Skip to content
anlyon.devby Anlyon

Hyperhuman

cc.hyperhuman/hyperhumanhyperhuman.ccstreamable-httpv0.1.0Scanned

Create, personalize and deliver branded workouts and programs from any AI assistant.

45 tools: 8 can delete or cancel things, 12 change things and 25 only read.

Tools: 8 delete, 0 irreversible, 12 write, 25 read.
  • Reads private data · 1
  • Reads text others write · 3
  • Can send data out · 0
  • 2 findings

Anlyon alternative

20 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

45 tools

Deletes or cancels 8Claude Code: deny
  • export_dropExports drop assets for a channel (video URL, cover URL, copy pack).1 finding

    Why it is in this group

    • The name "export_drop" says "drop": a word for removing or ending something.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "export_drop" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":false}; The name "export_drop" says "drop": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Exports drop assets for a channel (video URL, cover URL, copy pack). Use when the user wants to download assets or prepare a drop for external publishing.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
  • regenerate_drop_copyRegenerates AI copy pack (hook, caption, hashtags, CTA) for a drop.No findings

    Why it is in this group

    • The name "regenerate_drop_copy" says "drop": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Regenerates AI copy pack (hook, caption, hashtags, CTA) for a drop. Use when the user wants to refresh or improve the social copy.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
  • regenerate_drop_coverRegenerates AI cover image for a drop.No findings

    Why it is in this group

    • The name "regenerate_drop_cover" says "drop": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Regenerates AI cover image for a drop. Use when the user wants a new cover for the social asset.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
  • update_dropUpdates a drop title or channel preset.No findings

    Why it is in this group

    • The name "update_drop" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Updates a drop title or channel preset. Use when the user wants to change drop display title or default export channel. For copy changes use regenerate_drop_copy.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
  • update_exercise_groupUpdates an exercise group.No findings

    Why it is in this group

    • The name "update_exercise_group" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Updates an exercise group. Use when the user wants to change name, exercises, rounds, or rest time.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
  • update_exercise_metadataUpdates exercise metadata (name, muscle groups, categories, equipment, skill level).No findings

    Why it is in this group

    • The name "update_exercise_metadata" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Updates exercise metadata (name, muscle groups, categories, equipment, skill level). Use when the user wants to fix or improve exercise tagging. Only team-owned exercises can be updated; stock exercises are read-only. Provide at least one field to update besides exercise_id.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
  • update_programUpdates an existing program.No findings

    Why it is in this group

    • The name "update_program" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Updates an existing program. Use when the user wants to set duration, workouts per week, or edit program metadata. When updating, provide full program data (goal_ids, workout_ids, visibility, difficulty) from get_team_program and merge your changes.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
  • update_workoutUpdates an existing workout.No findings

    Why it is in this group

    • The name "update_workout" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Updates an existing workout. Use when the user wants to change workout name, description, difficulty, visibility, or exercise structure. When only partial fields are provided (e.g. name), the current workout data is fetched and merged automatically.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
Changes things 12Claude Code: ask
  • adapt_planAdapts an existing program for a user profile.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Adapts an existing program for a user profile. Use when the user wants to customize a program.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
  • adapt_workoutAdapts an existing workout for a user profile.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Adapts an existing workout for a user profile. Use when the user wants to customize a workout (duration, difficulty, equipment) without generating from scratch.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
  • clone_stock_programsClones stock programs to the user's team.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Clones stock programs to the user's team. Use when the user wants to add publisher programs to their library.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
  • create_dropCreates a social drop from an exercise, exercise group, workout, or program.No findings

    Why it is in this group

    • The name "create_drop" says "create": a word for a change.
    Description, as the server wrote it
    Creates a social drop from an exercise, exercise group, workout, or program. Use when the user wants to create social media content from existing content.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
  • create_exercise_groupCreates an exercise group (circuit or sets).No findings

    Why it is in this group

    • The name "create_exercise_group" says "create": a word for a change.
    Description, as the server wrote it
    Creates an exercise group (circuit or sets). Use when the user wants to group exercises for circuits or micro-workouts. Requires at least 2 exercise IDs.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
  • create_exercise_instanceCreates an exercise instance with duration/reps, pace, weight, RPE.No findings

    Why it is in this group

    • The name "create_exercise_instance" says "create": a word for a change.
    Description, as the server wrote it
    Creates an exercise instance with duration/reps, pace, weight, RPE. Use when building a workout manually - create instances for each exercise, then pass instance IDs to create_workout. Stock and team exercises can be used directly via exercise_id.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
  • create_programCreates a workout program from team workouts.No findings

    Why it is in this group

    • The name "create_program" says "create": a word for a change.
    Description, as the server wrote it
    Creates a workout program from team workouts. Use when the user wants to organize workouts into a multi-week program. Requires goal_ids (1-2) and workout_ids (min 2).

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
  • create_rest_instanceCreates a rest/break instance for use between exercises in a workout.No findings

    Why it is in this group

    • The name "create_rest_instance" says "create": a word for a change.
    Description, as the server wrote it
    Creates a rest/break instance for use between exercises in a workout. Use when building a workout manually - create rest instances, then include their IDs in create_workout exercise_map. Workout cannot start or end with rest.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
  • create_workoutCreates a workout from exercise and rest instances.No findings

    Why it is in this group

    • The name "create_workout" says "create": a word for a change.
    Description, as the server wrote it
    Creates a workout from exercise and rest instances. Use when the user wants to build a custom workout. Provide either exercise_map (ordered array of instance IDs from create_exercise_instance and create_rest_instance) or instances (raw instance objects). Workout cannot start or end with rest.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
  • generate_programGenerates an AI training program using team workouts.No findings

    Why it is in this group

    • The name "generate_program" says "generate": a word for a change.
    Description, as the server wrote it
    Generates an AI training program using team workouts. Use when the user wants to create a multi-week program from their workout library.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
  • generate_video_clipGenerates an AI exercise video from a trainer photo (CloneMotion).Reads text others writeNo findings

    Why it is in this group

    • The name "generate_video_clip" says "generate": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Generates an AI exercise video from a trainer photo (CloneMotion). Use when the user wants to create exercise videos without filming. Before calling, ensure you have the target exercise and image source (upload URL or saved trainer image ID); optionally ask for specific video requirements. Accepts trainer_image_url (HTTP URL or data:image/... base64) or trainer_image_id from Workout Defaults.

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: true
    • destructiveHint: false
  • generate_workoutGenerates an AI workout via Content API.No findings

    Why it is in this group

    • The name "generate_workout" says "generate": a word for a change.
    Description, as the server wrote it
    Generates an AI workout via Content API. Use when the user wants to create a personalized workout on-the-fly. Returns workout structure (not persisted to team library by default).

    Annotations the server declares

    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
Only reads 25Show 25 read-only tools
  • get_api_usage_statsReturns API key usage statistics for the current user's team.No findings

    Why it is in this group

    • The name "get_api_usage_stats" says "get": a word for reading.
    Description, as the server wrote it
    Returns API key usage statistics for the current user's team. Use when the user asks about API usage, request counts, or rate limits.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • get_dashboard_summaryReturns dashboard summary: latest created workouts with stats and ready-to-download items.No findings

    Why it is in this group

    • The name "get_dashboard_summary" says "get": a word for reading.
    Description, as the server wrote it
    Returns dashboard summary: latest created workouts with stats and ready-to-download items. Use when the user asks about dashboard, recent workouts, or content ready for download.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • get_embed_code_samplesReturns static copy-paste code templates for workout embeds (keyHandshake iframe), program page embeds, custom player JavaScript, or Content API cURL snippets.Reads text others write1 finding

    Why it is in this group

    • The name "get_embed_code_samples" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "return" and "url": it reads web pages, which anyone can write.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...s (YOUR_ORG_ID, YOUR_API_KEY) — no real credentials are fetched or transmitted. Defaults sa..."

