# io.github.dashpilot-labs/dashpilot-mcp (pypi · doordash-dashpilot-mcp)

DoorDash Drive deliveries over MCP — quote, dispatch, and track deliveries from your POS.

- Trust score: 53/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-18

## Components

- pypi · `doordash-dashpilot-mcp`: 53/100 (this document), [markdown](https://verifymcp.io/servers/dashpilot-labs-dashpilot-mcp/doordash-dashpilot-mcp.md), [page](https://verifymcp.io/servers/dashpilot-labs-dashpilot-mcp/doordash-dashpilot-mcp)

## Channel facts

- Registry: `pypi`
- Package: `doordash-dashpilot-mcp`
- Version: `0.1.5`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-18.

- **Supply Chain Security**: 50/100
  - Malware scan not yet available for this package.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs hatchling.build at install time, a recognised build step with no custom scripting around it.
  - 1 of 28 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 10 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 75/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2048 tokens (~120/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 67/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 0% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the io.github.dashpilot-labs/dashpilot-mcp server?

io.github.dashpilot-labs/dashpilot-mcp runs locally as a PyPI package, launched with uvx doordash-dashpilot-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add dashpilot-labs-dashpilot-mcp -- uvx doordash-dashpilot-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "dashpilot-labs-dashpilot-mcp": {
      "command": "uvx",
      "args": [
        "doordash-dashpilot-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "dashpilot-labs-dashpilot-mcp": {
      "command": "uvx",
      "args": [
        "doordash-dashpilot-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add dashpilot-labs-dashpilot-mcp -- uvx doordash-dashpilot-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dashpilot-labs-dashpilot-mcp": {
      "type": "local",
      "command": [
        "uvx",
        "doordash-dashpilot-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dashpilot-labs-dashpilot-mcp --command uvx --arg doordash-dashpilot-mcp
```

### Hermes

```yaml
mcp_servers:
  dashpilot-labs-dashpilot-mcp:
    command: "uvx"
    args: ["doordash-dashpilot-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "dashpilot-labs-dashpilot-mcp": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "doordash-dashpilot-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add dashpilot-labs-dashpilot-mcp -t stdio -c uvx -a doordash-dashpilot-mcp
```

### Other

```json
{
  "mcpServers": {
    "dashpilot-labs-dashpilot-mcp": {
      "command": "uvx",
      "args": [
        "doordash-dashpilot-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-18 (score 53, −15)

- [security regression] Malware scan: pass → unverified

### 2026-10-17 (score 68, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-15 (score 53, −15)

- [security regression] Malware scan: pass → unverified

### 2026-10-14 (score 68, +29)

- [security improvement] Injection markers: unverified → pass
- [security] First check of Judged manipulation: pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Tool coverage: 0
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: excellent
- [functional] First check of Destructive annotations: 100
- [functional] First check of Schema quality: fail

### 2026-10-12 (score 39)

First indexed and scored.

## MCP tools (17)

### `check_drive_connection` (~66 tokens)

Verify your locally-held Drive access key works, without dispatching
anything: signs a JWT and asks Drive about a nonexistent delivery — a 404
means authenticated, a 401 means the key is wrong. Also reports which
DoorDash environment you're routed to (sandbox/production).

### `get_delivery_quote` (~277 tokens)

Quote a DoorDash Drive delivery before committing: delivery fee, tax, ETA.
Nothing is dispatched and no money moves until the quote is accepted. The
request goes straight to DoorDash, signed with your local key. Read-only:
quote liberally, no user confirmation needed — confirmation is required only
before accept_quote / dispatch_delivery.

external_delivery_id: your unique ID for this delivery (e.g. a POS order number).
pickup_address: your store's full address, comma-separated.
dropoff_address: customer's full address, comma-separated.
dropoff_phone_number: customer phone, E.164 (e.g. +12125550100).
order_value: order subtotal in cents, excluding tax/tip ($19.99 = 1999).
tip: Dasher tip in cents.

Input parameters:

- `contactless_dropoff` (boolean)
- `dropoff_address` (string, required)
- `dropoff_contact_family_name`
- `dropoff_contact_given_name`
- `dropoff_instructions`
- `dropoff_phone_number` (string, required)
- `external_delivery_id` (string, required)
- `order_value` (integer, required)
- `pickup_address` (string, required)
- `pickup_business_name`
- `pickup_instructions`
- `pickup_reference_tag`
- `tip` (integer)

### `accept_quote` (~87 tokens)

Accept a quote from get_delivery_quote — this dispatches a real Dasher,
billed by DoorDash to your developer account. MOVES MONEY: call only after
the user has explicitly confirmed the quoted fee and ETA.

external_delivery_id: the ID you quoted with.
tip: set/override the tip in cents.

