Uber EatsSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
This is a POC of how you can build an MCP servers on top of Uber Eats
https://github.com/user-attachments/assets/05efbf51-1b95-4bd2-a327-55f1fe2f958b
What is MCP?
The Model Context Protocol (MCP) is an open protocol that enables seamless integration between LLM applications and external tools.
Prerequisites
- Python 3.12 or higher
- Anthropic API key or other supported LLM provider
Setup
- Ensure you have a virtual environment activated:
uv venv source .venv/bin/activate # On Unix/Mac
- Install required packages:
uv pip install -r requirements.txt playwright install
- Update the
.envfile with your API key:
ANTHROPIC_API_KEY=your_openai_api_key_here
Note
Since we're using stdio as MCP transport, we have disable all output from browser use
Debugging
You can run the MCP inspector tool with this command
uv run mcp dev server.py
97b7bae9411eOBSERVED · 2026-10-06Exposed tools (2)
1 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
find_menu_options | read | Search Uber Eats for restaurants or food items. |
order_food | write | Order food from a restaurant. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
browser-use, langchain-anthropic, langchain-openai, python-dotenv, fastmcp, mcp
Gates applied: no_behavioural_pass, no_license.
97b7bae9411efull audit observations/trust-audit/mcp-server/ericzakariasson__uber-eats.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-06 | 97b7bae9411e | SAFE | B | 89 | first audit |
Questions
What tools does Uber Eats expose?
2 in total: 1 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Uber Eats safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Uber Eats need?
No credential environment variables were found in its source, so it appears to need none.
How does Uber Eats run?
It speaks stdio, so it runs as a local process your client starts.
How current is this page?
The grade is for one exact copy of the source (97b7bae9411e), read on 2026-10-06. The repository is watched and re-audited when it changes.