// SCAN REPORT

Strava MCP Server

37 tools. 4 can modify or destroy data without limits.

4 write tools that can modify data. Rate limits recommended.

Last updated: 3 Jul 2026

4 can modify or destroy data

33 read-only

37 tools total

Community server · catalogue entry verified 03/07/2026

How to control Strava MCP Server ↓

TOOL MAP

What Strava MCP Server exposes to your agents

Read (33) Write / Execute (4) Destructive / Financial (0)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

High Risk

The most dangerous Strava MCP Server tools

Write · Medium create_activity This tool creates new activity records in Strava (workouts, exercises, or fitness events). Write · Medium update_activity The tool modifies existing fitness activity data reversibly. Write · Medium update_athlete_weight This tool creates or modifies data (athlete weight profile information) in a reversible manner. Write · Low star_segment This tool modifies a user preference (starring/unstarring a segment) which is a reversible write operation with minimal blast radius.

4 of Strava MCP Server's 37 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Strava MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and Strava MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Rate limit write operations

{
  "create_activity": {
    "limits": [
      {
        "counter": "create_activity_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "explore_segments": {
    "limits": [
      {
        "counter": "explore_segments_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Strava MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON STRAVA →

Instant setup, no code required.

FULL CATALOGUE

All 37 Strava MCP Server tools

WRITE 4 tools

Write create_activity create_activity Write star_segment Star or unstar a segment. Write update_activity update_activity Write update_athlete_weight Update the authenticated athlete's weight.

READ 33 tools

Read explore_segments explore_segments Read export_route_gpx Export a route as GPX XML data for use in GPS devices or other apps. Read export_route_tcx Export a route as TCX XML data for use in GPS devices or other apps. Read get_activities_by_date Get activities within a specific date range. Read get_activities_by_type Get recent activities filtered by sport type. Read get_activity Get full details for a specific activity including splits, Read get_activity_comments Get comments on a specific activity. Read get_activity_kudoers Get the list of athletes who gave kudos on an activity. Read get_activity_laps Get lap-by-lap breakdown for a specific activity. Read get_activity_streams get_activity_streams Read get_activity_zones Get heart rate and power zones for a specific activity. Read get_athlete_profile Get the authenticated athlete's full Strava profile. Read get_athlete_stats Get all-time and recent statistics for the authenticated athlete. Read get_athlete_zones Get the authenticated athlete's heart rate and power zones. Read get_club Get detailed information about a specific club. Read get_club_activities List recent activities posted by members of a specific club. Read get_club_admins List administrators of a specific club. Read get_club_members List members of a specific club. Read get_gear Get details about a specific piece of gear (bike or shoes). Read get_my_clubs List all clubs the authenticated athlete is a member of. Read get_my_routes List the authenticated athlete's saved routes. Read get_recent_activities Get the most recent activities from your Strava account. Read get_route Get detailed information about a specific route. Read get_route_streams Get stream data for a route (distance, altitude, latlng). Read get_segment Get detailed info about a segment: distance, grade, elevation, Read get_segment_effort Get detailed information about a specific segment effort. Read get_segment_effort_streams Get time-series stream data for a specific segment effort. Read get_segment_efforts get_segment_efforts Read get_segment_streams Get stream data for a segment (distance, altitude, latlng). Read get_starred_segments List the authenticated athlete's starred segments. Read get_upload_status Check the processing status of an activity upload. Read monthly_summary Summary of all activities from the past 30 days. Read weekly_summary Summary of all activities from the past 7 days.

FAQ

Questions about Strava MCP Server

How do I prevent bulk modifications through Strava MCP Server? +

The Strava MCP Server server has 4 write tools including create_activity, star_segment, update_activity. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Strava MCP Server.

How many tools does the Strava MCP Server MCP server expose? +

37 tools across 2 categories: Read, Write. 33 are read-only. 4 can modify, create, or delete data.

How do I enforce a policy on Strava MCP Server? +

Register the Strava MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Strava MCP Server tool call.

Deterministic rules across all 37 Strava MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON STRAVA →

Instant setup, no code required.

37 Strava MCP Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.