← Back to search

@trainheroic-unofficial/athlete-mcp

GitHub Actions Scanned 3d ago

Local single-user MCP server for a TrainHeroic athlete. No database, no Cloudflare deps.

npm
C
71.5 / 100

Versions

No versions found.

PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 86

foo
annotations: none low

boom
annotations: none low

bar
annotations: none low

gated
annotations: none low

programming_sync
annotations: none low

Populate the programming history warehouse: pull prescribed programs

programming_stored
annotations: none low

Query the prescribed-programming history warehouse (populate it with programming_sync first).

limit number before object
messaging_sync
annotations: none low

Populate the messaging history warehouse: pull chat streams + comments into D1,

full boolean
message_delete
annotations: none low

Soft-delete a chat message on the live account. Requires confirmation.

confirm boolean
messaging_stored
annotations: none low

Query the conversation history warehouse (populate it with messaging_sync first). Give

limit number timestamp number
athlete_workouts_sync
annotations: none low

Populate the workouts warehouse: pull workouts in a YYYY-MM-DD window into D1 (each

limit number before object
athlete_workouts_stored
annotations: none low

Query the workouts warehouse (populate it with athlete_workouts_sync first). Give

limit number before object
athlete_training_sync
annotations: none low

Populate the training warehouse: the exercise catalog, working maxes, and per-exercise

full boolean batchSize number
athlete_training_stored
annotations: none low

Query the training warehouse (populate it with athlete_training_sync first).

q string prs boolean limit number workingMaxes boolean
workout_build
annotations: none low

Build an UNPUBLISHED session from a spec (program -> session -> blocks -> exercises).

date string blocks array programId number instruction string timelineDay number
workout_read
annotations: none low

Read-back a session by programId, date (YYYY-M-D), and programWorkout id.

date string pwId number programId number
workout_publish
annotations: none low

Publish a built session — ATHLETE-FACING and immediate. Requires confirmation

date string pwId number confirm boolean programId number
session_remove
annotations: none low

Delete a session from the live calendar (also the way to replace a date: remove then

pwId number confirm boolean programId number
session_unpublish
annotations: none low

Unpublish a previously published session (POST .../programWorkout/unPublish/{pwId}). It

pwId number confirm boolean
session_copy
annotations: none low

Copy/repeat a session to a target date on a program (POST .../copyProgramWorkout).

pwId number toDate string toProgramId number
session_save_as_template
annotations: none low

Save an existing session as a reusable template in the session library

workoutId number
session_template_create
annotations: none low

Create an empty reusable session template in the library (POST /v5/sessions/template).

confirm boolean
session_template_delete
annotations: none low

Delete a library session template (DELETE /v5/sessions/template/{id}). Requires

confirm boolean
analytics_query
annotations: none low

date string metric enum dateEnd string userIds array dateStart string useMetric boolean
athlete_whoami
annotations: none low

The logged-in account's identity (id, name, roles) from /user/simple.

athlete_profile
annotations: none low

Lifetime training totals in one call — all-time session count (summary.sessions_count),

useMetric boolean
athlete_prefs
annotations: none low

Notification and display preference flags for the athlete account.

athlete_working_maxes
annotations: none low

The athlete's working max per exercise (drives % prescriptions). An entry can carry a

athlete_leaderboard
annotations: none low

Leaderboard for a benchmark/test workout by its workout id.

page number gender number pageSize number
athlete_workouts
annotations: none low

The all-time PR board for an exercise (reps/weight per rep-max, strength-standard

raw boolean limit number summary boolean loggedOnly boolean
athlete_exercises
annotations: none low

