Connect TrainingPeaks to Claude and other AI assistants via the Model Context Protocol (MCP). Query your workouts, analyze training load, compare power data, and track fitness trends through natural conversation. No API approval required. The official Training Peaks API is approval-gated, but this server uses secure cookie authentication that any user can set up in minutes. Your cookie is stored i
Add this skill
npx mdskills install JamsusMaximus/trainingpeaks-mcpPolished MCP server with comprehensive tools for training analytics and excellent security documentation
1# TrainingPeaks MCP Server23<a href="https://glama.ai/mcp/servers/@JamsusMaximus/TrainingPeaks-MCP">4 <img width="380" height="200" src="https://glama.ai/mcp/servers/@JamsusMaximus/TrainingPeaks-MCP/badge" alt="TrainingPeaks MCP server" />5</a>67Connect TrainingPeaks to Claude and other AI assistants via the Model Context Protocol (MCP). Query your workouts, analyze training load, compare power data, and track fitness trends through natural conversation.89**No API approval required.** The official Training Peaks API is approval-gated, but this server uses secure cookie authentication that any user can set up in minutes. Your cookie is stored in your system keyring, never transmitted anywhere except to TrainingPeaks.1011## What You Can Do12131415Ask your AI assistant questions like:16- "Compare my FTP progression this year vs last year"17- "What was my TSS ramp rate in the 6 weeks before my best 20-min power?"18- "Am I ready to race? Show my form trend and recent workout quality"19- "Which days of the week do I typically train hardest?"20- "Find weeks where I exceeded 800 TSS and show what happened to my form after"2122## Features2324| Tool | Description |25|------|-------------|26| `tp_get_workouts` | Query workouts by date range (planned and completed) |27| `tp_get_workout` | Get detailed metrics for a single workout |28| `tp_get_peaks` | Compare power PRs (5sec to 90min) and running PRs (400m to marathon) |29| `tp_get_fitness` | Track CTL, ATL, and TSB (fitness, fatigue, form) |30| `tp_get_workout_prs` | See personal records set in a specific session |31| `tp_refresh_auth` | Re-authenticate if your session expires (extracts fresh cookie from browser) |3233---3435## Setup Options3637### Option A: Auto-Setup with Claude Code3839If you have [Claude Code](https://claude.ai/code), paste this prompt:4041```42Set up the TrainingPeaks MCP server from https://github.com/JamsusMaximus/trainingpeaks-mcp - clone it, create a venv, install it, then walk me through getting my TrainingPeaks cookie from my browser and run tp-mcp auth. Finally, add it to my Claude Desktop config.43```4445Claude will handle the installation and guide you through authentication step-by-step.4647### Option B: Manual Setup4849#### Step 1: Install5051```bash52git clone https://github.com/JamsusMaximus/trainingpeaks-mcp.git53cd trainingpeaks-mcp54python3 -m venv .venv55source .venv/bin/activate # Windows: .venv\Scripts\activate56pip install -e .57```5859#### Step 2: Authenticate6061**Option A: Auto-extract from browser (easiest)**6263If you're logged into TrainingPeaks in your browser:6465```bash66pip install tp-mcp[browser] # One-time: install browser support67tp-mcp auth --from-browser chrome # Or: firefox, safari, edge, auto68```6970> **macOS note:** You may see security prompts for Keychain or Full Disk Access. This is normal - browser cookies are encrypted and require permission to read.7172**Option B: Manual cookie entry**73741. Log into [app.trainingpeaks.com](https://app.trainingpeaks.com)752. Open DevTools (`F12`) → **Application** tab → **Cookies**763. Find `Production_tpAuth` and copy its value774. Run `tp-mcp auth` and paste when prompted7879**Other auth commands:**80```bash81tp-mcp auth-status # Check if authenticated82tp-mcp auth-clear # Remove stored cookie83```8485#### Step 4: Add to Claude Desktop8687Run this to get your config snippet:8889```bash90tp-mcp config91```9293Edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows) and paste it inside `mcpServers`. Example with multiple servers:9495```json96{97 "mcpServers": {98 "some-other-server": {99 "command": "npx",100 "args": ["some-other-mcp"]101 },102 "trainingpeaks": {103 "command": "/Users/you/trainingpeaks-mcp/.venv/bin/tp-mcp",104 "args": ["serve"]105 }106 }107}108```109110Restart Claude Desktop. You're ready to go!111112---113114## Tool Reference115116### tp_get_workouts117List workouts in a date range. Max 90 days per query.118119```json120{ "start_date": "2026-01-01", "end_date": "2026-01-07", "type": "completed" }121```122123### tp_get_workout124Get full details for one workout including power, HR, cadence, TSS.125126```json127{ "workout_id": "123456789" }128```129130### tp_get_peaks131Get ranked personal records. Bike: power metrics. Run: pace/speed metrics.132133```json134{ "sport": "Bike", "pr_type": "power20min", "days": 365 }135```136137**Bike types:** `power5sec`, `power1min`, `power5min`, `power10min`, `power20min`, `power60min`, `power90min`138139**Run types:** `speed400Meter`, `speed1K`, `speed5K`, `speed10K`, `speedHalfMarathon`, `speedMarathon`140141### tp_get_fitness142Get training load metrics over time.143144```json145{ "days": 90 }146```147148Returns daily CTL (chronic training load / fitness), ATL (acute training load / fatigue), and TSB (training stress balance / form).149150### tp_get_workout_prs151Get PRs set during a specific workout.152153```json154{ "workout_id": "123456789" }155```156157## What is MCP?158159[Model Context Protocol](https://modelcontextprotocol.io) is an open standard for connecting AI assistants to external data sources. MCP servers expose tools that AI models can call to fetch real-time data, enabling assistants like Claude to access your Training Peaks account through natural language.160161## Security162163**TL;DR: Your cookie is encrypted on disk, exchanged for short-lived OAuth tokens, never shown to Claude, and only ever sent to TrainingPeaks. The server is read-only and has no network ports.**164165This server is designed with defense-in-depth. Your TrainingPeaks session cookie is sensitive - it grants access to your training data - so we treat it accordingly.166167### Cookie Storage168169| Platform | Primary Storage | Fallback |170|----------|----------------|----------|171| macOS | System Keychain | Encrypted file |172| Windows | Windows Credential Manager | Encrypted file |173| Linux | Secret Service (GNOME/KDE) | Encrypted file |174175Your cookie is **never** stored in plaintext. The encrypted file fallback uses Fernet symmetric encryption with a machine-specific key.176177### Cookie Never Leaks to AI178179The AI assistant (Claude) **never sees your cookie value**. Multiple layers ensure this:1801811. **Return value sanitization**: Tool results are scrubbed for any keys containing `cookie`, `token`, `auth`, `credential`, `password`, or `secret` before being sent to Claude1822. **Masked repr()**: The `BrowserCookieResult` class overrides `__repr__` to show `cookie=<present>` instead of the actual value1833. **Sanitized exceptions**: Error messages use only exception type names, never full messages that could contain data1844. **No logging**: Cookie values are never written to any log185186### Domain Hardcoding (Cannot Be Changed)187188The browser cookie extraction **only** accesses `.trainingpeaks.com`:189190```python191# From src/tp_mcp/auth/browser.py - HARDCODED, not a parameter192cj = func(domain_name=".trainingpeaks.com")193```194195Claude cannot modify this via tool parameters. The only parameter is `browser` (chrome/firefox/etc), not the domain. To change the domain would require modifying the source code.196197### Read-Only Access198199This server provides **read-only** access to TrainingPeaks:200- ✅ Query workouts, fitness metrics, personal records201- ❌ Cannot create, modify, or delete workouts202- ❌ Cannot change account settings203- ❌ Cannot access billing or payment info204205### No Network Exposure206207The MCP server uses **stdio transport only** - it communicates with Claude Desktop via stdin/stdout, not over the network. There is no HTTP server, no open ports, no remote access.208209### What This Server Cannot Do210211| Action | Possible? |212|--------|-----------|213| Read your workouts | ✅ Yes |214| Read your fitness metrics | ✅ Yes |215| Modify any TrainingPeaks data | ❌ No |216| Access other websites | ❌ No (domain hardcoded) |217| Send your cookie/token anywhere except TrainingPeaks | ❌ No |218| Expose your cookie to Claude | ❌ No (sanitized) |219| Open network ports | ❌ No (stdio only) |220221### Open Source222223This server is fully open source. You can audit every line of code before running it. Key security files:224- [`src/tp_mcp/auth/browser.py`](src/tp_mcp/auth/browser.py) - Cookie extraction with hardcoded domain225- [`src/tp_mcp/tools/refresh_auth.py`](src/tp_mcp/tools/refresh_auth.py) - Result sanitization226- [`tests/test_tools/test_refresh_auth_security.py`](tests/test_tools/test_refresh_auth_security.py) - Security tests227228## Authentication Flow229230The server uses a two-step authentication process:2312321. **Cookie → OAuth Token**: Your stored cookie is exchanged for a short-lived OAuth access token (expires in 1 hour)2332. **Automatic Refresh**: Tokens are cached in memory and automatically refreshed before expiry234235This means:236- You only need to authenticate once with `tp-mcp auth`237- API calls use proper Bearer token auth, not cookies238- If your session cookie expires (typically after several weeks), use `tp_refresh_auth` in Claude or run `tp-mcp auth` again239240## Development241242```bash243pip install -e ".[dev]"244pytest tests/ -v245mypy src/246ruff check src/247```248249## License250251MIT252
Full transparency — inspect the skill content before installing.