      What this check looks for
    Description, as the server wrote it
    Returns static copy-paste code templates for workout embeds (keyHandshake iframe), program page embeds, custom player JavaScript, or Content API cURL snippets. All samples contain only placeholder values (YOUR_ORG_ID, YOUR_API_KEY) — no real credentials are fetched or transmitted. Defaults sample_type to embed_prebuilt when omitted. Primary tool when the user asks for embed code, iframe HTML, or API snippet examples. Not for integration strategy or step-by-step plans (use get_integration_plan).

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • get_integration_planReturns an integration strategy and step-by-step plan for Hyperhuman workouts or programs: embed (iframe), stream videos (VOD export), or custom player (API + playlist).No findings

    Why it is in this group

    • The name "get_integration_plan" says "get": a word for reading.
    Description, as the server wrote it
    Returns an integration strategy and step-by-step plan for Hyperhuman workouts or programs: embed (iframe), stream videos (VOD export), or custom player (API + playlist). Use when the user asks how to integrate Hyperhuman or what integration options exist. Pass platform (web/mobile/hardware/cms) and use_case (mvp, programs, ai_generated, corporate_wellness, vod, etc.). Not for copy-paste embed HTML snippets (use get_embed_code_samples for those).

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • get_session_summaryReturns team name, plan label, and usage limits for the connected account.No findings

    Why it is in this group

    • The name "get_session_summary" says "get": a word for reading.
    Description, as the server wrote it
    Returns team name, plan label, and usage limits for the connected account. Use only when the user explicitly asks about their team, plan, or usage quotas.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • get_team_exerciseReturns full details of an exercise from the team library.No findings

    Why it is in this group

    • The name "get_team_exercise" says "get": a word for reading.
    Description, as the server wrote it
    Returns full details of an exercise from the team library. Use when the user selects an exercise or asks for exercise details.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • get_team_programReturns full details of a workout program from the team.No findings

    Why it is in this group

    • The name "get_team_program" says "get": a word for reading.
    Description, as the server wrote it
    Returns full details of a workout program from the team. Use when the user selects a program or asks for program structure.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • get_team_usageReturns usage quotas for the authenticated team (e.g.No findings

    Why it is in this group

    • The name "get_team_usage" says "get": a word for reading.
    Description, as the server wrote it
    Returns usage quotas for the authenticated team (e.g. social drop export count and limits). Use when the user asks about usage, quotas, or limits.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • get_team_workoutReturns full details of a workout from the team.No findings

    Why it is in this group

    • The name "get_team_workout" says "get": a word for reading.
    Description, as the server wrote it
    Returns full details of a workout from the team. Use when the user selects a workout or asks for details about a specific workout.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • get_video_generation_statusReturns status and result of a CloneMotion video generation job.No findings

    Why it is in this group

    • The name "get_video_generation_status" says "get": a word for reading.
    Description, as the server wrote it
    Returns status and result of a CloneMotion video generation job. Use when the user wants to check if a generated video is ready or view the generated variants. Generation can take a few minutes; if status is pending or running, ask the user to check again after waiting.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • get_workout_detailsReturns workout metadata, preview assets, and summary.No findings

    Why it is in this group

    • The name "get_workout_details" says "get": a word for reading.
    Description, as the server wrote it
    Returns workout metadata, preview assets, and summary. Use when the user selects a workout or asks for details about a specific workout. sample-* ids return a curated sample detail (no auth). Connected team workout ids use the Internal API (same data as get_team_workout). Other org ids use the Content API when the team has API entitlement.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • get_workout_playlistReturns playlist segments with timing and media pointers (progressive MP4/M4A URLs, typically ~7 days).No findings

    Why it is in this group

    • The name "get_workout_playlist" says "get": a word for reading.
    Description, as the server wrote it
    Returns playlist segments with timing and media pointers (progressive MP4/M4A URLs, typically ~7 days). sample-* ids return a curated sample playlist (no auth, no live media URLs). Connected org ids use the Content API when the team has API entitlement. Use when the user wants to see the segment structure or how to play a workout.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • health_checkReturns MCP server readiness status with a fixed ready message.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "return" and "message": it reads messages.
    • untrusted-inputThe description's first sentence says "return" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    Returns MCP server readiness status with a fixed ready message. Use when the user asks if the Hyperhuman app is working, reachable, or connected.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • list_equipmentReturns equipment for exercises.No findings

