Lyfta MCP

Read-only training connector

Paste the connector URL below in ChatGPT, Claude, or Cursor. Do not paste personal JWTs. Agents only see that user’s completed workouts.

What it is

Lyfta MCP is a read-only training connector. ChatGPT, Claude, Cursor, and similar agents call the API with an OAuth token for that Lyfta user. They never get write access.

Connector URL

Use this URL only. Not my.lyfta.app, not /community/mcp. MCP OAuth is not on the web app.

https://api.lyftadev.com/v2/mcp

How connect works

The user pastes https://api.lyftadev.com/v2/mcp in ChatGPT, Claude, or Cursor.
The client discovers OAuth at https://api.lyftadev.com/v2/.well-known/oauth-authorization-server. The issuer is /v2, not the API origin root. It registers itself (DCR) and should show Connect.
Connect opens the browser on my.lyfta.app for login, then consent at https://my.lyfta.app/oauth/consent.
The user chooses Allow or Deny.
The agent gets a token and can call tools for that user only.

There is no client secret. Clients use public PKCE. If a host still asks for a client id, use chatgpt or claude.

If Connect does not show

A connector with no client id and no discoverable OAuth shows as broken / no Connect. Pointing Claude at my.lyfta.app produces that on its own.

Confirm the connector URL is https://api.lyftadev.com/v2/mcp.
Remove a stale connector (especially one added before DCR) and add it again.
Org-level custom connectors can need a client id if Claude did not DCR. Paste claude or chatgpt— no secret.

When Connect opens, the browser goes to my.lyfta.app for login and Allow. That host is login + consent only. Do not look for /.well-known/oauth-authorization-server on my.lyfta.app.

Quick check

Open this URL. It should 200 and include authorization_endpoint, token_endpoint, and registration_endpoint. If it does, a “metadata missing” story is wrong unless the connector URL was not the one above.

https://api.lyftadev.com/v2/.well-known/oauth-authorization-server

Scope

training:read — that user’s completed workouts only. No logging, editing, or account changes.

Tools (v1)

Tool	Use when
`get_recent_workouts`	“What did I train lately?”
`get_workout`	One session’s sets/reps (workoutId from another tool)
`get_exercise_history`	How a lift is going (e.g. bench)
`get_training_summary`	This week / last 7 or 30 days / date range (UTC, max 90 days)

Status

API: MCP, OAuth discovery, DCR, authorize, token, revoke — done.
my.lyfta.app: login and consent only. Consent page: https://my.lyfta.app/oauth/consent.
Not yet: rate limits, tool-call audit log, write tools.