AI & MCP Integration

MCP (Model Context Protocol) is an open standard that lets AI assistants interact with your apps securely. Think of it like giving your AI a "window" into your training data — it can read your plan, add exercises, log wellness, and more.

Your AI assistant does the thinking. Hillory just responds to structured requests — no AI runs on our server.

To connect an AI assistant to your account:

1. Generate a Personal Access Token (PAT) via the API
2. Choose which scopes (permissions) to grant
3. Add the token to your AI client's MCP configuration

Your token looks like: mcp_aBcDeFgHiJk...

Add this to your Claude Desktop config file (claude_desktop_config.json):

{
  "mcpServers": {
    "hillory": {
      "url": "https://hillory.run/mcp",
      "headers": {
        "Authorization": "Bearer mcp_YOUR_TOKEN_HERE"
      }
    }
  }
}

Config file location: macOS ~/Library/Application Support/Claude/claude_desktop_config.json

Any MCP-compatible client works. You need two things:

• Server URL: https://hillory.run/mcp
• Auth header: Authorization: Bearer mcp_YOUR_TOKEN

When creating a token, choose only the scopes your AI needs:

💡 Tip: Start with read-only scopes and add write permissions as needed.

Once connected, try natural language prompts like:

• "Add calf raises as an optional exercise to my Thursday session"
• "Show me my running goals and suggest a new weekly distance target"
• "Log my wellness: slept great, no soreness, high energy"
• "What workouts do I have this week?"
• "Plan a kettlebell session focused on legs and core"
• "How's my muscle fatigue looking — am I ready to train today?"
• "Create an optional 20-minute core and calves workout for Friday"
• "Skip tomorrow's tempo run — I'm feeling too sore"

The AI figures out which tools to call. You just speak naturally.

• Your data only: tokens can only access your own data — never other users'
• Scoped access: each token is limited to the permissions you grant
• Revocable: revoke a token instantly if compromised
• Expiring: tokens expire after 90 days by default (max 1 year)
• Hashed storage: we store a SHA-256 hash — never your raw token
• Rate limited: 120 requests/minute to prevent abuse
• No AI on our side: we never send your data to any AI model — that's your client's job