hevy-mcp 4.0.1 → 4.1.0

package/README.md

@@ -414,20 +414,39 @@ self-hosted Streamable HTTP.
 
 ## Advanced configuration
 
-| Setting                | Default                        | Scope                         | Notes                                                                                                               |
-| ---------------------- | ------------------------------ | ----------------------------- | ------------------------------------------------------------------------------------------------------------------- |
-| `HEVY_API_KEY`         | None; required                 | Local stdio                   | Hevy API key from the Hevy app. Never pass it in a URL.                                                             |
-| `HEVY_MCP_API_TIMEOUT` | `30000` ms                     | Local stdio                   | Positive Hevy API timeout in milliseconds. Invalid values fall back to 30 seconds.                                  |
-| `HEVY_MCP_DEBUG`       | Disabled                       | Local stdio                   | Set to exactly `1` for privacy-bounded diagnostics on stderr. Stdout remains reserved for MCP JSON-RPC.             |
-| `XDG_CACHE_HOME`       | `~/.cache`                     | Local stdio                   | Changes the root for the npm update-check cache at `hevy-mcp/update-check.json`.                                    |
-| `SENTRY_DSN`           | Packaged project DSN           | Optional local Node telemetry | Overrides the Sentry destination. An empty value disables Sentry export. The Worker does not import Node telemetry. |
-| `SENTRY_RELEASE`       | `hevy-mcp@<installed-version>` | Optional local Node telemetry | Overrides the release label attached to local Sentry events and traces.                                             |
-| `-h`, `--help`         | N/A                            | Local stdio CLI               | Print supported options and exit.                                                                                   |
-| `-v`, `--version`      | N/A                            | Local stdio CLI               | Print the installed version and exit.                                                                               |
-
-The local executable is stdio-only. It does not support `PORT`,
-`HEVY_MCP_TRANSPORT`, or `--transport`, and it does not provide local HTTP or
-SSE behavior.
+| Setting                      | Default                        | Scope                         | Notes                                                                                                               |
+| ---------------------------- | ------------------------------ | ----------------------------- | ------------------------------------------------------------------------------------------------------------------- |
+| `HEVY_API_KEY`               | None; required                 | Local stdio or HTTP           | Hevy API key from the Hevy app. Never pass it in a URL.                                                             |
+| `HEVY_MCP_API_TIMEOUT`       | `30000` ms                     | Local stdio                   | Positive Hevy API timeout in milliseconds. Invalid values fall back to 30 seconds.                                  |
+| `HEVY_MCP_DEBUG`             | Disabled                       | Local Node                    | Set to exactly `1` for privacy-bounded diagnostics on stderr. Stdout remains reserved for MCP JSON-RPC.             |
+| `HEVY_MCP_HTTP_BEARER_TOKEN` | None                           | Non-loopback HTTP             | Required when `--host` is not loopback; use a separate token, never the Hevy API key.                               |
+| `XDG_CACHE_HOME`             | `~/.cache`                     | Local stdio                   | Changes the root for the npm update-check cache at `hevy-mcp/update-check.json`.                                    |
+| `SENTRY_DSN`                 | Packaged project DSN           | Optional local Node telemetry | Overrides the Sentry destination. An empty value disables Sentry export. The Worker does not import Node telemetry. |
+| `SENTRY_RELEASE`             | `hevy-mcp@<installed-version>` | Optional local Node telemetry | Overrides the release label attached to local Sentry events and traces.                                             |
+| `-h`, `--help`               | N/A                            | Local stdio CLI               | Print supported options and exit.                                                                                   |
+| `-v`, `--version`            | N/A                            | Local stdio CLI               | Print the installed version and exit.                                                                               |
+
+The local executable uses stdio by default. To opt into Streamable HTTP, run:
+
+```bash
+HEVY_API_KEY=your-hevy-api-key npx hevy-mcp --transport http --host 127.0.0.1 --port 3000
+```
+
+The MCP endpoint is `http://127.0.0.1:3000/mcp`. For a specific bind host,
+HTTP mode validates the Host header and configured port to protect against DNS
+rebinding. Loopback is the default. Wildcard binds (`0.0.0.0` or `::`) accept
+any hostname so they can be used behind Docker port mappings or a reverse
+proxy; they require `HEVY_MCP_HTTP_BEARER_TOKEN` and rely on that separate
+authentication token. Do not expose an unprotected shared Hevy account to the
+public internet. For Docker HTTP mode, publish the port explicitly:
+
+```bash
+docker run --rm -p 3000:3000 -e HEVY_API_KEY -e HEVY_MCP_HTTP_BEARER_TOKEN \
+  ghcr.io/chrisdoc/hevy-mcp:latest --transport http --host 0.0.0.0 --port 3000
+```
+
+Wildcard binds are allowed only with the separate bearer token; publish the
+container port deliberately and keep that token private.
 
