CellarTracker
NPM · CELLARTRACKER-MCP
Read-only access to your CellarTracker wine cellar: inventory, drinking windows, purchases, notes.
Available components
Last scanned (21 hours ago)
Scores higher than 99% of npm servers
Category Productivity and Notes
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to slavins-co/cellartracker-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 22 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability87
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1611 tokens (~73/item across 22 items; 13 tools + 9 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 27 Oct 26 0
- Stability: 0.97 → pass security
- 26 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 25 Oct 26 −1
- Stability: pass → 0.93 functional
- 17 Oct 26 +1
- Stability: 0.90 → pass security
- 16 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Oct 26 +46
- Injection markers: unverified → pass ▲ security
- Tool coverage: unverified → 100 ▲ functional
- Stability: unverified → 0.83 ▲ functional
- Schema quality: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- 13 Oct 26 0
- Package version: 0.5.2 → 0.5.4 functional
- 11 Oct 26 −47
- Stability: 0.93 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Package version: 0.5.1 → 0.5.2 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/cellartracker-mcp@0.5.4
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | slavins-co/cellartracker-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/slavins-co/cellartracker-mcp/.github/workflows/publish.yml@refs/tags/v0.5.4 |
| Rekor log index | 3238183154 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:844d9eb2cc3f2943b56edcb57dacbae97e6da27768639c7e2c2f0c46753346043d5931c3614505f0dafeac04b062f21930fa6251c59d5aa0d91fd1e4a |
Background: How many MCP packages publish verified provenance →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
bottle-details ~304
Look up individual bottles from the Bottles table — the per-bottle view spanning both in-cellar and consumed bottles, with barcode, exact location/bin, and size. Filter by wine name, location, bin, size, or barcode; set state to 'cellar' (default 'all' includes consumed). If the user attaches a photo of a bottle or its barcode, read the barcode digits from the image and pass them as the barcode filter. Location and Bin are account-specific labels, not physical descriptions — if a location/bin filter finds nothing, use cellar-stats with group_by=location or group_by=bin to see the actual values in use. Returns up to max_results per page (default 25) — pass offset to page through more.
| Name | Type | Req | Description |
|---|---|---|---|
| barcode | string | – | Bottle barcode — e.g. read from a photo |
| bin | string | – | Specific bin/position (e.g. 'Drawer 2', '1-3') |
| location | string | – | Storage location (e.g. 'Wine Fridge') |
| max_results | number | – | Maximum results (default 25) |
| offset | number | – | Result offset for pagination (default 0) |
| query | string | – | Wine name search term |
| size | string | – | Bottle format (e.g. '750ml', '1500ml') |
| state | string | – | Which bottles: 'cellar', 'consumed', or 'all' (default) |
| Name | Type | Req | Description |
|---|---|---|---|
| bottles | array | yes | – |
| count | number | yes | – |
| offset | number | yes | – |
| total | number | yes | – |
No examples provided.
cellar-stats ~56
Get cellar statistics: total bottles, value, unique wines, and optional breakdowns. Valid group_by options: color, country, region, varietal, location, bin, category.
| Name | Type | Req | Description |
|---|---|---|---|
| group_by | string | – | Breakdown dimension |
| Name | Type | Req | Description |
|---|---|---|---|
| avgPerWine | number | yes | – |
| breakdown | object | – | – |
| totalBottles | number | yes | – |
| totalValue | number | yes | – |
| uniqueWines | number | yes | – |
No examples provided.
clear-user-data ~65
Remove stored CellarTracker credentials and cached wine data from this machine. Use this to fully disconnect your account or free up disk space.
| Name | Type | Req | Description |
|---|---|---|---|
| clear_cache | boolean | – | Delete cached CSV exports (default true) |
| clear_credentials | boolean | – | Delete saved credentials (default true) |
| Name | Type | Req | Description |
|---|---|---|---|
| cacheFilesRemoved | number | yes | – |
| credentials | string | yes | – |
No examples provided.
consumption-history ~144
Search your consumption history — wines you've opened and drunk. Filter by wine name, color, or date range. Returns most recent consumptions first with tasting context, up to max_results per page (default 25) — pass offset to page through more.
| Name | Type | Req | Description |
|---|---|---|---|
| color | string | – | Filter by color (Red, White, Rosé) |
| date_from | string | – | Start date (YYYY-MM-DD) |
| date_to | string | – | End date (YYYY-MM-DD) |
| max_results | number | – | Maximum results (default 25) |
| offset | number | – | Result offset for pagination (default 0) |
| query | string | – | Wine name search term |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| offset | number | yes | – |
| rows | array | yes | – |
| total | number | yes | – |
No examples provided.
drinking-recommendations ~127
Get wine drinking recommendations sorted by urgency. Orders wines by their listed drinking window: past the window first, then in the final year, then the rest of the window (earliest end first), then not yet open. Status describes the listed window only; CellarTracker's drinkability index (a bottle-count pacing number, not a maturity measure) is reported separately and only breaks ties. Optionally filter by color.
| Name | Type | Req | Description |
|---|---|---|---|
| color | string | – | Filter by color |
| max_results | number | – | Maximum results (default 10) |
| occasion | string | – | Occasion description |
| Name | Type | Req | Description |
|---|---|---|---|
| recommendations | array | yes | – |
No examples provided.
