Connect IQ MCP

io.github.idooPublished by GitHub account idoov0.1.1Updated Oct 29, 2026

MCP server for Garmin Connect IQ developers: store portal, SDK builds, simulator. Read-only default.

VerifiedSTDIODesktop onlyBrowser AutomationDeveloper ToolsBusiness & Commerce

Overview

AI-generated overview

Local MCP server that lets an assistant manage Garmin Connect IQ apps: store listings, reviews, installs, SDK builds and the simulator.

What you can do
  • Inspect store data: app versions, listings, reviews, installs and supported devices
  • Draft replies to reviews and update store descriptions or publish new versions, with a preview and your approval
  • Build apps for chosen devices with the Connect IQ SDK and run them in the simulator
  • Take simulator screenshots and send simulator input (macOS only)
  • Optionally read your own Garmin Connect data when the connect toolset is enabled
  • Enable only the toolsets you need, such as store, sdk, simulator or connect
When to use it
Useful if you develop Garmin Connect IQ watch faces or apps and want an assistant to check store metrics and reviews, build and test in the simulator, or prepare store updates without leaving the chat.
Requirements
Runs as a local binary installed via script, Homebrew or the .mcpb package; sign-in through Garmin's own page in a separate browser profile. Builds and the simulator need Garmin's SDK Manager and Java 17 or newer. Optional settings include CIQ_MCP_SDK, CIQ_MCP_BROWSER, CIQ_MCP_PROFILE, CIQ_MCP_TOOLSETS, CIQ_MCP_ALLOW_WRITES and the CIQ_MCP_PORTAL_COOKIES secret for CI. Network access to Garmin services.
Before you install
It uses your Garmin developer account and the portal's private endpoints, which Garmin may change or object to; automated access may violate the portal's terms. Write tools stay hidden until CIQ_MCP_ALLOW_WRITES is set, and publishing or listing edits wait for approval. The CIQ_MCP_PORTAL_COOKIES secret grants portal access for about 15 days with no renewal. Simulator screenshots and input are macOS only.

Installation

In SourceWeft

  1. Open Connect IQ MCP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

[A goose in a headband and a guy in a grey hoodie with a smartwatch for a head run along a night lakeside trail past a PENDING APPROVAL sign, laptop open, while a cartoon Viking on a kid's bike films them laughing.]

Connect IQ MCP

MCP server for Garmin Connect IQ developers. Your agent gets the store (versions, listings, reviews, installs), SDK builds, the simulator and, if you want it, your Garmin Connect data. Read-only by default, and it asks before anything goes public. The binary is connect-iq-mcp.

[CI] [CodeQL] [Release] [Go Reference] [License: MIT] [MCP] [Glama score] [OpenSSF Scorecard]

Install

Paste this into whatever AI is writing your watch face right now:

text
Set up the connect-iq-mcp server for me: https://github.com/idoo/connect-iq-mcp/blob/main/docs/INSTALL.md

Or by hand, in three steps:

sh
curl -fsSL https://github.com/idoo/connect-iq-mcp/releases/latest/download/install.sh | sh   # or: brew install idoo/tap/connect-iq-mcpconnect-iq-mcp auth login                    # opens Garmin's sign-in page, tick Remember meconnect-iq-mcp config install claude-code    # or claude-desktop, codex, cursor, vscode, windsurf

Builds and the simulator also need Garmin's SDK Manager and Java 17+. Details, Windows and Linux: docs/INSTALL.md. Sign-in, signing keys, CI, upgrades and fixes: docs/FAQ.md.

Why you can trust it

You're handing it your Garmin developer account, so here's what you can check yourself instead of taking my word for it:

  • All of it is here. MIT, no closed parts. Build it yourself with go install github.com/idoo/connect-iq-mcp/cmd/connect-iq-mcp@latest.
  • It only talks to Garmin. The developer portal at apps.garmin.com, Garmin's SSO in the sign-in browser, and Garmin Connect if you turn it on. No telemetry. SECURITY.md
  • No tool sees your password or cookies. You sign in on Garmin's own page in a separate browser profile. The session cookie goes to the OS keychain, and no tool takes or returns it. SECURITY.md
  • Read-only until you say otherwise. Store write tools aren't listed until you turn writes on, and anything public shows a preview and waits for your yes. docs/SAFETY.md
  • Releases are signed and traceable to their source. Every release is built by release.yml from a tag, published as an immutable release, and ships an SPDX SBOM per archive, a cosign keyless signature on checksums.txt, and build provenance attestations. The macOS binaries are also signed with my Developer ID and notarized by Apple.
  • CI scans every push with CodeQL and govulncheck, and a tag can't ship with a known reachable vulnerability.

Check a download with the GitHub CLI:

sh
gh attestation verify connect-iq-mcp_<version>_<os>_<arch>.tar.gz --repo idoo/connect-iq-mcp \  --signer-workflow idoo/connect-iq-mcp/.github/workflows/release.yml --source-ref refs/tags/v<version>

or with cosign:

sh
cosign verify-blob --bundle checksums.txt.sigstore.json \  --certificate-identity 'https://github.com/idoo/connect-iq-mcp/.github/workflows/release.yml@refs/tags/v<version>' \  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txtshasum -a 256 -c checksums.txt --ignore-missing

On a Mac, spctl -a -vv -t install connect-iq-mcp should say source=Notarized Developer ID.

The .mcpb and tools.json are listed in checksums-extra.txt with their own checksums-extra.txt.sigstore.json. Both checks above work on them the same way.

Unofficial

Garmin has no public store API, so Connect IQ MCP uses the same private endpoints the developer portal website uses, plus Garmin's sign-in. Garmin can change them and break this any day, or object to it. Renewal runs a headless browser that doesn't announce itself as automated, and automated access may be against the portal's terms: it's your account and your call. Request rates stay low.

Not affiliated with or endorsed by Garmin. Garmin, Connect IQ and fēnix are trademarks of Garmin. If Garmin objects to the name, the name changes.

Compared

this oneweb portalmonkeyc + manual uploadwrobliskoandreycooper
Works from your agent+−−++
Store: reviews, installs, listings++−−−
Publish a version++~−−
SDK builds+−+++
Simulator screenshots and input+−~++
Unit tests in the simulator+−+−+
Prebuilt signed binary+−−

~ by hand. Screenshots and simulator input are macOS only here and in andreycooper's; wroblisko's also does Windows.

Security

It can't publish anything until you let it. Publishing a version and editing the listing wait for your yes; builds and the simulator don't ask. A 1-star review that says "ignore previous instructions" is still just a 1-star review. More in docs/SAFETY.md. Report holes privately: SECURITY.md.

What it does

  • "How are my apps doing? Downloads, ratings, last version."
  • "Any new reviews? Draft replies to the angry ones."
  • "Build the app for fenix 8, run it in the simulator, take a screenshot."
  • "Build the store .iq for all devices and publish it as 1.4.0." (asks you first)
  • "Update the store description, keep the rest as is." (asks you first)
  • "Which devices does the app support, and which new ones am I missing?"

Tools come in toolsets, so your agent only sees what you use. store, sdk and simulator are on out of the box. connect (your Garmin Connect data, after auth login --connect) and store_experimental (portal calls nobody has tried live yet) are off. Pick with CIQ_MCP_TOOLSETS (all, +connect) or ask the agent mid-chat. Every tool: docs/TOOLS.md.

License

MIT © Ivan Verevkin

Source: README.md at commit ced7f4c

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestOct 29, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts