Your AI plans. LeanMuscle helps you train.

# Connect your own AI to LeanMuscle

1. Install LeanMuscle and sign in with Apple or Google.
2. Copy the connection prompt from the App into a capable AI agent (for example
   Codex, Claude Code, Cursor Agent or Gemini CLI). HTTPS API access, configuration
   and secure credential storage are required; support depends on your client.
3. Compare the code shown by the AI, enter it in the App under Approve AI access,
   review the requested access and explicitly allow it. Never approve an unsolicited request.

## HTTPS API

All request bodies are JSON. Credentials go in Authorization: Bearer <agent token>,
never in URLs or chat. TLS verification is required; do not follow redirects.
GET /v1/capabilities is public: require mode=accounts and realPlans=true.
POST /v1/agent/requests with {"clientName":"Your AI name"} is public.
Keep deviceCode private; display only userCode and appURI to the user.
After App approval, POST /v1/agent/token with {"deviceCode":"<private device code>"}.
Poll no faster than interval (initially 5 seconds); authorization_pending means wait,
slow_down means increase the interval by 5 seconds. Stop on denial or expiry.
The successful response contains token, accountID and expiresAt; keep these in a
private local file (0700 directory / 0600 file), not source, logs, arguments or chat.
GET /v1/me using the new token must match that accountID before submitting a plan.
Do not borrow another account or overwrite existing MCP settings.

Before discussing a plan, GET /v1/exercises (or call get_exercise_catalog).
Choose only from this supported catalog, with the user's available equipment and
the correct variant. Copy exactly names.en or names.zh-Hans into exercise.name;
put coaching notes in note, not in name. exercise.id remains a fresh UUID for
each occurrence, not the catalog id. Repeated occurrences need different UUIDs.
The App uses these standard names to show bundled text and illustrated sequences
inline, including offline. If nothing fits, discuss it with the user; never silently
substitute a previously confirmed exercise. Get a new confirmation if the plan changes.
POST /v1/plans accepts a confirmed plan matching GET /schema/plan.json.
New unsupported names return 422 unsupported_exercise; the whole plan is rejected.
Previously stored plans, results and identical retries keep their original names.
Use isDemo=false for a real plan, and confirm with the human before pushing.
GET /v1/plans/{planID}/status checks stored_on_bridge versus received_by_app.
GET /v1/results?planID={planID} reads the actual finished result.
pending does not prove the user skipped training. Never invent actual exercise data.
Agents cannot write actual results, approve authorization, administer or delete an account.
Credentials expire after 30 days and can be revoked at any time in the App.

## Local stdio MCP

The service origin is an HTTPS REST API, not a remote HTTP MCP endpoint.
GET /downloads/manifest.json lists the exact SHA-256 of the six adapter source/data files.
Download them from /downloads/ into a new directory, verify hashes and review them.
Run python3 connect_client.py --endpoint <this HTTPS origin> --label <your AI name>.
The helper displays only the comparison code and App link, and writes a new private
configuration only after approval; it never prints the token or edits MCP settings.
Configure your MCP client to run python3 /absolute/path/mcp.py --client-file
/absolute/private/path/agent-client.json. A running MCP needs a restart to load it.
Supported tools: get_exercise_catalog, push_confirmed_workout_plan,
get_workout_plan_status, read_workout_results.
Do not claim a successful connection just because a prompt was copied or a file downloaded.