 ### Cache behavior
 

package/dist/cli.mjs

@@ -4,14 +4,14 @@
 (function() {
 	try {
 		var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {};
-		e.SENTRY_RELEASE = { id: "hevy-mcp@4.0.1" };
+		e.SENTRY_RELEASE = { id: "hevy-mcp@4.1.0" };
 		var n = new e.Error().stack;
-		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "6c94ca81-06a8-4c24-a812-6740b134ae63", e._sentryDebugIdIdentifier = "sentry-dbid-6c94ca81-06a8-4c24-a812-6740b134ae63");
+		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "625c4c9c-e20d-40b3-96b1-4e799ef130f3", e._sentryDebugIdIdentifier = "sentry-dbid-625c4c9c-e20d-40b3-96b1-4e799ef130f3");
 	} catch (e) {}
 })();
-import { a as flushTelemetry, i as createSafeErrorDiagnostic, n as runStdioServer, r as MissingHevyApiKeyError } from "./src-D0fOBh7M.mjs";
+import { a as createSafeErrorDiagnostic, i as MissingHevyApiKeyError, n as runServer, o as flushTelemetry } from "./src-wSWxe4LJ.mjs";
 //#region src/cli.ts
-runStdioServer().catch(async (error) => {
+runServer().catch(async (error) => {
 	if (error instanceof MissingHevyApiKeyError) console.error(error.message);
 	else console.error("Fatal error in main()", createSafeErrorDiagnostic(error));
 	try {

package/dist/index.d.mts

@@ -1,8 +1,12 @@
 
+//#region src/utils/arguments.d.ts
+type NodeTransport = "stdio" | "http";
+//#endregion
 //#region src/index.d.ts
 declare function createNodeMcpServer({ apiKey }: {
   apiKey: string;
-}): Promise<import("@modelcontextprotocol/sdk/server/mcp").McpServer>;
+}, transport?: NodeTransport): Promise<import("@modelcontextprotocol/sdk/server/mcp").McpServer>;
 declare function runStdioServer(): Promise<void>;
+declare function runServer(): Promise<void>;
 //#endregion
-export { createNodeMcpServer, runStdioServer };
+export { createNodeMcpServer, runServer, runStdioServer };

package/dist/index.mjs

@@ -4,10 +4,10 @@
 (function() {
 	try {
 		var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {};
-		e.SENTRY_RELEASE = { id: "hevy-mcp@4.0.1" };
+		e.SENTRY_RELEASE = { id: "hevy-mcp@4.1.0" };
 		var n = new e.Error().stack;
-		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "84f6be7e-0b11-45ac-9e79-1efe427bc1ab", e._sentryDebugIdIdentifier = "sentry-dbid-84f6be7e-0b11-45ac-9e79-1efe427bc1ab");
+		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "e9496b31-626b-4ad1-9416-47ba4ffd2995", e._sentryDebugIdIdentifier = "sentry-dbid-e9496b31-626b-4ad1-9416-47ba4ffd2995");
 	} catch (e) {}
 })();
-import { n as runStdioServer, t as createNodeMcpServer } from "./src-D0fOBh7M.mjs";
-export { createNodeMcpServer, runStdioServer };
+import { n as runServer, r as runStdioServer, t as createNodeMcpServer } from "./src-wSWxe4LJ.mjs";
+export { createNodeMcpServer, runServer, runStdioServer };

