// SCAN REPORT

Strava MCP Server

34 tools. 4 can modify or destroy data without limits.

4 write tools that can modify data. Rate limits recommended.

Last updated: 3 Jul 2026

4 can modify or destroy data

30 read-only

34 tools total

Community server · catalogue entry verified 03/07/2026

How to control Strava MCP Server ↓

TOOL MAP

What Strava MCP Server exposes to your agents

Read (30) Write / Execute (4) Destructive / Financial (0)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

High Risk

The most dangerous Strava MCP Server tools

Write · Medium strava_create_activity This tool creates new activity records in Strava, which is a reversible data modification operation. Write · Medium strava_create_upload This tool creates and persists new data (fitness activities) in the user's Strava account. Write · Medium strava_update_activity The tool modifies existing activity records (e.g., name, description, type, privacy settings) in a reversible manner. Write · Low strava_star_segment This tool modifies a user preference (starring/unstarring a segment) which is a reversible write operation.

4 of Strava MCP Server's 34 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Strava MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and Strava MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Rate limit write operations

{
  "strava_create_activity": {
    "limits": [
      {
        "counter": "strava_create_activity_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "strava_explore_segments": {
    "limits": [
      {
        "counter": "strava_explore_segments_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Strava MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON STRAVA →

Instant setup, no code required.

FULL CATALOGUE

All 34 Strava MCP Server tools

WRITE 4 tools

Write strava_create_activity Create a manual activity entry. Requires activity:write scope. Write strava_create_upload Upload an activity file (FIT, TCX, or GPX format) to create a new activity. The file content must be base64-en Write strava_star_segment Star or unstar a segment for the authenticated athlete. Write strava_update_activity Update an activity

READ 30 tools

Read strava_explore_segments Find popular segments within a geographic bounding box. Provide SW and NE corner coordinates as a comma-separa Read strava_export_route_gpx Export a route as a GPX file. Returns raw GPX XML content. Read strava_export_route_tcx Export a route as a TCX file. Returns raw TCX XML content. Read strava_export_segment_gpx Export a Strava segment as a GPX file for navigation. Returns GPX XML that can be imported into Garmin Connect Read strava_get_activity Get detailed information about a specific activity including description, calories, splits, laps, segment effo Read strava_get_activity_streams Get high-resolution time-series data for an activity (heart rate, power, cadence, altitude, GPS coordinates, e Read strava_get_athlete_stats Get activity statistics for an athlete: recent, year-to-date, and all-time totals for runs, rides, and swims. Read strava_get_athlete_zones Get the authenticated athlete Read strava_get_authenticated_athlete Get the profile of the currently authenticated athlete, including name, location, stats summary, bikes, and sh Read strava_get_club Get detailed information about a club including description, member count, and sport type. Read strava_get_gear Get equipment details by ID (name, brand, model, total distance). Gear IDs look like Read strava_get_route Get detailed route information including distance, elevation gain, and estimated moving time. Read strava_get_route_streams Get GPS coordinates, distance, and altitude data for a route. Read strava_get_segment Get detailed information about a segment including distance, elevation, grade, effort count, and athlete count Read strava_get_segment_effort Get a specific segment effort by ID, including elapsed time, heart rate, watts, and achievements. Read strava_get_segment_effort_streams Get high-resolution time-series data for a segment effort. Read strava_get_segment_streams Get GPS coordinates, distance, and altitude data for a segment. Read strava_get_upload Check the processing status of an upload. Returns status, error info, and the resulting activity ID once compl Read strava_list_activities List the authenticated athlete Read strava_list_activity_comments List comments on an activity. Read strava_list_activity_kudoers List athletes who gave kudos on an activity. Read strava_list_activity_laps List laps of an activity. Each lap includes distance, time, speed, heart rate, watts, and elevation. Read strava_list_activity_zones Get heart rate and power zone distribution for an activity. Shows time spent in each zone. Read strava_list_athlete_clubs List clubs the authenticated athlete belongs to. Read strava_list_athlete_routes List routes created by an athlete. Read strava_list_club_activities List recent activities by members of a club. Only includes activities set to Read strava_list_club_admins List admins of a club. Read strava_list_club_members List members of a club. Read strava_list_segment_efforts List efforts on a segment, optionally filtered by date range. Returns the authenticated athlete Read strava_list_starred_segments List segments starred by the authenticated athlete.

FAQ

Questions about Strava MCP Server

How do I prevent bulk modifications through Strava MCP Server? +

The Strava MCP Server server has 4 write tools including strava_create_activity, strava_create_upload, strava_star_segment. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Strava MCP Server.

How many tools does the Strava MCP Server MCP server expose? +

34 tools across 2 categories: Read, Write. 30 are read-only. 4 can modify, create, or delete data.

How do I enforce a policy on Strava MCP Server? +

Register the Strava MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Strava MCP Server tool call.

Deterministic rules across all 34 Strava MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON STRAVA →

Instant setup, no code required.

34 Strava MCP Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.