M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
COMPARE UP TO 4 SERVERS

Compare MCP servers

Compare scores, permissions, risks, and fit in one decision-focused table.

DimensionautoMateA smart NAS for AI: notes, files, reminders, memory, 40+ tools, plug into any AI client.Hevy MCPManage your Hevy workout data from AI assistants via MCP.
FMRS34 / 100 · D77 / 100 · B
Reliability3 / 2012 / 20
Security and permissions7 / 2016 / 20
Maintenance8 / 2016 / 20
Documentation8 / 2018 / 20
Setup experience8 / 2015 / 20
Best for
  • Users who use multiple AI clients and want unified data access
  • Those wanting a local-first personal infrastructure
  • People who want to easily wire up RPA and automation via MCP
  • Hevy PRO users who want AI assistants to directly access their workout data
  • People who prefer using MCP clients like Claude, Cursor, Codex for fitness tracking
  • Anyone needing summaries and insights from their training data
Not for
  • Users who don't want a local server
  • Security-sensitive users who are uncomfortable exposing shell.exec
  • Those expecting a hosted/managed solution
  • Users without a Hevy PRO subscription (API key required)
  • Users who want to use the server without an API key
  • Those needing delete workflows (Hevy API does not expose delete endpoints)
Required permissions
  • Network access (defaults to 127.0.0.1)
  • File system read/write (configured storage path)
  • System command execution (shell.exec and script.run)
  • Browser automation (Playwright and Chrome extension)
  • Audio input for transcription
  • Requires HEVY_API_KEY environment variable for Hevy API authentication
  • Can create, update, and replace workouts, routines, folders, templates, and body measurements via tools
  • Read operations can fetch workouts, routines, folders, templates, history, and user info
Risks and side effects
  • The MCP endpoint is protected by a Bearer token, but leaking the token could allow arbitrary code execution via shell.exec.
  • The local server could be exploited by malicious prompts to execute dangerous commands.
  • API keys and tokens are encrypted with Fernet, but the key file must be strictly protected.
  • autoMate Cloud is opt-in and sends no data unless AUTOMATE_CLOUD_URL is set.
  • Using Web Push could expose personal devices.
  • SaaS integrations require OAuth tokens, which are stored encrypted.
  • Ensure you trust the AI clients you configure with MCP, as they can call shell.exec.
  • Audit logs and recommended firewall rules help mitigate risks.
  • API key can be misused if leaked; do not expose in URLs, logs, or screenshots
  • Create operations may produce duplicates on retry; update operations replace existing records
  • The server sends data to the Hevy API and may send telemetry to external services unless disabled
Supported clientsClaude Desktop, OpenClaw, Cursor, ClineClaude Desktop, Cursor, Codex, Antigravity
Tools1526