# io.github.cyanheads/usda-mcp-server (npm · @cyanheads/usda-mcp-server)

Search foods, compare nutrients, and look up the full USDA FoodData Central database.

- Trust score: 66/100 (medium)
- Change this week: +61
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-07

## Components

- npm · `@cyanheads/usda-mcp-server`: 66/100 (this document), [markdown](https://verifymcp.io/servers/cyanheads-usda-mcp-server/cyanheads-usda-mcp-server.md), [page](https://verifymcp.io/servers/cyanheads-usda-mcp-server/cyanheads-usda-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@cyanheads/usda-mcp-server`
- Version: `0.1.6`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-07.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Known CVEs were checked across the 125 of 132 dependencies we could resolve, so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Dependency health was assessed across the 125 of 132 dependencies we could resolve, so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 47 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 79/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1441 tokens (~240/item across 6 items; 5 tools + 1 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add cyanheads-usda-mcp-server -- npx -y @cyanheads/usda-mcp-server
```

### Codex

```bash
codex mcp add cyanheads-usda-mcp-server -- npx -y @cyanheads/usda-mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cyanheads-usda-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@cyanheads/usda-mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add cyanheads-usda-mcp-server --command npx --arg -y --arg @cyanheads/usda-mcp-server
```

### Hermes

```yaml
mcp_servers:
  cyanheads-usda-mcp-server:
    command: "npx"
    args: ["-y", "@cyanheads/usda-mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "cyanheads-usda-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/usda-mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-06 (score 66, +31)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: fail

### 2026-08-02 (score 35, +14)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security] Stability: Stability not yet verified: our sandbox run of this package did not complete, so we have no schema to compare.
- [functional regression] Dependency health: partial → unverified
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional] Capabilities: Protocol version not yet verified: our sandbox run of this package did not complete, so we never saw its MCP handshake.
- [functional] Tool coverage: Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess.
- [functional] Schema quality: Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess.
- [functional] Licence: Apache-2.0

### 2026-08-01 (score 21, +16)

- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional improvement] Dependency health: unverified → partial
- [functional] Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- [functional] Capabilities: Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet.
- [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.

### 2026-07-31 (score 5, −1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 6, −40)

- [security regression] Install scripts: pass → unverified
- [security regression] Provenance: fail → unverified
- [security regression] Known CVEs: partial → unverified
- [security regression] Malware scan: pass → unverified
- [functional regression] Maintenance: pass → unverified
- [functional regression] Dependency health: partial → unverified
- [functional regression] License: pass → unverified
- [functional] Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional] Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.
- [functional] Licence: Apache-2.0

### 2026-07-28 (score 46, +21)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional] Tool coverage: Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess.
- [functional] Schema quality: Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess.
- [functional] Licence: Apache-2.0

### 2026-07-27 (score 25)

First indexed and scored.

## MCP tools (5)

### `usda_list_nutrients` (~154 tokens)

List USDA Nutrients

Look up the FDC nutrient reference table — all tracked nutrients with their numeric IDs, names, SR reference numbers, units, and categories. Use to resolve a nutrient name (e.g. "vitamin C") to its FDC ID (1162) before passing it to the nutrients[] filter on other tools. Filter by category (macronutrients, vitamins, minerals, lipids, amino_acids, or other) to narrow results. The data is static — call once and reuse the IDs.

Input parameters:

- `category` (string): Filter to a nutrient category. Omit to return all ~150 tracked nutrients. Options: macronutrients, vitamins, minerals, lipids, amino_acids, other.

Output parameters:

- `nutrients` (array): Nutrient reference entries matching the requested category, or all if category is omitted.

### `usda_search_foods` (~319 tokens)

Search USDA Foods

Search USDA FoodData Central foods by keyword. Returns matching foods with FDC IDs and a preview of key nutrients (energy, protein, fat, carbs — not guaranteed complete). Use the returned fdcId with usda_get_food for the full nutrient profile, or usda_compare_foods for side-by-side comparisons. Defaults to SR Legacy (common whole foods with complete profiles); set dataType to ["Branded"] for packaged products, or include a UPC/GTIN code as the query. Pass brandOwner (e.g. "General Mills") to narrow branded results.

Input parameters:

- `brandOwner` (string): Filter branded results by brand owner name (e.g. "General Mills", "Kraft"). Only meaningful when Branded is in dataType.
- `dataType` (array): FDC data sources to search. Defaults to ["SR Legacy"] (common whole foods, complete nutrient profiles). Include "Branded" for packaged products. Multiple values allowed.
- `foodCategory` (string): Filter by USDA food category (e.g. "Poultry Products", "Vegetables and Vegetable Products"). Case-sensitive.
- `pageNumber` (integer): Page number (1-based). Use with totalPages to paginate.
- `pageSize` (integer): Number of results per page. Default 10, maximum 50.
- `query` (string, required): Search terms — food name, ingredient, or UPC/GTIN code for branded products. Examples: "chicken breast raw", "banana", "012345678901".

Output parameters:

- `currentPage` (number): Current page number (1-based).
- `foods` (array): Foods matching the search query.
- `totalCount` (number): Total foods matching the query across all pages.
- `totalHits` (number): Total number of foods matching the query across all pages.
- `totalPages` (number): Total number of pages available.

