# whatevr (remote · api.trywhatevr.app)

Log meals and read calories and macros from any AI assistant. Pairs with the whatevr iPhone app.

- Trust score: 67/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `api.trywhatevr.app`: 67/100 (this document), [markdown](https://verifymcp.io/servers/app-trywhatevr-whatevr/api.md), [page](https://verifymcp.io/servers/app-trywhatevr-whatevr/api)

## Channel facts

- Endpoint: `https://api.trywhatevr.app/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.2`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (update_goals).
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 63/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2195 tokens (~182/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 37/100
  - Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 85/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 54% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the whatevr MCP server?

whatevr is a hosted endpoint at https://api.trywhatevr.app/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http app-trywhatevr-whatevr 'https://api.trywhatevr.app/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "app-trywhatevr-whatevr": {
      "url": "https://api.trywhatevr.app/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "app-trywhatevr-whatevr": {
      "type": "http",
      "url": "https://api.trywhatevr.app/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.app-trywhatevr-whatevr]
url = "https://api.trywhatevr.app/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "app-trywhatevr-whatevr": {
      "type": "remote",
      "url": "https://api.trywhatevr.app/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add app-trywhatevr-whatevr --url 'https://api.trywhatevr.app/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  app-trywhatevr-whatevr:
    url: "https://api.trywhatevr.app/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "app-trywhatevr-whatevr": {
      "Transport": "http",
      "Url": "https://api.trywhatevr.app/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add app-trywhatevr-whatevr -t streamable-http -u 'https://api.trywhatevr.app/mcp'
```

### Other

```json
{
  "mcpServers": {
    "app-trywhatevr-whatevr": {
      "type": "http",
      "url": "https://api.trywhatevr.app/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-02 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 64, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-27 (score 63, +1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] New tool “delete_log”, which the server declares destructive
- [security] New tool “update_goals”, which the server declares destructive
- [functional regression] Schema quality: 1561 → 2195
- [functional] Destructive annotations: pass → 100
- [functional] New tool “update_reminders”

### 2026-10-26 (score 62, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-10-25 (score 62)

First indexed and scored.

## MCP tools (12)

### `log_anything` (~238 tokens)

Log food, drinks, water, exercise, or a weigh-in from one natural-language sentence — the same parser as the app's voice logging. Examples: 'two eggs and toast', '30 minute run', '3 glasses of water', 'weighed 184 this morning'. Spoken dates like 'yesterday I had pizza' work. Describe the FOOD, not just numbers: stating explicit nutrition in the text ('burrito, 800 calories') pins those totals exactly but logs ONE pre-computed item with no ingredient breakdown — if you do that, follow up with update_log's `ingredients` array so the log keeps its per-item detail.

Input parameters:

- `logged_at` (string): Bare-local timestamp YYYY-MM-DDThh:mm:ss (no zone). Omit to use the user's 'now'.
- `text` (string, required): What to log, in plain words.
- `tz_offset_min` (number): The user's JS getTimezoneOffset() — minutes BEHIND UTC (e.g. 240 for EDT). Optional: when omitted, the user's app-reported timezone is used (UTC only if the account has never reported one).

### `log_exercise` (~151 tokens)

Log structured exercise with a known calorie burn. For an ESTIMATED burn from plain text, use log_anything ('30 minute run').

Input parameters:

- `activity` (string, required): e.g. 'running'
- `calories_burned` (number, required)
- `duration_minutes` (number, required)
- `logged_at` (string): Bare-local timestamp YYYY-MM-DDThh:mm:ss (no zone). Omit to use the user's 'now'.
- `tz_offset_min` (number): The user's JS getTimezoneOffset() — minutes BEHIND UTC (e.g. 240 for EDT). Optional: when omitted, the user's app-reported timezone is used (UTC only if the account has never reported one).

### `log_weight` (~130 tokens)

Log a weigh-in in pounds. The newest reading also becomes the user's current weight (drives their calorie targets).

