# `io.github.almostjacked/fitness-tools` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/io.github.almostjacked/fitness-tools
- JSON: https://anlyon.dev/api/v1/servers/io.github.almostjacked/fitness-tools
- Version: 0.3.4 (active)
- Publisher: io.github.almostjacked (GitHub account)
- Runs: remote (streamable-http), local (npm)
- Sign-in to list tools: none
- Repository: https://github.com/almostjacked/fitness-tools
- Metadata from the official MCP Registry, synced 2026-10-21T18:22:54.124Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Fitness Tools
Deterministic fitness calculators — TDEE, adaptive TDEE, body fat, 1RM, macros — with consensus.
```

Scanned 2026-10-21T19:06:04.279Z over streamable-http.

**10 tools: 10 change things.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 10 | ask |
| Only reads | read | 0 | allow |

## Findings

- **warn** Base64 strings in `body-fat` ([base64-blob](https://anlyon.dev/methodology#base64-blob))

```untrusted-server-text
The input schema at properties.weight.anyOf[0].properties.value.$ref contains a 43-character base64 string.

inputSchema.properties.weight.anyOf[0].properties.value.$ref: "#/properties/height/anyOf/0/properties/value"
```


## Changes things (10)

Creates or changes something that can be changed back. Claude Code: ask.

### `activity-multiplier`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Estimate the TDEE activity multiplier via the classic lookup table or a NEAT+EAT model (occupation/steps for non-exercise, training volume for exercise).
```

### `adaptive-tdee`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Measure actual TDEE from a logged history of daily weight and/or calorie intake. Default method (kalman) is a joint Kalman filter over true weight and TDEE — handles missing days, gates outliers, and reports uncertainty (CI95) alongside denoised true weight; regression/endpoints are simple window-based estimates kept for comparison. Use instead of formula TDEE once real logged data exists. Each entry needs at least one of weight/kcal (not necessarily both). Entry dates must span 10 years or less (earliest to latest). Note: all methods need at least one weigh-in (kalman) or two (regression/endpoints) — a history with zero weight entries throws under the kalman default; pass methods:'all' to get a graceful empty/skipped result instead.
```

### `body-fat`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
- Findings: warn base64-blob

Description, as the server wrote it:

```untrusted-server-text
Estimate body-fat % via US Navy circumference, Jackson-Pollock 3-site skinfold, and Deurenberg (BMI-based) methods.
```

### `ffmi`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Compute the Fat-Free Mass Index (FFMI) and its height-adjusted form from weight and body fat (or lean mass), and flag whether it exceeds the ~25 natural ceiling.
```

### `macros`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Compute protein/fat/carb grams for a calorie target using the g-per-kg-bodyweight method, with goal-based protein defaults.
```

### `muscle-potential`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Estimate drug-free maximum bodyweight at a target body-fat % via Casey Butt (wrist+ankle), the FFMI~25 natural cap, and Berkhan's max-contest-weight model. Men only in v1.
```

### `one-rep-max`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Estimate 1RM from a submaximal set via Epley, Brzycki, Lombardi, Wathan, O'Conner, and Mayhew; returns a %1RM load chart.
```

### `powerlifting-attempts`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Deterministic opener/second/third attempts from an estimated 1RM, plus a warmup ramp and per-side plate loading. Tunable by aggressiveness and available plates.
```

### `rsmi`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Estimate the appendicular skeletal muscle index (RSMI) from a DXA value (direct) and/or an anthropometric estimate (Wen 2011), and flag low muscle mass against EWGSOP2, AWGS, and Baumgartner sarcopenia cutoffs.
```

### `tdee`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Estimate BMR and TDEE via Mifflin-St Jeor, Harris-Benedict, Katch-McArdle, and Cunningham. Provide body_fat or lean_mass to unlock the LBM-based methods.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `fitness-tools`:

```json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__fitness-tools__tdee",
      "mcp__fitness-tools__adaptive-tdee",
      "mcp__fitness-tools__body-fat",
      "mcp__fitness-tools__one-rep-max",
      "mcp__fitness-tools__macros",
      "mcp__fitness-tools__activity-multiplier",
      "mcp__fitness-tools__powerlifting-attempts",
      "mcp__fitness-tools__muscle-potential",
      "mcp__fitness-tools__ffmi",
      "mcp__fitness-tools__rsmi"
    ],
    "deny": []
  }
}
```