# RUBICON.fitness MCP and API

> Connect a trusted coding agent to the RUBICON.fitness MCP server, or inspect the public HTTP API contract.

The MCP endpoint is https://www.rubicon.fitness/api/mcp. It uses the Model Context Protocol Streamable HTTP transport. Every MCP session uses OAuth 2.1 authorization with PKCE; tool leaves enforce their exact scopes again. Opening the endpoint in a browser is not a connection test; a plain GET intentionally returns 405 because this stateless server does not offer a standalone SSE stream.

## Codex

```sh
codex mcp add rubicon --url https://www.rubicon.fitness/api/mcp
codex mcp login rubicon --scopes training:read,training:write,feedback:read,programming:write,offline_access
```

The login command opens the RUBICON.fitness consent flow. These scopes let an athlete or coach read training, log and edit athlete-owned results, read feedback, and draft, project, apply, and release coach programming. `offline_access` lets the client refresh its credential without another browser sign-in. These scopes do not grant the operator-only `programming:admin` scope.

## Claude Code

```sh
claude mcp add --transport http rubicon https://www.rubicon.fitness/api/mcp
```

Claude Code starts the OAuth flow when the remote server first needs authorization. Choose user or project scope with Claude Code's `--scope` option when needed.

## Connection facts

- Transport: Streamable HTTP
- MCP endpoint: https://www.rubicon.fitness/api/mcp
- Protected resource metadata: https://www.rubicon.fitness/.well-known/oauth-protected-resource/api/mcp
- Authorization server metadata: https://www.rubicon.fitness/.well-known/oauth-authorization-server/api/auth
- OAuth token transport: `Authorization: Bearer <access-token>`; tokens never belong in a URL
- Athlete scopes: `training:read`, `training:write`
- Coach scopes: `feedback:read`, `programming:write`
- Operator-only scope: `programming:admin`

The server returns plain declared MCP tools and nothing else. There is no sandbox tool and no guest program to write: each tool takes typed input directly and declares its own input and output schema. The listing a client receives is filtered by that client's scopes, so an athlete token never sees a coach tool.

Read tools include `current_week`, `training_log`, `movement_history`, `movement_catalog_search`, and `list_tracks`. The athlete write tool is `log_result`; to correct a logged lift, log the right value again with `log_result` rather than editing the old one. Coach programming runs through `fitness_cycles_draft`, `fitness_cycles_revise`, `fitness_cycles_project`, `fitness_cycles_apply`, `fitness_cycles_complete_projection`, and `fitness_cycles_release`, with review tools alongside them. A write tool checks its exact scope and capability at the call; there is no blanket outer grant.

## HTTP API

- [API discovery document](https://www.rubicon.fitness/api)
- [Generated OpenAPI document](https://www.rubicon.fitness/openapi.json)
- Health check: https://www.rubicon.fitness/api/v1/meta/health

The OpenAPI document is generated from the same Effect `HttpApi` contract that serves `/api/v1`. It does not describe the MCP tool protocol.