### `usda_get_food` (~279 tokens)

Get USDA Food

Get the full nutrient profile for one food by FDC ID. Returns all available nutrients (or a filtered subset via the nutrients[] param) with optional per-portion scaling. Use usda_search_foods to discover FDC IDs. Provide quantity + unit to scale all nutrient values from per-100g to the specified portion (e.g. quantity=200, unit="g" → per-200g values). Use unit="serving" to scale to the food's first defined portion weight. Narrow nutrients[] to specific IDs to reduce response size for focused queries.

Input parameters:

- `fdcId` (integer, required): FDC ID of the food. Use usda_search_foods to discover IDs.
- `nutrients` (array): Filter to specific nutrient IDs (e.g. [1003, 1004, 1005, 1008] for protein, fat, carbs, energy). Use usda_list_nutrients to look up IDs. Omit to return all available nutrients.
- `quantity` (number): Amount of food to scale nutrient values to. Must be positive. When provided, unit is required. Omit for per-100g values (FDC database native basis).
- `unit` (string): Unit for quantity. "serving" uses the food's first defined portion weight. Required when quantity is provided.

Output parameters:

- `allPortions` (array): All named portions for this food.
- `brandName` (string): Brand name. Branded items only.
- `brandOwner` (string): Brand owner. Branded items only.
- `dataType` (string): FDC data source: SR Legacy, Foundation, Survey (FNDDS), or Branded.
- `description` (string): Full USDA food name (e.g. "Chicken, broilers or fryers, breast, meat only, raw").
- `fdcId` (number): FDC ID of the food.
- `foodCategory` (string): USDA food category (e.g. "Poultry Products"). Absent for some branded items.
- `ingredients` (string): Ingredient list from label. Branded items only.
- `nutrients` (array): Nutrient values for this food, per 100g or scaled to the requested quantity.
- `publicationDate` (string): Date this food entry was published in FDC.
- `scaledTo` (object): Scaling basis when quantity+unit were provided. Absent when returning per-100g values.
- `servingInfo` (object): First available portion definition, if present.

### `usda_get_foods` (~198 tokens)

Get USDA Foods (Batch)

Fetch nutrient profiles for 2–20 foods in a single API call. More efficient than calling usda_get_food N times when you already have multiple FDC IDs. All values are per 100g (no portion scaling). Use the nutrients[] filter to limit response size — strongly recommended for batch calls. For side-by-side comparison with a formatted table, use usda_compare_foods instead. Failed IDs (not found or no data) are reported in the failed[] array rather than aborting the entire batch.

Input parameters:

- `fdcIds` (array, required): FDC IDs to fetch — 2 to 20 IDs. Use usda_search_foods to discover IDs.
- `nutrients` (array): Filter to specific nutrient IDs (e.g. [1003, 1004, 1005, 1008]). Strongly recommended — full profiles can be large. Use usda_list_nutrients to look up IDs.

Output parameters:

- `failed` (array): IDs that returned no data. Check these with usda_search_foods to verify they exist.
- `foods` (array): Successfully fetched foods.

### `usda_compare_foods` (~348 tokens)

Compare USDA Foods

Compare nutrients side-by-side for 2–5 foods. Returns a structured table — one row per nutrient, one column per food — formatted as markdown. Best for "spinach vs kale iron" or "which has more protein?" questions. Omit nutrients[] to use the 12 most common defaults (energy, protein, fat, saturated fat, carbs, fiber, sugars, sodium, potassium, calcium, iron, vitamin C); provide nutrients[] with specific FDC IDs to compare different nutrients. All values are scaled to the same gram basis (default 100g). If one or more FDC IDs are not found, the comparison proceeds with the valid foods — only throws too_few_foods when fewer than 2 IDs return data.

Input parameters:

- `fdcIds` (array, required): FDC IDs to compare — 2 to 5 foods. Use usda_search_foods to discover IDs.
- `nutrients` (array): Nutrient IDs to include in the comparison. Defaults to the 12 most common: energy (1008), protein (1003), total fat (1004), saturated fat (1258), carbohydrate (1005), fiber (1079), sugars (1063), sod…
- `quantity` (number): Gram basis for comparison. All values scaled to this amount. Must be positive. Default 100.
- `unit` (string): Unit for quantity. Default "g". Does not support "serving" (use a fixed gram basis for consistent comparison).

Output parameters:

- `basis` (object): The common scaling basis applied to all nutrient values.
- `foods` (array): The compared foods, in the same order as the values arrays below.
- `missingData` (array): Foods or food+nutrient pairs where data was unavailable. Absent when all data was present.
- `nutrients` (array): Nutrient rows — one entry per requested nutrient, with per-food values in the values[] array.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/cyanheads-usda-mcp-server/cyanheads-usda-mcp-server#diagnostics

## Score history

- 2026-08-07: 66
- 2026-08-06: 66
- 2026-08-05: 35
- 2026-08-04: 35
- 2026-08-03: 35
- 2026-08-02: 35
- 2026-08-01: 21
- 2026-07-31: 5
- 2026-07-30: 6
- 2026-07-29: 46
- 2026-07-28: 46
- 2026-07-27: 25

## Links

- npm package: https://www.npmjs.com/package/@cyanheads/usda-mcp-server
- Socket report: https://socket.dev/npm/package/@cyanheads/usda-mcp-server
- Repository: https://github.com/cyanheads/usda-mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/cyanheads-usda-mcp-server/cyanheads-usda-mcp-server.xml
- Changelog JSON feed: https://verifymcp.io/servers/cyanheads-usda-mcp-server/cyanheads-usda-mcp-server.json
- HTML version of this page: https://verifymcp.io/servers/cyanheads-usda-mcp-server/cyanheads-usda-mcp-server