The all-time PR board for an exercise (reps/weight per rep-max, strength-standard

q string limit number
athlete_exercise_history
annotations: none low

The all-time PR board for an exercise (reps/weight per rep-max, strength-standard

raw boolean
athlete_personal_records
annotations: none low

The all-time PR board for an exercise (reps/weight per rep-max, strength-standard

athlete_exercise_stats
annotations: none low

A point-in-time snapshot for an exercise: last performance and PR as of a date

athlete_log_targets
annotations: none low

Create a new personal workout session for a given YYYY-MM-DD date on the athlete's

raw boolean program string
athlete_session_create
annotations: none low

Create a new personal workout session for a given YYYY-MM-DD date on the athlete's

athlete_session_add_exercises
annotations: none low

Add one or more exercises to a personal workout session. Get workoutId from

order number
athlete_session_remove
annotations: none low

Delete a personal (self-created) workout session from your calendar — use it to clean up a

confirm boolean
athlete_log_session
annotations: none low

Athlete-facing write for logging what you actually did, with NO coach-scheduled workout

confirm boolean
athlete_log_set
annotations: none low

Athlete-facing write: record entered results (reps/weight per set) for a saved workout

confirm boolean
athlete_prescribe_set
annotations: none low

Athlete-facing write: set the planned reps and/or weight for one of your scheduled

confirm boolean
athlete_swap_exercise
annotations: none low

Athlete-facing write: substitute one prescribed exercise in your scheduled workout for a

confirm boolean
athlete_circuits
annotations: none low

Named circuit history for the logged-in athlete (GET /v5/users/circuits/{recent|history}).

kind enum
athlete_programming_programs
annotations: none low

Programs the athlete is subscribed to (GET /1.0/athlete/programming/programs).

athlete_recent_exercises
annotations: none low

Recently used exercises (GET /v5/users/exercises/recent). Distinct from

whoami
annotations: none low

The authenticated TrainHeroic coach profile (id, org_id, name, roles, trial days).

list_athletes
annotations: none low

Every athlete on this coach's org roster, across all teams (not scoped to one team; the

q string limit number
list_teams
annotations: none low

Coach teams. The headcount fields are easy to misread: member_count and athlete_count

q string page number pageSize number
get_team
annotations: none low

Full team object by team id.

list_team_codes
annotations: none low

Join/access codes for a team.

athlete_lift_history
annotations: none low

Program detail live from the API, by program id. Works for team calendars and athlete

raw boolean
roster_activity
annotations: none low

Program detail live from the API, by program id. Works for team calendars and athlete

useMetric boolean athleteIds array
athlete_training
annotations: none low

Program detail live from the API, by program id. Works for team calendars and athlete

year number month number
get_program
annotations: none low

Program detail live from the API, by program id. Works for team calendars and athlete

team_volume
annotations: none low

Team-wide training volume (and reps/sessions) scoped to an inclusive YYYY-MM-DD window —

athleteIds array
coach_athlete_team_calendar
annotations: none low

Companion calendar for a roster athlete (GET /v5/calendars/athletes/{id}/coachAthleteTeam).

athlete_main_lift_prs
annotations: none low

roster_main_lift_prs
annotations: none low

athleteIds array
messaging_conversations
annotations: none low

List chat streams (id, kind, title) live from the API; no setup needed. Use the id to read/draft/send.

messaging_read
annotations: verified low

Comments in a stream, live from the API. Pass `afterCommentId` to fetch only newer

limit number
openWorldHint true
message_draft
annotations: verified low

Preview the exact payload and target WITHOUT sending. Always safe.

confirm boolean
openWorldHint true
message_send
annotations: verified low

Send a chat message — ATHLETE-FACING and immediate (no draft state on the server).

confirm boolean
openWorldHint true
athlete_invite
annotations: verified low

Add athletes by emailing them a TrainHeroic team invitation — this is how you

emails union confirm boolean message string
readOnlyHint false openWorldHint true idempotentHint true destructiveHint false
athlete_archive
annotations: verified low

Remove one or more athletes from the active roster (PUT /v5/athletes/archive). Their

confirm boolean athleteIds array
readOnlyHint false openWorldHint false idempotentHint true destructiveHint false
athlete_restore
annotations: verified low

