hevy-mcp 3.4.0 → 4.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -181,6 +181,23 @@ npx -y hevy-mcp
181
181
  `npx` requires Node.js 20 or newer. Restart or reconnect your client after
182
182
  saving its configuration.
183
183
 
184
+ ### Programmatic API
185
+
186
+ The package exposes two named functions for applications that embed the MCP
187
+ server:
188
+
189
+ ```ts
190
+ import { createNodeMcpServer, runStdioServer } from "hevy-mcp";
191
+
192
+ const server = await createNodeMcpServer({ apiKey: process.env.HEVY_API_KEY! });
193
+ // Connect `server` to the transport owned by your application, or use:
194
+ await runStdioServer();
195
+ ```
196
+
197
+ `createNodeMcpServer` never reads environment variables, connects a transport,
198
+ or installs process lifecycle handlers. The CLI-only `runStdioServer` function
199
+ owns those concerns.
200
+
184
201
  <details>
185
202
  <summary><strong>Use bunx instead</strong></summary>
186
203
 
@@ -397,17 +414,16 @@ self-hosted Streamable HTTP.
397
414
 
398
415
  ## Advanced configuration
399
416
 
400
- | Setting | Default | Scope | Notes |
401
- | ---------------------- | ------------------------------ | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
402
- | `HEVY_API_KEY` | None; required | Local stdio | Hevy API key from the Hevy app. Never pass it in a URL. |
403
- | `HEVY_MCP_API_TIMEOUT` | `30000` ms | Local stdio | Positive Hevy API timeout in milliseconds. Invalid values fall back to 30 seconds. |
404
- | `HEVY_MCP_DEBUG` | Disabled | Local stdio | Set to exactly `1` for privacy-bounded diagnostics on stderr. Stdout remains reserved for MCP JSON-RPC. |
405
- | `MCP_ALLOWED_ORIGINS` | No browser origins allowed | Self-hosted Worker | Optional comma-separated exact origins. Wildcards are unsupported. Requests without `Origin`, such as desktop clients, remain accepted. |
406
- | `XDG_CACHE_HOME` | `~/.cache` | Local stdio | Changes the root for the npm update-check cache at `hevy-mcp/update-check.json`. |
407
- | `SENTRY_DSN` | Packaged project DSN | Optional local Node telemetry | Overrides the Sentry destination. An empty value disables Sentry export. The Worker does not import Node telemetry. |
408
- | `SENTRY_RELEASE` | `hevy-mcp@<installed-version>` | Optional local Node telemetry | Overrides the release label attached to local Sentry events and traces. |
409
- | `-h`, `--help` | N/A | Local stdio CLI | Print supported options and exit. |
410
- | `-v`, `--version` | N/A | Local stdio CLI | Print the installed version and exit. |
417
+ | Setting | Default | Scope | Notes |
418
+ | ---------------------- | ------------------------------ | ----------------------------- | ------------------------------------------------------------------------------------------------------------------- |
419
+ | `HEVY_API_KEY` | None; required | Local stdio | Hevy API key from the Hevy app. Never pass it in a URL. |
420
+ | `HEVY_MCP_API_TIMEOUT` | `30000` ms | Local stdio | Positive Hevy API timeout in milliseconds. Invalid values fall back to 30 seconds. |
421
+ | `HEVY_MCP_DEBUG` | Disabled | Local stdio | Set to exactly `1` for privacy-bounded diagnostics on stderr. Stdout remains reserved for MCP JSON-RPC. |
422
+ | `XDG_CACHE_HOME` | `~/.cache` | Local stdio | Changes the root for the npm update-check cache at `hevy-mcp/update-check.json`. |
423
+ | `SENTRY_DSN` | Packaged project DSN | Optional local Node telemetry | Overrides the Sentry destination. An empty value disables Sentry export. The Worker does not import Node telemetry. |
424
+ | `SENTRY_RELEASE` | `hevy-mcp@<installed-version>` | Optional local Node telemetry | Overrides the release label attached to local Sentry events and traces. |
425
+ | `-h`, `--help` | N/A | Local stdio CLI | Print supported options and exit. |
426
+ | `-v`, `--version` | N/A | Local stdio CLI | Print the installed version and exit. |
411
427
 