package/dist/{src-D0fOBh7M.mjs → src-wSWxe4LJ.mjs}

@@ -4,9 +4,9 @@
 (function() {
 	try {
 		var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {};
-		e.SENTRY_RELEASE = { id: "hevy-mcp@4.0.1" };
+		e.SENTRY_RELEASE = { id: "hevy-mcp@4.1.0" };
 		var n = new e.Error().stack;
-		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "bc3b943c-f25f-42fc-a541-63e23c6ca05a", e._sentryDebugIdIdentifier = "sentry-dbid-bc3b943c-f25f-42fc-a541-63e23c6ca05a");
+		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "4b988c15-eb76-40ac-8399-033bebec17f8", e._sentryDebugIdIdentifier = "sentry-dbid-4b988c15-eb76-40ac-8399-033bebec17f8");
 	} catch (e) {}
 })();
 import * as Sentry from "@sentry/node";
@@ -18,11 +18,15 @@ import { resourceFromAttributes } from "@opentelemetry/resources";
 import { BatchSpanProcessor } from "@opentelemetry/sdk-trace-base";
 import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
 import { MeterProvider, PeriodicExportingMetricReader } from "@opentelemetry/sdk-metrics";
-import { createHmac, randomUUID } from "node:crypto";
+import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z as z$1 } from "zod/v4";
+import { isIP } from "node:net";
+import { createServer } from "node:http";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { deserializeMessage } from "@modelcontextprotocol/sdk/shared/stdio.js";
 import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
@@ -77,10 +81,10 @@ function sanitizeSentryMcpSpan(span) {
 * OTel Collector → Honeycomb: performance traces, metrics
 */
 const name$1 = "hevy-mcp";
-const version$1 = "4.0.1";
+const version$1 = "4.1.0";
 const collectorToken = "NH9vOela-HYreQxAbJa68cjEmORoEKM57EvneUDVcOo";
 const COLLECTOR_ENDPOINT = "https://otel.chrisdoc.dev/v1";
-const sentryRelease = process.env.SENTRY_RELEASE ?? `hevy-mcp@4.0.1`;
+const sentryRelease = process.env.SENTRY_RELEASE ?? `hevy-mcp@4.1.0`;
 const resource = resourceFromAttributes({
 	"service.name": name$1,
 	"service.version": version$1
@@ -2582,7 +2586,7 @@ function registerHevyResources(server, runtime) {
 //#endregion
 //#region ../core/src/server-metadata.ts
 const SERVER_NAME = "hevy-mcp";
-const SERVER_VERSION = "4.0.1";
+const SERVER_VERSION = "4.1.0";
 const SERVER_INSTRUCTIONS = [
 	"Hevy MCP connects clients to the authenticated user's Hevy workout-tracking data, including workouts, routines, exercise templates, routine folders, body measurements, and profile information. HEVY_API_KEY must contain a valid Hevy API key for local stdio use.",
 	"Safety: all get-* and search-* tools are read-only. create-* and update-* tools mutate Hevy data. Creates are additive and non-idempotent, so repeating one can create duplicates. Updates can overwrite existing data. Delete operations are not available.",
@@ -4432,6 +4436,444 @@ function assertApiKey(apiKey) {
 	if (!apiKey) throw new MissingHevyApiKeyError();
 }
 //#endregion
+//#region src/utils/arguments.ts
+const DEFAULT_HOST = "127.0.0.1";
+const DEFAULT_PORT = 3e3;
+function valueAfter(args, index, option) {
+	const value = args[index + 1];
+	if (!value || value.startsWith("-")) throw new Error(`${option} requires a value.`);
+	return value;
+}
+function parseHost(value) {
+	const host = value.trim();
+	const unbracketed = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+	const isBracketed = host.startsWith("[") || host.endsWith("]");
+	if (host.length === 0 || isBracketed && !(host.startsWith("[") && host.endsWith("]")) || isBracketed && isIP(unbracketed) !== 6 || !isBracketed && host.includes(":") && isIP(host) !== 6 || !isBracketed && !host.includes(":") && isIP(host) === 0 && !/^(?=.{1,253}$)(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)*[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/u.test(host) || /\s/u.test(host) || host.includes("/") || host.includes("@") || host.includes("://")) throw new Error(`Invalid host: ${value}. Provide a hostname or IP address.`);
+	return unbracketed;
+}
+function parsePort(value) {
+	if (!/^[0-9]+$/u.test(value)) throw new Error(`Invalid port: ${value}. Use an integer from 1 to 65535.`);
+	const port = Number(value);
+	if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new Error(`Invalid port: ${value}. Use an integer from 1 to 65535.`);
+	return port;
+}
+function parseNodeCliOptions(args) {
+	let transport = "stdio";
+	let host = DEFAULT_HOST;
+	let port = DEFAULT_PORT;
+	let transportExplicit = false;
+	let hostExplicit = false;
+	let portExplicit = false;
+	for (let index = 0; index < args.length; index += 1) {
+		const arg = args[index];
+		if (!arg || [
+			"--help",
+			"-h",
