io.github.fliptheweb/fatsecret-mcp
NPM · FATSECRET-MCP
MCP server for FatSecret API - food search, nutrition, diary, recipes, weight tracking (unofficial)
Available components
Last scanned (4 hours ago)
Scores higher than 91% of npm servers
Category Health and Science
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to fliptheweb/fatsecret-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 4 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability74
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 3114 tokens (~70/item across 44 items; 44 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage80
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 41% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 5 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 45 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (16)
- Malware scan
- Known CVEs
- Install scripts
- Dependency health
- Source repository
- Provenance
- License
- Maintenance
- Security disclosure
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this package (2)
- Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
- Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 0
- Stability: 0.97 → pass security
- 3 Nov 26 0
- Stability: pass → 0.97 functional
- 1 Nov 26 −1
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Package version: 0.0.8 → 0.0.10 functional
- 28 Oct 26 +1
- Stability: 0.97 → pass security
- 27 Oct 26 −1
- Stability: pass → 0.97 functional
- 24 Oct 26 −5
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 21 Oct 26 +1
- Stability: 0.97 → pass security
- 20 Oct 26 −1
- Stability: pass → 0.97 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 6 Nov 2026 · Analysed npm/fatsecret-mcp@0.0.10
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | fliptheweb/fatsecret-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/fliptheweb/fatsecret-mcp/.github/workflows/publish.yml@refs/tags/v0.0.10 |
| Rekor log index | 3627715691 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:ed9f10c6db527016b7c2e82c60e1341d5b2d00a7561cf9092ef683dda8e0251b1fb79f85f71eb2cce8ea9faa9ad9c27df7293029563e465df0e9127e3 |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 95 packages
| Packages resolved | 95 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_favorite_recipe ~41
Add a recipe to the user's favorites. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| recipe_id | integer | yes | Recipe ID to add to favorites |
No output schema declared.
No examples provided.
add_saved_meal_item ~90
Add a food item to a saved meal. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| food_id | integer | yes | Food ID to add |
| number_of_units | number | yes | Number of serving units |
| saved_meal_id | integer | yes | Saved meal ID |
| saved_meal_item_name | string | yes | Item name |
| serving_id | integer | yes | Serving ID |
No output schema declared.
No examples provided.
autocomplete_foods ~54
Get autocomplete suggestions for a partial food search expression. Premier exclusive.
| Name | Type | Req | Description |
|---|---|---|---|
| expression | string | yes | Partial search expression |
| language | string | – | – |
| max_results | number | – | – |
| region | string | – | – |
No output schema declared.
No examples provided.
check_auth_status ~29
Check if API credentials and profile authentication are configured. Call this first to understand what setup is needed.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
complete_auth ~39
Complete the OAuth 1.0 flow with the verifier code from the authorization page.
| Name | Type | Req | Description |
|---|---|---|---|
| verifier | string | yes | OAuth verifier code from the authorization page |
No output schema declared.
No examples provided.
copy_food_entries ~67
Copy food entries from one date to another, optionally filtered by meal. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| from_date | string | yes | Source date YYYY-MM-DD |
| meal | string | – | Meal type |
| to_date | string | yes | Target date YYYY-MM-DD |
No output schema declared.
No examples provided.
copy_saved_meal_entries ~74
Copy entries from a saved meal to a meal on a specific date. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date in YYYY-MM-DD format (default today) |
| meal | string | yes | Meal type |
| saved_meal_id | integer | yes | Saved meal ID to copy |
No output schema declared.
No examples provided.
create_food ~259
Create a custom food with nutrition info. Premier exclusive. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| added_sugars | string | – | – |
| brand_name | string | yes | Brand name |
| calcium | string | – | – |
| calories | number | yes | Calories (kcal) |
| calories_from_fat | string | – | – |
| carbohydrate | number | yes | Total carbohydrate (g) |
| cholesterol | string | – | – |
| fat | number | yes | Total fat (g) |
| fiber | string | – | – |
| food_name | string | yes | Food name |
| iron | string | – | – |
| monounsaturated_fat | string | – | – |
| polyunsaturated_fat | string | – | – |
| potassium | string | – | – |
| protein | number | yes | Protein (g) |
| saturated_fat | string | – | – |
| serving_amount | string | – | – |
| serving_amount_unit | string | – | – |
| serving_size | string | yes | Serving size description (e.g. "1 slice") |
| sodium | string | – | – |
| sugar | string | – | – |
| trans_fat | string | – | – |
| vitamin_a | string | – | – |
| vitamin_c | string | – | – |
| vitamin_d | string | – | – |
No output schema declared.
