hevy-mcp 3.2.1 → 3.3.0

package/README.md

@@ -367,9 +367,28 @@ The bearer value is your Hevy API key, not an OAuth token. The Worker validates
 the key with Hevy on each request, does not store it, and forwards it upstream
 only as Hevy's required `api-key` header.
 
-The endpoint does not expose legacy SSE or a `GET` event stream. Clients that
-require OAuth discovery, dynamic registration, token refresh, or legacy SSE are
-not compatible unless they can send the fixed custom header above.
+### OAuth for Claude.ai and other remote MCP clients
+
+Workers deployed with an `OAUTH_KV` namespace binding (see
+[CONTRIBUTING.md](./CONTRIBUTING.md)) additionally expose a full OAuth 2.1
+layer for clients that cannot send a fixed header, such as Claude.ai custom
+connectors:
+
+- RFC 8414 / RFC 9728 discovery metadata under `/.well-known/`
+- Dynamic client registration (`/register`) and PKCE token exchange (`/token`)
+- An `/authorize` page where you paste your Hevy API key once; the key is
+  validated with Hevy and stored encrypted inside the OAuth grant
+
+Add the Worker URL ending in `/mcp` as a Claude.ai custom connector and
+complete the authorization flow in the browser. Direct
+`Authorization: Bearer <hevy-api-key>` requests keep working unchanged — the
+OAuth layer is purely additive — and rotating your Hevy API key invalidates
+every OAuth grant created with it.
+
+The endpoint does not expose legacy SSE or a `GET` event stream. Without the
+opt-in OAuth layer, clients that require OAuth discovery, dynamic
+registration, or token refresh are not compatible unless they can send the
+fixed custom header above.
 
 ### Self-host the Worker
 

package/dist/cli.mjs

@@ -4,12 +4,12 @@
 (function() {
 	try {
 		var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {};
-		e.SENTRY_RELEASE = { id: "hevy-mcp@3.2.1" };
+		e.SENTRY_RELEASE = { id: "hevy-mcp@3.3.0" };
 		var n = new e.Error().stack;
 		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "47a79c69-c982-44cf-abda-d010f962b955", e._sentryDebugIdIdentifier = "sentry-dbid-47a79c69-c982-44cf-abda-d010f962b955");
 	} catch (e) {}
 })();
-import { i as createSafeErrorDiagnostic, r as runServer } from "./src-D1O3O9f2.mjs";
+import { i as createSafeErrorDiagnostic, r as runServer } from "./src-B_mNqS1X.mjs";
 //#region src/cli.ts
 runServer().catch((error) => {
 	console.error("Fatal error in main()", createSafeErrorDiagnostic(error));

package/dist/index.mjs

@@ -4,10 +4,10 @@
 (function() {
 	try {
 		var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {};
-		e.SENTRY_RELEASE = { id: "hevy-mcp@3.2.1" };
+		e.SENTRY_RELEASE = { id: "hevy-mcp@3.3.0" };
 		var n = new e.Error().stack;
 		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "5b077b94-9ef8-4f24-a0b0-8dcfbf491be1", e._sentryDebugIdIdentifier = "sentry-dbid-5b077b94-9ef8-4f24-a0b0-8dcfbf491be1");
 	} catch (e) {}
 })();
-import { n as createServer, r as runServer, t as configSchema } from "./src-D1O3O9f2.mjs";
+import { n as createServer, r as runServer, t as configSchema } from "./src-B_mNqS1X.mjs";
 export { configSchema, createServer, createServer as default, runServer };