412
428
  The local executable is stdio-only. It does not support `PORT`,
413
429
  `HEVY_MCP_TRANSPORT`, or `--transport`, and it does not provide local HTTP or
@@ -431,8 +447,9 @@ server-scoped in-memory catalog cache:
431
447
  - Hosted clients send the key only in the `Authorization: Bearer` header. The
432
448
  Worker validates each key with Hevy, does not store it, and sends it upstream
433
449
  only as Hevy's `api-key` header.
434
- - Browser requests to a self-hosted Worker must exactly match an origin in
435
- `MCP_ALLOWED_ORIGINS`; wildcard CORS is intentionally unsupported.
450
+ - Browser requests must come from an exact allowlisted origin. The default
451
+ allowlist includes Claude.ai, ChatGPT, VS Code for the Web, and github.dev;
452
+ self-hosted deployments can override it with `MCP_ALLOWED_ORIGINS`.
436
453
  - Create operations can produce duplicates when retried. Update operations
437
454
  replace existing records. Review tool inputs and use client confirmations.
438
455
 
package/dist/cli.d.mts CHANGED
@@ -1,2 +1,2 @@
1
1
 
2
- export { };
2
+ export {}
package/dist/cli.mjs CHANGED
@@ -4,18 +4,20 @@
4
4
  (function() {
5
5
  try {
6
6
  var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {};
7
- e.SENTRY_RELEASE = { id: "hevy-mcp@3.4.0" };
7
+ e.SENTRY_RELEASE = { id: "hevy-mcp@4.0.1" };
8
8
  var n = new e.Error().stack;
9
- n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "47a79c69-c982-44cf-abda-d010f962b955", e._sentryDebugIdIdentifier = "sentry-dbid-47a79c69-c982-44cf-abda-d010f962b955");
9
+ n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "6c94ca81-06a8-4c24-a812-6740b134ae63", e._sentryDebugIdIdentifier = "sentry-dbid-6c94ca81-06a8-4c24-a812-6740b134ae63");
10
10
  } catch (e) {}
11
11
  })();
12
- import { i as createSafeErrorDiagnostic, r as runServer } from "./src-86dub6ti.mjs";
12
+ import { a as flushTelemetry, i as createSafeErrorDiagnostic, n as runStdioServer, r as MissingHevyApiKeyError } from "./src-D0fOBh7M.mjs";
13
13
  //#region src/cli.ts
14
- runServer().catch((error) => {
15
- console.error("Fatal error in main()", createSafeErrorDiagnostic(error));
14
+ runStdioServer().catch(async (error) => {
15
+ if (error instanceof MissingHevyApiKeyError) console.error(error.message);
16
+ else console.error("Fatal error in main()", createSafeErrorDiagnostic(error));
17
+ try {
18
+ await flushTelemetry();
19
+ } catch {}
16
20
  process.exit(1);
17
21
  });
18
22
  //#endregion
19
23
  export {};
20
-
21
- //# sourceMappingURL=cli.mjs.map
package/dist/index.d.mts CHANGED
@@ -1,17 +1,8 @@
1
1
 
2
- import { z } from "zod";
3
2
  //#region src/index.d.ts
4
- declare const serverConfigSchema: z.ZodObject<{
5
- apiKey: z.ZodString;
6
- }, z.core.$strip>;
7
- declare const configSchema: z.ZodObject<{
8
- apiKey: z.ZodString;
9
- }, z.core.$strip>;
10
- type ServerConfig = z.infer<typeof serverConfigSchema>;
11
- declare function createServer({ config }: {
12
- config: ServerConfig;
3
+ declare function createNodeMcpServer({ apiKey }: {
4
+ apiKey: string;
13
5
  }): Promise<import("@modelcontextprotocol/sdk/server/mcp").McpServer>;
14
- declare function runServer(): Promise<void>;
6
+ declare function runStdioServer(): Promise<void>;
15
7
  //#endregion
16
- export { configSchema, createServer, createServer as default, runServer };
17
- //# sourceMappingURL=index.d.mts.map
8
+ export { createNodeMcpServer, runStdioServer };
package/dist/index.mjs CHANGED
@@ -4,10 +4,10 @@
4
4
  (function() {
5
5
  try {
6
6
  var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {};
7
- e.SENTRY_RELEASE = { id: "hevy-mcp@3.4.0" };
7
+ e.SENTRY_RELEASE = { id: "hevy-mcp@4.0.1" };
8
8
  var n = new e.Error().stack;
9
- n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "5b077b94-9ef8-4f24-a0b0-8dcfbf491be1", e._sentryDebugIdIdentifier = "sentry-dbid-5b077b94-9ef8-4f24-a0b0-8dcfbf491be1");
9
+ n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "84f6be7e-0b11-45ac-9e79-1efe427bc1ab", e._sentryDebugIdIdentifier = "sentry-dbid-84f6be7e-0b11-45ac-9e79-1efe427bc1ab");
10
10
  } catch (e) {}
11
11
  })();
12
- import { n as createServer, r as runServer, t as configSchema } from "./src-86dub6ti.mjs";
13
- export { configSchema, createServer, createServer as default, runServer };
12
+ import { n as runStdioServer, t as createNodeMcpServer } from "./src-D0fOBh7M.mjs";
13
+ export { createNodeMcpServer, runStdioServer };