v0.5.0

Spec-generated schemas, exercise-template search, self-syncing CI, maintenance mode. See CHANGELOG.md.

v0.4.1

Security hardening

Patch release addressing an independent security review of v0.4.0. The review found no Critical or High issues — v0.4.0 was confirmed safe as published. This release closes the Medium and Low findings.

• Request timeouts — every HTTP request to the Hevy API is now bounded (hevyFetch 30 s, setup key check 15 s). A hung or slow upstream can no longer stall an MCP call indefinitely.
• URL-escaped path parameters — workout / routine / folder / exercise-template ids and dates are encodeURIComponent-escaped before path interpolation. Defense in depth on top of the existing strict Zod validation.
• Tighter config permissions — ~/.config/hevy-mcp is created with 0700, and 0600 is re-applied to the config file on overwrite.

No behavior changes. Drop-in upgrade from v0.4.0.

🤖 Generated with Claude Code

v0.4.0

Highlights

Install is now frictionless. npx @diecoscai/hevy-mcp setup validates your Hevy Pro key against the live API, asks whether to enable writes, and saves everything to ~/.config/hevy-mcp/config.json (mode 0600). After that the MCP client entry needs no env block — the server reads the key from the file. Environment variables still take precedence if you prefer them.

Also in this release

• hevy_get_exercise_history accepts start_date / end_date (ISO-8601) — the server always supported date-range filtering; the MCP only exposed pagination.
• Plain-text upstream responses pass through as raw text — no more JSON-quoted ids from hevy_create_exercise_template.
• Live enum drift test — asserts the MCP's muscle-group / equipment / exercise-type enums match what the Hevy server accepts. Catches the class of bug that slipped through in v0.3.0.
• CI now runs on Node 20 / 22 / 24; actions/* bumped to v5.

One behavior change (plain-text output shape) is documented at the top of the CHANGELOG [0.4.0] section.

🤖 Generated with Claude Code

v0.3.0

Highlights

Fixed: hevy_create_exercise_template now actually works. It was broken in every prior published version — wrong request wrapper (exercise_template instead of exercise), wrong field names, bogus CustomExerciseType enum values, and a crash parsing the plain-text success response. All confirmed against the live Hevy API and fixed. See docs/api-quirks.md.

Also in this release

• Error hints now distinguish "no Pro subscription" from "invalid key" on HTTP 401, and cover 403 (limit reached) and 429 (rate limit).
• Tool descriptions rewritten for LLM-facing UX — write tools name their prerequisite lookup tools so the model resolves exercise_template_id before composing a write.
• Trust signals: provenance attestations on every npm publish, SECURITY.md, CI badge.
• PUT /v1/routines/{id} no longer accepts folder_id (the Hevy server rejects it); notes/description reject empty strings.
• Closed all transitive npm audit advisories.

Full changelog: https://github.com/diecoscai/hevy-mcp/blob/main/CHANGELOG.md

🤖 Generated with Claude Code

v0.2.0 — exercise-template cache

What's new in 0.2.0

Added

• In-memory TTL cache for hevy_list_exercise_templates and hevy_get_exercise_template. Default TTL 1h, opt-out via HEVY_MCP_DISABLE_CACHE=1, custom TTL via HEVY_MCP_CACHE_TTL_SECONDS. hevy_create_exercise_template invalidates the list portion of the cache on success.
• README sections documenting the cache and explaining the deliberate absence of webhook tools.

Install

npx -y @diecoscai/hevy-mcp

Or add to your MCP client config — see README for Claude Desktop / Claude Code CLI / Cursor / VS Code snippets.

Requires: Node 20+, Hevy Pro API key from https://hevy.com/settings?developer.

Full changelog

https://github.com/diecoscai/hevy-mcp/blob/main/CHANGELOG.md