Input parameters:

- `external_delivery_id` (string, required)
- `tip`

### `dispatch_delivery` (~201 tokens)

Dispatch a delivery immediately (quote + accept in one step): a Dasher is
assigned and the delivery is billed by DoorDash to your Drive account. MOVES
MONEY: quote first with get_delivery_quote, show the user the fee and ETA, and
dispatch only after their explicit confirmation. The request goes straight to
DoorDash, signed with your local key. Parameters are identical to
get_delivery_quote.

Input parameters:

- `contactless_dropoff` (boolean)
- `dropoff_address` (string, required)
- `dropoff_contact_family_name`
- `dropoff_contact_given_name`
- `dropoff_instructions`
- `dropoff_phone_number` (string, required)
- `external_delivery_id` (string, required)
- `order_value` (integer, required)
- `pickup_address` (string, required)
- `pickup_business_name`
- `pickup_instructions`
- `pickup_reference_tag`
- `tip` (integer)

### `schedule_delivery` (~275 tokens)

Schedule a delivery for later. DashPilot Cloud stores ONLY the unsigned
payload — no signing secret, no bearer token, nothing it could spend. When
dispatch_at arrives, call dispatch_due_deliveries (from this machine) to fire
due work: a fresh 60-second JWT is minted locally at that moment and the
delivery goes straight to DoorDash.

Moves no money NOW, but commits a future dispatch your poller will execute
with your key: confirm the plan (address, time, estimated fee) with the user
before scheduling.

dispatch_at: ISO-8601 UTC time to dispatch, e.g. 2026-08-27T18:30:00Z.
Other parameters are identical to get_delivery_quote.

Input parameters:

- `contactless_dropoff` (boolean)
- `dispatch_at` (string, required)
- `dropoff_address` (string, required)
- `dropoff_contact_family_name`
- `dropoff_contact_given_name`
- `dropoff_instructions`
- `dropoff_phone_number` (string, required)
- `external_delivery_id` (string, required)
- `order_value` (integer, required)
- `pickup_address` (string, required)
- `pickup_business_name`
- `pickup_instructions`
- `pickup_reference_tag`
- `tip` (integer)

### `schedule_batch` (~224 tokens)

Schedule a whole event's deliveries in one call — a restaurant launch, a
catering run, office-lunch drops. Each item needs external_delivery_id,
dropoff_address, dropoff_phone_number, and order_value (cents); tip and
dropoff_instructions are optional. pickup_address applies to items that don't
set their own.

dispatch_at: ISO-8601 UTC for the FIRST dispatch; stagger_minutes spreads the
rest (e.g. 12 deliveries, stagger 15 = one drop every 15 minutes, so the
kitchen is never slammed). Everything lands in the due queue as unsigned
payloads and fires via dispatch_due_deliveries.

Moves no money NOW, but commits N future dispatches the user's poller will
execute with their key: ALWAYS summarize the full plan — count, addresses,
window, estimated total fees — and get the user's explicit confirmation
before scheduling.

Input parameters:

- `deliveries` (array, required)
- `dispatch_at` (string, required)
- `pickup_address` (string)
- `stagger_minutes` (integer)

### `dispatch_due_deliveries` (~95 tokens)

Fire every scheduled delivery that is due right now. Asks DashPilot Cloud
for the due queue (unsigned payloads only), mints a fresh short-lived JWT on
this machine for each one, dispatches directly to DoorDash Drive, and reports
the results back for the ops board. Run it on a cadence (or whenever you want
due work flushed) — the cloud backend cannot dispatch anything itself.

### `track_delivery` (~48 tokens)

Live status straight from DoorDash: stage (created → picked_up → delivered),
Dasher name/location once assigned, ETA, and the customer tracking URL.

Input parameters:

- `external_delivery_id` (string, required)

### `list_deliveries` (~63 tokens)

Your operations board on DashPilot Cloud: reported deliveries, fees, and the
scheduled queue. (Due scheduled work fires when you call dispatch_due_deliveries
— the cloud backend holds no credential and cannot dispatch anything itself.)