Input parameters:

- `logged_at` (string): Bare-local timestamp YYYY-MM-DDThh:mm:ss (no zone). Omit to use the user's 'now'.
- `note` (string)
- `tz_offset_min` (number): The user's JS getTimezoneOffset() — minutes BEHIND UTC (e.g. 240 for EDT). Optional: when omitted, the user's app-reported timezone is used (UTC only if the account has never reported one).
- `weight_lb` (number, required)

### `log_water` (~147 tokens)

Log water — glasses (8 fl oz each) or an exact amount_fl_oz. Defaults to 1 glass.

Input parameters:

- `amount_fl_oz` (number)
- `glasses` (number): 8 fl oz each; used when amount_fl_oz is absent
- `logged_at` (string): Bare-local timestamp YYYY-MM-DDThh:mm:ss (no zone). Omit to use the user's 'now'.
- `tz_offset_min` (number): The user's JS getTimezoneOffset() — minutes BEHIND UTC (e.g. 240 for EDT). Optional: when omitted, the user's app-reported timezone is used (UTC only if the account has never reported one).

### `get_today` (~116 tokens)

Today's complete picture: calorie/macro totals vs targets, water, streak, exercises, and the item-by-item food log (`recent`: every logged item's name, calories, macros, ingredients). Each `recent` item's `id` works with update_log to correct mistakes.

Input parameters:

- `tz_offset_min` (number): The user's JS getTimezoneOffset() — minutes BEHIND UTC (e.g. 240 for EDT). Optional: when omitted, the user's app-reported timezone is used (UTC only if the account has never reported one).

### `get_day` (~71 tokens)

Everything logged on a specific day, INCLUDING each food item's name and nutrition (same shape as get_today). Use this to answer “what did I eat yesterday / on <date>”. Each `recent` item's `id` works with update_log to correct mistakes.

Input parameters:

- `date` (string, required): YYYY-MM-DD

### `get_progress` (~129 tokens)

Daily calorie/macro/exercise TOTALS over time + the weight trend (no food item names — use get_day for what was actually eaten).

Input parameters:

- `anchor` (string): Window end date (default: the user's today)
- `days` (number): 1–730, or 0 for all-time (default 30)
- `tz_offset_min` (number): The user's JS getTimezoneOffset() — minutes BEHIND UTC (e.g. 240 for EDT). Optional: when omitted, the user's app-reported timezone is used (UTC only if the account has never reported one).

### `get_me` (~30 tokens)

Who the user is: name/handle/email, health profile, calorie/macro targets, and derived metrics.

### `update_goals` (~302 tokens)

Change the user's goal and daily targets — the same settings as the app's Goals screen. Send ONLY the fields to change. Each target takes a number (a custom target) or "auto" (computed from their body, activity and goal). The server keeps calories and macros consistent (protein×4 + carbs×4 + fat×9 ≈ calories), so the targets it returns can differ slightly from what you sent — report the returned ones. Current weight is not here: log a weigh-in with log_weight. Needs the user's "Change goals & settings" switch for this connection (whatevr app → Settings → Connections); if it's off you'll get a message saying so — relay it. The user is notified of every change.

Input parameters:

- `activity_level` (string)
- `calorie_target`: 1000–5000, or "auto".
- `carbs_target_g`: 20–600, or "auto".
- `fat_target_g`: 10–250, or "auto".
- `fiber_minimum_g` (number)
- `goal` (string)
- `goal_weight_lb` (number)
- `protein_target_g`: 20–400, or "auto".
- `rate_lb_per_week` (number): Pace for lose/gain (ignored for maintain).
- `sodium_maximum_mg` (number)
- `sugar_maximum_g` (number)
- `water_goal_glasses` (number)

### `update_reminders` (~110 tokens)

Turn the user's daily reminders on or off: the evening 'nothing logged today' nudge and the streak reminder. Same as the app's Notifications screen. Needs the user's "Change goals & settings" switch for this connection. The user is notified of the change.

