Vitruve MCP server
Connect Claude, ChatGPT, Claude Code, Codex, Cursor, VS Code and other MCP clients to an organization's Vitruve data: read-only tools, OAuth sign-in, no API key.
The Vitruve MCP server lets an AI assistant read an organization’s training data through the Model Context Protocol. Add one URL to your MCP client, sign in with a Vitruve account, choose the organization to share, and ask in plain language.
Setting it up as a coach? The AI assistants guide walks through each app step by step. This page is for developers and for clients not covered there.
| Server URL | https://mcp.vitruve.fit/mcp |
| Transport | Streamable HTTP |
| Authentication | OAuth 2.1, discovered automatically. No API key. |
| Access | Read-only, scope mcp:read |
| Who can connect | Owners and Coaches whose organization’s plan includes AI connectors |
| Add-ons | Program and template tools need Builder; analytics tools and get_athlete_profile need Labs. Without them they are not listed |
Set up
claude mcp add --transport http vitruve https://mcp.vitruve.fit/mcpAdd --scope user to make it available in every project. Then run /mcp, select vitruve and choose Authenticate.
The first connection opens Vitruve’s sign-in and consent page in the browser. The user signs in, picks one organization, and selects Allow access; the client stores and refreshes its tokens on its own.
Authentication
The server follows the MCP authorization specification. Clients discover it from the 401 response, so nothing needs configuring.
| Protected resource metadata | https://mcp.vitruve.fit/.well-known/oauth-protected-resource/mcp |
| Authorization server metadata | https://mcp.vitruve.fit/.well-known/oauth-authorization-server |
| Client registration | Client ID Metadata Documents or Dynamic Client Registration; public clients with PKCE S256 |
| Redirect URIs | Claude, ChatGPT, Cursor and VS Code callbacks (https://vscode.dev/redirect, https://insiders.vscode.dev/redirect, cursor://anysphere.cursor-mcp/oauth/callback), loopback (http://localhost, http://127.0.0.1, http://[::1], any port). A registration listing any other URI is refused |
| Tokens | Access tokens last 1 hour; refresh tokens 30 days, rotated on every use. A retry with the same refresh token within 10 seconds gets a fresh pair; a reuse after that revokes the connection |
| Sign-in | The consent page only accepts the browser that opened the authorization URL. The Vitruve session it creates ends once the user allows or denies, and after 12 hours at most |
API keys from API access do not work here.
What a connection can read
A connection is bound to one user and one organization. Owners read the whole organization; Coaches read only the athletes visible to them in Vitruve, exactly as in the app. Access is re-checked continuously: if the user leaves the organization or the plan drops AI connectors, the connection stops working.
The tools read the same records as the Vitruve API, with the same field names, plus Vitruve’s knowledge base on training data and VBT methodology. Nothing can be created, changed, or deleted.
Prompts
The server also ships prompts: ready-made analyses that clients show as slash commands or in a prompt menu. Each fills in its arguments and tells the assistant which tools to call, in which order. Clients list them with prompts/list.
| Prompt | What it does |
|---|---|
athlete-progress | Trend of one athlete's metric (velocity, power, 1RM…) on an exercise over a period, optionally at one load |
load-velocity-check | Load-velocity profile: estimated 1RM, velocity at a load, load in a velocity range |
session-review | One athlete's session (the latest when no date is given): sets, prescribed vs executed, VBT metrics |
athlete-comparison | Two or more athletes side by side on one metric and exercise |
team-ranking | One-off leaderboard for a team or the whole roster |
compliance-report | Scheduled vs performed workouts, missed sessions, athletes with no plan |
readiness-check | Wellness questionnaires and active injuries, optionally against training velocity |
Limits
| Limit | Value |
|---|---|
| Requests | 300 per minute per connection (429 with Retry-After) |
| Token refreshes | 30 per hour per connection (429, too_many_requests) |
| Invalid access tokens | 100 per minute per client address, then 429 before any check, except for tokens in recent use |
| Result size | 60,000 characters per tool result |
| Tool time | 20 seconds |
| Page size | limit 1–100, 25 by default |
A tool that cannot answer returns a result with isError: true and a message the model can act on, such as narrowing the request.
Security
- Connect only to
https://mcp.vitruve.fit/mcp, and sign in only on pages atmcp.vitruve.fit. - The assistant gets the same read access as the signed-in user in the chosen organization. Results become part of the conversation with the AI provider.
- Content from other tools or web pages can carry prompt injections. This server cannot write to Vitruve, but data it returned can be passed to another connected tool; keep human approval on for tools that send or publish.
- Users review and revoke connections at mcp.vitruve.fit/connections. See Manage connected AI apps.