hevy-mcp 4.1.0 → 4.1.1

package/README.md

@@ -414,17 +414,18 @@ self-hosted Streamable HTTP.
 
 ## Advanced configuration
 
-| Setting                      | Default                        | Scope                         | Notes                                                                                                               |
-| ---------------------------- | ------------------------------ | ----------------------------- | ------------------------------------------------------------------------------------------------------------------- |
-| `HEVY_API_KEY`               | None; required                 | Local stdio or HTTP           | Hevy API key from the Hevy app. Never pass it in a URL.                                                             |
-| `HEVY_MCP_API_TIMEOUT`       | `30000` ms                     | Local stdio                   | Positive Hevy API timeout in milliseconds. Invalid values fall back to 30 seconds.                                  |
-| `HEVY_MCP_DEBUG`             | Disabled                       | Local Node                    | Set to exactly `1` for privacy-bounded diagnostics on stderr. Stdout remains reserved for MCP JSON-RPC.             |
-| `HEVY_MCP_HTTP_BEARER_TOKEN` | None                           | Non-loopback HTTP             | Required when `--host` is not loopback; use a separate token, never the Hevy API key.                               |
-| `XDG_CACHE_HOME`             | `~/.cache`                     | Local stdio                   | Changes the root for the npm update-check cache at `hevy-mcp/update-check.json`.                                    |
-| `SENTRY_DSN`                 | Packaged project DSN           | Optional local Node telemetry | Overrides the Sentry destination. An empty value disables Sentry export. The Worker does not import Node telemetry. |
-| `SENTRY_RELEASE`             | `hevy-mcp@<installed-version>` | Optional local Node telemetry | Overrides the release label attached to local Sentry events and traces.                                             |
-| `-h`, `--help`               | N/A                            | Local stdio CLI               | Print supported options and exit.                                                                                   |
-| `-v`, `--version`            | N/A                            | Local stdio CLI               | Print the installed version and exit.                                                                               |
+| Setting                      | Default                        | Scope                         | Notes                                                                                                                                                                            |
+| ---------------------------- | ------------------------------ | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `HEVY_API_KEY`               | None; required                 | Local stdio or HTTP           | Hevy API key from the Hevy app. Never pass it in a URL.                                                                                                                          |
+| `HEVY_MCP_API_TIMEOUT`       | `30000` ms                     | Local stdio                   | Positive Hevy API timeout in milliseconds. Invalid values fall back to 30 seconds.                                                                                               |
+| `HEVY_MCP_DEBUG`             | Disabled                       | Local Node                    | Set to exactly `1` for privacy-bounded diagnostics on stderr. Stdout remains reserved for MCP JSON-RPC.                                                                          |
+| `HEVY_MCP_HTTP_BEARER_TOKEN` | None                           | Non-loopback HTTP             | Required when `--host` is not loopback; use a separate token, never the Hevy API key.                                                                                            |
+| `HEVY_MCP_TELEMETRY`         | Enabled                        | Local Node                    | Set to exactly `0` before startup/import to disable Sentry errors/traces and OTLP traces/metrics. Takes precedence over `SENTRY_DSN` and packaged/runtime collector credentials. |
+| `XDG_CACHE_HOME`             | `~/.cache`                     | Local stdio                   | Changes the root for the npm update-check cache at `hevy-mcp/update-check.json`.                                                                                                 |
+| `SENTRY_DSN`                 | Packaged project DSN           | Optional local Node telemetry | Sentry-only override for the destination. An empty value disables Sentry export. The Worker does not import Node telemetry.                                                      |
+| `SENTRY_RELEASE`             | `hevy-mcp@<installed-version>` | Optional local Node telemetry | Overrides the release label attached to local Sentry events and traces.                                                                                                          |
+| `-h`, `--help`               | N/A                            | Local stdio CLI               | Print supported options and exit.                                                                                                                                                |
+| `-v`, `--version`            | N/A                            | Local stdio CLI               | Print the installed version and exit.                                                                                                                                            |
 
 The local executable uses stdio by default. To opt into Streamable HTTP, run:
 
@@ -459,6 +460,42 @@ server-scoped in-memory catalog cache:
 - Paginated `get-exercise-templates` calls always fetch their requested page.
 - Each hosted Worker request gets a fresh cache, preventing cross-key sharing.
 