+			"--version",
+			"-v"
+		].includes(arg)) continue;
+		switch (arg) {
+			case "--transport": {
+				const value = valueAfter(args, index, arg);
+				index += 1;
+				if (value !== "stdio" && value !== "http") throw new Error(`Invalid transport: ${value}. Use either stdio or http.`);
+				transport = value;
+				transportExplicit = true;
+				break;
+			}
+			case "--host":
+				host = parseHost(valueAfter(args, index, arg));
+				hostExplicit = true;
+				index += 1;
+				break;
+			case "--port":
+				port = parsePort(valueAfter(args, index, arg));
+				portExplicit = true;
+				index += 1;
+				break;
+			default: throw new Error(`Unknown option: ${arg}`);
+		}
+	}
+	if (transport === "stdio" && (hostExplicit || portExplicit)) throw new Error("--host and --port can only be used with --transport http.");
+	if (transport === "stdio" && transportExplicit) return {
+		transport,
+		host: DEFAULT_HOST,
+		port: DEFAULT_PORT
+	};
+	return {
+		transport,
+		host,
+		port
+	};
+}
+//#endregion
+//#region src/utils/mcp-session-observability.ts
+const UNKNOWN_METADATA = "unknown";
+const MAX_METADATA_LENGTH = 64;
+const SAFE_METADATA_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+:/@-]{0,63}$/u;
+const contextStorage = new AsyncLocalStorage();
+let activeStdioSession;
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function normalizeMetadata(value) {
+	if (typeof value !== "string") return UNKNOWN_METADATA;
+	const normalized = value.trim();
+	if (normalized.length === 0 || normalized.length > MAX_METADATA_LENGTH || !SAFE_METADATA_PATTERN.test(normalized)) return UNKNOWN_METADATA;
+	return normalized;
+}
+function getInitializeParams(message) {
+	if (!isRecord(message) || message.method !== "initialize") return {};
+	return isRecord(message.params) ? message.params : {};
+}
+function extractMcpClientMetadata(message) {
+	const params = getInitializeParams(message);
+	const clientInfo = isRecord(params.clientInfo) ? params.clientInfo : {};
+	return {
+		name: normalizeMetadata(clientInfo.name),
+		version: normalizeMetadata(clientInfo.version),
+		protocolVersion: normalizeMetadata(params.protocolVersion)
+	};
+}
+function createMcpSessionContext(message, transport = "stdio") {
+	return {
+		metadata: extractMcpClientMetadata(message),
+		startedAt: Date.now(),
+		toolCalls: 0,
+		hadToolFailure: false,
+		transport
+	};
+}
+function runWithMcpSessionContext(context, callback) {
+	return contextStorage.run(context, callback);
+}
+function getSession() {
+	return contextStorage.getStore() ?? activeStdioSession;
+}
+function metadataAttributes(metadata, transport) {
+	return {
+		client_name: metadata.name,
+		client_version: metadata.version,
+		protocol_version: metadata.protocolVersion,
+		transport
+	};
+}
+function durationBucket(durationMs) {
+	if (durationMs < 1e3) return "<1s";
+	if (durationMs < 1e4) return "1-10s";
+	if (durationMs < 6e4) return "10-60s";
+	if (durationMs < 3e5) return "1-5m";
+	return "5m+";
+}
+function recordMcpSessionStart(message, transport = "stdio", context) {
+	const session = context ?? createMcpSessionContext(message, transport);
+	if (session.transport === "stdio") activeStdioSession = session;
+	const attributes = metadataAttributes(session.metadata, session.transport);
+	sessionStarted.add(1, attributes);
+	return session.metadata;
+}
+function recordMcpToolInvocation() {
+	const session = getSession();
+	if (session) session.toolCalls += 1;
+	return metadataAttributes(session?.metadata ?? {
+		name: UNKNOWN_METADATA,
+		version: UNKNOWN_METADATA,
+		protocolVersion: UNKNOWN_METADATA
+	}, session?.transport ?? "stdio");
+}
+function recordMcpToolFailure() {
+	const session = getSession();
+	if (session) session.hadToolFailure = true;
+}
+function getCurrentMcpClientMetadata() {
+	return getSession()?.metadata ?? {
+		name: UNKNOWN_METADATA,
+		version: UNKNOWN_METADATA,
+		protocolVersion: UNKNOWN_METADATA
+	};
+}
+function getCurrentMcpTransport() {
+	return getSession()?.transport ?? "stdio";
+}
+function recordMcpSessionTermination(category, context) {
+	const session = context ?? getSession();
+	const durationMs = session ? Math.max(0, Date.now() - session.startedAt) : 0;
+	const attributes = {
+		...metadataAttributes(session?.metadata ?? {
+			name: UNKNOWN_METADATA,
+			version: UNKNOWN_METADATA,
+			protocolVersion: UNKNOWN_METADATA
+		}, session?.transport ?? "stdio"),
+		termination_category: category,
+		session_duration_bucket: durationBucket(durationMs),
+		tool_calls_bucket: bucketCount(session?.toolCalls ?? 0)
+	};
+	sessionEnded.add(1, attributes);