Restore previously archived athletes to the active roster (PUT /v5/athletes/restore).

athleteIds array
readOnlyHint false openWorldHint false idempotentHint true destructiveHint false
athlete_saved_workouts
annotations: none low

A roster athlete's scheduled/logged workouts in an inclusive YYYY-MM-DD window. This is the

raw boolean program string
log_athlete_set
annotations: none low

Coach-facing write: record entered results (reps/weight per set) for one of a roster

confirm boolean
coach_log_session
annotations: none low

Coach-facing write: log results for a roster athlete by exercise on a given day, without

confirm boolean
swap_athlete_exercise
annotations: none low

Coach-facing write: replace one exercise in a roster athlete's scheduled workout with a

confirm boolean
prescribe_athlete_set
annotations: none low

Coach-facing write: set the prescribed reps and/or weight for one of a roster athlete's

confirm boolean
program_create
annotations: none low

Create either an ongoing calendar or a fixed-length standalone program

kind enum name string
program_delete
annotations: none low

Delete a standalone calendar or fixed program (DELETE /v5/programs/{programId}).

confirm boolean
exercise_update
annotations: none low

Update a custom exercise (POST /2.0/coach/exercise/update/{id}) and write it through

confirm boolean
exercise_delete
annotations: none low

Delete a custom exercise on TrainHeroic (DELETE /v5/exercises/{id}) and drop it from

confirm boolean
exercise_resolve
annotations: none low

Map a name to an exercise id via the local mirror. Prefer this over exercise_search when

name string
exercise_search
annotations: none low

Ranked fuzzy search over exercise titles. Returns candidates with units. Each result's

limit number query string
exercise_get
annotations: verified low

Full exercise object (with units) by id.

readOnlyHint false openWorldHint false idempotentHint true destructiveHint false
exercise_sync
annotations: verified low

Refresh the cached exercise index from TrainHeroic.

force boolean
readOnlyHint false openWorldHint false idempotentHint true destructiveHint false
exercise_create
annotations: verified low

Create a custom exercise (POST /2.0/coach/exercise/create) and write it through to the

readOnlyHint false openWorldHint false idempotentHint true destructiveHint false
exercise_forget
annotations: verified low

Remove an exercise from the local mirror only. Does not call TrainHeroic — use

readOnlyHint false openWorldHint false idempotentHint true destructiveHint false
store_stats
annotations: none low

Row counts and sync state for the cached exercise index.

team_create
annotations: none low

Create a team (POST /1.0/coach/team/createWithTitleAndCode). Also creates the team's

title string
team_update
annotations: none low

Update a team's title and/or reassign its calendar (PUT /v5/teams/{teamId}).

title string confirm boolean
team_delete
annotations: none low

Delete a team (DELETE /v5/teams/{teamId}). Removes the team and its calendar from the

confirm boolean
team_code_create
annotations: none low

Create an access code athletes use to self-join a team

type number
team_code_delete
annotations: none low

Delete a team access code by its id (DELETE /v5/teamCodes/{codeId}). Athletes can no

confirm boolean
team_publish_settings
annotations: none low

Update a team's auto-publish settings (POST /1.0/coach/team/updatePublishSettings).

confirm boolean

Permissions 3

env_vars low
Server uses env_vars capabilities via: process.env
network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()

