
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
golf-coach
Advanced tools
MCP server that fetches a user's Trackman Golf stats (handicap, rounds, practice, shots, club gapping).
A golf coach that trains you purely on your stats — round after round, closer to scratch.
Golf Coach logs into Trackman Golf with your own account and turns your stats — course rounds, practice sessions, shot-level launch-monitor data, club gapping, and handicap — into a diagnosis of where you're losing strokes, then hands you a specific practice plan with drills and YouTube links for your next session and grades your progress over time. It ships as an MCP server (the data tools) plus Claude skills (the coaching brain).
You don't read the charts — you get a coach. Point it at your Trackman data and it:

A real session diagnosis: what's wrong, why, how close you are to your targets, and exactly what to practice next.
Name note. "Golf Coach" is the product name. The technical ids stay
golf-coach(MCP server / plugin) andgolf-coach(the published package), so existing installs keep working.
[!IMPORTANT] Unofficial. This project is not affiliated with or endorsed by Trackman. It talks to Trackman's private web API using a token from your own authenticated session, and automates a browser login on your behalf. This may conflict with Trackman's Terms of Service — use it on your own account, at your own risk. Never use it to access anyone else's data.
See CLAUDE.md for the full architecture and auth/secret rules.
Pick the path for how you use Claude. Each takes about two minutes, then do the one-time Authentication step.
golf-coach.mcpb (from the latest release).Nothing to install and no config to edit — Claude Desktop runs everything and opens the sign-in browser for you. (First sign-in may take a moment if it needs to fetch a browser. You may also see an "unsigned extension" note — expected for one installed from a file.)
Platforms: macOS, Linux, and Windows — Claude Desktop runs the server via
uv on all three, and the browser sign-in uses Playwright (cross-platform). One
caveat on Windows: the local token/data files are protected by your Windows user
profile (ACLs) rather than POSIX 0600 modes. The optional cron/launchd
auto-refresh script is macOS/Linux only — on Windows use Task Scheduler, or just
re-run the in-app "log in to Trackman" when the ~7-day token lapses.
/plugin marketplace add bjornj12/golf-coach
/plugin install golf-coach@golf-coach
Installs the MCP server (run via uvx) and all ten coaching skills.
Requires uv (curl -LsSf https://astral.sh/uv/install.sh | sh).
Add this to your client's MCP config:
{
"mcpServers": {
"golf-coach": { "command": "uvx", "args": ["golf-coach"] }
}
}
For Claude Desktop's manual config (
~/Library/Application Support/Claude/claude_desktop_config.jsonon macOS), use the absolute path touvx— e.g./opt/homebrew/bin/uvx— because the app doesn't inherit your shellPATH. The.mcpbinstall above avoids this entirely.
The server needs to sign in to your Trackman account. Trackman has no public login API, so it captures a token from a real signed-in browser session once; it's then cached locally and refreshes itself. Your password is never seen or stored by the tool, and nothing leaves your machine.
Say "log in to Trackman." A browser window opens (an isolated profile, not
your normal Chrome); sign in once, at your own pace — the window is driven by a
background task, so it stays open until you're done and won't be closed out
from under you (even a slow Apple/Google 2FA is fine). When you've finished,
tell Claude and it confirms. The token caches at ~/.golf-coach/token.json
(mode 0600) and the MCP uses it automatically from then on. No terminal, no
token to copy — the extension fetches a browser itself if you don't have one.
uv tool install "golf-coach[login]"
golf-coach login # opens a browser; sign in once
golf-coach login --headless # silent refresh later (tokens last ~7 days)
scripts/install-refresh-schedule.sh # optional: auto-refresh twice weekly
portal.trackmangolf.com → DevTools → Network → a graphql request → copy
the Authorization: Bearer … value → paste into the extension's Trackman
token field (or set TRACKMAN_TOKEN). Tokens expire after ~7 days, so the
sign-in flows above are easier.
Ask Claude "Am I signed in to Trackman?" — it runs auth(action="status") and
replies with your name (never the token).
All tools return raw data only; the skills interpret it.
8 tools. trackman and gamebook each take an action (so the agent
picks one tool with a mode rather than many near-identical tools).
Setup: setup — one call returns an always-on coach system prompt (for a
Project), the skills as upload-ready files, and per-client steps. There's a
matching setup prompt in the picker.
Auth: auth(action: status | login, source?)
Trackman data (read-only): trackman(action: profile | handicap | sessions | session | rounds | clubs | summary) — profile+handicap, handicap history,
activity list, one activity in full (incl. shot-level metrics), course rounds,
club gapping, activity counts.
Gamebook rounds (local, deterministic): gamebook(action: save | list | get | compare) — on-course rounds ingested from Golf GameBook screenshots,
rolling last 5, coverage-aware (only score-per-hole is trusted).
Cross-source synthesis (local, deterministic): synthesize() — aligns
Trackman's and GameBook's per-source Findings by skill area (no verdict; see
CLAUDE.md's "Sources & normalization").
Session analysis (local, deterministic): session_analysis(action: analyze | get | list)
Training-plan memory: training_plan(action: save | next | list | done | verify)
Visualization: build_visualization (self-contained animated HTML artifact)
See CLAUDE.md for the full table and backing GraphQL.
The skills under skills/ are delivered two ways:
| Skill | What it does |
|---|---|
trackman-stats-analysis | Diagnose weaknesses from the data |
golf-coaching | Turn the diagnosis into an actionable practice plan (visual-first; auto-grades progress) |
drill-library | Curated drills + vetted links — incl. at-home / no-ball drills — plus live search |
golf-practice-at-home | Build a daily no-ball routine for a diagnosed fault, animated per drill |
at-home-practice-feedback | A single mobile-first drill card with built-in feedback: prop, validation checkpoint, budget tier, video |
trackman-session-analyzer | Ingest + normalize recent sessions |
gamebook-screenshot-analysis | Ingest GameBook round screenshots into a coverage-aware round record; scoring-led progress that feeds the coach |
swing-video-check | Frame-by-frame visual check of a filmed swing (one angle per clip) against the current practice card |
grip-check | Grade the grip (too weak / too strong) from two face-forward photos — the coach's gate before any new prescription |
trackman-visualizer | Animate a diagnosis (or a single drill's mechanics) as an HTML artifact |
To check a filmed swing: drop a clip named DATE_CLUB_ACTION.mp4 (e.g.
2026-07-17_driver_grip-reset.mp4) into the project in Claude Code and say
"check my swing" — you get an angle-scoped checklist and one swing thought
(needs ffmpeg).
(trackman-api-discovery is a project/dev skill and isn't served as a prompt.)
uv venv && uv pip install -e '.[login,dev]' # [login] = Playwright, [dev] = test/lint tools
golf-coach # run the MCP server (stdio)
uv run python scripts/validate.py # sanity-check stats coverage with your token
uv run pytest # tests
uv run ruff check # lint
uv run mypy # type-check
Releasing (PyPI + MCP Registry + the Desktop .mcpb) is one command —
scripts/release.sh patch — see PUBLISHING.md.
FAQs
MCP server that fetches a user's Trackman Golf stats (handicap, rounds, practice, shots, club gapping).
The pypi package golf-coach receives a total of 41 weekly downloads. As such, golf-coach popularity was classified as not popular.
We found that golf-coach demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.