Strava Planner MCP

Item: Strava Planner MCP
Rating: 74
Author: M8ven

Exposes Strava training data to Claude for coaching, planning, and analysis via a read-only MCP server with OAuth and Docker support.

→ Mohith1612/strava-planner-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Tests do not pass

Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.

✅

13 tools verified — handlers match their declared behaviour

13 read-only tools verified — handlers contain no write/delete/exec

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

🔐

You'll be asked for 2 credentials: STRAVA_REFRESH_TOKEN, STRAVA_TOKEN_ENCRYPTION_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configATHLETE_CONTEXT_PATH— Unset outside Docker; /config/athlete-context.json in Compose.

configMCP_HOST— 0.0.0.0 (production behind Nginx). Use 127.0.0.1 for authless local dev.

configMCP_PUBLIC_URL— Exact public endpoint, e.g. https://mcp-strava.example.com/mcp.

configSTRAVA_REDIRECT_URI

🔐 secretSTRAVA_REFRESH_TOKEN— 1. Set from the Strava API application page. On first API use, the server exchanges it and writes the current token set to the encrypted token file.

🔐 secretSTRAVA_TOKEN_ENCRYPTION_KEY— Use them for , MCP_OAUTH_CLIENT_ID, MCP_OAUTH_CLIENT_SECRET, and MCP_OAUTH_TOKEN_SIGNING_KEY respectively.

configSTRAVA_TOKEN_PATH— ~/.strava-planner-mcp/tokens.enc.json outside Docker; /data/tokens.enc.json in Compose.

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/mohith1612-strava-planner-mcp-jm9p72)](https://m8ven.ai/mcp/mohith1612-strava-planner-mcp-jm9p72)

commit: 185be3e6564901bcb63494f53eb5817a7eb201c3

code hash: 4c7b0ae630510c0c1742a030609e330cff8c63080dc68be2fcc74d8d1c2b60e7

verified: 7/15/2026, 8:45:39 AM

view raw JSON →