Scan Findings 184

info
Tool: bar manifest_parser · 85%
info
Tool: gated manifest_parser · 85%
info
Tool: programming_sync manifest_parser · 85%
info
Tool: programming_stored manifest_parser · 85%
info
Tool: messaging_sync manifest_parser · 85%
info
Tool: messaging_stored manifest_parser · 85%
info
Tool: athlete_workouts_sync manifest_parser · 85%
info
Tool: athlete_workouts_stored manifest_parser · 85%
info
Tool: athlete_training_sync manifest_parser · 85%
info
Tool: athlete_training_stored manifest_parser · 85%
info
Tool: workout_build manifest_parser · 85%
info
Tool: workout_read manifest_parser · 85%
info
Tool: workout_publish manifest_parser · 85%
info
Tool: session_remove manifest_parser · 85%
info
Tool: session_unpublish manifest_parser · 85%
low
Tool 'boom' has no annotations annotation_checker · 100%
low
Tool 'bar' has no annotations annotation_checker · 100%
low
Tool 'gated' has no annotations annotation_checker · 100%
low
Tool 'programming_sync' has no annotations annotation_checker · 100%
low
Tool 'programming_stored' has no annotations annotation_checker · 100%
low
Tool 'foo' has no annotations annotation_checker · 100%
low
Tool 'messaging_sync' has no annotations annotation_checker · 100%
low
Tool 'messaging_stored' has no annotations annotation_checker · 100%
low
Tool 'athlete_workouts_sync' has no annotations annotation_checker · 100%
low
Tool 'athlete_workouts_stored' has no annotations annotation_checker · 100%
low
Tool 'athlete_training_sync' has no annotations annotation_checker · 100%
low
Tool 'athlete_training_stored' has no annotations annotation_checker · 100%
low
Tool 'workout_build' has no annotations annotation_checker · 100%
low
Tool 'workout_read' has no annotations annotation_checker · 100%
low
Tool 'workout_publish' has no annotations annotation_checker · 100%
low
Tool 'session_remove' has no annotations annotation_checker · 100%
low
Tool 'session_unpublish' has no annotations annotation_checker · 100%
low
Tool 'session_copy' has no annotations annotation_checker · 100%
low
Tool 'session_save_as_template' has no annotations annotation_checker · 100%
low
Tool 'session_template_create' has no annotations annotation_checker · 100%
low
Tool 'session_template_delete' has no annotations annotation_checker · 100%
low
Tool 'analytics_query' has no annotations annotation_checker · 100%
low
Tool 'athlete_whoami' has no annotations annotation_checker · 100%
low
Tool 'athlete_profile' has no annotations annotation_checker · 100%
low
Tool 'athlete_prefs' has no annotations annotation_checker · 100%
low
Tool 'athlete_working_maxes' has no annotations annotation_checker · 100%
low
Tool 'athlete_leaderboard' has no annotations annotation_checker · 100%
low
Tool 'athlete_workouts' has no annotations annotation_checker · 100%
low
Tool 'athlete_exercises' has no annotations annotation_checker · 100%
low
Tool 'athlete_exercise_history' has no annotations annotation_checker · 100%
low
Tool 'athlete_personal_records' has no annotations annotation_checker · 100%
low
Tool 'athlete_exercise_stats' has no annotations annotation_checker · 100%
low
Tool 'athlete_log_targets' has no annotations annotation_checker · 100%
low
Tool 'athlete_session_create' has no annotations annotation_checker · 100%
low
Tool 'athlete_session_add_exercises' has no annotations annotation_checker · 100%
low
Tool 'athlete_session_remove' has no annotations annotation_checker · 100%
low
Tool 'athlete_log_session' has no annotations annotation_checker · 100%
low
Tool 'athlete_log_set' has no annotations annotation_checker · 100%
low
Tool 'athlete_prescribe_set' has no annotations annotation_checker · 100%
low
Tool 'athlete_swap_exercise' has no annotations annotation_checker · 100%
low
Tool 'athlete_circuits' has no annotations annotation_checker · 100%
