pantrist-mcpSAFE
Model Context Protocol server wrapping the Pantrist REST API
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Model Context Protocol server that wraps the Pantrist REST API, so an LLM client (Claude Desktop, the Claude web/mobile connector, Cursor, ...) can manage shopping lists, the pantry, recipes and the week plan in natural language.
It's a thin wrapper — no business logic. Every tool maps to an existing REST endpoint and forwards the caller's Bearer token. The HTTP client is generated from the public OpenAPI spec (src/generated/pantrist-api.ts), so request/response types track the API automatically; only the curated tool layer (src/tools.ts) is hand-written.
Documentation
- docs/ARCHITECTURE.md — components, the token context, request flow, transports, regeneration.
- docs/AUTHENTICATION.md — OAuth flow, token-type ↔ tool compatibility, multi-user isolation, the consent-page dependency.
- docs/DEPLOYMENT.md — full env var reference, remote/ingress setup, scaling, security checklist.
- docs/TOOLS.md — every tool's args, REST mapping, and the item shape.
- docs/LIMITATIONS.md — known rough edges (read before relying on it in production).
Two transports
Connecting Claude to the hosted server
If you just want to use Pantrist with Claude (not self-host), the public endpoint is `https://mcp.pantrist.app/mcp`. Pick whichever Claude surface you're on; in every case the first tool call walks you through an OAuth login to your Pantrist account, no token to copy by hand.
Claude.ai (web or desktop app)
- claude.ai → profile menu → **Settings → Connect
4db35c9d125cOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add pantrist-mcp-server --env PANTRIST_TOKEN=${PANTRIST_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"pantrist-mcp-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"PANTRIST_TOKEN": "${PANTRIST_TOKEN}"
}
}
}
}Exposed tools (14)
8 read · 4 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add_pantry_item | write | Add a new item to the pantry by name. The API matches |
add_shopping_item | write | Add an item to the shopping list by name. The API matches |
check_shopping_item | read | Check off a shopping-list item. The list\ |
delete_recipe | destructive | Delete a recipe you own, unconditionally and irreversibly. The API rejects deletes for recipes belonging to another user with a 403; that error surfaces verbatim to the caller. Preview with |
delete_shopping_item | destructive | Remove an item from the shopping list, unconditionally and irreversibly (no soft-delete, not affected by list |
get_recipe | read | Get a single recipe by its uuid. Read-only. Returns a full |
get_week_plan | read | List meal-plan entries between two dates (inclusive). Read-only. Returns an array of day objects — |
list_lists | read | List the shopping lists / pantries the authenticated user can access. Read-only. Returns an array of list objects each with |
list_pantry_items | read | List all items currently stocked in the pantry for |
list_shopping_items | read | List all items currently on the shopping list for |
reduce_pantry_amount | read | Change the stock of an existing pantry item by a delta. Mutates state and returns the updated |
search_recipes | read | Search the user\ |
update_pantry_item | write | Update an existing pantry item\ |
update_week_plan_day | write | Replace the meal-plan entries for one day, identified by date. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (6)
delete_recipe, delete_shopping_item
process.env.PANTRIST_BASE_URL = `http://127.0.0.1:${port}`;@modelcontextprotocol/sdk, express, openapi-fetch, zod, @types/express, @types/node, openapi-typescript, tsx
Claude ──POST /mcp (no token)──▶ MCP server
Claude ──POST /mcp (no token)──────────────▶ MCP server
| `OAUTH_AUTHORIZE_URL` | **Required for remote OAuth.** Public URL of a browser-facing consent page that runs the user's Firebase login and then calls `POST /access-token/authorize` (e.g. `https://pa
Gates applied: no_behavioural_pass.
4db35c9d125cfull audit observations/trust-audit/mcp-server/pantrist-dev__pantrist-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 4db35c9d125c | SAFE | B | 89 | first audit |
Questions
What is the pantrist-mcp MCP server?
Model Context Protocol server wrapping the Pantrist REST API
What tools does pantrist-mcp expose?
14 in total: 8 read-only, 4 that write, and 2 that can delete or overwrite (delete_recipe, delete_shopping_item). Every one is listed on this page with its risk.
Is pantrist-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does pantrist-mcp need?
It reads PANTRIST_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does pantrist-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as pantrist-mcp-server at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (4db35c9d125c), read on 2026-10-11. The repository is watched and re-audited when it changes.