← Back to search

@trainheroic-unofficial/athlete-mcp

GitHub Actions Scanned 19d ago

Local single-user MCP server for a TrainHeroic athlete. No database, no Cloudflare deps.

npm
C
65.8 / 100

Versions

1.7.3latest
Jul 10, 2026
1.7.2
Jul 6, 2026
1.7.1
Jul 2, 2026
1.7.0
Jul 1, 2026
1.6.1
Jul 1, 2026
+ show 18 moreshow less
1.6.0
Jun 30, 2026
1.5.0
Jun 26, 2026
1.4.0
Jun 23, 2026
1.3.0
Jun 22, 2026
1.2.0
Jun 22, 2026
1.1.1
Jun 22, 2026
1.1.0
Jun 22, 2026
1.0.0
Jun 22, 2026
0.6.5
Jun 22, 2026
0.6.4
Jun 21, 2026
0.6.3
Jun 21, 2026
0.6.2
Jun 21, 2026
0.6.1
Jun 21, 2026
0.6.0
Jun 21, 2026
0.5.0
Jun 21, 2026
0.4.2
Jun 21, 2026
0.4.1
Jun 21, 2026
0.4.0
Jun 20, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 88

foo
annotations: none low

boom
annotations: none low

bar
annotations: none low

gated
annotations: none low

programming_sync
annotations: none low

Populate the programming history warehouse: pull prescribed programs

programming_stored
annotations: none low

Query the prescribed-programming history warehouse (populate it with programming_sync first).

limit number before object
messaging_sync
annotations: none low

Populate the messaging history warehouse: pull chat streams + comments into D1,

full boolean
messaging_stored
annotations: none low

Query the conversation history warehouse (populate it with messaging_sync first). Give

limit number timestamp number
athlete_workouts_sync
annotations: none low

Populate the workouts warehouse: pull workouts in a YYYY-MM-DD window into D1 (each

limit number before object
athlete_workouts_stored
annotations: none low

Query the workouts warehouse (populate it with athlete_workouts_sync first). Give

limit number before object
athlete_training_sync
annotations: none low

Populate the training warehouse: the exercise catalog, working maxes, and per-exercise

full boolean batchSize number
athlete_training_stored
annotations: none low

Query the training warehouse (populate it with athlete_training_sync first).

q string prs boolean limit number workingMaxes boolean
program_create
annotations: none low

Create either an ongoing calendar or a fixed-length standalone program

kind enum name string
program_delete
annotations: none low

Delete a standalone calendar or fixed program (DELETE /v5/programs/{programId}).

confirm boolean
workout_build
annotations: none low

Build an UNPUBLISHED session from a spec (program -> session -> blocks -> exercises).

date string blocks array confirm boolean programId number instruction string timelineDay number
workout_read
annotations: none low

Read-back a session by programId, date (YYYY-M-D), and programWorkout id.

date string pwId number programId number
workout_publish
annotations: none low

Publish a built session — ATHLETE-FACING and immediate. Requires confirmation

date string pwId number confirm boolean programId number
session_remove
annotations: none low

Delete a session from the live calendar (also the way to replace a date: remove then

pwId number confirm boolean programId number
session_unpublish
annotations: none low

Unpublish a previously published session (POST .../programWorkout/unPublish/{pwId}). It

pwId number confirm boolean
session_copy
annotations: none low

Copy/repeat a session to a target date on a program (POST .../copyProgramWorkout).

pwId number toDate string toProgramId number
session_save_as_template
annotations: none low

Save an existing session as a reusable template in the session library

workoutId number
session_template_create
annotations: none low

Create an empty reusable session template in the library (POST /v5/sessions/template).

confirm boolean
session_template_delete
annotations: none low

Delete a library session template (DELETE /v5/sessions/template/{id}). Requires

confirm boolean
whoami
annotations: none low

The authenticated TrainHeroic coach profile (id, org_id, name, roles, trial days).

list_athletes
annotations: none low

Every athlete on this coach's org roster, across all teams (not scoped to one team; the

q string limit number
list_teams
annotations: none low

Coach teams. The headcount fields are easy to misread: member_count and athlete_count

q string page number pageSize number
get_team
annotations: none low

Full team object by team id.

