70
grade C
11 days ago
glama
Strava MCP Server
An MCP server that enables interaction with the Strava API v3 to manage fitness activities, athlete profiles, segments, and routes. It supports retrieving detailed performance metrics, exploring geographic data, and managing club information through natural language.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
⚠️
Known vulnerabilities in dependencies: 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
34 tools verified — handlers match their declared behaviour
30 read-only tools verified — handlers contain no write/delete/exec
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 3 credentials: STRAVA_ACCESS_TOKEN, STRAVA_CLIENT_SECRET, STRAVA_REFRESH_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from
process.env. You'll be asked to provide them before it can run.🔐 secret
STRAVA_ACCESS_TOKEN— export ="your_access_token"config
STRAVA_CLIENT_ID— export ="your_client_id"🔐 secret
STRAVA_CLIENT_SECRET— export ="your_client_secret"🔐 secret
STRAVA_REFRESH_TOKEN— export ="your_refresh_token"// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/justmytwospence-strava-mcp-1xf29z)commit: 2f754fa8c82ec2a004220fe193f08995103de9b1
code hash: db93c2b8ced9d94c29e8266a4f4159f4130aae9b8c21d97dd6e58460cb0a2ccf
verified: 4/11/2026, 2:50:17 PM