Atlas / MCP servers / cupofowls / Kroger

KrogerSAFE

Name: Kroger
Author: cupofowls

mcp/cupofowls/kroger

MCP server by cupofowls · Audited 2026-10-07

A FastMCP server that provides AI assistants like Claude with access to Kroger's grocery shopping functionality through the Model Context Protocol (MCP). This server enables AI assistants to find stores, search products, manage shopping carts, and access Kroger's comprehensive grocery data via the k

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

29 20r · 6w · 3d

Transport

sse · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

📚 Docs: https://cupofowls.github.io/kroger-api/building-ai-agents/agent-lab — build an AI agent with kroger-mcp, and the full tool reference.

📺 Demo

Using Claude with this MCP server to search for stores, find products, and add items to your cart:

https://github.com/user-attachments/assets/69055f5f-04f5-4ec1-96ac-330aa288fbd1

Changelog

A changelog with recent changes is here.

🚀 Quick Start

Prerequisites

You will need Kroger API credentials (free from Kroger Developer Portal). Visit the Kroger Developer Portal to:

Create a developer account
Register your application
Get your CLIENT_ID, CLIENT_SECRET, and set your REDIRECT_URI

The first time you run a tool requiring user authentication, you'll be prompted to authorize your app through your web browser. You're granting permission to your own registered app, not to any third party.

Installation

⚠️ macOS users must use installation Option 2 ⚠️

Option 1: Using uvx with Claude Desktop (Recommended)

Once published to PyPI, you can use uvx to run the package directly without cloning the repository:

Edit Claude Desktop's configuration file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

Linux: ~/.config/Claude/claude_desktop_config.json

Windows: %APPDATA%/Claude/claude_desktop_config.json

{
"mcpSe

Read from source at commit 99ba2ba88d35OBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add kroger-mcp --env KROGER_CLIENT_SECRET=${KROGER_CLIENT_SECRET} -- uvx kroger-mcp

claude-desktop

{
  "mcpServers": {
    "kroger-mcp": {
      "command": "uvx",
      "args": [
        "kroger-mcp"
      ],
      "env": {
        "KROGER_CLIENT_SECRET": "${KROGER_CLIENT_SECRET}"
      }
    }
  }
}

Exposed tools (29)

20 read · 6 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add_items_to_cart`	write
`bulk_add_to_cart`	write
`bulk_search_products`	read
`check_chain_exists`	read
`check_department_exists`	read
`check_location_exists`	read
`clear_current_cart`	destructive
`complete_authentication`	read
`force_reauthenticate`	destructive
`get_authentication_info`	read
`get_chain_details`	read
`get_current_datetime`	read
`get_department_details`	read
`get_location_details`	read
`get_preferred_location`	read
`get_product_details`	read
`get_product_images`	read
`get_user_profile`	read
`get_user_zip_code`	read
`list_chains`	read
`list_departments`	read
`mark_order_placed`	write
`remove_from_cart`	destructive
`search_products_by_id`	read
`set_preferred_location`	write
`start_authentication`	write
`test_authentication`	read
`view_current_cart`	read
`view_order_history`	write

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (1 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (2)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

clear_current_cart, force_reauthenticate, remove_from_cart

Why it matters. 3 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

requirements.txt

fastmcp, kroger-api, requests, pydantic, python-dotenv

Why it matters. 5 requirement(s) not pinned with ==

Fix. pin exact versions

Gates applied: no_behavioural_pass.

Audited 2026-10-07 · audit v0.4.1 · source sha 99ba2ba88d35full audit observations/trust-audit/mcp-server/cupofowls__kroger.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-07	`99ba2ba88d35`	SAFE	B	89	first audit

Questions

What is the Kroger MCP server?

What tools does Kroger expose?

29 in total: 20 read-only, 6 that write, and 3 that can delete or overwrite (clear_current_cart, force_reauthenticate, remove_from_cart). Every one is listed on this page with its risk.

Is Kroger safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Kroger need?

It reads KROGER_CLIENT_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Kroger run?

It speaks sse and streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as kroger-mcp.

How current is this page?

The grade is for one exact copy of the source (99ba2ba88d35), read on 2026-10-07. The repository is watched and re-audited when it changes.

Source	cupofowls/kroger-mcp
PyPI	`kroger-mcp`
Transports	sse · streamable-http
Credentials it reads	`KROGER_CLIENT_SECRET`
License	MIT
Activity	pushed 30d ago