Input parameters:

- `log_reminder` (boolean)
- `streak_reminder` (boolean)
- `tz_offset_min` (number): The user's JS getTimezoneOffset(). Only used if the app has never reported their timezone; then it's required.

### `delete_log` (~140 tokens)

Delete ONE entry from the user's log: a food, exercise, weigh-in or water entry. Read get_today/get_day first — each item in `recent` carries its `id` and `type`; pass both. Deleting a weigh-in updates their current weight to the newest remaining one. This can't be undone, so confirm with the user first. Needs the user's "Delete entries" switch for this connection (whatevr app → Settings → Connections). The user is notified.

Input parameters:

- `log_id` (string, required): The item's `id` from get_today/get_day `recent`.
- `type` (string, required): The item's `type` from `recent`.

### `update_log` (~390 tokens)

Correct an existing FOOD log: title, nutrition numbers, the ingredient list, meal, or time-of-day. Read get_today/get_day first — each item in `recent` (type "food") carries the `id` to pass here. Send ONLY the fields to change; values are absolute for the item as logged. Two modes, never mixed: send `ingredients` to REPLACE the whole list (include every ingredient you want kept — the log's totals recompute from it, so don't also send calories/macros), OR send top-level numbers to set totals directly — the existing ingredient breakdown then RESCALES proportionally so the parts always sum to the new totals (ingredient names/amounts don't change, so when the COMPOSITION changed — something added or removed — send `ingredients` instead). Note: ANY edit that changes a routine-created log's title or its calories — including an ingredients replacement, since totals recompute — also updates that saved routine. When logged_time changes, the log's meal may re-infer from the new hour unless you set meal explicitly. Requires a full-access token; edit one log at a time.

Input parameters:

- `calories` (number)
- `carbs_g` (number)
- `fat_g` (number)
- `fiber_g` (number)
- `ingredients` (array): REPLACES the full ingredient list; totals recompute from it. Cannot be combined with top-level numeric fields.
- `log_id` (string, required): The item's `id` from get_today/get_day `recent` (type "food" only).
- `logged_time` (string): HH:MM 24h — time-of-day only; the log's DATE never changes.
- `meal` (string)
- `protein_g` (number)
- `sodium_mg` (number)
- `sugar_g` (number)
- `title` (string)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/app-trywhatevr-whatevr/api#diagnostics

## Score history

- 2026-11-05: 67
- 2026-11-04: 66
- 2026-11-03: 66
- 2026-11-02: 66
- 2026-11-01: 65
- 2026-10-31: 65
- 2026-10-30: 64
- 2026-10-29: 64
- 2026-10-28: 63
- 2026-10-27: 63
- 2026-10-26: 62
- 2026-10-25: 62

## Common questions

### What is the whatevr MCP server?

whatevr is an MCP server listed in the public MCP registry as app.trywhatevr/whatevr. Log meals and read calories and macros from any AI assistant. Pairs with the whatevr iPhone app. This page covers its hosted endpoint (https://api.trywhatevr.app/mcp).

### Is the whatevr MCP server safe to use?

whatevr scores 67 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the whatevr MCP server expose?

whatevr exposes 12 tools: log_anything, log_exercise, log_weight, log_water, get_today, and 7 more. Their descriptions and schemas cost roughly 1,954 tokens of context every time the server is loaded.

### Does the whatevr MCP server require authentication?

No. We connected to whatevr without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the whatevr MCP server still maintained?

whatevr is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://api.trywhatevr.app/mcp
- Website: https://trywhatevr.app/connect
- Changelog RSS feed: https://verifymcp.io/servers/app-trywhatevr-whatevr/api.xml
- Changelog JSON feed: https://verifymcp.io/servers/app-trywhatevr-whatevr/api.json
- HTML version of this page: https://verifymcp.io/servers/app-trywhatevr-whatevr/api