No examples provided.
create_food_entry ~108
Add a food diary entry. Requires food_id, serving_id, and meal type. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date in YYYY-MM-DD format (default today) |
| food_entry_name | string | yes | Name for the food entry |
| food_id | integer | yes | Food ID |
| meal | string | yes | Meal type |
| number_of_units | number | yes | Number of serving units |
| serving_id | integer | yes | Serving size ID |
No output schema declared.
No examples provided.
create_saved_meal ~54
Create a new saved meal. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| meals | string | – | – |
| saved_meal_description | string | – | – |
| saved_meal_name | string | yes | Meal name |
No output schema declared.
No examples provided.
delete_favorite_food ~58
Remove a food from the user's favorites. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| food_id | integer | yes | Food ID to remove from favorites |
| number_of_units | string | – | – |
| serving_id | string | – | – |
No output schema declared.
No examples provided.
delete_favorite_recipe ~41
Remove a recipe from the user's favorites. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| recipe_id | integer | yes | Recipe ID to remove from favorites |
No output schema declared.
No examples provided.
delete_food_entry ~40
Delete a food diary entry by ID. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| food_entry_id | integer | yes | Food entry ID to delete |
No output schema declared.
No examples provided.
delete_saved_meal ~39
Delete a saved meal. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| saved_meal_id | integer | yes | Saved meal ID to delete |
No output schema declared.
No examples provided.
delete_saved_meal_item ~46
Remove a food item from a saved meal. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| saved_meal_item_id | integer | yes | Saved meal item ID to delete |
No output schema declared.
No examples provided.
edit_exercise_entries ~117
Shift exercise time between activities for a date. Moves minutes from one exercise to another. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date in YYYY-MM-DD format (default today) |
| kcal | number | – | – |
| minutes | integer | yes | Minutes to shift |
| shift_from_id | integer | yes | Exercise ID to shift time FROM |
| shift_from_name | string | – | – |
| shift_to_id | integer | yes | Exercise ID to shift time TO |
| shift_to_name | string | – | – |
No output schema declared.
No examples provided.
edit_food_entry ~79
Edit an existing food diary entry. Cannot change the date. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| food_entry_id | integer | yes | Food entry ID to edit |
| food_entry_name | string | – | – |
| meal | string | – | Meal type |
| number_of_units | number | – | – |
| serving_id | number | – | – |
No output schema declared.
No examples provided.
edit_saved_meal ~71
Edit a saved meal name, description, or associated meals. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| meals | string | – | – |
| saved_meal_description | string | – | – |
| saved_meal_id | integer | yes | Saved meal ID |
| saved_meal_name | string | – | – |
No output schema declared.
No examples provided.
edit_saved_meal_item ~73
Edit a food item in a saved meal (name or units). Cannot change serving_id. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| number_of_units | number | – | – |
| saved_meal_item_id | integer | yes | Saved meal item ID |
| saved_meal_item_name | string | – | – |
No output schema declared.
No examples provided.
find_food_by_barcode ~102
Find food by barcode (GTIN-13). UPC-A, EAN-13 and EAN-8 supported. Premier exclusive.
| Name | Type | Req | Description |
|---|---|---|---|
| barcode | string | yes | GTIN-13 barcode number |
| flag_default_serving | boolean | – | – |
| include_food_attributes | boolean | – | – |
| include_food_images | boolean | – | – |
| include_sub_categories | boolean | – | – |
| language | string | – | – |
| region | string | – | – |
No output schema declared.