+	if (!context || context === activeStdioSession) activeStdioSession = void 0;
+}
+function resolveSessionTerminationCategory(shutdownSucceeded, context) {
+	if (!shutdownSucceeded) return "unknown";
+	return (context ?? getSession())?.hadToolFailure ? "tool_failure" : "clean";
+}
+//#endregion
+//#region src/utils/streamable-http.ts
+const MCP_PATH = "/mcp";
+const MAX_BODY_BYTES = 1048576;
+const HTTP_BEARER_TOKEN = "HEVY_MCP_HTTP_BEARER_TOKEN";
+var HttpRequestError = class extends Error {
+	statusCode;
+	constructor(statusCode, message) {
+		super(message);
+		this.name = "HttpRequestError";
+		this.statusCode = statusCode;
+	}
+};
+function normalizeHost(host) {
+	return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+function isLoopbackHost(host) {
+	const normalized = normalizeHost(host).toLowerCase();
+	return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1";
+}
+function hostNamesFor(options) {
+	const configured = normalizeHost(options.host).toLowerCase();
+	const names = /* @__PURE__ */ new Set([configured]);
+	if (isLoopbackHost(options.host)) {
+		names.add("localhost");
+		names.add("127.0.0.1");
+		names.add("::1");
+	}
+	return names;
+}
+function expectedPort(options, server) {
+	if (options.port !== 0) return options.port;
+	const address = server.address();
+	return address && typeof address !== "string" ? address.port : 0;
+}
+function validateHostHeader(request, allowedHosts, port, allowAnyHostname = false) {
+	const header = request.headers.host;
+	if (!header || Array.isArray(header)) return false;
+	try {
+		const parsed = new URL(`http://${header}`);
+		if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || !allowAnyHostname && (parsed.port ? Number(parsed.port) : 80) !== port) return false;
+		return allowAnyHostname || allowedHosts.has(normalizeHost(parsed.hostname).toLowerCase());
+	} catch {
+		return false;
+	}
+}
+function safeDiagnostic(error) {
+	return JSON.stringify(createSafeErrorDiagnostic(error));
+}
+function writeJson(res, status, message) {
+	if (res.headersSent) return;
+	res.statusCode = status;
+	res.setHeader("Content-Type", "application/json");
+	res.end(JSON.stringify({ error: message }));
+}
+function readBody(request) {
+	return new Promise((resolve, reject) => {
+		let size = 0;
+		let rejected = false;
+		const chunks = [];
+		const onData = (chunk) => {
+			const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+			size += buffer.byteLength;
+			if (size > MAX_BODY_BYTES) {
+				if (!rejected) {
+					rejected = true;
+					request.removeListener("data", onData);
+					request.resume();
+					reject(new HttpRequestError(413, "Request body is too large."));
+				}
+				return;
+			}
+			if (!rejected) chunks.push(buffer);
+		};
+		request.on("data", onData);
+		request.once("error", (error) => {
+			if (!rejected) reject(error);
+		});
+		request.once("end", () => {
+			if (rejected) return;
+			try {
+				const raw = Buffer.concat(chunks).toString("utf8");
+				resolve(raw.length === 0 ? void 0 : JSON.parse(raw));
+			} catch {
+				reject(new HttpRequestError(400, "Request body must be valid JSON."));
+			}
+		});
+	});
+}
+function isInitializeRequest(body) {
+	return Boolean(body && typeof body === "object" && !Array.isArray(body) && "method" in body && body.method === "initialize");
+}
+function closeServer(server) {
+	return new Promise((resolve, reject) => {
+		if (!server.listening) {
+			resolve();
+			return;
+		}
+		server.close((error) => error ? reject(error) : resolve());
+		server.closeIdleConnections();
+		server.closeAllConnections();
+	});
+}
+function isBearerAuthorized(request, token) {
+	if (!token) return false;
+	const header = request.headers.authorization;
+	if (typeof header !== "string") return false;
+	const expected = Buffer.from(`Bearer ${token}`);
+	const actual = Buffer.from(header);
+	return expected.byteLength === actual.byteLength && timingSafeEqual(expected, actual);
+}
+function aggregateErrors(errors, message) {
+	if (errors.length === 1) return errors[0];
+	return new AggregateError(errors, message);
+}
+async function startStreamableHttpServer(options, apiKey, createMcpServer) {
+	const wildcard = options.host === "0.0.0.0" || options.host === "::" || options.host === "[::]";
+	const loopback = isLoopbackHost(options.host);
+	const bearerToken = process.env[HTTP_BEARER_TOKEN];
+	if (!loopback && !bearerToken) throw new Error(`Non-loopback HTTP mode requires ${HTTP_BEARER_TOKEN} to protect the shared Hevy account.`);
+	const sessions = /* @__PURE__ */ new Map();
+	const cleanupErrors = [];
+	const server = createServer((request, response) => {
