Is Crowntowncompost free?

Yes, Crowntowncompost is free to use.

How do I install Crowntowncompost?

Crowntowncompost is a local plugin. Install it using npm package: crowntowncompost-mcp and add the generated configuration snippet to your AI app's MCP config file. Then restart your AI app.

Is Crowntowncompost safe to use?

Crowntowncompost scored 7/10 (moderate risk) in MCP Marketplace's automated security scan. It has 1 high or critical finding to review. It's listed, but review the security report on this page before installing.

What credentials does Crowntowncompost need?

Crowntowncompost requires the following credentials or environment variables: CROWNTOWN_SESSION_COOKIE, CROWNTOWN_USERNAME, CROWNTOWN_PASSWORD, CROWNTOWN_SESSION_CACHE, CROWNTOWN_SESSION_FILE. You can find setup instructions on the server detail page.

What AI apps work with Crowntowncompost?

Crowntowncompost uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Crowntowncompost MCP Server

by Chris Hall

Developer ToolsModerate7.0Local

Free

Customer access to the Crown Town Compost portal: pickups, invoices, and skips (AI-built).

About

Customer access to the Crown Town Compost portal: pickups, invoices, and skips (AI-built).

Security Report

7.0

Moderate7.0Moderate Risk

Crown Town Compost MCP server is well-architected with strong security practices for a third-party service integration tool. Authentication is properly implemented with support for both session cookies and credential-based login, with deferred configuration errors and secure credential handling via environment variables. The codebase demonstrates careful input validation, confirm-gated mutations, and proper state verification. Minor code quality observations exist around error handling breadth and logging, but these do not materially impact security. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

6 files analyzed · 7 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

What You'll Need

Set these up before or after installing:

A Cookie header from an already-signed-in portal session ("sessionid=...; csrftoken=..."). Supply this and no password is needed — the login is skipped entirely.Required

Environment variable: CROWNTOWN_SESSION_COOKIE

Your portal.crowntowncompost.com username or email address. Needed only if you are not supplying CROWNTOWN_SESSION_COOKIE.Optional

Environment variable: CROWNTOWN_USERNAME

Your Crown Town Compost customer-portal password. Needed only if you are not supplying CROWNTOWN_SESSION_COOKIE.Required

Environment variable: CROWNTOWN_PASSWORD

Set to false to disable the on-disk session cache and re-authenticate on every process start. Defaults to enabled.Optional

Environment variable: CROWNTOWN_SESSION_CACHE

Absolute path for the session cache file. Defaults to $MCP_DATA_DIR/.crowntowncompost-mcp/session.json.Optional

Environment variable: CROWNTOWN_SESSION_FILE

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-chrischall-crowntowncompost-mcp": {
      "env": {
        "CROWNTOWN_PASSWORD": "your-crowntown-password-here",
        "CROWNTOWN_USERNAME": "your-crowntown-username-here",
        "CROWNTOWN_SESSION_FILE": "your-crowntown-session-file-here",
        "CROWNTOWN_SESSION_CACHE": "your-crowntown-session-cache-here",
        "CROWNTOWN_SESSION_COOKIE": "your-crowntown-session-cookie-here"
      },
      "args": [
        "-y",
        "crowntowncompost-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

crowntowncompost-mcp

MCP server for the Crown Town Compost customer portal — check your pickups, invoices, and upcoming collection days, skip a service, report a missed pickup, and update your account, all in natural language.

Developed and maintained by AI (Claude Code). Use at your own discretion.

What it talks to

crowntowncompost.com is a marketing site with no customer data. Everything lives at portal.crowntowncompost.com, a Django app (a white-labeled StopSuite hauler platform). This server authenticates server-side with a session cookie you already hold, or with your own portal username and password — a normal form login that returns one — and reads the same pages and JSON endpoints the website uses. No browser extension, no bot-wall workaround, no third-party service in the middle.

Install

npm install -g crowntowncompost-mcp

Then add it to your MCP host. Two configurations work — supply either a session cookie you already hold (nothing else needed), or the login pair so the server can mint one:

{
  "mcpServers": {
    "crowntowncompost": {
      "command": "npx",
      "args": ["-y", "crowntowncompost-mcp"],
      "env": {
        "CROWNTOWN_USERNAME": "you@example.com",
        "CROWNTOWN_PASSWORD": "your-portal-password"
      }
    }
  }
}

To use a session cookie instead, set CROWNTOWN_SESSION_COOKIE to a Cookie header value from a signed-in browser session (sessionid=…; csrftoken=…) and leave the username and password unset. The portal login is then never run, and no password is stored anywhere.

Setting both is also valid, and is the most robust configuration: the cookie is used first, and when the portal eventually expires it the login quietly mints a replacement. With a cookie alone, an expired session is reported as expired — the server says so plainly rather than claiming nothing is configured.

Locally you can instead copy .env.example to .env. The server boots without credentials (so a host's install-time probe succeeds); the configuration error surfaces on the first tool call.

Tools

Reads

Tool	What it returns
`crowntown_healthcheck`	Whether credentials work, plus account status — distinguishes "no creds" from "bad creds" from "site error"
`crowntown_get_dashboard`	Account status, subscription (plan, price, renewal date), next service date, service addresses + pickup days, and your environmental impact
`crowntown_get_account`	Contact details and notification preferences
`crowntown_get_pickup_schedule`	Pickup day(s) and time window per address — the official set-out-by time plus an observed arrival window (earliest/latest/typical, consistent vs varies) derived from your collection history
`crowntown_list_service_history`	Past collection stops — date, outcome, time, weight, services. Paginated; filter by `success`/`missing`/`empty`/`inaccessible`/`unacceptable`
`crowntown_list_upcoming_services`	Upcoming collection days, each with the ids needed to skip it
`crowntown_list_invoices`	Billing history with amounts, status, and Stripe payment links

Writes (all confirm-gated)

Tool	What it does
`crowntown_skip_service`	Skip or un-skip an upcoming collection day
`crowntown_update_account`	Update contact details / notification preferences
`crowntown_report_missed_pickup`	Report that a collection was missed
`crowntown_contact_support`	Send a message to customer support

Every mutating tool takes confirm. Without confirm: true it makes no network call and returns a dry-run preview of exactly what would be sent. Where a re-read can prove the change stuck (skips, account updates) the tool re-reads and reports verified; where it can't (support messages, missed-pickup reports) it says so rather than claiming success.

Payments are deliberately out of scope — crowntown_list_invoices returns the hosted invoice URL for you to open in a browser.

Without the MCP

The skills/crowntown-portal skill does the same things with curl in a shell — useful in scripts or on a machine where this server isn't installed. It documents the Django CSRF handshake, both JSON endpoints, and every write's field list.

Development

npm install
npm run build
npm test

Tests mock the network — no credentials needed and nothing hits the live portal. tests/server-boot.test.ts spawns the real built artifacts (the npm bin and the bundle, the latter without node_modules) and runs the MCP handshake against them.

Endpoint shapes are documented in docs/CROWNTOWN-API.md, including which parts are live-verified and which are not.