list_team_codes
annotations: none low

Join/access codes for a team.

athlete_lift_history
annotations: none low

Program detail live from the API, by program id. Works for team calendars and athlete

raw boolean
roster_activity
annotations: none low

Program detail live from the API, by program id. Works for team calendars and athlete

useMetric boolean athleteIds array
athlete_training
annotations: none low

Program detail live from the API, by program id. Works for team calendars and athlete

year number month number
get_program
annotations: none low

Program detail live from the API, by program id. Works for team calendars and athlete

team_volume
annotations: none low

Team-wide training volume (and reps/sessions) scoped to an inclusive YYYY-MM-DD window —

athleteIds array
coach_athlete_team_calendar
annotations: none low

Companion calendar for a roster athlete (GET /v5/calendars/athletes/{id}/coachAthleteTeam).

analytics_query
annotations: none low

date string metric enum dateEnd string userIds array dateStart string useMetric boolean
team_create
annotations: none low

Create a team (POST /1.0/coach/team/createWithTitleAndCode). Also creates the team's

title string
team_update
annotations: none low

Update a team's title and/or reassign its calendar (PUT /v5/teams/{teamId}).

title string confirm boolean
team_delete
annotations: none low

Delete a team (DELETE /v5/teams/{teamId}). Removes the team and its calendar from the

confirm boolean
team_code_create
annotations: none low

Create an access code athletes use to self-join a team

type number
team_code_delete
annotations: none low

Delete a team access code by its id (DELETE /v5/teamCodes/{codeId}). Athletes can no

confirm boolean
team_publish_settings
annotations: none low

Update a team's auto-publish settings (POST /1.0/coach/team/updatePublishSettings).

confirm boolean
messaging_conversations
annotations: none low

List chat streams (id, kind, title) live from the API; no setup needed. Use the id to read/draft/send.

messaging_read
annotations: verified low

Comments in a stream, live from the API. Pass `afterCommentId` to fetch only newer

limit number
openWorldHint true
message_draft
annotations: verified low

Preview the exact payload and target WITHOUT sending. Always safe.

confirm boolean
openWorldHint true
message_send
annotations: verified low

Send a chat message — ATHLETE-FACING and immediate (no draft state on the server).

confirm boolean
openWorldHint true
message_delete
annotations: none low

Soft-delete a chat message on the live account. Requires confirmation.

confirm boolean
athlete_whoami
annotations: none low

The logged-in account's identity (id, name, roles) from /user/simple.

athlete_profile
annotations: none low

Lifetime training totals in one call — all-time session count (summary.sessions_count),

useMetric boolean
athlete_prefs
annotations: none low

Notification and display preference flags for the athlete account.

athlete_working_maxes
annotations: none low

The athlete's working max per exercise (drives % prescriptions). An entry can carry a

athlete_leaderboard
annotations: none low

Leaderboard for a benchmark/test workout by its workout id.

page number gender number pageSize number
athlete_workouts
annotations: none low

The all-time PR board for an exercise (reps/weight per rep-max, strength-standard

raw boolean limit number summary boolean loggedOnly boolean
athlete_exercises
annotations: none low

The all-time PR board for an exercise (reps/weight per rep-max, strength-standard

q string limit number
athlete_exercise_history
annotations: none low

The all-time PR board for an exercise (reps/weight per rep-max, strength-standard

raw boolean
athlete_personal_records
annotations: none low

The all-time PR board for an exercise (reps/weight per rep-max, strength-standard

athlete_exercise_stats
annotations: none low

A point-in-time snapshot for an exercise: last performance and PR as of a date

athlete_log_targets
annotations: none low

Create a new personal workout session for a given YYYY-MM-DD date on the athlete's

raw boolean program string
athlete_session_create
annotations: none low

Create a new personal workout session for a given YYYY-MM-DD date on the athlete's

athlete_session_add_exercises
annotations: none low

Add one or more exercises to a personal workout session. Get workoutId from

order number
athlete_session_remove
annotations: none low

Delete a personal (self-created) workout session from your calendar — use it to clean up a

confirm boolean
athlete_workout_note
annotations: none low

Athlete-facing write: set the free-text note (and/or session RPE 1–10) on a workout.

