Nutrition MCP Server

Nutrition MCP

A remote MCP server for personal nutrition tracking — log meals with calories, macros, fiber, total and added sugar, saturated and trans fat, sodium (with an optional daily ceiling) and caffeine (optionally ingredient by ingredient), look up generic foods in USDA FoodData Central and packaged products by barcode in Open Food Facts, record where each nutrient value came from, save meals you eat often and log them again by name, log water, body weight and body measurements, review nutrition history, and import an existing food diary from another app, all through conversation. Alcohol tracking is opt-in and off by default. The website and the in-chat widgets are available in English, German, Spanish, French, Dutch, Polish, Italian, Ukrainian, Japanese and Turkish; set_language picks the widget language.

Help me pay for the servers on Patreon

Table of Contents

• Quick Start
• Demo
• Tech Stack
• MCP Tools
• MCP Resources
• Self-hosting
  • 0. Get the code
  • 1. Supabase setup
  • 2. Environment variables
  • 3. Google sign-in (optional)
• Development
  • Testing and quality
• Connect to Claude.ai
• Apple Health sync
• Troubleshooting
• API Endpoints
• Deploy
• Support & security
• Data sources
• License

Quick Start

Already hosted and ready to use — just connect it to your MCP client:

https://nutrition-mcp.com/mcp

On Claude.ai: open Nutrition MCP in the Claude directory and click Connect (see Connect to Claude.ai below)

On first connect, sign in with Google or enter an email and password and choose Create account. Your data persists across reconnections. Trouble connecting? See Troubleshooting.

By connecting you agree to the Terms of Service; how your data is handled is in the Privacy Policy.

Switching from another tracker? See the nutrition-app alternatives — how it compares to MyFitnessPal, Cronometer, Lose It!, MacroFactor, Yazio, and Lifesum. Bring your history with you: say "import my meals" and an importer opens in the chat, where you pick the CSV you exported from your old app, map its columns, and check what will be added before anything is saved. Exports from MyFitnessPal, Cronometer, Lose It! and MacroFactor are recognised automatically; any other CSV works by mapping its columns yourself. In clients that can't show in-chat panels, paste the export instead and the AI imports it for you. If your export has an alcohol column and you want it kept, turn alcohol tracking on before importing — the importer skips that column while tracking is off, and re-importing the same file later won't backfill it.

Demo

Read the story behind it: How I Replaced MyFitnessPal and Other Apps with a Single MCP Server

Tech Stack

• Bun — runtime and package manager
• Hono — HTTP framework
• MCP TypeScript SDK v2 (@modelcontextprotocol/server) with Zod 4 schemas — Model Context Protocol over Streamable HTTP, answering both the 2026-07-28 and the 2025-11-25 protocol revisions
• Supabase — PostgreSQL database + user authentication
• OAuth 2.0 — authentication for Claude.ai and other MCP clients: per-client dynamic client registration (RFC 7591) with exact redirect-URI matching, mandatory PKCE (S256), token-endpoint client authentication (none, client_secret_post, client_secret_basic), codes and refresh tokens bound to the client they were issued to, iss on every authorization response (RFC 9207), and client secrets, access tokens, refresh tokens and codes stored only as a SHA-256 hash. Access tokens last 24 hours; refresh tokens last 90 days from their last use and rotate on every refresh; expired tokens and never-used client registrations are swept hourly

MCP Tools

MCP Resources

In-chat widgets

On hosts that support MCP Apps, the tools also draw a card in the chat. Each card carries the same figures as the text answer:

• Nutrition summary (get_nutrition_summary) and meal logged (log_meal, update_meal, log_saved_meal): a half-gauge of calories. For one day the arc is split into meals; for a range it shows the average against the peak day. Show more opens the nutrients: each one has its own mini gauge and, expanded, the meals and ingredients it came from, plus a by-day strip for a range and calories by meal. Sodium and saturated and trans fat are in that list. The meal-logged card only appears once goals are set.
• Goal progress (get_goal_progress): intake against targets and limits for a day, and latest weight against the target weight.
• Trends (get_trends): a 7/14/30-day toggle and a nutrient switcher over a bar chart, with one card per nutrient.
• Weight trends (get_weight_trends): weight over time, zoomed to 7 days, 30 days, 90 days, 1 year or all history.
• Digest (get_digest): one period in collapsible sections — calories and nutrients against goals, trends, water and weight, meals or logging habits, and highlights.
• Import (start_meal_import): the CSV importer. The file is read in the browser, mapped, and previewed before anything is saved.

