Fitness context.
Connected.

Exercise demonstrations, reviewed meal estimates, food logging, and your saved fitness context—available to assistants through MCP and a small HTTP API.

Updated September 22, 2026. This is a private-beta connector, not a claim of Muse approval.

Endpoints

Access requirements

An Autumn account and a separately issued, scoped Autumn connector API key are required. Beta access is provisioned individually; contact arham@yoautumn.com from your account contact address to request onboarding. Email alone never establishes account ownership. A dedicated synthetic account and 30-day test key have been prepared privately.

Exercise-content delivery to third-party assistants is pending provider permission. The exercise tools have passed internal technical tests, but new exercise-enabled keys are not issued until rights covering external assistant delivery are verified. Do not share internal review keys or redistribute provider exercise data/videos before this is resolved. The tool inventory below describes the implementation, not approval for external distribution.

Keys expire after 30 days by default (1–90 days supported) and can be revoked. Native app session tokens, third-party provider credentials, and shared developer keys are not accepted by the MCP endpoint. OAuth and PKCE are not implemented in this release. There is no public self-service connector sign-in screen yet. Use a host that supports manually configured bearer API keys; OAuth-only hosts are not compatible.

No separate connector payment is collected in this beta. Autumn account entitlements and upstream service quotas still apply; access is not a promise of unlimited AI use. The connector has no additional country allowlist, but app availability and provider restrictions may vary by region. Responses are primarily English and measurement inputs use grams and calendar dates.

Connect with MCP

Use HTTPS Streamable HTTP with a bearer header. This stateless server supports JSON responses to POST; GET streams and DELETE sessions return 405. No session ID is required. Clients should negotiate the protocol with initialize, then send the negotiated MCP-Protocol-Version header. Supported protocol versions are those accepted by the official TypeScript SDK v1.30.0.

{
  "mcpServers": {
    "autumn": {
      "url": "https://api.yoautumn.com/mcp",
      "headers": { "Authorization": "Bearer YOUR_AUTUMN_KEY" }
    }
  }
}

This configuration shape is illustrative; use your host's remote-MCP settings. Send Accept: application/json, text/event-stream and Content-Type: application/json. Do not put credentials in URLs, source control, analytics, or logs.

Use the HTTP API

Every operation has a POST /v1/{tool_name} equivalent, including reads. Request and response bodies are JSON; normal responses use {"success":true,"data":...}. The OpenAPI document is the authoritative argument schema.

curl https://api.yoautumn.com/v1/search_exercises   -H 'Authorization: Bearer YOUR_AUTUMN_KEY'   -H 'Content-Type: application/json'   -d '{"query":"squat","limit":5}'

Tools and scopes

Exercise demos are provider-hosted, temporary URLs. Fetch them on demand, respect provider usage rights, and refresh expired URLs. Inline playback depends on the host. Video access may update a cached catalog thumbnail; it does not modify the user's workout.

Meal analysis and safe logging

1. Analyze a user-provided JPEG/PNG (base64, no data-URL prefix), describe a meal, or search for a food. Ask permission before sending a photo for analysis. Analysis uses AI and may store a private meal image; it does not save a diary entry.
2. Review ingredients and portions with the user. Estimates can miss oils, sauces, preparation methods, and portion sizes. Never present them as measurements or medical guidance.
3. Call preview_food_log with a date, meal slot, grams, and the reviewed per-100g nutrition. Preserve the food's source; use ai_estimate for model estimates. Show the full preview and totals.
4. Only after explicit approval, call log_food with the unchanged approval token and userConfirmed: true. Tokens are bound to the account and key and expire after 10 minutes.
5. Retry the same token after a network error. Its stable entry ID prevents duplicates. Do not generate a fresh preview merely to retry a save.

Each preview covers one food entry. Repeat the review flow for each item in a multi-item meal. To cancel, simply do not approve the preview. Correcting portions is supported before saving; editing or deleting existing food entries must be done in the Autumn app.

Limits and errors

• 60 connector requests per minute per key; additional upstream account limits apply.
• 15 meal-analysis requests per hour per account across image and text tools.
• Exercise media: up to 20 requests per minute per account, subject to provider availability.
• JSON request limit: 6 MB; image base64 field: at most 5,500,000 characters. Hosting platforms may enforce a smaller body limit; keep uploaded images below 3 MB.
• Search: up to 25 results. Workout history: up to 30 recent sessions. No background tasks or scheduled monitoring.

HTTP errors: 400 invalid input, 401 missing/expired/revoked credentials, 403 denied scope or Origin, 409 invalid/expired preview, 413 oversized body, 429 usage limit, 503 temporary service failure. Honor Retry-After; retry analysis conservatively because it spends quota. MCP tool failures use isError: true; authentication and transport failures use HTTP errors.

Key lifecycle

For approved developers, account-management endpoints use an existing Autumn native session only against Autumn's own key-management API. Do not send that session to an assistant host. These endpoints verify the signed-in account; callers cannot choose a user ID.

POST /account/keys
Authorization: Bearer NATIVE_AUTUMN_SESSION
{
  "name": "My assistant",
  "scopes": ["exercises:read", "nutrition:read"],
  "expiresInDays": 30,
  "consent": true
}

The secret is returned once. GET /account/keys lists metadata without secrets; DELETE /account/keys/{id} revokes an owned key, using native authentication. DELETE /account/key revokes the currently authenticated connector key. Only request scopes needed for the user's task. Connector keys are stored as hashes, never plaintext. Expired records are removed automatically; account deletion disables all associated connector keys.

Privacy and boundaries

Personal tools access only the account associated with the key. Responses can contain food diaries, workouts, goals, body metrics, allergies, injuries, and saved notes depending on scope. Connect only to hosts you trust, and explain what data will be shared. Do not use the connector for another person's records.

Meal photos are processed by Autumn's configured AI provider and private image storage; current production analysis uses OpenAI and Cloudflare R2. Stored app records follow Autumn's privacy policy and account deletion process. The connector does not retain request bodies in its own application logs. Signed preview tokens contain the proposed food entry: treat them as sensitive and do not log them. Revocation prevents future access but cannot erase copies already received by a host.

This release does not diagnose conditions, prescribe treatment, analyze a user's exercise video, autonomously monitor activity, modify workout or meal plans, or correct previously saved diary entries. An assistant can combine returned context to answer a user request, but Autumn is not an always-running agent inside the host.

Example requests

• “Show me how to do a Romanian deadlift, with an exercise demo.”
• “Find beginner dumbbell exercises for my shoulders.”
• “Estimate the calories and protein in this meal photo. Ask me about portions before logging it.”
• “I ate two eggs and toast. Estimate the macros, then let me review them.”
• “Before saving, change the portion from 200 g to 150 g and show me the new total.”
• “How much protein have I logged today compared with my saved target?”
• “Show my current workout plan and demos for its exercises.”
• “Use my saved goals, recent workouts, and today's food log to help me decide what to focus on.”