# io.github.markswendsen-code/grubhub (npm · @striderlabs/mcp-grubhub)

MCP server for GrubHub - let AI agents order food and manage restaurant delivery autonomously

- Trust score: 69/100 (medium)
- Change this week: +45
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@striderlabs/mcp-grubhub`: 69/100 (this document), [markdown](https://verifymcp.io/servers/markswendsen-code-grubhub/striderlabs-mcp-grubhub.md), [page](https://verifymcp.io/servers/markswendsen-code-grubhub/striderlabs-mcp-grubhub)

## Channel facts

- Registry: `npm`
- Package: `@striderlabs/mcp-grubhub`
- Version: `0.1.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (97 of 101), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (97 of 101), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 47 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 549 tokens (~45/item across 12 items; 12 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add markswendsen-code-grubhub -- npx -y @striderlabs/mcp-grubhub
```

### Codex

```bash
codex mcp add markswendsen-code-grubhub -- npx -y @striderlabs/mcp-grubhub
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "markswendsen-code-grubhub": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@striderlabs/mcp-grubhub"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add markswendsen-code-grubhub --command npx --arg -y --arg @striderlabs/mcp-grubhub
```

### Hermes

```yaml
mcp_servers:
  markswendsen-code-grubhub:
    command: "npx"
    args: ["-y", "@striderlabs/mcp-grubhub"]
```

### Other

```json
{
  "mcpServers": {
    "markswendsen-code-grubhub": {
      "command": "npx",
      "args": [
        "-y",
        "@striderlabs/mcp-grubhub"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 69, +3)

- [functional improvement] Stability: unverified → 0.23

### 2026-08-02 (score 66, +45)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] Security disclosure: fail → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: MIT

### 2026-08-01 (score 21, +16)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-31 (score 5, −3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 8, −38)

- [security regression] Malware scan: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial

### 2026-07-28 (score 46, +22)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: unverified
- [functional] First check of Schema quality: pass

### 2026-07-27 (score 24)

First indexed and scored.

## MCP tools (12)

### `grubhub_status` (~40 tokens)

Check if the user is logged in to Grubhub. Returns auth status and instructions if not authenticated. Call this before any other Grubhub operations.

### `grubhub_login` (~55 tokens)

Log in to Grubhub with email and password via browser automation. Session is saved for future use.

Input parameters:

- `email` (string, required): Grubhub account email address
- `password` (string, required): Grubhub account password

### `grubhub_logout` (~26 tokens)

Clear the stored Grubhub session. The user will need to log in again.

### `grubhub_set_address` (~54 tokens)

Set the delivery address for Grubhub orders. Must be set before searching for restaurants.

Input parameters:

- `address` (string, required): Full delivery address (e.g., '123 Main St, New York, NY 10001')

### `grubhub_search_restaurants` (~84 tokens)

Search for restaurants on Grubhub by name, food type, or cuisine. Returns a list of restaurants with ratings, delivery times, and fees.

Input parameters:

- `cuisine` (string): Filter by cuisine type (e.g., 'pizza', 'chinese', 'mexican')
- `query` (string, required): Search query — restaurant name, food type, or keyword

### `grubhub_get_restaurant` (~48 tokens)

Get full details for a restaurant: menu categories, items with prices, hours, and address.

Input parameters:

- `restaurantId` (string, required): The restaurant ID or URL slug (from search results)

### `grubhub_add_to_cart` (~77 tokens)

Add a menu item to the cart.

Input parameters:

- `itemName` (string, required): Name of the menu item to add
- `quantity` (number): Quantity to add (default: 1)
- `restaurantId` (string, required): The restaurant ID (from search results)
- `specialInstructions` (string): Special preparation instructions (optional)

### `grubhub_view_cart` (~23 tokens)

View current cart contents, including items, quantities, and totals.

### `grubhub_clear_cart` (~18 tokens)

Remove all items from the current cart.

### `grubhub_checkout` (~50 tokens)

Proceed to checkout. Set confirm=false to preview order details before placing; set confirm=true to actually place the order.

Input parameters:

- `confirm` (boolean, required): Set to true to place the order, false to preview

### `grubhub_track_order` (~52 tokens)

Track the status of an active Grubhub order — delivery progress, estimated time, and driver info.

Input parameters:

- `orderId` (string): Order ID to track (optional — defaults to most recent active order)

### `grubhub_get_orders` (~22 tokens)

Get Grubhub order history — past and active orders.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/markswendsen-code-grubhub/striderlabs-mcp-grubhub#diagnostics

## Score history

- 2026-08-03: 69
- 2026-08-02: 66
- 2026-08-01: 21
- 2026-07-31: 5
- 2026-07-30: 8
- 2026-07-28: 46
- 2026-07-27: 24

## Links

- npm package: https://www.npmjs.com/package/@striderlabs/mcp-grubhub
- Socket report: https://socket.dev/npm/package/@striderlabs/mcp-grubhub
- Repository: https://github.com/markswendsen-code/mcp-grubhub
- Changelog RSS feed: https://verifymcp.io/servers/markswendsen-code-grubhub/striderlabs-mcp-grubhub/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/markswendsen-code-grubhub/striderlabs-mcp-grubhub/changelog.json
- HTML version of this page: https://verifymcp.io/servers/markswendsen-code-grubhub/striderlabs-mcp-grubhub