Cards follow the light or dark theme of the host and the language set with set_language. They are on by default; set_widget_display turns them off, and the text answers are unchanged.

Self-hosting

0. Get the code

git clone https://github.com/akutishevsky/nutrition-mcp.git
cd nutrition-mcp
bun install
cp .env.example .env   # fill in real values as you go through the steps below

Requires Bun 1.x (matches the Dockerfile's oven/bun:1 base image; no exact minor version is pinned).

bun run gen:all regenerates the public site pages without starting the server.

Making it yours: The public site includes the maintainer's personal bits — Google Analytics, Microsoft Clarity, Patreon/GitHub/contact links, and the nutrition-mcp.com domain. Run bun run gen:all to produce the public pages, then bun run depersonalize to strip the personal bits in one pass (the consent-gated analytics snippet, the consent banner and the footer "Cookie settings" button, plus the analytics CSP hosts, the Support/Contact sections, social links, and the domain → a your-domain.com placeholder). Use bun run depersonalize --dry to preview without writing. Afterwards, swap in your own public/og.png, favicon.ico, favicon.svg, apple-touch-icon.png, icon-192.png and icon-512.png, replace the domain placeholder with your real domain, and rewrite the analytics paragraphs of the privacy policy and terms (src/copy/legal*.ts), which still name both services. Its edits to the generated pages are undone by bun run gen:all — to regenerate, first change the sources it reads from (in scripts/site-partials.ts, either your own GA_MEASUREMENT_ID / CLARITY_PROJECT_ID, which analyticsHead() loads only after a visitor accepts the consent banner, or ANALYTICS_ENABLED set to false to drop the snippet, banner and button altogether; SITE in src/routes.ts), then run it again. This script only touches the generated files under public/, the import widget's support address, src/index.ts and the security.txt contact in src/security-txt.ts (blanked, so /.well-known/security.txt answers 404 until you set your own) — it doesn't touch this README or SECURITY.md, so if you're publishing your own fork, rewrite SECURITY.md for your deployment and also edit or remove the Patreon line near the top of this file and the Medium link in Demo.

1. Supabase setup

1. Create a Supabase project.

2. Enable Email Auth (Authentication → Providers → Email) and disable email confirmation.

3. Apply the schema. The full schema lives in supabase/migrations/. With the Supabase CLI:

   supabase link --project-ref <your-project-ref>
   supabase db push
   

   This creates every table, index, RLS policy, and foreign key the app needs. No local Postgres is involved — migrations run against your hosted project.

4. Copy the service role key from Project Settings → API and use it as SUPABASE_SECRET_KEY.

2. Environment variables

Legacy only — a fresh deploy doesn't need these, since every client registers its own credentials via POST /register. To set the optional OAUTH_CLIENT_* pair for the legacy static client:

bun run generate-oauth-creds

or manually:

openssl rand -hex 16   # use as OAUTH_CLIENT_ID
openssl rand -hex 32   # use as OAUTH_CLIENT_SECRET

Patreon posts, one-time setup: PATREON_ACCESS_TOKEN / PATREON_REFRESH_TOKEN are only ever read once, at server boot, to seed the patreon_tokens table if it's still empty — the server refreshes and stores its own pair from then on, so leaving these two set permanently is safe (every later boot is a no-op). You never need to touch the database by hand.

3. Google sign-in (optional)

Email/password works out of the box. To also offer "Continue with Google", follow docs/google-auth-setup.md to create a Google OAuth client, enable the Google provider in Supabase, and set GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET. This adds the POST /authorize/google and GET /auth/google/callback routes — see API Endpoints.

Development

bun install
cp .env.example .env   # fill in your credentials — see Self-hosting above for what to put here
bun run dev             # regenerates public/ pages, then starts with hot reload on http://localhost:8080

The generated pages under public/ (index, tools, privacy, terms, login, /alternatives, locale mirrors, sitemap.xml) are build artifacts, not tracked in git — they're regenerated on every Docker build, in CI, and once at each bun run dev start. --watch only restarts the src/index.ts process on save, so it does not rerun generation — after editing src/copy/, src/routes.ts, or scripts/site-partials.ts, run bun run gen:all yourself to pick up the change.