low
Tool 'athlete_programming_programs' has no annotations annotation_checker · 100%
low
Tool 'athlete_recent_exercises' has no annotations annotation_checker · 100%
low
Tool 'whoami' has no annotations annotation_checker · 100%
low
Tool 'list_athletes' has no annotations annotation_checker · 100%
low
Tool 'list_teams' has no annotations annotation_checker · 100%
low
Tool 'get_team' has no annotations annotation_checker · 100%
low
Tool 'list_team_codes' has no annotations annotation_checker · 100%
low
Tool 'athlete_lift_history' has no annotations annotation_checker · 100%
low
Tool 'roster_activity' has no annotations annotation_checker · 100%
low
Tool 'athlete_training' has no annotations annotation_checker · 100%
low
Tool 'get_program' has no annotations annotation_checker · 100%
low
Tool 'team_volume' has no annotations annotation_checker · 100%
low
Tool 'coach_athlete_team_calendar' has no annotations annotation_checker · 100%
low
Tool 'athlete_main_lift_prs' has no annotations annotation_checker · 100%
low
Tool 'roster_main_lift_prs' has no annotations annotation_checker · 100%
low
Tool 'messaging_conversations' has no annotations annotation_checker · 100%
info
Tool 'messaging_read' annotations are consistent annotation_checker · 80%
info
Tool 'message_draft' annotations are consistent annotation_checker · 80%
info
Tool 'message_send' annotations are consistent annotation_checker · 80%
low
Tool 'message_delete' has no annotations annotation_checker · 100%
info
Tool 'athlete_invite' annotations are consistent annotation_checker · 80%
info
Tool 'athlete_archive' annotations are consistent annotation_checker · 80%
info
Tool 'athlete_restore' annotations are consistent annotation_checker · 80%
low
Tool 'athlete_saved_workouts' has no annotations annotation_checker · 100%
low
Tool 'log_athlete_set' has no annotations annotation_checker · 100%
low
Tool 'coach_log_session' has no annotations annotation_checker · 100%
low
Tool 'swap_athlete_exercise' has no annotations annotation_checker · 100%
low
Tool 'prescribe_athlete_set' has no annotations annotation_checker · 100%
low
Tool 'program_create' has no annotations annotation_checker · 100%
low
Tool 'program_delete' has no annotations annotation_checker · 100%
low
Tool 'exercise_update' has no annotations annotation_checker · 100%
low
Tool 'exercise_delete' has no annotations annotation_checker · 100%
low
Tool 'exercise_resolve' has no annotations annotation_checker · 100%
low
Tool 'exercise_search' has no annotations annotation_checker · 100%
info
Tool 'exercise_get' annotations are consistent annotation_checker · 80%
info
Tool 'exercise_sync' annotations are consistent annotation_checker · 80%
info
Tool 'exercise_create' annotations are consistent annotation_checker · 80%
info
Tool 'exercise_forget' annotations are consistent annotation_checker · 80%
low
Tool 'store_stats' has no annotations annotation_checker · 100%
low
Tool 'team_create' has no annotations annotation_checker · 100%
low
Tool 'team_update' has no annotations annotation_checker · 100%
low
Tool 'team_delete' has no annotations annotation_checker · 100%
low
Tool 'team_code_create' has no annotations annotation_checker · 100%
low
Tool 'team_code_delete' has no annotations annotation_checker · 100%
low
Tool 'team_publish_settings' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
info
package.json metadata manifest_parser · 100%
info
Tool: foo manifest_parser · 85%
info
Tool: boom manifest_parser · 85%
info
Tool: session_copy manifest_parser · 85%
info
Tool: session_save_as_template manifest_parser · 85%
info
Tool: session_template_create manifest_parser · 85%
info
Tool: session_template_delete manifest_parser · 85%
info
Tool: analytics_query manifest_parser · 85%
info
Tool: athlete_whoami manifest_parser · 85%