confirm boolean
athlete_exercise_note
annotations: none low

Athlete-facing write: set the free-text note on one exercise in a workout (the

confirm boolean
athlete_log_session
annotations: none low

Athlete-facing write for logging what you actually did, with NO coach-scheduled workout

confirm boolean
athlete_log_set
annotations: none low

Athlete-facing write: record entered results (reps/weight per set) for a saved workout

confirm boolean
athlete_prescribe_set
annotations: none low

Athlete-facing write: set the planned reps and/or weight for one of your scheduled

confirm boolean
athlete_swap_exercise
annotations: none low

Athlete-facing write: substitute one prescribed exercise in your scheduled workout for a

confirm boolean
athlete_circuits
annotations: none low

Named circuit history for the logged-in athlete (GET /v5/users/circuits/{recent|history}).

kind enum
athlete_programming_programs
annotations: none low

Programs the athlete is subscribed to (GET /1.0/athlete/programming/programs).

athlete_recent_exercises
annotations: none low

Recently used exercises (GET /v5/users/exercises/recent). Distinct from

exercise_update
annotations: none low

Update a custom exercise (POST /2.0/coach/exercise/update/{id}) and write it through

confirm boolean
exercise_delete
annotations: none low

Delete a custom exercise on TrainHeroic (DELETE /v5/exercises/{id}) and drop it from

confirm boolean
exercise_resolve
annotations: none low

Map a name to an exercise id via the local mirror. Prefer this over exercise_search when

name string
exercise_search
annotations: none low

Ranked fuzzy search over exercise titles. Returns candidates with units. Each result's

limit number query string
exercise_get
annotations: verified low

Full exercise object (with units) by id.

readOnlyHint false openWorldHint false idempotentHint true destructiveHint false
exercise_sync
annotations: verified low

Refresh the cached exercise index from TrainHeroic.

force boolean
readOnlyHint false openWorldHint false idempotentHint true destructiveHint false
exercise_create
annotations: verified low

Create a custom exercise (POST /2.0/coach/exercise/create) and write it through to the

readOnlyHint false openWorldHint false idempotentHint true destructiveHint false
exercise_forget
annotations: verified low

Remove an exercise from the local mirror only. Does not call TrainHeroic — use

readOnlyHint false openWorldHint false idempotentHint true destructiveHint false
store_stats
annotations: none low

Row counts and sync state for the cached exercise index.

athlete_main_lift_prs
annotations: none low

roster_main_lift_prs
annotations: none low

athleteIds array
athlete_invite
annotations: verified low

Add athletes by emailing them a TrainHeroic team invitation — this is how you

emails union confirm boolean message string
readOnlyHint false openWorldHint true idempotentHint true destructiveHint false
athlete_archive
annotations: verified low

Remove one or more athletes from the active roster (PUT /v5/athletes/archive). Their

confirm boolean athleteIds array
readOnlyHint false openWorldHint false idempotentHint true destructiveHint false
athlete_restore
annotations: verified low

Restore previously archived athletes to the active roster (PUT /v5/athletes/restore).

athleteIds array
readOnlyHint false openWorldHint false idempotentHint true destructiveHint false
athlete_saved_workouts
annotations: none low

A roster athlete's scheduled/logged workouts in an inclusive YYYY-MM-DD window. This is the

raw boolean program string
log_athlete_set
annotations: none low

Coach-facing write: record entered results (reps/weight per set) for one of a roster

confirm boolean
coach_log_session
annotations: none low

Coach-facing write: log results for a roster athlete by exercise on a given day, without

confirm boolean
swap_athlete_exercise
annotations: none low

Coach-facing write: replace one exercise in a roster athlete's scheduled workout with a

confirm boolean
prescribe_athlete_set
annotations: none low

Coach-facing write: set the prescribed reps and/or weight for one of a roster athlete's