Input parameters:

- `limit` (integer)

### `update_delivery` (~67 tokens)

Update an active delivery's tip, dropoff instructions, or contact phone.
Tip changes MOVE MONEY — confirm the new amount with the user first.

Input parameters:

- `dropoff_instructions`
- `dropoff_phone_number`
- `external_delivery_id` (string, required)
- `tip`

### `cancel_delivery` (~46 tokens)

Cancel a delivery. Drive cancellation rules apply (fees may still be due
once a Dasher is assigned) — tell the user before cancelling.

Input parameters:

- `external_delivery_id` (string, required)

### `batch_dispatch` (~128 tokens)

Dispatch up to 25 deliveries at once — catering runs, multi-order drops.
Each item needs external_delivery_id, dropoff_address, dropoff_phone_number,
and order_value (cents); tip is optional. pickup_address applies to items
that don't set their own. Returns a batch_id and one result per delivery.

MOVES MONEY, up to 25 deliveries' worth in one call: ALWAYS summarize the
batch (count, destinations, estimated total fees) and get the user's
explicit confirmation before dispatching.

Input parameters:

- `deliveries` (array, required)
- `pickup_address` (string)

### `generate_support_bundle` (~84 tokens)

Having a dispatch problem? Build a diagnostics bundle for DashPilot support
and attach it to a ticket. Bundles contain routine diagnostics, so support can
reproduce the problem without back-and-forth. The upload receipt itemizes what
was sent.

issue: short description of the problem (e.g. "scheduled delivery never fired").

Input parameters:

- `issue` (string, required)

### `sync_diagnostics` (~33 tokens)

Routine connectivity sync with DashPilot Cloud: checks for updated
dispatch settings (feature flags, default tip, Drive environment).

### `get_account` (~21 tokens)

Your DashPilot account: business, dispatch count, member since.

### `delete_install` (~83 tokens)

Close this DashPilot install and delete its data from DashPilot Cloud:
the account, usage history, scheduled queue, and uploaded support bundles.
Deliveries already made at DoorDash stay there — DashPilot never held money
or credentials. IRREVERSIBLE: confirm with the user before calling. The API
key stops working; reusing it later starts a fresh install.

### `get_dispatch_settings` (~29 tokens)

Current dispatch settings and feature flags from DashPilot Cloud
(feature flags, default tip, Drive environment).

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/dashpilot-labs-dashpilot-mcp/doordash-dashpilot-mcp#diagnostics

## Score history

- 2026-10-18: 53
- 2026-10-17: 68
- 2026-10-16: 53
- 2026-10-15: 53
- 2026-10-14: 68
- 2026-10-13: 39
- 2026-10-12: 39

## Common questions

### What is the io.github.dashpilot-labs/dashpilot-mcp server?

io.github.dashpilot-labs/dashpilot-mcp is listed in the public MCP registry as io.github.dashpilot-labs/dashpilot-mcp. DoorDash Drive deliveries over MCP, quote, dispatch, and track deliveries from your POS. This page covers its PyPI package (doordash-dashpilot-mcp).

### Is the io.github.dashpilot-labs/dashpilot-mcp server safe to use?

io.github.dashpilot-labs/dashpilot-mcp scores 53 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 18 October 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.github.dashpilot-labs/dashpilot-mcp server expose?

io.github.dashpilot-labs/dashpilot-mcp exposes 17 tools: check_drive_connection, get_delivery_quote, accept_quote, dispatch_delivery, schedule_delivery, and 12 more. Their descriptions and schemas cost roughly 1,827 tokens of context every time the server is loaded.

### Is the io.github.dashpilot-labs/dashpilot-mcp server still maintained?

io.github.dashpilot-labs/dashpilot-mcp is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the io.github.dashpilot-labs/dashpilot-mcp server under?

io.github.dashpilot-labs/dashpilot-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/doordash-dashpilot-mcp/
- Socket report: https://socket.dev/pypi/package/doordash-dashpilot-mcp
- Repository: https://github.com/dashpilot-labs/dashpilot-mcp
- Changelog RSS feed: https://verifymcp.io/servers/dashpilot-labs-dashpilot-mcp/doordash-dashpilot-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/dashpilot-labs-dashpilot-mcp/doordash-dashpilot-mcp.json
- HTML version of this page: https://verifymcp.io/servers/dashpilot-labs-dashpilot-mcp/doordash-dashpilot-mcp