No examples provided.
get_brands ~57
Get the list of food brands, optionally filtered by starting letter and type. Premier exclusive.
| Name | Type | Req | Description |
|---|---|---|---|
| brand_type | string | – | – |
| language | string | – | – |
| region | string | – | – |
| starts_with | string | – | – |
No output schema declared.
No examples provided.
get_exercise_entries_month ~48
Get daily calories expended from exercise for a month. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Any date within the target month (YYYY-MM-DD) |
No output schema declared.
No examples provided.
get_exercises ~30
Get the full list of supported exercise types and their IDs. Requires profile auth (check_auth_status first).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_favorite_foods ~26
Get the user's favorite foods. Requires profile auth (check_auth_status first).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_favorite_recipes ~26
Get the user's favorite recipes. Requires profile auth (check_auth_status first).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_food ~99
Get detailed nutritional information for a specific food by ID. Returns servings, calories, macros, and micronutrients.
| Name | Type | Req | Description |
|---|---|---|---|
| flag_default_serving | boolean | – | – |
| food_id | integer | yes | Food ID |
| include_food_attributes | boolean | – | – |
| include_food_images | boolean | – | – |
| include_sub_categories | boolean | – | – |
| language | string | – | – |
| page_number | number | – | – |
| region | string | – | – |
No output schema declared.
No examples provided.
get_food_categories ~34
Get the full list of food categories. Premier exclusive.
| Name | Type | Req | Description |
|---|---|---|---|
| language | string | – | – |
| region | string | – | – |
No output schema declared.
No examples provided.
get_food_entries ~61
Get food diary entries for a date or a specific entry by ID. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date in YYYY-MM-DD (required if food_entry_id not specified) |
| food_entry_id | number | – | – |
No output schema declared.
No examples provided.
get_food_entries_month ~51
Get daily nutrition summary for a month. Returns calories and macros per day. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Any date within the target month (YYYY-MM-DD) |
No output schema declared.
No examples provided.
get_food_sub_categories ~49
Get food sub categories for a given food category. Premier exclusive.
| Name | Type | Req | Description |
|---|---|---|---|
| food_category_id | integer | yes | Food category ID |
| language | string | – | – |
| region | string | – | – |
No output schema declared.
No examples provided.
get_most_eaten_foods ~43
Get the user's most eaten foods, optionally filtered by meal. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| meal | string | – | Meal type |
No output schema declared.
No examples provided.
get_profile ~26
Get profile status information for the authenticated user. Requires profile auth (check_auth_status first).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_recently_eaten_foods ~43
Get the user's recently eaten foods, optionally filtered by meal. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| meal | string | – | Meal type |
No output schema declared.
No examples provided.
get_recipe ~48
Get detailed recipe information by ID including ingredients, directions, and nutrition.
| Name | Type | Req | Description |
|---|---|---|---|
| max_results | number | – | – |
| page_number | number | – | – |
| recipe_id | integer | yes | Recipe ID |
No output schema declared.
No examples provided.
get_recipe_types ~19
Get the full list of supported recipe type names.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_saved_meal_items ~42
Get all food items in a saved meal. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| saved_meal_id | integer | yes | Saved meal ID |
No output schema declared.
No examples provided.
get_saved_meals ~42
Get the user's saved meals, optionally filtered by meal type. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| meal | string | – | Filter by meal type |
No output schema declared.
No examples provided.
get_weight_month ~44
Get the user's weight entries for a month. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Any date within the target month (YYYY-MM-DD) |
No output schema declared.
No examples provided.
save_exercise_template ~80
Save the current day's exercise entries as a template for specified days of the week. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Date in YYYY-MM-DD format (default today) |
| days | integer | yes | Days of week as bit flags (Sun=bit 1, Sat=bit 7), converted to int |
No output schema declared.
No examples provided.
search_foods ~135
Search the FatSecret food database. Returns food names, descriptions, and basic nutrition info. On the Basic plan only search_expression, page_number and max_results (max 50) are used.
| Name | Type | Req | Description |
|---|---|---|---|
| flag_default_serving | boolean | – | – |
| food_type | string | – | – |
| include_food_attributes | boolean | – | – |
| include_food_images | boolean | – | – |
| include_sub_categories | boolean | – | – |
| language | string | – | – |
| max_results | number | – | – |
| page_number | number | – | – |
| region | string | – | – |
| search_expression | string | yes | Search query for foods |
No output schema declared.
