Strava MCP
Accesses Strava fitness data with OAuth so Claude can analyse runs, rides, and training load over time.
Delv Safety Grade: C
Score 62/100 · assessed 2026-04-28
This community MCP server provides read-only access to Strava fitness data via OAuth. The maintainer (Rick Huijts) appears to be a solo developer with limited public profile, creating bus factor concerns. The server requires OAuth credentials (client ID and secret) which users must obtain from Strava's developer portal, adding setup complexity but providing proper API authentication. Permissions are appropriately scoped to reading fitness data only, with no write capabilities or filesystem access. The package is distributed via npm with standard installation, though repository activity and documentation appear minimal. No security incidents are known. The main risks stem from the solo maintainer model and limited transparency around ongoing maintenance rather than the technical implementation itself, which follows OAuth best practices for API access.
Lethal Trifecta (prompt-injection exposure)
TRIFECTA RISKPrivate routes and bio. Comments and segment names are user-generated. Outbound posts to clubs and feeds.
Green flags
- Read-only API access with no write or delete permissions
- Uses proper OAuth flow rather than storing credentials directly
- Distributed via npm with standard package management
- Scoped to single domain (Strava fitness data only)
- No known security incidents or vulnerabilities
Red flags
- Solo maintainer with limited public developer profile
- Minimal repository activity and sparse documentation
- Requires manual OAuth app setup in Strava developer portal
- No visible community adoption or peer review
Permissions requested
Install
npx -y @r-huijts/strava-mcp-server
STRAVA_CLIENT_IDSTRAVA_CLIENT_SECRETReview
Install this if you're a regular Strava user who wants Claude to answer training questions without manual exports. The OAuth setup is a bit of admin, but it's the proper way to do it. Skip it if you only glance at Strava occasionally or you're not interested in conversational data analysis.
Good at
- Proper OAuth flow respects Strava's permissions and avoids brittle API key setups.
- Lets you ask natural-language questions about training data without exporting CSVs or opening the app.
- Good for runners and cyclists who want conversational access to mileage, pace, power, and training load.
- Works across Claude Desktop, Claude Code, and Cursor once configured.
Watch out
- Requires creating a Strava API application even for personal use, which adds setup friction.
- No response caching, so repeated queries in one session can hit Strava's rate limits.
- Documentation assumes familiarity with MCP config files, not beginner-friendly.
- Only useful if you log activities regularly and care about interrogating the data.
Use cases
- training log analysis
- running coach workflows
- cycling performance
- fitness journaling
Getting started
Works with
Similar MCPs
- MobbinReference 621,500+ real app screens from inside Claude, Cursor, and other AI tools. Mobbin's design library exposed as MCP so agents can work from real UI patterns instead of guessing.
- Discogs MCPSearches the Discogs music catalogue for releases, artists, labels, and marketplace listings.
- Unsplash MCPSearches Unsplash for high-quality stock photos with filters for orientation, colour, and size.
- OP.GG MCPProvides gaming data for League of Legends, TFT, and Valorant including champion analytics, esports schedules, and meta comps.