    Why it is in this group

    • The name "list_equipment" says "list": a word for reading.
    Description, as the server wrote it
    Returns equipment for exercises. Use when updating exercise metadata or filtering exercises.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • list_muscle_groupsReturns muscle groups for exercises.No findings

    Why it is in this group

    • The name "list_muscle_groups" says "list": a word for reading.
    Description, as the server wrote it
    Returns muscle groups for exercises. Use when updating exercise metadata or filtering exercises.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • list_sample_workoutsReturns a workout carousel for sample-workout prompts.No findings

    Why it is in this group

    • The name "list_sample_workouts" says "list": a word for reading.
    Description, as the server wrote it
    Returns a workout carousel for sample-workout prompts. When the user is connected via OAuth, lists up to 8 team workouts through the Internal API (Bearer token only — no Content API key required). When not connected, returns up to 6 curated guest samples with embedDemoUrl. Use when the user asks for sample workouts, a workout carousel, or embed demo preview. Not for full team-library admin views (use list_team_workouts), integration plans (use get_integration_plan), or copy-paste embed HTML (use get_embed_code_samples).

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • list_stock_programsReturns platform stock programs (publisher programs).No findings

    Why it is in this group

    • The name "list_stock_programs" says "list": a word for reading.
    Description, as the server wrote it
    Returns platform stock programs (publisher programs). Use when the user wants to browse or clone stock programs.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • list_team_dropsReturns social drops (videos, covers, copy) for the team.No findings

    Why it is in this group

    • The name "list_team_drops" says "list": a word for reading.
    Description, as the server wrote it
    Returns social drops (videos, covers, copy) for the team. Use when the user asks about drops, social assets, or ready-to-download content.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • list_team_exercisesReturns exercises from the team library.No findings

    Why it is in this group

    • The name "list_team_exercises" says "list": a word for reading.
    Description, as the server wrote it
    Returns exercises from the team library. Use when the user wants to browse exercises, find exercises for workouts, or manage the library.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • list_team_goalsReturns fitness goals available for programs.No findings

    Why it is in this group

    • The name "list_team_goals" says "list": a word for reading.
    Description, as the server wrote it
    Returns fitness goals available for programs. Use when creating or generating programs to get valid goal IDs.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • list_team_programsReturns workout programs (collections) for the authenticated user's team.No findings

    Why it is in this group

    • The name "list_team_programs" says "list": a word for reading.
    Description, as the server wrote it
    Returns workout programs (collections) for the authenticated user's team. Use when the user asks to see programs, training plans, or workout collections.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • list_team_workoutsReturns workouts for the authenticated user's team via Internal API.No findings

    Why it is in this group

    • The name "list_team_workouts" says "list": a word for reading.
    Description, as the server wrote it
    Returns workouts for the authenticated user's team via Internal API. Use when the user asks to see my team's workouts, my team workouts, or their organization workout library. Requires OAuth. Not for curated sample workouts or guest embed demo (use list_sample_workouts).

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • list_workout_categoriesReturns workout categories for workouts.No findings

    Why it is in this group

    • The name "list_workout_categories" says "list": a word for reading.
    Description, as the server wrote it
    Returns workout categories for workouts. Use when creating or updating workouts to get valid category_ids.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • recommend_plansReturns ranked program recommendations from the organization library (up to 12 programs in the tool response; optional limit up to 20 is sent to the API).No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Returns ranked program recommendations from the organization library (up to 12 programs in the tool response; optional limit up to 20 is sent to the API). Use when the user wants instant program suggestions.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • recommend_workoutsReturns ranked workout recommendations from the organization library (up to 12 workouts in the tool response; optional limit up to 20 is sent to the API).No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Returns ranked workout recommendations from the organization library (up to 12 workouts in the tool response; optional limit up to 20 is sent to the API). Use when the user wants instant suggestions based on profile (faster than generate).