+### Local Node telemetry and privacy
+
+The local Node package enables project telemetry by default. It is local Node
+behavior only; the Cloudflare Worker does not import Node telemetry. Set
+`HEVY_MCP_TELEMETRY=0` before startup or import to disable all project
+telemetry. Only the literal value `0` opts out: an unset value, an empty value,
+`1`, `false`, and every other value remain enabled. The master setting takes
+precedence over `SENTRY_DSN` and packaged or runtime `OTEL_COLLECTOR_TOKEN`
+credentials, so the disabled path creates no telemetry exporters or periodic
+metric readers and makes no telemetry network requests. `SENTRY_DSN` remains a
+Sentry-only setting; when telemetry is enabled, an empty value disables only
+Sentry export.
+
+When enabled, errors and traces are sent to the packaged Sentry project at
+<https://o4508975499575296.ingest.de.sentry.io/4509049671647312>. Traces and
+metrics are sent to the collector at
+<https://otel.chrisdoc.dev/v1/traces> and
+<https://otel.chrisdoc.dev/v1/metrics>, which forward to Honeycomb. Metrics
+export every 10 seconds.
+
+The API key is never exported. Enabled telemetry derives a deterministic
+ten-character HMAC-SHA-256 pseudonym from it solely for cross-span
+correlation. The pseudonym is attached to spans only, never used as a metric
+dimension, and is not intended for per-user behavior histories.
+
+The privacy allowlist contains service/version/transport; fixed tool feature,
+read/write kind, operation, and short-lived tool name; bounded
+outcome/error/count/retry/duration/session/cache/workflow values; normalized API
+method/endpoint/status; shape-only key names, presence, count, and boolean
+fields; sanitized client/protocol tokens; and the span-only pseudonym. It
+explicitly prohibits raw prompts, tool argument values, tool result content,
+request bodies, API keys, raw identifiers/queries/exact dates,
+workout/routine/folder/template/body-measurement content, names/titles/
+descriptions/notes, measurement values, arbitrary client metadata, and
+unnormalized endpoint paths.
+
 ## Security and mutations
 
 - Keep `HEVY_API_KEY` out of source control, URLs, logs, and screenshots.

package/dist/cli.mjs

@@ -4,12 +4,12 @@
 (function() {
 	try {
 		var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {};
-		e.SENTRY_RELEASE = { id: "hevy-mcp@4.1.0" };
+		e.SENTRY_RELEASE = { id: "hevy-mcp@4.1.1" };
 		var n = new e.Error().stack;
 		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "625c4c9c-e20d-40b3-96b1-4e799ef130f3", e._sentryDebugIdIdentifier = "sentry-dbid-625c4c9c-e20d-40b3-96b1-4e799ef130f3");
 	} catch (e) {}
 })();
-import { a as createSafeErrorDiagnostic, i as MissingHevyApiKeyError, n as runServer, o as flushTelemetry } from "./src-wSWxe4LJ.mjs";
+import { a as createSafeErrorDiagnostic, i as MissingHevyApiKeyError, n as runServer, o as flushTelemetry } from "./src-BPbLELQf.mjs";
 //#region src/cli.ts
 runServer().catch(async (error) => {
 	if (error instanceof MissingHevyApiKeyError) console.error(error.message);

package/dist/index.mjs

@@ -4,10 +4,10 @@
 (function() {
 	try {
 		var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {};
-		e.SENTRY_RELEASE = { id: "hevy-mcp@4.1.0" };
+		e.SENTRY_RELEASE = { id: "hevy-mcp@4.1.1" };
 		var n = new e.Error().stack;
 		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "e9496b31-626b-4ad1-9416-47ba4ffd2995", e._sentryDebugIdIdentifier = "sentry-dbid-e9496b31-626b-4ad1-9416-47ba4ffd2995");
 	} catch (e) {}
 })();
-import { n as runServer, r as runStdioServer, t as createNodeMcpServer } from "./src-wSWxe4LJ.mjs";
+import { n as runServer, r as runStdioServer, t as createNodeMcpServer } from "./src-BPbLELQf.mjs";
 export { createNodeMcpServer, runServer, runStdioServer };