+		handleRequest(request, response).catch((error) => {
+			if (response.headersSent) {
+				if (!response.writableEnded) response.destroy();
+				return;
+			}
+			if (error instanceof HttpRequestError) {
+				writeJson(response, error.statusCode, error.message);
+				return;
+			}
+			console.error(`HTTP request failed: ${safeDiagnostic(error)}`);
+			writeJson(response, 500, "Internal server error.");
+		});
+	});
+	async function closeSession(session, failureCategory) {
+		if (session.closed) return;
+		session.closed = true;
+		for (const [id, current] of sessions) if (current === session) sessions.delete(id);
+		for (const response of session.responses) if (!response.writableEnded) response.destroy();
+		const errors = (await Promise.allSettled([Promise.resolve().then(() => session.transport.close()), Promise.resolve().then(() => session.server.close())])).flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+		const succeeded = errors.length === 0;
+		recordMcpSessionTermination(failureCategory && succeeded ? failureCategory : resolveSessionTerminationCategory(succeeded, session.context), session.context);
+		if (errors.length > 0) throw aggregateErrors(errors, "MCP session cleanup failed.");
+	}
+	async function closeUnregistered(transport, mcpServer) {
+		const errors = (await Promise.allSettled([Promise.resolve().then(() => transport.close()), ...mcpServer ? [Promise.resolve().then(() => mcpServer.close())] : []])).flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+		if (errors.length > 0) throw aggregateErrors(errors, "MCP cleanup failed.");
+	}
+	async function handleRequest(request, response) {
+		if (request.url?.split("?", 1)[0] !== MCP_PATH) {
+			writeJson(response, 404, "Not found");
+			return;
+		}
+		if (!validateHostHeader(request, hostNamesFor(options), expectedPort(options, server), wildcard)) {
+			writeJson(response, 403, "Invalid Host header");
+			return;
+		}
+		if (!loopback && !isBearerAuthorized(request, bearerToken)) {
+			writeJson(response, 401, "Authorization required");
+			return;
+		}
+		const body = request.method === "POST" ? await readBody(request) : void 0;
+		const initializing = request.method === "POST" && isInitializeRequest(body);
+		const sessionHeader = request.headers["mcp-session-id"];
+		const sessionId = typeof sessionHeader === "string" ? sessionHeader : void 0;
+		if (initializing) {
+			if (sessionId) {
+				writeJson(response, 400, "Initialization must not include Mcp-Session-Id.");
+				return;
+			}
+			const context = createMcpSessionContext(body, "http");
+			recordMcpSessionStart(body, "http", context);
+			let session;
+			let mcpServer;
+			let connected = false;
+			const transport = new StreamableHTTPServerTransport({
+				sessionIdGenerator: randomUUID,
+				onsessioninitialized: (id) => {
+					if (session) sessions.set(id, session);
+				}
+			});
+			transport.onclose = () => {
+				if (session) closeSession(session).catch((error) => {
+					cleanupErrors.push(error);
+				});
+			};
+			try {
+				mcpServer = await createMcpServer({ apiKey });
+				session = {
+					transport,
+					server: mcpServer,
+					context,
+					responses: /* @__PURE__ */ new Set(),
+					closed: false
+				};
+				await mcpServer.connect(transport);
+				connected = true;
+				session.responses.add(response);
+				response.once("close", () => session?.responses.delete(response));
+				await runWithMcpSessionContext(context, () => transport.handleRequest(request, response, body));
+			} catch (error) {
+				console.error(`HTTP session request failed: ${safeDiagnostic(error)}`);
+				let cleanupError;
+				try {
+					if (session) await closeSession(session, connected ? "unknown" : "connect_failure");
+					else {
+						await closeUnregistered(transport, mcpServer);
+						recordMcpSessionTermination("startup_failure", context);
+					}
+				} catch (cleanupFailure) {
+					cleanupError = cleanupFailure;
+					if (!session) recordMcpSessionTermination("unknown", context);
+				}
+				if (cleanupError) console.error(`HTTP cleanup failed: ${safeDiagnostic(cleanupError)}`);
+				if (!response.writableEnded) writeJson(response, 500, "Internal server error.");
+			}
+			return;
+		}
+		if (!sessionId) {
+			writeJson(response, 400, "Mcp-Session-Id header is required.");
+			return;
+		}
+		const session = sessions.get(sessionId);
+		if (!session) {
+			writeJson(response, 404, "Unknown Mcp-Session-Id.");
+			return;
+		}
+		if (request.method !== "DELETE") {
+			session.responses.add(response);
+			response.once("close", () => session.responses.delete(response));
+		}
