Lyfta MCP

Read-only training connector

Paste the connector URL below in ChatGPT, Claude, or Cursor. Do not paste personal JWTs. Agents only see that user’s completed workouts.

What it is

Lyfta MCP is a read-only training connector. ChatGPT, Claude, Cursor, and similar agents call the API with an OAuth token for that Lyfta user. They never get write access.

Connector URL

Use this URL only. Not my.lyfta.app, not /community/mcp. MCP OAuth is not on the web app.

https://api.lyftadev.com/v2/mcp

How connect works

The user pastes https://api.lyftadev.com/v2/mcp in ChatGPT, Claude, or Cursor.
The client discovers OAuth at https://api.lyftadev.com/v2/.well-known/oauth-authorization-server. The issuer is /v2, not the API origin root. It registers itself (DCR) and should show Connect.
Connect opens the browser on my.lyfta.app for login, then consent at https://my.lyfta.app/oauth/consent.
The user chooses Allow or Deny.
After Allow, the browser must leave my.lyfta.app to the agent’s callback with code and state. Until that happens, the agent is not connected.

There is no client secret. Clients use public PKCE. If a host still asks for a client id, use the matching one: Cursor → cursor, Claude → claude, ChatGPT → chatgpt.

If Connect does not show

A connector with no client id and no discoverable OAuth shows as broken / no Connect. Pointing Claude or Cursor at my.lyfta.app produces that on its own. https://my.lyfta.app/.well-known/oauth-authorization-server is personal-API metadata (no registration_endpoint) — not MCP discovery.

Confirm the connector URL is https://api.lyftadev.com/v2/mcp.
Remove a stale connector (especially one added before DCR) and add it again.
Org-level custom connectors can need a client id if Claude did not DCR. Paste claude — no secret.

When Connect opens, the browser goes to my.lyfta.app for login and Allow. MCP OAuth discovery is the API URL in Quick check — not my.lyfta.app. Do not paste my.lyfta.app or /community/mcp as the connector.

If Allow succeeds but Cursor stays disconnected

After Allow, the tab must leave to a Cursor callback: https://www.cursor.com/agents/mcp/oauth/callback, http://localhost:8787/callback, or cursor://…. If it stays on /oauth/consent, click Continue to Cursor. cursor:// and localhost assigns can fail silently.
Connect from the same Cursor surface that started OAuth. Cloud Agents callback ≠ desktop chat token.
One client id per connect. Disconnect the stale connector. Add https://api.lyftadev.com/v2/mcp only, or paste cursor if asked. Do not DCR a UUID first and then paste cursor — that produces invalid_grant.
Do not paste chatgpt into Cursor.

Lyfta must not show a “you’re connected” screen. The agent is connected only after it has the token.

Quick check

Open this URL. It should 200 and include authorization_endpoint, token_endpoint, and registration_endpoint. If it does, a “metadata missing” story is wrong unless the connector URL was not the one above.

https://api.lyftadev.com/v2/.well-known/oauth-authorization-server

Scope

training:read — that user’s completed workouts only. No logging, editing, or account changes.

Tools (v1)

Tool	Use when
`get_recent_workouts`	“What did I train lately?”
`get_workout`	One session’s sets/reps (workoutId from another tool)
`get_exercise_history`	How a lift is going (e.g. bench)
`get_training_summary`	This week / last 7 or 30 days / date range (UTC, max 90 days)

Status

API: MCP, OAuth discovery, DCR, authorize, token, revoke — done.
my.lyfta.app: login, consent, and personal-API OAuth metadata (no DCR). MCP connector and discovery live on the API. Consent page: https://my.lyfta.app/oauth/consent.
Not yet: rate limits, tool-call audit log, write tools.