Testing and quality

bun test                # run the test suite
bun run format           # format with Prettier (4-space indentation)
bun run format:check     # verify the tree is prettier-clean
bun run typecheck        # typecheck src/

CI runs format:check and typecheck on every PR; typecheck is scoped to src/, so a type error in a test file or under scripts/ won't be caught by it.

For in-chat widget development (public/widgets/), bun run harness starts a local host simulator so you can test widgets without a real MCP client.

Connect to Claude.ai

1. Open Nutrition MCP in the Claude directory
2. Click Connect
3. Sign in or register when prompted
4. Done — Claude can now use your nutrition tools

Alternatively, add https://nutrition-mcp.com/mcp as a custom connector under Customize → Connectors. If you reconnect later, sign in with the same email and password to keep your data.

Apple Health sync

An optional iOS Shortcut, Nutrition MCP Health, copies your daily totals into Apple Health on your iPhone: calories (Dietary Energy), protein, carbohydrates, total fat, fiber and caffeine, plus water if you opt in when connecting. Alcohol is never sent, and neither are sodium, saturated and trans fat or sugar. There is no app to install and no new MCP tool — your AI app keeps doing the logging, and the shortcut only reads finished days. The setup guide — install link, connecting, automations and everyday use — is at nutrition-mcp.com/apple-health (the install link appears there once the shortcut is published); how the shortcut is built is in docs/apple-health-shortcut.md.

• Connecting: run the shortcut on your iPhone. It asks whether to include water and whether to send the last 7 days too, then opens a sign-in page in Safari — sign in with the same account your AI app uses. The page hands control back to the shortcut, which finishes connecting. The connect link works once, for 30 minutes, and only the iPhone that started it can finish it.
• What arrives: only finished days. A day counts as finished at 05:00 the next morning in your timezone, so yesterday appears after 05:00 today and today is never in Health. Each day is one entry per type at 12:00, labelled "Shortcuts". Every sync looks back over the last 7 finished days, so a missed morning catches up by itself.
• Later changes: a meal added to a day that was already sent follows as a small extra entry (12:01, 12:02, …) while the day is within those 7 days. Health cannot lower a value, so a deleted or smaller meal leaves Health higher and the shortcut shows a notice saying how to fix the day by hand.
• When it runs: whenever one of its automations fires — opening the Health app, stopping your alarm, optionally plugging in — or when you choose Sync now in the shortcut.
• What the server keeps: the connection, and for 8 days what it sent, so a day is sent once and afterwards only topped up. Both are in your data export (health_sync.csv, and a health_sync row in connections.csv). The connection ends after 90 days without a sync and 365 days after connecting at the latest; Disconnect in the shortcut, or deleting your account, removes it at once. Nothing is ever removed from Apple Health — that data is on your iPhone.
• Your profile timezone decides where one day ends. If you never set one, the timezone your iPhone reported when connecting is used. get_profile shows whether the sync is connected and which day it has sent through.

Your data

export_all_data returns everything stored about the account as one ZIP, behind a link that expires after 60 minutes. Each export replaces the last. The ZIP holds:

• meals.csv and meal_items.csv — every meal and its ingredients, with the source of each nutrient value. meals.csv uses the importer's column names, so it can be imported again.
• saved_meals.csv and saved_meal_items.csv — saved meals and their ingredients.
• water.csv, weight.csv and body_measurements.csv — every entry.
• goals.csv and goals_history.csv — current targets and limits, and how they changed.
• profile.csv and account.csv — settings and account details.
• telemetry.csv — the tool-call log kept for the account.
• connections.csv — the apps connected to the account, including the Apple Health sync link.
• health_sync.csv — the days sent to Apple Health in the last 8 days.
• README.txt — the timezone the timestamps are written in, which columns are in milligrams, and which files can be imported.

Every timestamp has a timezone column next to it, and each file has its header even when it has no rows.

Troubleshooting

The full version, in 10 languages, is at nutrition-mcp.com/tools#troubleshooting. In short:

Documentation truncated — see the full README on GitHub.