@atomicmetrix/mcp

Official Atomic Metrix MCP package.

This package is the public npm entry point for discovering the production Atomic Metrix remote MCP service and its OAuth metadata URL.

What it is

• a stable public package for Atomic Metrix MCP discovery
• a CLI that prints the official production URLs and connection guidance
• a public manifest and tool catalog for reviewer visibility
• a clean open-source surface for external review

What it is not

• not a local MCP server
• not a stdio bridge
• not a replacement for the production remote MCP service

The real MCP service runs remotely and is authenticated with OAuth.

Install

npm install @atomicmetrix/mcp

Or run it directly:

npx -y @atomicmetrix/mcp urls

CLI

Print the official URLs:

npx -y @atomicmetrix/mcp urls

Print connection guidance for a client:

npx -y @atomicmetrix/mcp connect chatgpt
npx -y @atomicmetrix/mcp connect codex
npx -y @atomicmetrix/mcp connect claude

Print the public tool catalog:

npx -y @atomicmetrix/mcp catalog

Print the service descriptor as JSON:

npx -y @atomicmetrix/mcp json

Exported metadata

import {
  atomicMetrixMcp,
  atomicMetrixMcpManifest,
  atomicMetrixPublicToolCatalog,
} from "@atomicmetrix/mcp";

Current production values:

• website: https://www.atomicmetrix.com
• MCP URL: https://atomic-metrics-mcp-nyqprtd7ba-uc.a.run.app/mcp
• OAuth metadata: https://atomic-metrics-mcp-nyqprtd7ba-uc.a.run.app/.well-known/oauth-authorization-server

Open-source intent

This package is designed to be public. It describes how to connect to the Atomic Metrix MCP service without exposing the full private backend implementation.

Reviewer-facing surface

If a reviewer wants to understand the integration quickly, the public package now exposes:

• the official website URL
• the official remote MCP endpoint
• the OAuth discovery URL
• a public manifest describing auth, transport, and security posture
• a public tool catalog summarizing the exposed MCP surface (73 tools across 6 categories)

Security and compliance

The production MCP server implements the following security controls:

OAuth 2.1

• PKCE: S256 only (plain is rejected)
• Dynamic Client Registration (RFC 7591): POST /register
• Authorization Server Metadata (RFC 8414): GET /.well-known/oauth-authorization-server
• Protected Resource Metadata (RFC 9728): GET /.well-known/oauth-protected-resource
• Resource Indicators (RFC 8707): resource parameter stored on all tokens; audience validated on every request
• Token audience validation: access tokens are rejected if their resource field does not match the server's canonical URI
• Refresh token rotation: old refresh tokens are revoked on use

Transport security

• HTTPS enforced: production rejects non-HTTPS requests (HTTP 421)
• DNS rebinding protection: enabled by default via StreamableHTTPServerTransport
• Streamable HTTP: POST /mcp endpoint per MCP spec (2025-06-18)
• WWW-Authenticate: returned on all 401 responses per RFC 6750

Rate limiting

• OAuth endpoints: /token (30/min), /register (10/min), /authorize (30/min) per client IP
• MCP tool endpoints: 120 reads/min, 20 mutations/min per principal per tool

Data access

• All data access is per-authenticated-user only
• OAuth tokens cannot act as another user
• API key act-as requires explicit users:act_as scope

Scopes

settings:read  activities:read  readiness:read
plans:read     plans:propose    plans:write
workouts:read  workouts:propose workouts:write
actions:write

Privacy

• No data is shared between users
• No admin endpoints are exposed via MCP
• Internal database schema, business rules, and service internals are not part of the public API surface