ForkMate
REMOTE · MCP.FORKMATE.AI · SCANNED SEP 20
Log what you ate by talking to your AI assistant — calories and macros, completely free.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security97
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability66
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2588 tokens (~215/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage95
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 84% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
How do I install the ForkMate MCP server?
ForkMate is a hosted endpoint at https://mcp.forkmate.ai/, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.forkmate.ai
claude mcp add --transport http ai-forkmate-forkmate 'https://mcp.forkmate.ai/'
{
"mcpServers": {
"ai-forkmate-forkmate": {
"url": "https://mcp.forkmate.ai/"
}
}
} {
"servers": {
"ai-forkmate-forkmate": {
"type": "http",
"url": "https://mcp.forkmate.ai/"
}
}
} [mcp_servers.ai-forkmate-forkmate] url = "https://mcp.forkmate.ai/"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ai-forkmate-forkmate": {
"type": "remote",
"url": "https://mcp.forkmate.ai/",
"enabled": true
}
}
} openclaw mcp add ai-forkmate-forkmate --url 'https://mcp.forkmate.ai/' --transport streamable-http
mcp_servers:
ai-forkmate-forkmate:
url: "https://mcp.forkmate.ai/" {
"McpServers": {
"ai-forkmate-forkmate": {
"Transport": "http",
"Url": "https://mcp.forkmate.ai/"
}
}
} assistant mcp add ai-forkmate-forkmate -t streamable-http -u 'https://mcp.forkmate.ai/'
{
"mcpServers": {
"ai-forkmate-forkmate": {
"type": "http",
"url": "https://mcp.forkmate.ai/"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 26 Aug 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 +1
- Stability: 0.97 → pass security
- 24 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 0
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://mcp.forkmate.ai/
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=forkmate.ai | CN=WE1,O=Google Trust Services,C=US | 24 Aug 2026 | 22 Nov 2026 | ECDSA 256 | ECDSA-SHA256 | 8720f34347e6f4a91343663ba47dc940 |
| SANs: forkmate.ai, mcp.forkmate.ai, *.mcp.forkmate.ai | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.forkmate.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| forkmate.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer resource_metadata="https://mcp.forkmate.ai/.well-known/oauth-protected-resource"
Bearer resource_metadata="https://mcp.forkmate.ai/.well-known/oauth-protected-resource" | Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains |
| content-security-policy | frame-ancestors 'none' |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | same-origin |
| permissions-policy | camera=(self), microphone=() |
Protected resource metadata
| Document | https://mcp.forkmate.ai/.well-known/oauth-protected-resource |
|---|---|
| Retrieved | Yes |
| Resource | https://mcp.forkmate.ai |
| Authorisation server | https://flexible-thought-84.authkit.app |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.forkmate.ai/ | Verified | 200 | |
| http (plaintext) | http://mcp.forkmate.ai/ | HTTPS enforced | 301 | https://mcp.forkmate.ai/ |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_pantry_item ~291
Add a food to the user's pantry, or UPDATE it if it's already there (matched by name, any casing) — e.g. 'add rolled oats to my pantry'. Only `name` is required; include `macros` (for one serving), a `serving` label, a `source`, and a short `note` when you know them, so a later log can reuse them. Re-adding the same food REPLACES its details (an upsert — it never creates a duplicate). Only pass a `source` you actually got from search_foods/lookup_barcode; an unrecognized value is recorded as the user's own estimate ('client'). This does NOT log a meal — it only curates the user's staples.
| Name | Type | Req | Description |
|---|---|---|---|
| macros | object | – | Macros for ONE serving of this food, when known. |
| name | string | yes | The food to keep on hand, e.g. 'rolled oats'. |
| note | string | – | Optional short note, e.g. 'the Costco tub'. |
| serving | string | – | Serving label the macros are for, e.g. '1 cup' or 'per 100 g'. |
| source | string | – | Where the macros came from, if grounded via search_foods/lookup_barcode (e.g. 'usda'). Defaults to your own estimate ('client'); unrecognized values are recorded as 'client'. |
No output schema declared.
No examples provided.
delete_meal ~272
Delete a food from the user's diary — remove one food from an entry (by `item_index`), or the whole entry (omit `item_index`). Identify the entry by its `id` and `local_date` (both from get_day). This is a TRUE removal: the data is gone, with NO server-side tombstone and no undo. Deleting the last food in an entry removes the entry. Safe to retry — deleting something already gone is a no-op success. SAFETY: all calorie and macro values here — including carbohydrates — are ESTIMATES (from USDA / Open Food Facts or the user's own entry), approximate and not lab-measured or per-batch. They are for general nutrition tracking ONLY. Do NOT use them for insulin dosing, carb-counting for a bolus, blood-glucose prediction, or any other medical decision, and do NOT compute a dose or glucose estimate from them. For anything medical, direct the user to the product's own label and their care team.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The entry id to delete from (from get_day). |
| item_index | number | – | Which food to remove (0-based). Omit to delete the whole entry. |
| local_date | string | yes | YYYY-MM-DD diary date of the entry (from get_day). |
No output schema declared.