confirm boolean

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 189

low
Tool 'foo' has no annotations annotation_checker · 100%
low
Tool 'boom' has no annotations annotation_checker · 100%
low
Tool 'bar' has no annotations annotation_checker · 100%
low
Tool 'gated' has no annotations annotation_checker · 100%
low
Tool 'programming_sync' has no annotations annotation_checker · 100%
low
Tool 'programming_stored' has no annotations annotation_checker · 100%
low
Tool 'messaging_sync' has no annotations annotation_checker · 100%
low
Tool 'messaging_stored' has no annotations annotation_checker · 100%
low
Tool 'athlete_workouts_sync' has no annotations annotation_checker · 100%
low
Tool 'athlete_workouts_stored' has no annotations annotation_checker · 100%
low
Tool 'athlete_training_sync' has no annotations annotation_checker · 100%
low
Tool 'athlete_training_stored' has no annotations annotation_checker · 100%
low
Tool 'program_create' has no annotations annotation_checker · 100%
low
Tool 'program_delete' has no annotations annotation_checker · 100%
low
Tool 'workout_build' has no annotations annotation_checker · 100%
low
Tool 'workout_read' has no annotations annotation_checker · 100%
low
Tool 'workout_publish' has no annotations annotation_checker · 100%
low
Tool 'session_remove' has no annotations annotation_checker · 100%
low
Tool 'session_unpublish' has no annotations annotation_checker · 100%
low
Tool 'session_copy' has no annotations annotation_checker · 100%
low
Tool 'session_save_as_template' has no annotations annotation_checker · 100%
low
Tool 'session_template_create' has no annotations annotation_checker · 100%
low
Tool 'session_template_delete' has no annotations annotation_checker · 100%
low
Tool 'whoami' has no annotations annotation_checker · 100%
low
Tool 'list_athletes' has no annotations annotation_checker · 100%
low
Tool 'list_teams' has no annotations annotation_checker · 100%
low
Tool 'get_team' has no annotations annotation_checker · 100%
low
Tool 'list_team_codes' has no annotations annotation_checker · 100%
low
Tool 'athlete_lift_history' has no annotations annotation_checker · 100%
low
Tool 'roster_activity' has no annotations annotation_checker · 100%
low
Tool 'athlete_training' has no annotations annotation_checker · 100%
low
Tool 'get_program' has no annotations annotation_checker · 100%
low
Tool 'team_volume' has no annotations annotation_checker · 100%
low
Tool 'coach_athlete_team_calendar' has no annotations annotation_checker · 100%
low
Tool 'analytics_query' has no annotations annotation_checker · 100%
low
Tool 'team_create' has no annotations annotation_checker · 100%
low
Tool 'team_update' has no annotations annotation_checker · 100%
low
Tool 'team_delete' has no annotations annotation_checker · 100%
low
Tool 'team_code_create' has no annotations annotation_checker · 100%
low
Tool 'team_code_delete' has no annotations annotation_checker · 100%
low
Tool 'team_publish_settings' has no annotations annotation_checker · 100%
low
Tool 'messaging_conversations' has no annotations annotation_checker · 100%
info
Tool 'messaging_read' annotations are consistent annotation_checker · 80%
info
Tool 'message_draft' annotations are consistent annotation_checker · 80%
info
Tool 'message_send' annotations are consistent annotation_checker · 80%
low
Tool 'message_delete' has no annotations annotation_checker · 100%
low
Tool 'athlete_whoami' has no annotations annotation_checker · 100%
low
Tool 'athlete_profile' has no annotations annotation_checker · 100%
low
Tool 'athlete_prefs' has no annotations annotation_checker · 100%
low
Tool 'athlete_working_maxes' has no annotations annotation_checker · 100%
low
Tool 'athlete_leaderboard' has no annotations annotation_checker · 100%
low
Tool 'athlete_workouts' has no annotations annotation_checker · 100%
low
Tool 'athlete_exercises' has no annotations annotation_checker · 100%
low
