Zero-dependency MCP client for McDonald's China — 3 quirks in a real-world MCP server

[26514651]

I built 点单参谋 (mcd-order-copilot) — a client that drives McDonald's China official MCP (mcp.mcd.cn, 35 tools) to answer one question: what am I actually about to eat?

You give it a location → it finds nearby stores → pulls that store's live menu → puts calories / protein / fat / carbs / sodium / calcium on one card, and recalculates when you swap a meal component (e.g. medium fries → large: +90 kcal, +¥1.5).

Two parts of this might be useful to people here.

1. Three quirks from a real-world MCP server

(a) query-nearby-stores silently ignores coordinates. I passed latitude / longitude and got back a response byte-identical to the same call without them. The tool only accepts beType / city / keyword / searchType — "search by location" means city + landmark keyword, not lat/lng. There's no error, no warning; the extra fields just vanish.

The workaround: reverse-geocode the coordinates into a Chinese place name first (Photon / OpenStreetMap, no API key needed), then query by place. Worth noting that the choice of place name matters a lot — the same coordinates resolved to 琶洲街道阅江西路 put the nearest store ~1 km off, while 赤岗街道阅江西路 was exact. So I fire 3–6 candidate place names concurrently and merge results by store code.

(b) Tool responses are not pure JSON. Several tools return a prose sentence followed by a JSON payload. A naive json.loads(body) on the whole response fails — you need to locate the JSON boundary rather than assume the body is machine-readable end to end.

(c) list-nutrition-foods returns a CSV string, not a JSON array — inconsistent with the rest of the tool surface.

2. Quota math that ends up shaping the design

The official ceiling is 600 calls/minute for the entire token. Pulling one store's complete menu costs ~115 calls (one detail call per item). So the first five users could exhaust a day's budget if you don't throttle. Two consequences:

• Anonymous traffic is IP rate-limited, and the shared demo quota lives server-side — it never appears in any HTTP response.
• Menu building uses bounded concurrency: 115 items in 2.55s at 16 workers, vs 1.85s at 24 — past 16 the curve flattens and the traffic stops looking like a well-behaved client.

One more design note: reading your own saved addresses is the only endpoint that requires the caller's own token. It reads private account data, so borrowing the demo quota would mean showing the deployer's home address to every visitor — the backend returns 403 for anonymous callers instead.

3. What it's built with

Pure Python standard library — zero third-party dependencies, 62 unit tests. docs/evidence-real.md documents the raw MCP handshake, the tools/list output for all 35 tools, and both parsing bugs above with the exact payloads that triggered them.

Try it without a token

McDonald's MCP tokens are only issued to registered developers, so the repo ships a real interface snapshot in fixtures/ — no token needed to see the entire UI:

• Source: https://github.com/26514651/mcd-order-copilot
• Snapshot version (no backend required): https://26514651.github.io/mcd-order-copilot/

Honest scope: it's read-only, gives no medical advice, and does no brand comparison. Of 115 items on sale at a store, 90 carry nutrition data and 25 don't — the UI shows those separately rather than interpolating a number.

Happy to talk about the client implementation. The reverse-geocoding workaround in particular feels like a trap that any location-aware MCP tool will run into.