NutriPal MCP v0.4.1

NutriPal MCP v0.4.1

Auth prompt reliability

The hidden MyFitnessPal session-token prompt now reads raw terminal input through explicit input events. Enter submits the token, while Ctrl+C and Ctrl+D restore normal terminal mode before exiting. The prompt also rejects an empty token and prints a status before checking the session with MyFitnessPal.

This patch release changes the auth command only. It does not alter MyFitnessPal API behavior or stored session formats.

NutriPal MCP v0.4.0

NutriPal MCP v0.4.0

Added

• Add USDA FoodData Central as a labeled food search fallback and support importing USDA foods into MyFitnessPal before logging.
• Let auth save sessions as either private plain text or JSON, with an interactive choice and --format option.
• Add food source attribution and safeguards against accidental duplicate diary entries.

Fixed

• Validate the current MyFitnessPal website session before account operations.
• Verify diary writes and deletions by exact entry ID, and distinguish API listing visibility from mobile app visibility.
• Correct gram serving and nutrition calculations in the weight logger.

NutriPal MCP v0.3.1

NutriPal MCP v0.3.1

Food search fix

Food search now calls MyFitnessPal's Next.js data route:
/_next/data/{buildId}/food/calorie-chart-nutrition-facts.json?params=[query,page].
NutriPal reads the current build ID from the public homepage, encodes the query and page as JSON in params, and retries once with a refreshed build ID if the data route returns 404.

The previous implementation requested chart pages with the query embedded in the path and looked for results in page markup. Those pages could return HTTP 200 without any search results. The tested /api/services/foods URLs are food lookup routes and returned 422 for search parameters; /api/services/search/nutrition returned 404. These responses did not establish a working food search endpoint.

Session errors and diagnostics

MyFitnessPal can keep account and diary API access working after its website session expires. The search data route can then return HTTP 200 with a Next.js redirect to /account/logout. NutriPal now reports that response, as well as HTTP redirects, as MFP_SESSION_STALE with a profile-specific reauthentication hint. It does not report either response as an empty search result.

diagnose now probes the data route used by search_food and reports status, whether a food query was present, and a stale-session hint when applicable. It does not print cookie values or food/account details.

Verification

• 22 regression tests passed, including the encoded request, HTTP redirect, embedded Next.js redirect, and missing search data cases.
• Typecheck, build, Node.js launcher handshake, npm pack dry run, and GitHub CI passed.
• The live account and diary reads passed. Live food search returned MFP_SESSION_STALE because the available default website session redirects to logout. A successful live search with a refreshed session remains unverified for this release.

Upgrade note

If search_food reports MFP_SESSION_STALE while other account tools work, refresh the affected profile's website session with nutripal-mcp auth --profile NAME, then run nutripal-mcp live-check --profile NAME. The default profile can use plain auth and live-check.

NutriPal MCP v0.3.0

NutriPal MCP v0.3.0

• Add named MyFitnessPal profiles, profile selection on account tools, session status, and parallel read calls. Writes are serialized per profile, including across local server processes.
• Select servings by ID or value and unit, preserve diary meal placement on edits, and report total and net carbohydrate values with an explicit basis.
• Return structured stale-session errors and verify food logging and diary deletion with diary read-backs.
• Ship compiled JavaScript for Node.js 20 or newer, with Bun support for running TypeScript from a checkout.

Known limitation: The saved default session used for the pre-release live check passed account and diary reads but MyFitnessPal redirected food search to logout. A refreshed browser session and a successful live write check are still needed to confirm this integration end to end. MyFitnessPal website endpoints can change without notice.

See CHANGELOG.md for the full change list.

NutriPal MCP v0.2.0

Expanded MyFitnessPal account, diary, goals, profile, exercise, measurement, and activity-summary coverage. Nutrition goal updates now handle the live API's response shape, and diary reads include exercise entries. See the repository changelog for details and current limitations.

NutriPal MCP v0.1.0 - first release

Changelog

All notable changes to NutriPal MCP are documented here.

The format follows Keep a Changelog,
and the project adheres to Semantic Versioning.

[0.1.0] - 2026-10-11

First public release. A Bun + TypeScript MCP server that talks to MyFitnessPal's
website endpoints over stdio, using your own browser session.

Added

Session and setup

• bun run auth — hidden-prompt CLI that verifies a MyFitnessPal session cookie
  against the account endpoint before saving it.
• Session stored at ~/.config/nutripal-mcp/session with 0700 on the directory
  and 0600 on the file. Overridable with MFP_DATA_DIR.
• MFP_COOKIE environment variable accepts a bare token or a full Cookie header,
  taking precedence over the stored session.
• Session values are never printed by any command.

Diary and notes

• get_diary — read one day of food entries.
• get_diary_range — read up to 31 days, rejecting wider ranges with a clear error.
• get_daily_note — read the food diary note for a date.
• get_food_settings — read diary settings including configured meal labels.

Food database and My Foods

• search_food — search the public catalog with pagination, returning exact IDs
  and serving options.
• get_food — read nutrition and serving sizes for one food ID.
• list_my_foods — list private custom foods, including ones absent from public search.
• create_food — create a private custom food with calories, macros and optional
  nutrients (fiber, sugar, sodium, saturated fat, cholesterol, potassium).
• update_my_food — partial edit of a private food by exact ID; only supplied
  fields are changed.
• delete_my_food — delete a private food by exact ID.
• country_code on custom foods defaults to US (total carbs); pass a two-letter
  European code for net-carb label conventions.

Logging

• log_food — log an exact food ID and serving. Never guesses among matches.
• create_and_log_food — create a custom food and log it in one call. If the diary
  write fails, the created food ID and a recovery instruction are returned so the
  entry can be logged without creating a duplicate.
• update_diary_entry — change a serving count by exact entry ID.
• delete_diary_entry — delete a diary entry by exact ID.

Meals, recent foods, water and measurements

• list_my_meals, delete_my_meal — read and remove saved meals.
• list_recent_foods — recent or frequent foods computed from up to 31 diary days.
• get_water, log_water — read water, or set it in cups or millilitres.
• get_measurements, log_weight — read body measurements, log weight in kg or lbs.

Validation and safety

• Every tool input is validated with Zod, including ISO YYYY-MM-DD dates,
  finite non-negative nutrition values and bounded meal positions.
• Tools are annotated with readOnlyHint / destructiveHint so MCP clients can
  warn before destructive calls.
• Error messages are sanitized: response bodies, tokens and Bearer values are
  stripped before anything reaches the client.

CLI scripts

• bun run live-check — read-only sweep of session, My Foods, diary, food search
  and details, saved meals, food settings, notes, goals, recent foods, water and
  measurements.
• bun run live-check --write — creates one temporary private food, verifies and
  edits it, logs and edits one diary entry, then deletes both. On cleanup failure
  it prints the temporary name or ID for manual removal.
• bun run log-by-weight <food> <grams> — interactive weight-based logging with
  ranked exact-match selection, a gram serving default and --date / --meal
  overrides.
• bun run diagnose — probes read-only food routes and prints status codes and
  response structure without printing the session or response bodies.

Project

• 8 unit tests covering session normalization, food ID handling and request paths.
• tsc --noEmit typecheck, TypeScript 7, Bun runtime.
• Published to npm as nutripal-mcp with a
  nutripal-mcp bin, so bunx nutripal-mcp runs the server without cloning. Invoking it
  under Node.js exits with a message explaining that Bun is required.
• MIT license.