Pelaris (theDonk/pelaris-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 35 tools. No publisher has claimed this listing.
Connect Pelaris to any MCP-compatible AI assistant for personalised fitness coaching. Plan training programs, log workouts, track benchmarks, manage goals, and get data-driven coaching insights. Supports science-based methodologies including 5/3/1, Pfitzinger, polarised training, and more. OAuth 2.0 authentication with Streamable HTTP transport. Documentation: https://pelaris.io/integrations Web
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
theDonk
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
list_feedbackList user feedback entries. PII is automatically scrubbed from the response.
get_feedback_itemGet a single feedback entry by ID. PII is automatically scrubbed.
list_pipeline_itemsList content pipeline items, optionally filtered by status or type.
get_pipeline_itemGet a single content pipeline item by ID.
write_pipeline_itemCreate or update a content pipeline item. Provide an ID to update, omit to create.
get_user_statsGet aggregate user statistics (counts only). No individual profile data is returned — privacy by design.
get_researchQuery research cache by topic. Returns cached research content, sources, and metadata.
write_researchWrite or update a research cache entry. Creates a new document or updates an existing one by ID.
record_injuryLog an injury or pain point so your training plan adapts automatically. Returns a coaching note about how sessions will adjust.
daily_check_inLog how you're feeling today — readiness, soreness, sleep, and mood. Your coach uses this to adapt upcoming sessions.
create_planned_sessionSchedule a future workout session with target exercises. The session will appear in your training calendar ready to track.
delete_sessionDelete a planned training session. Completed and Strava-imported sessions cannot be deleted.
delete_sessionsDelete multiple planned training sessions at once (max 20). Returns per-session success/failure.
generate_weekly_planGenerate a new weekly training plan tailored to your program, goals, and readiness. Sessions are written directly to your calendar.
get_active_programView your current training programs with progress, phase, weekly structure, and session details.
get_benchmarksView your performance benchmarks — current values, trends, and progress over time.
get_body_analysisView your latest body composition data — measurements, ratios, archetype, and changes since your last analysis.
get_coach_insightGet personalised coaching observations based on your recent training — consistency, fatigue, goal progress, and areas to focus on.
get_generation_statusCheck the status of a training plan generation job. Returns progress through pipeline stages and session count when complete.
get_onboarding_statusCheck your account setup progress — intake completion, sport selection, program creation, and device connections.
get_program_statusView your current active training programs or browse your full program history.
get_session_detailsView the full details of a workout session — exercises, sets, reps, weights, completion status, and feedback.
get_training_overviewView your complete training snapshot — active programs, recent sessions, check-in data, goals, and progress at a glance.
get_weekly_debriefView your weekly training summary — session completion, highlights, areas for improvement, and next week's focus.
send_feedbackShare feedback about the coaching experience to help improve tool quality and accuracy.
log_completed_sessionLog a completed workout retroactively with exercises, RPE, feedback, and coach notes. Prevents duplicate entries automatically.
log_workoutRecord a completed workout with exercises, RPE, and how you felt. Duplicate entries are automatically prevented.
manage_goalsCreate, update, complete, or list your training goals. Supports race events, body composition targets, and performance milestones.
manage_programArchive a training program. Use get_program_status to view programs first.
modify_training_sessionAdjust a planned session — reduce volume, change intensity, swap exercises, or reschedule to a different date.
record_benchmarkRecord a new personal best or benchmark result. Previous values are saved to history so you can track progress over time.
search_training_resourcesSearch the curated library of coaching articles, videos, and guides. Find resources by topic, sport, or training goal.
swap_exerciseFind alternative exercises with rationale, or swap an exercise in a planned session. Returns 3 suggestions based on movement pattern.
update_sessionUpdate an existing session with corrected or additional data — title, focus, duration, status, RPE, feedback, exercises, or coach notes.
update_profileUpdate your training preferences — equipment, available days, session duration, experience level, and more.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
ALLOWED_ORIGINSCF_BASE_URLGCP_PROJECT_IDMCP_BEARER_TOKENMCP_JWT_SECRETOAUTH_CF_BASEOWNERSHIP_VERIFICATION_LOG_ONLYPORTTool annotations
27/35 tools have annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
18/35 tools missing one or more hints — list_feedback (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_feedback_item (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_pipeline_items (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +15 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
openWorldHint matches behaviour
1 tool claims openWorldHint=false but make outbound HTTP — generate_weekly_plan → dynamic (line 108)
Either flip openWorldHint to true (acknowledging external reach) or refactor the handler to avoid outbound HTTP. If the only network calls are to a known fixed endpoint that you consider part of the tool itself, document that and keep openWorldHint=false; otherwise true is honest.
Tool inputs are validated
Only 10/35 tool handlers declare input schemas (29%)
Declare an inputSchema with zod/joi/yup on every tool definition.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.0 (high), @modelcontextprotocol/sdk@1.12.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/thedonk/pelaris-mcp-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check