package/dist/{src-wSWxe4LJ.mjs → src-BPbLELQf.mjs}

@@ -4,11 +4,12 @@
 (function() {
 	try {
 		var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {};
-		e.SENTRY_RELEASE = { id: "hevy-mcp@4.1.0" };
+		e.SENTRY_RELEASE = { id: "hevy-mcp@4.1.1" };
 		var n = new e.Error().stack;
-		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "4b988c15-eb76-40ac-8399-033bebec17f8", e._sentryDebugIdIdentifier = "sentry-dbid-4b988c15-eb76-40ac-8399-033bebec17f8");
+		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "3ad9084e-6d6c-4681-ad27-9168114359ab", e._sentryDebugIdIdentifier = "sentry-dbid-3ad9084e-6d6c-4681-ad27-9168114359ab");
 	} catch (e) {}
 })();
+import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import * as Sentry from "@sentry/node";
 import { SentryPropagator, SentrySampler, SentrySpanProcessor } from "@sentry/opentelemetry";
 import { SpanStatusCode, metrics, trace } from "@opentelemetry/api";
@@ -18,7 +19,6 @@ import { resourceFromAttributes } from "@opentelemetry/resources";
 import { BatchSpanProcessor } from "@opentelemetry/sdk-trace-base";
 import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
 import { MeterProvider, PeriodicExportingMetricReader } from "@opentelemetry/sdk-metrics";
-import { createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -81,26 +81,15 @@ function sanitizeSentryMcpSpan(span) {
 * OTel Collector → Honeycomb: performance traces, metrics
 */
 const name$1 = "hevy-mcp";
-const version$1 = "4.1.0";
+const version$1 = "4.1.1";
+const telemetryEnabled = process.env.HEVY_MCP_TELEMETRY !== "0";
 const collectorToken = "NH9vOela-HYreQxAbJa68cjEmORoEKM57EvneUDVcOo";
 const COLLECTOR_ENDPOINT = "https://otel.chrisdoc.dev/v1";
-const sentryRelease = process.env.SENTRY_RELEASE ?? `hevy-mcp@4.1.0`;
+const sentryRelease = process.env.SENTRY_RELEASE ?? `hevy-mcp@4.1.1`;
 const resource = resourceFromAttributes({
 	"service.name": name$1,
 	"service.version": version$1
 });
-const rawDsn = process.env.SENTRY_DSN ?? "https://ce696d8333b507acbf5203eb877bce0f@o4508975499575296.ingest.de.sentry.io/4509049671647312";
-const isValidDsn = typeof rawDsn === "string" && rawDsn.length > 0 && !rawDsn.startsWith("*");
-const sentryClient = Sentry.init({
-	dsn: isValidDsn ? rawDsn : void 0,
-	beforeSendSpan: sanitizeSentryMcpSpan,
-	release: sentryRelease,
-	tracesSampleRate: 1,
-	sendDefaultPii: false,
-	skipOpenTelemetrySetup: true,
-	registerEsmLoaderHooks: false,
-	ignoreErrors: ["EPIPE", "broken pipe"]
-});
 let currentUserHash;
 var UserHashSpanProcessor = class {
 	onStart(span) {
@@ -110,37 +99,53 @@ var UserHashSpanProcessor = class {
 	async forceFlush() {}
 	async shutdown() {}
 };
-const spanProcessors = [new UserHashSpanProcessor(), new SentrySpanProcessor()];
-spanProcessors.push(new BatchSpanProcessor(new OTLPTraceExporter({
-	url: `${COLLECTOR_ENDPOINT}/traces`,
-	headers: { Authorization: `Bearer ${collectorToken}` }
-})));
-const tracerProvider = new NodeTracerProvider({
-	resource,
-	sampler: sentryClient ? new SentrySampler(sentryClient) : void 0,
-	spanProcessors
-});
-tracerProvider.register({
-	propagator: new SentryPropagator(),
-	contextManager: new Sentry.SentryContextManager()
-});
+let tracerProvider;
 let meterProvider;
-meterProvider = new MeterProvider({
