Strava MCP server

A local, read-only Model Context Protocol server for an athlete's Strava profile and activities. It uses standard input/output, so it works with MCP hosts that can launch a local command.

What it can do

• get_my_profile — retrieve the authenticated athlete's profile
• list_my_activities — retrieve recent activities, with paging and date filters
• get_activity — retrieve a detailed activity by its Strava ID

Set up

1. In Strava API Settings, create an application. Copy the client ID and client secret.

2. In the app settings, set Authorization Callback Domain to localhost.

3. Copy .env.example to .env and fill in STRAVA_CLIENT_ID and STRAVA_CLIENT_SECRET.

4. Run npm run authorize. Open the printed sign-in link and authorize read,activity:read. The helper verifies activity access and saves the issued tokens to .env automatically.

5. Install and check the project:

   npm install
   npm run build
   

6. Configure your MCP host to run:

   {
     "command": "npx",
     "args": ["tsx", "C:/absolute/path/to/strava-mcp/src/index.ts"]
   }
   

The server reads credentials from the project's .env file. Do not duplicate tokens in the MCP host configuration, because copied values become stale when Strava rotates a refresh token.

Use the server's inspect script to test it interactively before connecting it to a host.

Security

• Never place .env or a refresh token in source control.
• The server only registers read-only tools. Add activity-creating or activity-editing tools only after deciding how you want human confirmation to work.
• OAuth access may be narrower than requested if the athlete declined a scope; tool calls then receive a Strava error.

Token refresh

Strava issues a refresh token plus a short-lived access token. The authorization helper saves the initial token set to .env, and the server writes newly rotated tokens back to .env before continuing. This ensures that restarts use the most recent refresh token.