+		await runWithMcpSessionContext(session.context, () => session.transport.handleRequest(request, response, body));
+	}
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(options.port, options.host, () => {
+			server.removeListener("error", reject);
+			resolve();
+		});
+	});
+	let closePromise;
+	return {
+		server,
+		close: () => {
+			if (closePromise) return closePromise;
+			closePromise = (async () => {
+				const sessionsToClose = [...sessions.values()];
+				const results = await Promise.allSettled([...sessionsToClose.map((session) => closeSession(session)), closeServer(server)]);
+				sessions.clear();
+				const errors = [...cleanupErrors, ...results.flatMap((result) => result.status === "rejected" ? [result.reason] : [])];
+				if (errors.length > 0) throw aggregateErrors(errors, "HTTP server cleanup failed.");
+			})();
+			return closePromise;
+		}
+	};
+}
+//#endregion
 //#region src/utils/graceful-shutdown.ts
 const shutdownSignals = ["SIGINT", "SIGTERM"];
 const FORCED_EXIT_TIMEOUT_MS = 5e3;
@@ -4599,99 +5041,6 @@ function createNodeHevyClientOptions() {
 	};
 }
 //#endregion
-//#region src/utils/mcp-session-observability.ts
-const UNKNOWN_METADATA = "unknown";
-const MAX_METADATA_LENGTH = 64;
-const SAFE_METADATA_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+:/@-]{0,63}$/u;
-let currentSession;
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function normalizeMetadata(value) {
-	if (typeof value !== "string") return UNKNOWN_METADATA;
-	const normalized = value.trim();
-	if (normalized.length === 0 || normalized.length > MAX_METADATA_LENGTH || !SAFE_METADATA_PATTERN.test(normalized)) return UNKNOWN_METADATA;
-	return normalized;
-}
-function getInitializeParams(message) {
-	if (!isRecord(message) || message.method !== "initialize") return {};
-	return isRecord(message.params) ? message.params : {};
-}
-function extractMcpClientMetadata(message) {
-	const params = getInitializeParams(message);
-	const clientInfo = isRecord(params.clientInfo) ? params.clientInfo : {};
-	return {
-		name: normalizeMetadata(clientInfo.name),
-		version: normalizeMetadata(clientInfo.version),
-		protocolVersion: normalizeMetadata(params.protocolVersion)
-	};
-}
-function metadataAttributes(metadata) {
-	return {
-		client_name: metadata.name,
-		client_version: metadata.version,
-		protocol_version: metadata.protocolVersion,
-		transport: "stdio"
-	};
-}
-function durationBucket(durationMs) {
-	if (durationMs < 1e3) return "<1s";
-	if (durationMs < 1e4) return "1-10s";
-	if (durationMs < 6e4) return "10-60s";
-	if (durationMs < 3e5) return "1-5m";
-	return "5m+";
-}
-function recordMcpSessionStart(message) {
-	const metadata = extractMcpClientMetadata(message);
-	currentSession = {
-		metadata,
-		startedAt: Date.now(),
-		toolCalls: 0,
-		hadToolFailure: false
-	};
-	const attributes = metadataAttributes(metadata);
-	sessionStarted.add(1, attributes);
-	return metadata;
-}
-function recordMcpToolInvocation() {
-	if (currentSession) currentSession.toolCalls += 1;
-	return metadataAttributes(currentSession?.metadata ?? {
-		name: UNKNOWN_METADATA,
-		version: UNKNOWN_METADATA,
-		protocolVersion: UNKNOWN_METADATA
-	});
-}
-function recordMcpToolFailure() {
-	if (currentSession) currentSession.hadToolFailure = true;
-}
-function getCurrentMcpClientMetadata() {
-	return currentSession?.metadata ?? {
-		name: UNKNOWN_METADATA,
-		version: UNKNOWN_METADATA,
-		protocolVersion: UNKNOWN_METADATA
-	};
-}
-function recordMcpSessionTermination(category) {
-	const session = currentSession;
-	const durationMs = session ? Math.max(0, Date.now() - session.startedAt) : 0;
-	const attributes = {
-		...metadataAttributes(session?.metadata ?? {
-			name: UNKNOWN_METADATA,
-			version: UNKNOWN_METADATA,
-			protocolVersion: UNKNOWN_METADATA
-		}),
-		termination_category: category,
-		session_duration_bucket: durationBucket(durationMs),
-		tool_calls_bucket: bucketCount(session?.toolCalls ?? 0)
-	};
-	sessionEnded.add(1, attributes);
-	currentSession = void 0;
-}
-function resolveSessionTerminationCategory(shutdownSucceeded) {
-	if (!shutdownSucceeded) return "unknown";
-	return currentSession?.hadToolFailure ? "tool_failure" : "clean";
-}
-//#endregion
 //#region src/utils/tool-observer.ts
 const WORKFLOW_PAGINATION_RESOURCES = /* @__PURE__ */ new Set([
 	"workouts",
@@ -4722,7 +5071,7 @@ function createAttributes(invocation) {
 		"mcp.client.name": clientMetadata.name,
 		"mcp.client.version": clientMetadata.version,
 		"mcp.protocol.version": clientMetadata.protocolVersion,
-		"mcp.transport": "stdio",
+		"mcp.transport": getCurrentMcpTransport(),