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write3
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn1 info
  • Warnexport_drop

    The server marks "export_drop" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":false}; The name "export_drop" says "drop": a word for removing or ending something.

    What this check looks for
  • Infoget_embed_code_samples

    The description mentions "credentials".

    Matched text

    description: "...s (YOUR_ORG_ID, YOUR_API_KEY) — no real credentials are fetched or transmitted. Defaults sa..."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http hyperhuman https://mcp.hyperhuman.cc/mcp
claude mcp add --transport http hyperhuman https://mcp.hyperhuman.cc/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__hyperhuman__get_integration_plan",
      "mcp__hyperhuman__list_sample_workouts",
      "mcp__hyperhuman__get_workout_details",
      "mcp__hyperhuman__get_workout_playlist",
      "mcp__hyperhuman__get_embed_code_samples",
      "mcp__hyperhuman__list_team_workouts",
      "mcp__hyperhuman__get_team_workout",
      "mcp__hyperhuman__list_team_programs",
      "mcp__hyperhuman__get_team_program",
      "mcp__hyperhuman__list_team_goals",
      "mcp__hyperhuman__list_workout_categories",
      "mcp__hyperhuman__list_muscle_groups",
      "mcp__hyperhuman__list_equipment",
      "mcp__hyperhuman__get_team_usage",
      "mcp__hyperhuman__get_session_summary",
      "mcp__hyperhuman__get_api_usage_stats",
      "mcp__hyperhuman__list_team_drops",
      "mcp__hyperhuman__get_dashboard_summary",
      "mcp__hyperhuman__list_stock_programs",
      "mcp__hyperhuman__list_team_exercises",
      "mcp__hyperhuman__get_team_exercise",
      "mcp__hyperhuman__get_video_generation_status",
      "mcp__hyperhuman__recommend_workouts",
      "mcp__hyperhuman__recommend_plans",
      "mcp__hyperhuman__health_check"
    ],
    "ask": [
      "mcp__hyperhuman__create_drop",
      "mcp__hyperhuman__generate_program",
      "mcp__hyperhuman__create_workout",
      "mcp__hyperhuman__create_program",
      "mcp__hyperhuman__clone_stock_programs",
      "mcp__hyperhuman__create_exercise_instance",
      "mcp__hyperhuman__create_rest_instance",
      "mcp__hyperhuman__create_exercise_group",
      "mcp__hyperhuman__generate_video_clip",
      "mcp__hyperhuman__generate_workout",
      "mcp__hyperhuman__adapt_workout",
      "mcp__hyperhuman__adapt_plan"
    ],
    "deny": [
      "mcp__hyperhuman__regenerate_drop_copy",
      "mcp__hyperhuman__regenerate_drop_cover",
      "mcp__hyperhuman__export_drop",
      "mcp__hyperhuman__update_workout",
      "mcp__hyperhuman__update_program",
      "mcp__hyperhuman__update_exercise_group",
      "mcp__hyperhuman__update_exercise_metadata",
      "mcp__hyperhuman__update_drop"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as hyperhuman. Review it before you use it.

Capability tags behind 3 rules
  • mcp__hyperhuman__get_embed_code_samples untrusted-input
  • mcp__hyperhuman__generate_video_clip untrusted-input
  • mcp__hyperhuman__health_check private-data, untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/cc.hyperhuman/hyperhuman/verify?hash=ec93bb192146a876177ead951b17ee8fcb88e757eb90a9bed126a4756ae751ce" | jq -e '.changed == false'

Pinned hash ec93bb192146, from Nov 1, 2026, 10:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/cc.hyperhuman/hyperhuman/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for cc.hyperhuman/hyperhuman
[![anlyon.dev](https://anlyon.dev/badge/cc.hyperhuman/hyperhuman.svg)](https://anlyon.dev/servers/cc.hyperhuman/hyperhuman)

Source: MCP Registry. Synced Nov 1, 2026, 10:17 UTC.