get-wishlist ~39
View your CellarTracker wishlist wines. Optionally search by wine name, region, or varietal.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | – | Search term |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| wines | array | yes | – |
No examples provided.
incoming-orders ~58
List wines ordered but not yet received, from the Pending table. Sorted oldest order first. Use this for 'what's on the way', unlike recent-deliveries which shows what has already arrived.
| Name | Type | Req | Description |
|---|---|---|---|
| store | string | – | Store name filter |
| Name | Type | Req | Description |
|---|---|---|---|
| rows | array | yes | – |
| total | number | yes | – |
No examples provided.
purchase-history ~94
Search purchase history with spending summary. Filter by wine name, store, or date range (YYYY-MM-DD format). Shows total spent, average price, per-store breakdown, and recent purchases.
| Name | Type | Req | Description |
|---|---|---|---|
| date_from | string | – | Start date (YYYY-MM-DD) |
| date_to | string | – | End date (YYYY-MM-DD) |
| query | string | – | Wine name search |
| store | string | – | Store name filter |
| Name | Type | Req | Description |
|---|---|---|---|
| avgPrice | number | yes | – |
| bottleCount | number | yes | – |
| byStore | array | yes | – |
| recent | array | yes | – |
| totalSpent | number | yes | – |
No examples provided.
recent-deliveries ~103
List wines actually delivered (received) in a date range, keyed on DeliveryDate. Defaults to the last 30 days. Use this for 'what just landed', unlike purchase-history which keys on order date.
| Name | Type | Req | Description |
|---|---|---|---|
| date_from | string | – | Start delivery date (YYYY-MM-DD). Defaults to 30 days ago. |
| date_to | string | – | End delivery date (YYYY-MM-DD). Defaults to today. |
| store | string | – | Store name filter |
| Name | Type | Req | Description |
|---|---|---|---|
| mostRecentDelivery | string | – | – |
| rows | array | yes | – |
| total | number | yes | – |
No examples provided.
refresh-data ~33
Force refresh all CellarTracker data from the server. Downloads fresh CSV exports for all 8 tables regardless of cache age.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| refreshedAt | string | yes | – |
| serverVersion | string | yes | – |
| tables | array | yes | – |
No examples provided.
search-cellar ~168
Search your wine cellar by name, color, region, varietal, location, or vintage range. The region parameter searches across Country, Region, SubRegion, Appellation, and Locale fields. Returns matching wines with details, up to 25 per page — pass offset to page through more.
| Name | Type | Req | Description |
|---|---|---|---|
| color | string | – | Filter by color (Red, White, Rosé) |
| location | string | – | Storage location |
| offset | number | – | Result offset for pagination (default 0) |
| query | string | – | Wine name search term |
| region | string | – | Region, country, or appellation |
| varietal | string | – | Grape varietal |
| vintage_max | number | – | Maximum vintage year |
| vintage_min | number | – | Minimum vintage year |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| offset | number | yes | – |
| total | number | yes | – |
| wines | array | yes | – |
No examples provided.
setup-credentials ~69
Set up or update your CellarTracker login credentials. Validates credentials against CellarTracker before saving. Use this if you just installed the plugin or need to change your login.
| Name | Type | Req | Description |
|---|---|---|---|
| password | string | yes | Your CellarTracker password |
| username | string | yes | Your CellarTracker username |
| Name | Type | Req | Description |
|---|---|---|---|
| envOverrideActive | boolean | yes | – |
| status | string | yes | – |
No examples provided.
tasting-notes ~125
Search your tasting notes and reviews. Filter by wine name, color, or minimum rating. Returns notes with ratings, scores, and tasting details, up to max_results per page (default 25) — pass offset to page through more.
| Name | Type | Req | Description |
|---|---|---|---|
| color | string | – | Filter by color (Red, White, Rosé) |
| max_results | number | – | Maximum results (default 25) |
| min_rating | number | – | Minimum rating filter |
| offset | number | – | Result offset for pagination (default 0) |
| query | string | – | Wine name search term |
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | yes | – |
| offset | number | yes | – |
| rows | array | yes | – |
| total | number | yes | – |
No examples provided.
How do I install the CellarTracker MCP server?
CellarTracker runs locally as an npm package, launched with npx -y cellartracker-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · cellartracker-mcp
claude mcp add slavins-co-cellartracker-mcp -- npx -y cellartracker-mcp
What is the CellarTracker MCP server?
CellarTracker is an MCP server listed in the public MCP registry as io.github.slavins-co/cellartracker-mcp. Read-only access to your CellarTracker wine cellar: inventory, drinking windows, purchases, notes. This page covers its npm package (cellartracker-mcp).
Is the CellarTracker MCP server safe to use?
CellarTracker scores 97 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the CellarTracker MCP server expose?
CellarTracker exposes 13 tools: search-cellar, drinking-recommendations, cellar-stats, purchase-history, recent-deliveries, and 8 more. Their descriptions and schemas cost roughly 1,385 tokens of context every time the server is loaded.
Is the CellarTracker MCP server still maintained?
CellarTracker is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the CellarTracker MCP server under?
CellarTracker declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.