Tool 'athlete_exercise_history' has no annotations annotation_checker · 100%
low
Tool 'athlete_personal_records' has no annotations annotation_checker · 100%
low
Tool 'athlete_exercise_stats' has no annotations annotation_checker · 100%
low
Tool 'athlete_log_targets' has no annotations annotation_checker · 100%
low
Tool 'athlete_session_create' has no annotations annotation_checker · 100%
low
Tool 'athlete_session_add_exercises' has no annotations annotation_checker · 100%
low
Tool 'athlete_session_remove' has no annotations annotation_checker · 100%
low
Tool 'athlete_workout_note' has no annotations annotation_checker · 100%
low
Tool 'athlete_exercise_note' has no annotations annotation_checker · 100%
low
Tool 'athlete_log_session' has no annotations annotation_checker · 100%
low
Tool 'athlete_log_set' has no annotations annotation_checker · 100%
low
Tool 'athlete_prescribe_set' has no annotations annotation_checker · 100%
low
Tool 'athlete_swap_exercise' has no annotations annotation_checker · 100%
low
Tool 'athlete_circuits' has no annotations annotation_checker · 100%
low
Tool 'athlete_programming_programs' has no annotations annotation_checker · 100%
low
Tool 'athlete_recent_exercises' has no annotations annotation_checker · 100%
low
Tool 'exercise_update' has no annotations annotation_checker · 100%
low
Tool 'exercise_delete' has no annotations annotation_checker · 100%
low
Tool 'exercise_resolve' has no annotations annotation_checker · 100%
low
Tool 'exercise_search' has no annotations annotation_checker · 100%
info
Tool 'exercise_get' annotations are consistent annotation_checker · 80%
info
Tool 'exercise_sync' annotations are consistent annotation_checker · 80%
info
Tool 'exercise_create' annotations are consistent annotation_checker · 80%
info
Tool 'exercise_forget' annotations are consistent annotation_checker · 80%
low
Tool 'store_stats' has no annotations annotation_checker · 100%
low
Tool 'athlete_main_lift_prs' has no annotations annotation_checker · 100%
low
Tool 'roster_main_lift_prs' has no annotations annotation_checker · 100%
info
Tool 'athlete_invite' annotations are consistent annotation_checker · 80%
info
Tool 'athlete_archive' annotations are consistent annotation_checker · 80%
info
Tool 'athlete_restore' annotations are consistent annotation_checker · 80%
low
Tool 'athlete_saved_workouts' has no annotations annotation_checker · 100%
low
Tool 'log_athlete_set' has no annotations annotation_checker · 100%
low
Tool 'coach_log_session' has no annotations annotation_checker · 100%
low
Tool 'swap_athlete_exercise' has no annotations annotation_checker · 100%
low
Tool 'prescribe_athlete_set' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client secret in alandotcom-trainheroic-unofficial-17df34b/packages/js/test/http-error.test.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
info
package.json metadata manifest_parser · 100%
info
Tool: foo manifest_parser · 85%
info
Tool: boom manifest_parser · 85%
info
Tool: bar manifest_parser · 85%
info
Tool: gated manifest_parser · 85%
info
Tool: programming_sync manifest_parser · 85%
info
Tool: programming_stored manifest_parser · 85%
info
Tool: messaging_sync manifest_parser · 85%
info
Tool: messaging_stored manifest_parser · 85%
info
Tool: athlete_workouts_sync manifest_parser · 85%
info
Tool: athlete_workouts_stored manifest_parser · 85%
info
Tool: athlete_training_sync manifest_parser · 85%
info
Tool: athlete_training_stored manifest_parser · 85%
info
Tool: program_create manifest_parser · 85%
info
Tool: program_delete manifest_parser · 85%
info
Tool: workout_build manifest_parser · 85%
info
Tool: workout_read manifest_parser · 85%
info
Tool: workout_publish manifest_parser · 85%
info
Tool: session_remove manifest_parser · 85%
info
Tool: session_unpublish manifest_parser · 85%
info
Tool: session_copy manifest_parser · 85%
info
Tool: session_save_as_template manifest_parser · 85%
info
Tool: session_template_create manifest_parser · 85%
info
