cellartracker-mcpSAFE
A local MCP server to connect AI tools to your wine cellar
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Disclaimer: This is a community-maintained project with no affiliation to, or endorsement by, CellarTracker! LLC. It uses CellarTracker's self-serve data export on your own account's behalf.
Connect Claude to your CellarTracker wine cellar. Query your inventory, get drinking recommendations, and analyze purchases and drinking history, all through natural conversation. No need to refresh your inventory, or share your tasting notes. Claude pulls them directly from your CellarTracker account.
Install
Two install methods for different Claude interfaces. You may need one or both:
Which do I need?
- Chat (Desktop) only → Desktop Extension
- Code only → Claude Code Plugin
- Cowork only → Either works (plugin adds skills)
- Full coverage → Install both
Installing both is safe. The extension covers Chat (Desktop); the plugin covers Cowork and Code. In Cowork, both are accessible without conflict. Note, there is no coverage for claude.ai web chat sessions.
Desktop Extension (Chat & Cowork)
One-click install. No terminal needed.
- Download
cellartracker-mcp.mcpbfrom the latest release - Double-click the file to install in Claude Desktop
- Enter your CellarTracker username and password when prompted
- Start chatting (e.g. "What wines should I open this month?")
Credentials are stored in your OS keychain (macOS Keychain / Windows Credential M
317e71530b06OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add cellartracker-mcp --env CT_PASSWORD=${CT_PASSWORD} -- npx -y [email protected]Exposed tools (13)
12 read · 0 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
bottle-details | read | |
cellar-stats | read | |
clear-user-data | destructive | |
consumption-history | read | |
drinking-recommendations | read | |
get-wishlist | read | |
incoming-orders | read | |
purchase-history | read | |
recent-deliveries | read | |
refresh-data | read | |
search-cellar | read | |
setup-credentials | read | |
tasting-notes | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (8)
clear-user-data
.mcpbignore
@modelcontextprotocol/sdk, csv-parse, zod, @anthropic-ai/mcpb, @types/node, ajv, typescript, vitest
Connect Claude to your [CellarTracker](https://www.cellartracker.com/) wine cellar. Query your inventory, get drinking recommendations, and analyze purchases and drinking history, all through natural
When a task needs to verify an actual CellarTracker URL pattern resolves (e.g. picking between `wine.asp?iWine=<id>` and `label.asp?iWine=<id>` for #52's deep links), both WebFetch and a headless-brow
- [x] #54 slice C — MCP resources: `cellartracker://tables/<Table>` CSV resource per table (8 total) + `cellartracker://meta/cache` JSON resource with per-table freshness + server version; cellartrack
CellarTracker has no OAuth, API keys, or scoped tokens. Authentication requires your actual account username and password, sent as URL query parameters over HTTPS. While encrypted on the wire, query p
- A test meant to exercise `getCredentials()`'s "not found" error path deleted `CT_USERNAME`/`CT_PASSWORD` from `process.env` and asserted the thrown message — but `getCredentials()` also falls back t
Gates applied: no_behavioural_pass.
317e71530b06full audit observations/trust-audit/mcp-server/slavins-co__cellartracker-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 317e71530b06 | SAFE | B | 89 | first audit |
Questions
What is the cellartracker-mcp MCP server?
A local MCP server to connect AI tools to your wine cellar
What tools does cellartracker-mcp expose?
13 in total: 12 read-only, 0 that write, and 1 that can delete or overwrite (clear-user-data). Every one is listed on this page with its risk.
Is cellartracker-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does cellartracker-mcp need?
It reads CT_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does cellartracker-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as cellartracker-mcp at 0.5.2.
How current is this page?
The grade is for one exact copy of the source (317e71530b06), read on 2026-10-10. The repository is watched and re-audited when it changes.