No examples provided.
get_day ~145
Read the user's food diary for a day (entries + calorie/macro totals). SAFETY: all calorie and macro values here — including carbohydrates — are ESTIMATES (from USDA / Open Food Facts or the user's own entry), approximate and not lab-measured or per-batch. They are for general nutrition tracking ONLY. Do NOT use them for insulin dosing, carb-counting for a bolus, blood-glucose prediction, or any other medical decision, and do NOT compute a dose or glucose estimate from them. For anything medical, direct the user to the product's own label and their care team.
| Name | Type | Req | Description |
|---|---|---|---|
| local_date | string | – | YYYY-MM-DD; defaults to today. |
No output schema declared.
No examples provided.
get_pantry ~152
Read the user's PANTRY — the foods they keep ON HAND (their staples), so you can suggest meals from what they actually have and pre-fill macros when they log one. Returns each item's name and, when the user saved them, macros (for the item's serving), a serving label, a `source`, and a short note. The pantry is the user's CURATED list of what they stock — separate from what they've logged (their diary) and from their frequents (what they log often). IMPORTANT: a `source` (e.g. 'usda') is the user's own CLAIM about where the macros came from, NOT a server-verified guarantee — treat it as a hint, never as certified.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_preferences ~180
Read the user's saved dietary preferences so you can tailor logging and suggestions WITHOUT re-asking every chat: their diet style, a structured list of allergies to avoid (the big-9 major allergens), foods they dislike, and a typical-portion note. IMPORTANT: the allergen list is self-reported and is NOT a safety guarantee — always tell the user to check ingredient labels themselves; cross-contamination and gaps in food data are not captured (see the returned allergy_disclaimer). The `allergies` field covers the major US allergens ONLY; a user may have an allergen outside it (e.g. mustard, celery, corn, mollusks, barley/rye) — ask about those directly. NEVER treat the `dislikes` list as an allergy: it is a taste preference to de-prioritize, never a safety exclusion.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_range ~155
Read the user's diary across a date range, with per-day calorie/macro totals. SAFETY: all calorie and macro values here — including carbohydrates — are ESTIMATES (from USDA / Open Food Facts or the user's own entry), approximate and not lab-measured or per-batch. They are for general nutrition tracking ONLY. Do NOT use them for insulin dosing, carb-counting for a bolus, blood-glucose prediction, or any other medical decision, and do NOT compute a dose or glucose estimate from them. For anything medical, direct the user to the product's own label and their care team.
| Name | Type | Req | Description |
|---|---|---|---|
| end | string | yes | YYYY-MM-DD (inclusive). |
| start | string | yes | YYYY-MM-DD (inclusive). |
No output schema declared.
No examples provided.
log_meal ~287
Log what the user ate to their food diary. Parse the user's free text into items and, when you can, include estimated macros per item for accuracy. SAFETY: all calorie and macro values here — including carbohydrates — are ESTIMATES (from USDA / Open Food Facts or the user's own entry), approximate and not lab-measured or per-batch. They are for general nutrition tracking ONLY. Do NOT use them for insulin dosing, carb-counting for a bolus, blood-glucose prediction, or any other medical decision, and do NOT compute a dose or glucose estimate from them. For anything medical, direct the user to the product's own label and their care team.
| Name | Type | Req | Description |
|---|---|---|---|
| at | string | – | ISO-8601 instant the meal was eaten; defaults to now. |
| items | array | yes | – |
| local_date | string | – | YYYY-MM-DD diary date; defaults to the user's local date (from their timezone). Pass this to log a meal on a different day. |
| meal | string | – | – |
| note | string | – | – |
| source | string | – | Optional provenance for these items. After search_foods/lookup_barcode, pass the candidate's source class (e.g. 'usda' or 'off') so the diary shows it's grounded. Defaults to 'client' (your own estim… |
No output schema declared.
