Provider guide · OAuth activity MCP

Strava MCP connector for AI agents

Give an MCP-compatible agent bounded access to your runs, rides, swims, routes and recorded sensor streams without handing OAuth secrets or location data to the model by default.

Short answer

The Strava MCP connector is a local-first bridge to Strava API v3. Create a personal Strava API app, run npx -y strava-mcp-unofficial setup, authorize read activity:read_all profile:read_all, and verify with npx -y strava-mcp-unofficial doctor. OAuth tokens stay local. Start with daily or weekly summaries; GPS lat/lng requires explicit opt-in and route geometry remains redacted from safe response modes.

Setup method

Connect Strava in five controlled steps

1
Create your personal Strava API app
Create an application in Strava API Settings and use http://127.0.0.1:3000/callback as the local authorization callback. Keep the client secret private.
2
Run the local setup
Run npx -y strava-mcp-unofficial setup. The setup stores the application configuration locally with restrictive file permissions.
3
Authorize only the required scopes
Complete OAuth in the browser and approve read activity:read_all profile:read_all. The athlete may decline scopes, so do not assume access until it is verified.
4
Verify auth and privacy
Run npx -y strava-mcp-unofficial doctor, then call strava_connection_status, strava_data_inventory and strava_privacy_audit before fetching activities.
5
Start with summaries
Use strava_daily_summary or strava_weekly_summary first. Request detailed streams only for a specific activity, and keep GPS disabled unless the user explicitly opts in.

Install and verify

terminal

npx -y strava-mcp-unofficial setup

verify

npx -y strava-mcp-unofficial doctor

MCP client configuration

Add the standalone server after setup and OAuth succeed locally.

mcp-client.json

{
  "mcpServers": {
    "strava": {
      "command": "npx",
      "args": ["-y", "strava-mcp-unofficial"]
    }
  }
}

What the agent can use

Activities and summaries

Runs, rides, swims and workouts, plus daily and weekly training context.

Recorded streams

Heart rate, power, cadence, altitude and related series when the device and upstream activity provide them.

Routes and gear

Route and equipment context with route geometry removed from safe response modes.

Location by consent

GPS lat/lng is available only through an explicit user opt-in for a specific stream request.

Recorded data is conditional: activity streams depend on the recorded sensors, activity visibility and granted OAuth scopes. Missing heart rate, power, cadence or GPS must remain missing; an agent should never infer sensor measurements that Strava did not return.

Safe first-call sequence

1. strava_connection_status
2. strava_data_inventory
3. strava_privacy_audit
4. strava_daily_summary
5. strava_activity_series

Privacy boundary

OAuth tokens stay local and are never returned through MCP tools.
Write and upload scopes are not requested by default.
GPS lat/lng requires explicit opt-in; raw mode also requires explicit user intent.
Revoke access when the connector is no longer needed.

Rate limits without polling loops

Strava documents default overall limits of 200 requests every 15 minutes and 2,000 per day for newly created apps, alongside separate read limits and athlete-capacity tiers. Treat response headers as the live authority. Prefer summaries, pagination and caching over repeated full-history fetches; a hosted multi-user app should use webhooks instead of polling for activity changes.

Strava MCP questions

What is the Strava MCP connector?

strava-mcp-unofficial is a local-first bridge between Strava API v3 and an MCP-compatible AI agent. It exposes read-only activities, summaries, streams, routes and athlete context while keeping OAuth tokens outside model responses.

How do I connect Strava MCP to Claude?

Create a personal Strava API app, run the local setup and doctor commands, add the documented mcpServers block to Claude Desktop and start with strava_connection_status, strava_data_inventory and strava_privacy_audit. Keep GPS disabled unless the user explicitly opts in.

Which Strava OAuth scopes does it request?

The recommended baseline is read activity:read_all profile:read_all. Strava lets an athlete decline individual scopes, so the connector doctor verifies the scopes actually granted before an agent requests private activities or profile details.

Can an AI agent see my activity map?

Not by default. GPS lat/lng requires explicit opt-in, and route geometry is redacted from summary and structured modes. Raw or GPS-bearing output should be requested only after the user understands the location exposure.

Does every Strava activity have heart rate, power or cadence streams?

No. Activity streams depend on the recorded sensors, the activity type, privacy and the scopes granted. A missing stream means the upstream record did not return that series; it should not be inferred or fabricated.

What Strava rate limit should a personal agent expect?

Strava documents default overall limits of 200 requests every 15 minutes and 2,000 per day for newly created applications, with separate read limits and account-tier differences. The connector caches and throttles, but callers should still batch work and avoid polling loops.

Is this an official Strava product or medical advice?

No. Delx Wellness and strava-mcp-unofficial are not affiliated with Strava. The connector supplies personal training context and is not medical advice, diagnosis, treatment or emergency monitoring.

Canonical and official sources

Strava connector specification Strava OAuth documentation Strava API rate limits Strava API v3 reference Strava webhook events Machine-readable Markdown

Delx Wellness and strava-mcp-unofficial are not affiliated with Strava. This page provides technical wellness integration context, not medical advice.