| FMRS | 63 / 100 · C | 77 / 100 · B |
|---|
| Reliability | 10 / 20 | 12 / 20 |
|---|
| Security and permissions | 10 / 20 | 16 / 20 |
|---|
| Maintenance | 13 / 20 | 16 / 20 |
|---|
| Documentation | 16 / 20 | 18 / 20 |
|---|
| Setup experience | 14 / 20 | 15 / 20 |
|---|
| Best for | - SEO practitioners who regularly analyze GSC search performance data
- Users of MCP-compatible clients such as Claude Desktop, Cursor, Codex CLI, Gemini CLI, or Antigravity
- Individuals and small teams who prefer natural-language conversation over manually exporting reports
- Users willing to configure their own Google Cloud credentials and run the server locally
| - Hevy PRO users who want AI assistants to directly access their workout data
- People who prefer using MCP clients like Claude, Cursor, Codex for fitness tracking
- Anyone needing summaries and insights from their training data
|
|---|
| Not for | - Users who only want claude.ai in the browser and won't install the desktop app (the MCP server runs locally)
- Users who don't want to create a Google Cloud project and API credentials
- Users who need a hosted one-click sign-in with GA4 tools (the source points to a separate hosted version limited to 100 seats)
- Users running a cloned install on Python 3.10 or older
| - Users without a Hevy PRO subscription (API key required)
- Users who want to use the server without an API key
- Those needing delete workflows (Hevy API does not expose delete endpoints)
|
|---|
| Required permissions | - Google Search Console API access (read search analytics and site data)
- OAuth path requires Google account authorization, with the token cached locally
- Service account path requires adding the service account email as a Full access user on your GSC property
- Credential JSON file paths are provided by the user via the client config env
- Destructive operations (add_site, delete_site, delete_sitemap) are disabled by default and require explicitly setting GSC_ALLOW_DESTRUCTIVE=true
| - Requires HEVY_API_KEY environment variable for Hevy API authentication
- Can create, update, and replace workouts, routines, folders, templates, and body measurements via tools
- Read operations can fetch workouts, routines, folders, templates, history, and user info
|
|---|
| Risks and side effects | - Credential JSON files contain sensitive keys and must be protected and kept out of version control
- If GSC_ALLOW_DESTRUCTIVE is enabled, the AI assistant can perform destructive actions such as adding/removing sites and deleting sitemaps
- Remote deployment with sse transport bound to 0.0.0.0 exposes the service on the network, so you must assess access-control risk yourself
- OAuth tokens are cached in the local platform user config directory, which may have access boundaries on multi-user machines
- Service account keys are long-lived, so a leak has a broad impact
| - API key can be misused if leaked; do not expose in URLs, logs, or screenshots
- Create operations may produce duplicates on retry; update operations replace existing records
- The server sends data to the Hevy API and may send telemetry to external services unless disabled
|
|---|
| Supported clients | Claude Desktop, Cursor, Codex, Gemini CLI, Antigravity | Claude Desktop, Cursor, Codex, Antigravity |
|---|
| Tools | 15 | 26 |
|---|