-	resource,
-	readers: [new PeriodicExportingMetricReader({
-		exporter: new OTLPMetricExporter({
-			url: `${COLLECTOR_ENDPOINT}/metrics`,
-			headers: { Authorization: `Bearer ${collectorToken}` }
-		}),
-		exportIntervalMillis: 1e4
-	})]
-});
-metrics.setGlobalMeterProvider(meterProvider);
-trace.setGlobalTracerProvider(tracerProvider);
-Sentry.validateOpenTelemetrySetup();
+if (telemetryEnabled) {
+	const rawDsn = process.env.SENTRY_DSN ?? "https://ce696d8333b507acbf5203eb877bce0f@o4508975499575296.ingest.de.sentry.io/4509049671647312";
+	const isValidDsn = typeof rawDsn === "string" && rawDsn.length > 0 && !rawDsn.startsWith("*");
+	const sentryClient = Sentry.init({
+		dsn: isValidDsn ? rawDsn : void 0,
+		beforeSendSpan: sanitizeSentryMcpSpan,
+		release: sentryRelease,
+		tracesSampleRate: 1,
+		sendDefaultPii: false,
+		skipOpenTelemetrySetup: true,
+		registerEsmLoaderHooks: false,
+		ignoreErrors: ["EPIPE", "broken pipe"]
+	});
+	const spanProcessors = [new UserHashSpanProcessor(), new SentrySpanProcessor()];
+	spanProcessors.push(new BatchSpanProcessor(new OTLPTraceExporter({
+		url: `${COLLECTOR_ENDPOINT}/traces`,
+		headers: { Authorization: `Bearer ${collectorToken}` }
+	})));
+	tracerProvider = new NodeTracerProvider({
+		resource,
+		sampler: sentryClient ? new SentrySampler(sentryClient) : void 0,
+		spanProcessors
+	});
+	tracerProvider.register({
+		propagator: new SentryPropagator(),
+		contextManager: new Sentry.SentryContextManager()
+	});
+	meterProvider = new MeterProvider({
+		resource,
+		readers: [new PeriodicExportingMetricReader({
+			exporter: new OTLPMetricExporter({
+				url: `${COLLECTOR_ENDPOINT}/metrics`,
+				headers: { Authorization: `Bearer ${collectorToken}` }
+			}),
+			exportIntervalMillis: 1e4
+		})]
+	});
+	metrics.setGlobalMeterProvider(meterProvider);
+	trace.setGlobalTracerProvider(tracerProvider);
+	Sentry.validateOpenTelemetrySetup();
+}
 async function flushTelemetry(timeoutMs = 1e3) {
+	if (!telemetryEnabled) return;
 	const flushPromise = Promise.allSettled([
-		tracerProvider.forceFlush(),
+		...tracerProvider ? [tracerProvider.forceFlush()] : [],
 		...meterProvider ? [meterProvider.forceFlush()] : [],
 		Sentry.flush(timeoutMs)
 	]);
@@ -156,8 +161,12 @@ async function flushTelemetry(timeoutMs = 1e3) {
 }
 const tracer = trace.getTracer(name$1);
 const meter = metrics.getMeter(name$1);
-function setCurrentUserHash(hash) {
-	currentUserHash = hash;
+const SENTRY_USER_ID_CONTEXT = "hevy-mcp:sentry-user-id:v1";
+function setTelemetryUser(apiKey) {
+	if (!telemetryEnabled) return;
+	const userHash = createHmac("sha256", apiKey).update(SENTRY_USER_ID_CONTEXT).digest("hex").slice(0, 10);
+	currentUserHash = userHash;
+	Sentry.setUser({ id: userHash });
 }
 //#endregion
 //#region src/utils/metrics.ts
@@ -2586,7 +2595,7 @@ function registerHevyResources(server, runtime) {
 //#endregion
 //#region ../core/src/server-metadata.ts
 const SERVER_NAME = "hevy-mcp";
-const SERVER_VERSION = "4.1.0";
+const SERVER_VERSION = "4.1.1";
 const SERVER_INSTRUCTIONS = [
 	"Hevy MCP connects clients to the authenticated user's Hevy workout-tracking data, including workouts, routines, exercise templates, routine folders, body measurements, and profile information. HEVY_API_KEY must contain a valid Hevy API key for local stdio use.",
