Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/cygnusb/coros-mcp/claude-mdgit clone --depth 1 https://github.com/cygnusb/coros-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/cygnusb/coros-mcp/claude-md)<a href="https://agentmods.dev/instructions/cygnusb/coros-mcp/claude-md"><img src="https://agentmods.dev/badge/instructions/cygnusb/coros-mcp/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01408 | $0.01408 |
| Opus 5 | $0.00704 | $0.00704 |
| Sonnet 5 | $0.00282 | $0.00282 |
| Haiku 4.5 | $0.00141 | $0.00141 |
Grade A, and why
coros-mcp CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 73 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
Project Overview
coros-mcp is a Model Context Protocol (MCP) server that exposes Coros fitness data (sleep, HRV, training metrics, activities, workouts) to AI assistants. It uses the unofficial Coros API — no official API key required.
Setup & Installation
python3 -m venv .venv
source .venv/bin/activate
pip install -e .
# For development (pytest, ruff, mypy):
pip install -e ".[dev]"
Running the Server
# Run via CLI entry point (recommended):
coros-mcp serve
# Or register with Claude Code:
claude mcp add coros -- /path/to/coros-mcp/.venv/bin/coros-mcp serve
CLI Commands
coros-mcp auth # Authenticate (web + mobile tokens)
coros-mcp auth-web # Web API only (no sleep data)
coros-mcp auth-mobile # Mobile API only (sleep data)
coros-mcp auth-status # Check token status
coros-mcp auth-clear # Remove stored tokens
coros-mcp sync [--from YYYYMMDD] [--to YYYYMMDD] # Backfill data to local cache
coros-mcp cache-status # Show local cache coverage
Architecture
The project wraps two separate Coros APIs behind a unified MCP interface:
Dual API Design
- Training Hub web API (
teameuapi.coros.com/teamapi.coros.com): HRV, daily metrics, activities, workouts. Auth via MD5-hashed password →accessTokenheader. Token TTL: 24 hours. - Mobile API (
apieu.coros.com/apius.coros.com): Sleep stage data (deep/light/REM/awake). Auth via AES-128-CBC encrypted credentials (key reverse-engineered from Coros APK). Token TTL: ~1 hour, auto-refreshes by replaying the stored encrypted login payload.
Token Storage (coros_mcp/auth/)
Priority chain for retrieval: COROS_ACCESS_TOKEN env var → system keyring → encrypted local file. The env var replaces only the web access token — stored user_id, region, and mobile token/payload are merged in so sleep data keeps working. On write, both keyring and encrypted file are updated (belt-and-suspenders). The entire StoredAuth object (web token + mobile token + mobile login payload for replay) is serialized as JSON and stored as a single credential.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 73 lines · 1,408 tokens per session scan A 97507b3f9ea2
coros-mcp CLAUDE.md is an instructions file published in the GitHub repository cygnusb/coros-mcp (117 stars, last pushed 8d ago), licensed MIT. It adds 1,408 tokens to every session, about $0.0070 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
withings-mcp CLAUDE.md
Instructions for akutishevsky/withings-mcp, covering claude.md, general rules, project overview, development commands and running.
vscode-winccoa-mcp-server copilot-instructions.md
Copilot instructions for winccoa-tools-pack/vscode-winccoa-mcp-server, covering readme für github copilot: wincc oa mcp server extension, projektübersicht, kernziele, 🎯 hauptfunktionen and projektstruktur.
garmin_ai AGENTS.md
AGENTS.md instructions for TolmachevKirill/garmin_ai, covering agents.md — garmin health pipeline, setup / running commands, testing, ad hoc analytical questions (no exact report matches) and creating/scheduling a workout in garmin.
withings-mcp AGENTS.md
AGENTS.md instructions for davidmosiah/withings-mcp, covering agent development notes, scope, commands and rules.
oura-mcp AGENTS.md
AGENTS.md instructions for davidmosiah/oura-mcp, covering agent development notes, scope, commands and rules.
phone-mcp CLAUDE.md
Claude Code instructions for premex-ab/phone-mcp, covering claude.md, project overview, build commands, architecture and module layout.