jlxq0/hevy-mcp
Watch
1
0
Fork
You've already forked hevy-mcp
 0
Code Issues 2 Pull requests Projects Releases 1 Packages 1 Wiki Activity Actions
1 release 11 tags
  • v0.5.0 4444b987bb

    v0.5.0 — audit repairs and dependency security
    All checks were successful
    CI / docker (push) Successful in 1m38s
    Details
    CI / cargo (push) Successful in 2m9s
    Details
    Stable

    jlxq0 released this 2026-10-24 02:25:13 +00:00 | 5 commits to main since this release

    Repairs the audited Hevy MCP dependency, error-reporting and template-read issues.

    • Six targeted lockfile updates clear 11 vulnerabilities, the Tokio unsoundness advisory and yanked chacha20. Rust 1.93 build support and rustls-only reqwest features retained.
    • Backend errors expose HTTP status and a bounded, key-redacted top-level JSON diagnostic; auth failures, missing resources and conflicts have distinct classes. Rate limits remain error envelopes; no automatic retries.
    • MCP initialize reports hevy-mcp 0.5.0. Health response changes from plain text to JSON with status/name/version. HTTP health and bearer-only authentication contracts are preserved.
    • Template search caches complete lists for five minutes per full key digest, with 16-entry and 2 MiB serialized-response admission limits. Creation invalidates cache; partial/error results are not cached. External changes/key revocation may take up to five minutes to affect cached searches; concurrent misses may fetch independently.
    • Added wiremock write-body/pagination/history/folder coverage and MCP wire regressions for diagnostics, identity and classes. Removed unused Matrix URL code and account-specific instructions.

    Validation: 58 tests; fmt; Clippy 1.98; Rust 1.93 check; audit and deny all pass. Independent pre-PR review and one rework completed. PR #17 exact-head run 51 passed; protected merge tree equals the reviewed candidate. Main run 52 and release run 53 both have successful cargo and actual docker tasks.

    Source: 4444b987bb.
    Image: forge.oddie.app/jlxq0/hevy-mcp:v0.5.0@sha256:f30eaba555f7535c43082874f823ce25ec93c6337c3182a89768809ed5437e98 (registry manifest tag/digest read back).

    No real workout writes were performed. Image publication is not deployment proof. Live rollout and actual valid-key Claude read-only client proof are tracked separately in issue #16 and operations card t_7c4c63ff; current live deployment was verified on v0.4.4. Do not treat dummy-bearer initialization or mock success as account access.

    Downloads