 	"Safety: all get-* and search-* tools are read-only. create-* and update-* tools mutate Hevy data. Creates are additive and non-idempotent, so repeating one can create duplicates. Updates can overwrite existing data. Delete operations are not available.",
@@ -5542,6 +5551,7 @@ const HELP_TEXT = [
 	"  HEVY_API_KEY=<api-key>     Hevy API key from Hevy app settings",
 	"  HEVY_MCP_DEBUG=1           Enable verbose diagnostics on stderr",
 	"  HEVY_MCP_HTTP_BEARER_TOKEN Protect non-loopback HTTP deployments",
+	"  HEVY_MCP_TELEMETRY=0     Disable all project telemetry",
 	"",
 	"Examples:",
 	"  HEVY_API_KEY=your-key npx hevy-mcp",
@@ -5570,10 +5580,6 @@ const SAFE_NETWORK_ERROR_CODES = /* @__PURE__ */ new Set([
 	"ETIMEDOUT",
 	"HEVY_RETRY_EXHAUSTED"
 ]);
-const SENTRY_USER_ID_CONTEXT = "hevy-mcp:sentry-user-id:v1";
-function fingerprintApiKey(apiKey) {
-	return createHmac("sha256", apiKey).update(SENTRY_USER_ID_CONTEXT).digest("hex").slice(0, 10);
-}
 const serverConfigSchema = z.object({ apiKey: z.string().min(1, "Hevy API key is required").describe("Your Hevy API key (available in the Hevy app settings).") });
 function getHttpStatus(error) {
 	if (isHevyHttpError(error)) return error.status;
@@ -5638,9 +5644,7 @@ function buildServer(apiKey, transport = "stdio") {
 }
 async function createNodeMcpServer({ apiKey }, transport = "stdio") {
 	const { apiKey: validatedApiKey } = serverConfigSchema.parse({ apiKey });
-	const userHash = fingerprintApiKey(validatedApiKey);
-	setCurrentUserHash(userHash);
-	Sentry.setUser({ id: userHash });
+	setTelemetryUser(validatedApiKey);
 	await validateApiKey(validatedApiKey);
 	return buildServer(validatedApiKey, transport);
 }
@@ -5656,11 +5660,7 @@ async function runStdioServer() {
 	}
 	serverStartups.add(1, { version });
 	const configuredApiKey = process.env.HEVY_API_KEY;
-	const initialUserHash = configuredApiKey ? fingerprintApiKey(configuredApiKey) : void 0;
-	if (initialUserHash) {
-		setCurrentUserHash(initialUserHash);
-		Sentry.setUser({ id: initialUserHash });
-	}
+	if (configuredApiKey) setTelemetryUser(configuredApiKey);
 	let connectAttempted = false;
 	await tracer.startActiveSpan("mcp.server.run", { attributes: { "mcp.transport": "stdio" } }, async (span) => {
 		try {
@@ -5724,6 +5724,7 @@ async function runServer() {
 		try {
 			const cfg = parseConfig(process.env);
 			assertApiKey(cfg.apiKey);
+			setTelemetryUser(cfg.apiKey);
 			await validateApiKey(cfg.apiKey);
 			const handle = await startStreamableHttpServer(options, cfg.apiKey, (params) => Promise.resolve(buildServer(params.apiKey, "http")));
 			listening = true;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "hevy-mcp",
-	"version": "4.1.0",
+	"version": "4.1.1",
 	"private": false,
 	"description": "A Model Context Protocol (MCP) server implementation that interfaces with the Hevy fitness tracking app and its API.",
 	"repository": {

package/server.json

@@ -7,12 +7,12 @@
 		"url": "https://github.com/chrisdoc/hevy-mcp",
 		"source": "github"
 	},
-	"version": "4.1.0",
+	"version": "4.1.1",
 	"packages": [
 		{
 			"registryType": "npm",
 			"identifier": "hevy-mcp",
-			"version": "4.1.0",
+			"version": "4.1.1",
 			"transport": {
 				"type": "stdio"
 			},