 		"mcp.tool.args.key_count_bucket": invocation.argumentKeyCountBucket ?? "unknown",
 		"mcp.tool.args.keys": invocation.argumentKeys?.join(",") ?? ""
 	};
@@ -5185,13 +5534,18 @@ const HELP_TEXT = [
 	"Options:",
 	"  -h, --help                 Show this help message and exit",
 	"  -v, --version              Show version and exit",
+	"  --transport stdio|http     Select the transport (default: stdio)",
+	"  --host <host>              HTTP bind host (default: 127.0.0.1)",
+	"  --port <port>              HTTP bind port (default: 3000)",
 	"",
 	"Environment:",
 	"  HEVY_API_KEY=<api-key>     Hevy API key from Hevy app settings",
 	"  HEVY_MCP_DEBUG=1           Enable verbose diagnostics on stderr",
+	"  HEVY_MCP_HTTP_BEARER_TOKEN Protect non-loopback HTTP deployments",
 	"",
 	"Examples:",
-	"  HEVY_API_KEY=your-key npx hevy-mcp"
+	"  HEVY_API_KEY=your-key npx hevy-mcp",
+	"  HEVY_API_KEY=your-key npx hevy-mcp --transport http --port 3000"
 ].join("\n");
 function getCliAction(args) {
 	for (const arg of args) {
@@ -5251,11 +5605,11 @@ async function validateApiKey(apiKey) {
 		console.error(diagnostic ? `${API_KEY_VALIDATION_WARNING} Diagnostic: ${diagnostic}.` : API_KEY_VALIDATION_WARNING);
 	}
 }
-function buildServer(apiKey) {
+function buildServer(apiKey, transport = "stdio") {
 	return tracer.startActiveSpan("mcp.server.build", { attributes: {
 		"mcp.server.name": name,
 		"mcp.server.version": version,
-		"mcp.transport": "stdio"
+		"mcp.transport": transport
 	} }, (span) => {
 		try {
 			const server = createHevyMcpServer({
@@ -5282,13 +5636,13 @@ function buildServer(apiKey) {
 		}
 	});
 }
-async function createNodeMcpServer({ apiKey }) {
+async function createNodeMcpServer({ apiKey }, transport = "stdio") {
 	const { apiKey: validatedApiKey } = serverConfigSchema.parse({ apiKey });
 	const userHash = fingerprintApiKey(validatedApiKey);
 	setCurrentUserHash(userHash);
 	Sentry.setUser({ id: userHash });
 	await validateApiKey(validatedApiKey);
-	return buildServer(validatedApiKey);
+	return buildServer(validatedApiKey, transport);
 }
 async function runStdioServer() {
 	const cliAction = getCliAction(process.argv.slice(2));
@@ -5348,5 +5702,51 @@ async function runStdioServer() {
 		}
 	});
 }
+async function runServer() {
+	const args = process.argv.slice(2);
+	const cliAction = getCliAction(args);
+	if (cliAction === "version") {
+		console.error(`${name} v${version}`);
+		return;
+	}
+	if (cliAction === "help") {
+		console.log(HELP_TEXT);
+		return;
+	}
+	const options = parseNodeCliOptions(args);
+	if (options.transport === "stdio") {
+		await runStdioServer();
+		return;
+	}
+	await tracer.startActiveSpan("mcp.server.run", { attributes: { "mcp.transport": "http" } }, async (span) => {
+		let listening = false;
+		serverStartups.add(1, { version });
+		try {
+			const cfg = parseConfig(process.env);
+			assertApiKey(cfg.apiKey);
+			await validateApiKey(cfg.apiKey);
+			const handle = await startStreamableHttpServer(options, cfg.apiKey, (params) => Promise.resolve(buildServer(params.apiKey, "http")));
+			listening = true;
+			console.error(`Starting MCP server in HTTP mode at ${options.host}:${options.port}/mcp`);
+			scheduleUpdateCheck({
+				packageName: name$1,
+				currentVersion: version$1
+			});
+			installGracefulShutdown({
+				target: handle,
+				onComplete: async () => {
+					await flushTelemetry();
+				}
+			});
+			span.setStatus({ code: SpanStatusCode.OK });
+		} catch (error) {
+			recordMcpSessionTermination(listening ? "unknown" : "startup_failure");
+			span.setStatus({ code: SpanStatusCode.ERROR });
+			throw error;
+		} finally {
+			span.end();
+		}
+	});
+}
 //#endregion
-export { flushTelemetry as a, createSafeErrorDiagnostic as i, runStdioServer as n, MissingHevyApiKeyError as r, createNodeMcpServer as t };
+export { createSafeErrorDiagnostic as a, MissingHevyApiKeyError as i, runServer as n, flushTelemetry as o, runStdioServer as r, createNodeMcpServer as t };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "hevy-mcp",
-	"version": "4.0.1",
+	"version": "4.1.0",
 	"private": false,
 	"description": "A Model Context Protocol (MCP) server implementation that interfaces with the Hevy fitness tracking app and its API.",
 	"repository": {

package/server.json

@@ -7,12 +7,12 @@
 		"url": "https://github.com/chrisdoc/hevy-mcp",
 		"source": "github"
 	},
-	"version": "4.0.1",
+	"version": "4.1.0",
 	"packages": [
 		{
 			"registryType": "npm",
 			"identifier": "hevy-mcp",
-			"version": "4.0.1",
+			"version": "4.1.0",
 			"transport": {
 				"type": "stdio"
 			},