No examples provided.
search_recipes ~177
Search recipes with optional filters for calories, macros, prep time, and recipe types.
| Name | Type | Req | Description |
|---|---|---|---|
| calories.from | number | – | – |
| calories.to | number | – | – |
| carb_percentage.from | number | – | – |
| carb_percentage.to | number | – | – |
| fat_percentage.from | number | – | – |
| fat_percentage.to | number | – | – |
| max_results | number | – | – |
| must_have_images | boolean | – | – |
| page_number | number | – | – |
| prep_time.from | number | – | – |
| prep_time.to | number | – | – |
| protein_percentage.from | number | – | – |
| protein_percentage.to | number | – | – |
| recipe_types | string | – | – |
| recipe_types_matchall | boolean | – | – |
| search_expression | string | – | Search query for recipes |
| sort_by | string | – | – |
No output schema declared.
No examples provided.
setup_credentials ~109
Configure FatSecret API credentials. Get them at https://platform.fatsecret.com/ → My Account → API Keys. Saves to persistent config file.
| Name | Type | Req | Description |
|---|---|---|---|
| client_id | string | yes | FatSecret Client ID (from platform.fatsecret.com → API Keys) |
| client_secret | string | yes | FatSecret Client Secret (OAuth 2.0) |
| consumer_secret | string | yes | FatSecret Consumer Secret (OAuth 1.0 — different from Client Secret, found on the same API Keys page) |
No output schema declared.
No examples provided.
start_auth ~38
Start the OAuth 1.0 authorization flow for profile access. Returns an authorization URL the user must visit. Requires API credentials (setup_credentials first).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
update_weight ~110
Record the user's weight for a date. First weigh-in requires goal_weight_kg and current_height_cm. Requires profile auth (check_auth_status first).
| Name | Type | Req | Description |
|---|---|---|---|
| comment | string | – | – |
| current_height_cm | number | – | – |
| current_weight_kg | number | yes | Current weight in kg |
| date | string | – | Date in YYYY-MM-DD format (default today) |
| goal_weight_kg | number | – | – |
| height_type | string | – | – |
| weight_type | string | – | – |
No output schema declared.
No examples provided.
How do I install the io.github.fliptheweb/fatsecret-mcp server?
io.github.fliptheweb/fatsecret-mcp runs locally as an npm package, launched with npx -y fatsecret-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · fatsecret-mcp
claude mcp add fliptheweb-fatsecret-mcp -- npx -y fatsecret-mcp
What is the io.github.fliptheweb/fatsecret-mcp server?
io.github.fliptheweb/fatsecret-mcp is listed in the public MCP registry as io.github.fliptheweb/fatsecret-mcp. MCP server for FatSecret API - food search, nutrition, diary, recipes, weight tracking (unofficial). This page covers its npm package (fatsecret-mcp).
Is the io.github.fliptheweb/fatsecret-mcp server safe to use?
io.github.fliptheweb/fatsecret-mcp scores 87 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 6 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.fliptheweb/fatsecret-mcp server expose?
io.github.fliptheweb/fatsecret-mcp exposes 44 tools: search_foods, get_food, find_food_by_barcode, autocomplete_foods, search_recipes, and 39 more. Their descriptions and schemas cost roughly 2,918 tokens of context every time the server is loaded.
Is the io.github.fliptheweb/fatsecret-mcp server still maintained?
io.github.fliptheweb/fatsecret-mcp is still listed as active in the MCP registry. We last reached this channel on 6 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.fliptheweb/fatsecret-mcp server under?
io.github.fliptheweb/fatsecret-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.
What did VerifyMCP test on the io.github.fliptheweb/fatsecret-mcp server?
VerifyMCP ran 16 checks on io.github.fliptheweb/fatsecret-mcp, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.