package/dist/{src-D1O3O9f2.mjs → src-B_mNqS1X.mjs}

@@ -4,9 +4,9 @@
 (function() {
 	try {
 		var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {};
-		e.SENTRY_RELEASE = { id: "hevy-mcp@3.2.1" };
+		e.SENTRY_RELEASE = { id: "hevy-mcp@3.3.0" };
 		var n = new e.Error().stack;
-		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "8ce801d0-ad38-40ee-a7f3-dc829e212db8", e._sentryDebugIdIdentifier = "sentry-dbid-8ce801d0-ad38-40ee-a7f3-dc829e212db8");
+		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "d4c67aeb-89ed-4cf7-ae4a-09c19c187b3d", e._sentryDebugIdIdentifier = "sentry-dbid-d4c67aeb-89ed-4cf7-ae4a-09c19c187b3d");
 	} catch (e) {}
 })();
 import * as Sentry from "@sentry/node";
@@ -40,10 +40,10 @@ import semver from "semver";
 * OTel Collector → Honeycomb: performance traces, metrics
 */
 const name$1 = "hevy-mcp";
-const version$1 = "3.2.1";
+const version$1 = "3.3.0";
 const collectorToken = "NH9vOela-HYreQxAbJa68cjEmORoEKM57EvneUDVcOo";
 const COLLECTOR_ENDPOINT = "https://otel.chrisdoc.dev/v1";
-const sentryRelease = process.env.SENTRY_RELEASE ?? `hevy-mcp@3.2.1`;
+const sentryRelease = process.env.SENTRY_RELEASE ?? `hevy-mcp@3.3.0`;
 const resource = resourceFromAttributes({
 	"service.name": name$1,
 	"service.version": version$1
@@ -59,7 +59,16 @@ const sentryClient = Sentry.init({
 	registerEsmLoaderHooks: false,
 	ignoreErrors: ["EPIPE", "broken pipe"]
 });
-const spanProcessors = [new SentrySpanProcessor()];
+let currentUserHash;
+var UserHashSpanProcessor = class {
+	onStart(span) {
+		if (currentUserHash) span.setAttribute("user.hash", currentUserHash);
+	}
+	onEnd(_span) {}
+	async forceFlush() {}
+	async shutdown() {}
+};
+const spanProcessors = [new UserHashSpanProcessor(), new SentrySpanProcessor()];
 spanProcessors.push(new BatchSpanProcessor(new OTLPTraceExporter({
 	url: `${COLLECTOR_ENDPOINT}/traces`,
 	headers: { Authorization: `Bearer ${collectorToken}` }
@@ -90,12 +99,8 @@ trace.setGlobalTracerProvider(tracerProvider);
 Sentry.validateOpenTelemetrySetup();
 const tracer = trace.getTracer(name$1);
 const meter = metrics.getMeter(name$1);
-let currentUserId;
-function setCurrentUserId(id) {
-	currentUserId = id;
-}
-function getCurrentUserId() {
-	return currentUserId;
+function setCurrentUserHash(hash) {
+	currentUserHash = hash;
 }
 //#endregion
 //#region src/utils/metrics.ts
@@ -1121,7 +1126,7 @@ function registerHevyResources(server, runtime) {
 //#endregion
 //#region src/server-metadata.ts
 const SERVER_NAME = "hevy-mcp";
-const SERVER_VERSION = "3.2.1";
+const SERVER_VERSION = "3.3.0";
 const SERVER_INSTRUCTIONS = [
 	"Hevy MCP connects clients to the authenticated user's Hevy workout-tracking data, including workouts, routines, exercise templates, routine folders, body measurements, and profile information. HEVY_API_KEY must contain a valid Hevy API key for local stdio use.",
 	"Safety: all get-* and search-* tools are read-only. create-* and update-* tools mutate Hevy data. Creates are additive and non-idempotent, so repeating one can create duplicates. Updates can overwrite existing data. Delete operations are not available.",
@@ -3692,8 +3697,7 @@ function createNodeHevyClientOptions() {
 			const span = tracer.startSpan(`hevy.api.${observation.method}`, { attributes: {
 				"http.method": observation.method,
 				"http.status_code": observation.status,
-				"hevy.api.endpoint": observation.endpoint,
-				...getCurrentUserId() ? { "user.id": getCurrentUserId() } : {}
+				"hevy.api.endpoint": observation.endpoint
 			} });
 			span.setStatus({ code: observation.error ? SpanStatusCode.ERROR : SpanStatusCode.OK });
 			if (observation.error) {
@@ -3789,7 +3793,6 @@ function withTelemetry(fn, context) {
 		const startTime = Date.now();
 		let isError = false;
 		toolInvocations.add(1, { tool_name: context });
-		const userId = getCurrentUserId();
 		const safeArgs = extractSafeArgs(args);
 		const whitelistedKeys = Object.keys(safeArgs).map((key) => key.replace("mcp.tool.args.", ""));
 		return tracer.startActiveSpan(`mcp.tool.${context}`, { attributes: {
@@ -3797,7 +3800,6 @@ function withTelemetry(fn, context) {
 			"workflow.name": context,
 			"mcp.tool.args.key_count": argumentKeyCount,
 			"mcp.tool.args.keys": whitelistedKeys.join(","),
-			...userId ? { "user.id": userId } : {},
 			...safeArgs
 		} }, async (span) => {
 			try {
@@ -4251,16 +4253,12 @@ async function validateApiKey(apiKey) {
 	}
 }
 function buildServer(apiKey) {
-	const userId = fingerprintApiKey(apiKey);
 	return tracer.startActiveSpan("mcp.server.build", { attributes: {
 		"mcp.server.name": name,
 		"mcp.server.version": version,
-		"mcp.transport": "stdio",
-		"user.id": userId
+		"mcp.transport": "stdio"
 	} }, (span) => {
 		try {
-			Sentry.setUser({ id: userId });
-			setCurrentUserId(userId);
 			const server = createSharedMcpServer({
 				apiKey,
 				clientOptions: createNodeHevyClientOptions(),
@@ -4281,6 +4279,9 @@ function buildServer(apiKey) {
 }
 async function createServer({ config }) {
 	const { apiKey } = serverConfigSchema.parse(config);
+	const userHash = fingerprintApiKey(apiKey);
+	setCurrentUserHash(userHash);
+	Sentry.setUser({ id: userHash });
 	await validateApiKey(apiKey);
 	return buildServer(apiKey);
 }
@@ -4295,6 +4296,12 @@ async function runServer() {
 		return;
 	}
 	serverStartups.add(1, { version });
+	const configuredApiKey = process.env.HEVY_API_KEY;
+	const initialUserHash = configuredApiKey ? fingerprintApiKey(configuredApiKey) : void 0;
+	if (initialUserHash) {
+		setCurrentUserHash(initialUserHash);
+		Sentry.setUser({ id: initialUserHash });
+	}
 	await tracer.startActiveSpan("mcp.server.run", { attributes: { "mcp.transport": "stdio" } }, async (span) => {
 		try {
 			const apiKey = parseConfig(process.env).apiKey;
@@ -4330,4 +4337,4 @@ async function runServer() {
 //#endregion
 export { createSafeErrorDiagnostic as i, createServer as n, runServer as r, configSchema as t };
 
-//# sourceMappingURL=src-D1O3O9f2.mjs.map
+//# sourceMappingURL=src-B_mNqS1X.mjs.map