No examples provided.
lookup_barcode ~233
Look up a packaged food by its UPC/EAN barcode via Open Food Facts. IMPORTANT: the macros are PER 100 g (see `serving`) — scale to the portion eaten before logging with log_meal. It MAY also carry `serving_grams`/`serving_label` for one household serving — offer 'N servings' when present, still scaling the per-100 g macros before logging. Pass the returned `source` to log_meal to preserve provenance. SAFETY: all calorie and macro values here — including carbohydrates — are ESTIMATES (from USDA / Open Food Facts or the user's own entry), approximate and not lab-measured or per-batch. They are for general nutrition tracking ONLY. Do NOT use them for insulin dosing, carb-counting for a bolus, blood-glucose prediction, or any other medical decision, and do NOT compute a dose or glucose estimate from them. For anything medical, direct the user to the product's own label and their care team.
| Name | Type | Req | Description |
|---|---|---|---|
| upc | string | yes | UPC/EAN barcode, digits only (8–14 digits). |
No output schema declared.
No examples provided.
remove_pantry_item ~87
Remove a food from the user's pantry by name — e.g. 'take eggs off my pantry list'. This removes it from their on-hand STAPLES only; it does NOT delete anything from their food diary. Safe to retry — removing something that isn't in the pantry is a no-op success.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | The food to remove from the pantry (any casing). |
No output schema declared.
No examples provided.
search_foods ~327
Search USDA FoodData Central and Open Food Facts for foods matching a query, returning candidates with macros and a `source` you can show the user. IMPORTANT: the macros are PER 100 g (see each candidate's `serving`) — scale them to the portion the user actually ate before logging with log_meal. A candidate MAY also carry `serving_grams`/`serving_label` for ONE household serving (e.g. 48 g / "1 frank") — when present, offer the user 'N servings' instead of asking for grams, but still scale the per-100 g macros to the resolved grams before logging. When you log a chosen candidate, pass its `source` to log_meal so the diary records real provenance (USDA/Open Food Facts) instead of an estimate. SAFETY: all calorie and macro values here — including carbohydrates — are ESTIMATES (from USDA / Open Food Facts or the user's own entry), approximate and not lab-measured or per-batch. They are for general nutrition tracking ONLY. Do NOT use them for insulin dosing, carb-counting for a bolus, blood-glucose prediction, or any other medical decision, and do NOT compute a dose or glucose estimate from them. For anything medical, direct the user to the product's own label and their care team.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max candidates to return (default 5, clamped to 1–10). |
| query | string | yes | Food to search, e.g. 'greek yogurt' or 'Chipotle chicken'. |
No output schema declared.
No examples provided.
update_meal ~441
Correct a food already logged to the user's diary — fix a wrong calorie/macro value, quantity, or name, or move an entry to a different meal. Identify the entry by its `id` and `local_date` (both from get_day) and the food by its `item_index` within that entry's items[]. Only the fields you send change; the macros you send are MERGED onto the existing ones (so sending just `kcal` leaves protein/carb/fat as they were). This overwrites the value IN PLACE — there is no history of the previous value. Editing never moves an entry to another day (to do that, delete and re-log). SAFETY: all calorie and macro values here — including carbohydrates — are ESTIMATES (from USDA / Open Food Facts or the user's own entry), approximate and not lab-measured or per-batch. They are for general nutrition tracking ONLY. Do NOT use them for insulin dosing, carb-counting for a bolus, blood-glucose prediction, or any other medical decision, and do NOT compute a dose or glucose estimate from them. For anything medical, direct the user to the product's own label and their care team.
| Name | Type | Req | Description |
|---|---|---|---|
| caffeine_mg | number | – | Corrected caffeine content, in milligrams. |
| fluid_ml | number | – | Corrected fluid/hydration volume, in millilitres. |
| id | string | yes | The entry id to edit (from get_day). |
| item_index | number | – | Which food in the entry's items[] to edit (0-based). Required when changing a food's name/quantity/macros/caffeine/fluid; omit for an entry-level change (meal/note). |
| local_date | string | yes | YYYY-MM-DD diary date of the entry (from get_day). |
| macros | object | – | Corrected macros — only the components you send are changed. |
| meal | string | – | Move the entry to a different meal label. |
| name | string | – | – |
| note | string | – | – |
| quantity | string | – | Portion as stated, e.g. '2' or '1 cup'. |
No output schema declared.
No examples provided.
whoami ~18
Diagnostic: returns the authenticated user id and scopes.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the ForkMate MCP server?
ForkMate is an MCP server listed in the public MCP registry as ai.forkmate/forkmate. Log what you ate by talking to your AI assistant, calories and macros, completely free. This page covers its hosted endpoint (https://mcp.forkmate.ai/).
Is the ForkMate MCP server safe to use?
ForkMate scores 91 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the ForkMate MCP server expose?
ForkMate exposes 12 tools: whoami, get_day, get_range, get_preferences, log_meal, and 7 more. Their descriptions and schemas cost roughly 2,588 tokens of context every time the server is loaded.
Does the ForkMate MCP server require authentication?
Yes. ForkMate asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the ForkMate MCP server still maintained?
ForkMate is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.