limit before issuing a burst of requests.

Notes

• /activities/{id}/zones and /segment_efforts require a Strava subscription.

• Tokens are stored on disk in plain JSON. Keep the file local; for a multi-user deployment replace src/strava/token-store.ts with an encrypted, per-user store.