Tool: session_template_delete manifest_parser · 85%
info
Tool: whoami manifest_parser · 85%
info
Tool: list_athletes manifest_parser · 85%
info
Tool: list_teams manifest_parser · 85%
info
Tool: get_team manifest_parser · 85%
info
Tool: list_team_codes manifest_parser · 85%
info
Tool: athlete_lift_history manifest_parser · 85%
info
Tool: roster_activity manifest_parser · 85%
info
Tool: athlete_training manifest_parser · 85%
info
Tool: get_program manifest_parser · 85%
info
Tool: team_volume manifest_parser · 85%
info
Tool: coach_athlete_team_calendar manifest_parser · 85%
info
Tool: analytics_query manifest_parser · 85%
info
Tool: team_create manifest_parser · 85%
info
Tool: team_update manifest_parser · 85%
info
Tool: team_delete manifest_parser · 85%
info
Tool: team_code_create manifest_parser · 85%
info
Tool: team_code_delete manifest_parser · 85%
info
Tool: team_publish_settings manifest_parser · 85%
info
Tool: messaging_conversations manifest_parser · 85%
info
Tool: messaging_read manifest_parser · 85%
info
Tool: message_draft manifest_parser · 85%
info
Tool: message_send manifest_parser · 85%
info
Tool: message_delete manifest_parser · 85%
info
Tool: athlete_whoami manifest_parser · 85%
info
Tool: athlete_profile manifest_parser · 85%
info
Tool: athlete_prefs manifest_parser · 85%
info
Tool: athlete_working_maxes manifest_parser · 85%
info
Tool: athlete_leaderboard manifest_parser · 85%
info
Tool: athlete_workouts manifest_parser · 85%
info
Tool: athlete_exercises manifest_parser · 85%
info
Tool: athlete_exercise_history manifest_parser · 85%
info
Tool: athlete_personal_records manifest_parser · 85%
info
Tool: athlete_exercise_stats manifest_parser · 85%
info
Tool: athlete_log_targets manifest_parser · 85%
info
Tool: athlete_session_create manifest_parser · 85%
info
Tool: athlete_session_add_exercises manifest_parser · 85%
info
Tool: athlete_session_remove manifest_parser · 85%
info
Tool: athlete_workout_note manifest_parser · 85%
info
Tool: athlete_exercise_note manifest_parser · 85%
info
Tool: athlete_log_session manifest_parser · 85%
info
Tool: athlete_log_set manifest_parser · 85%
info
Tool: athlete_prescribe_set manifest_parser · 85%
info
Tool: athlete_swap_exercise manifest_parser · 85%
info
Tool: athlete_circuits manifest_parser · 85%
info
Tool: athlete_programming_programs manifest_parser · 85%
info
Tool: athlete_recent_exercises manifest_parser · 85%
info
Tool: exercise_update manifest_parser · 85%
info
Tool: exercise_delete manifest_parser · 85%
info
Tool: exercise_resolve manifest_parser · 85%
info
Tool: exercise_search manifest_parser · 85%
info
Tool: exercise_get manifest_parser · 85%
info
Tool: exercise_sync manifest_parser · 85%
info
Tool: exercise_create manifest_parser · 85%
info
Tool: exercise_forget manifest_parser · 85%
info
Tool: store_stats manifest_parser · 85%
info
Tool: athlete_main_lift_prs manifest_parser · 85%
info
Tool: roster_main_lift_prs manifest_parser · 85%
info
Tool: athlete_invite manifest_parser · 85%
info
Tool: athlete_archive manifest_parser · 85%
info
Tool: athlete_restore manifest_parser · 85%
info
Tool: athlete_saved_workouts manifest_parser · 85%
info
Tool: log_athlete_set manifest_parser · 85%
info
Tool: coach_log_session manifest_parser · 85%
info
Tool: swap_athlete_exercise manifest_parser · 85%
info
Tool: prescribe_athlete_set manifest_parser · 85%
info
Required env vars (22) manifest_parser · 80%
high
Deprecated implicit grant flow in alandotcom-trainheroic-unofficial-17df34b/packages/cloudflare/test/auth-flow.test.ts oauth_scope_analyzer · 85%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 33 components sbom_generator · 100%
high
Hardcoded Password found in alandotcom-trainheroic-unofficial-17df34b/packages/eval/src/surfaces/cli.ts secret_scanner · 65%
high
Hardcoded Password found in alandotcom-trainheroic-unofficial-17df34b/packages/eval/src/surfaces/mcp.ts secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%