info
Tool: athlete_profile manifest_parser · 85%
info
Tool: athlete_prefs manifest_parser · 85%
info
Tool: athlete_working_maxes manifest_parser · 85%
info
Tool: athlete_leaderboard manifest_parser · 85%
info
Tool: athlete_workouts manifest_parser · 85%
info
Tool: athlete_exercises manifest_parser · 85%
info
Tool: athlete_exercise_history manifest_parser · 85%
info
Tool: athlete_personal_records manifest_parser · 85%
info
Tool: athlete_exercise_stats manifest_parser · 85%
info
Tool: athlete_log_targets manifest_parser · 85%
info
Tool: athlete_session_create manifest_parser · 85%
info
Tool: athlete_session_add_exercises manifest_parser · 85%
info
Tool: athlete_session_remove manifest_parser · 85%
info
Tool: athlete_log_session manifest_parser · 85%
info
Tool: athlete_log_set manifest_parser · 85%
info
Tool: athlete_prescribe_set manifest_parser · 85%
info
Tool: athlete_swap_exercise manifest_parser · 85%
info
Tool: athlete_circuits manifest_parser · 85%
info
Tool: athlete_programming_programs manifest_parser · 85%
info
Tool: athlete_recent_exercises manifest_parser · 85%
info
Tool: whoami manifest_parser · 85%
info
Tool: list_athletes manifest_parser · 85%
info
Tool: list_teams manifest_parser · 85%
info
Tool: get_team manifest_parser · 85%
info
Tool: list_team_codes manifest_parser · 85%
info
Tool: athlete_lift_history manifest_parser · 85%
info
Tool: roster_activity manifest_parser · 85%
info
Tool: athlete_training manifest_parser · 85%
info
Tool: get_program manifest_parser · 85%
info
Tool: team_volume manifest_parser · 85%
info
Tool: coach_athlete_team_calendar manifest_parser · 85%
info
Tool: athlete_main_lift_prs manifest_parser · 85%
info
Tool: roster_main_lift_prs manifest_parser · 85%
info
Tool: messaging_conversations manifest_parser · 85%
info
Tool: messaging_read manifest_parser · 85%
info
Tool: message_draft manifest_parser · 85%
info
Tool: message_send manifest_parser · 85%
info
Tool: message_delete manifest_parser · 85%
info
Tool: athlete_invite manifest_parser · 85%
info
Tool: athlete_archive manifest_parser · 85%
info
Tool: athlete_restore manifest_parser · 85%
info
Tool: athlete_saved_workouts manifest_parser · 85%
info
Tool: log_athlete_set manifest_parser · 85%
info
Tool: coach_log_session manifest_parser · 85%
info
Tool: swap_athlete_exercise manifest_parser · 85%
info
Tool: prescribe_athlete_set manifest_parser · 85%
info
Tool: program_create manifest_parser · 85%
info
Tool: program_delete manifest_parser · 85%
info
Tool: exercise_update manifest_parser · 85%
info
Tool: exercise_delete manifest_parser · 85%
info
Tool: exercise_resolve manifest_parser · 85%
info
Tool: exercise_search manifest_parser · 85%
info
Tool: exercise_get manifest_parser · 85%
info
Tool: exercise_sync manifest_parser · 85%
info
Tool: exercise_create manifest_parser · 85%
info
Tool: exercise_forget manifest_parser · 85%
info
Tool: store_stats manifest_parser · 85%
info
Tool: team_create manifest_parser · 85%
info
Tool: team_update manifest_parser · 85%
info
Tool: team_delete manifest_parser · 85%
info
Tool: team_code_create manifest_parser · 85%
info
Tool: team_code_delete manifest_parser · 85%
info
Tool: team_publish_settings manifest_parser · 85%
info
Required env vars (22) manifest_parser · 80%
high
Deprecated implicit grant flow in alandotcom-trainheroic-unofficial-8e0d6cc/packages/cloudflare/test/auth-flow.test.ts oauth_scope_analyzer · 85%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 32 components sbom_generator · 100%
high
Hardcoded Password found in alandotcom-trainheroic-unofficial-8e0d6cc/packages/eval/src/surfaces/mcp.ts secret_scanner · 65%
high
Hardcoded Password found in alandotcom-trainheroic-unofficial-8e0d6cc/packages/eval/src/surfaces/cli.ts secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%