nutriCAUTION
Production nutrition-tracking PWA (React, Supabase) built and operated inside Claude Code: production RAG pipeline, hybrid semantic search (pgvector), self-built remote MCP server (OAuth 2.1 + PKCE, RLS-enforced), three-model AI fallback chain, and an LLM eval harness gating every release.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A precision-first nutrition-tracking PWA — think Cronometer, rebuilt small and exact. React SPA on Vercel, Supabase (Postgres + Auth + PostgREST) as the entire backend, Row Level Security as the only authorization layer. In production at nutri.vryahn.com, used daily by two real users.
The core design commitment: stored nutritional data is never allowed to drift or degrade. Every trade-off in the codebase — UX, speed, scope — resolves in favor of data accuracy. Questionable values get flagged (⚠), never silently saved.
Dependencia del plan de seguimiento
Nutri y Hevy son herramientas de captura y seguimiento dependientes del plan maestro anual de Anthropometry. El plan aprobado gobierna fases, fechas, targets nutricionales, descansos, rutinas y reglas de ajuste. Todo cambio de planificación aprobado se documenta primero en el plan maestro, con valores, fechas y bitácora; después se refleja y verifica en las herramientas. Sus datos son evidencia observada, no autoridad para reemplazar el plan. Una discrepancia se reporta y concilia; nunca se convierte silenciosamente en aprobación. Las automatizaciones solo ejecutan reglas ya aprobadas y documentadas en el plan, y sus resultados deben reflejarse allí antes de considerarse nuevos targets normativos. Propuestas pendientes y briefs no son decisiones aprobadas. Esta regla no altera la precisión ni las fuentes de los registros históricos.
Why this codebase is worth a look
- Nutrients are computed, never copied. Entries store only
(food, grams); SQL views derive every nutrient at read time. Fixing a food retroactively corrects all history for free — there is no denormalized data to backfill, ever. - No app server. The client talks to PostgREST directly; RLS policies are the sole authorization layer. The only server-side code is a stateless MCP endpoint (one Vercel function) that also delegates all authorization to RLS.
- **AI with a regression g
3ceea4450551OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add nutri --env FDC_KEY=${FDC_KEY} --env GEMINI_KEY=${GEMINI_KEY} --env GROQ_KEY=${GROQ_KEY} --env MISTRAL_KEY=${MISTRAL_KEY} -- npx -y [email protected]{
"mcpServers": {
"nutri": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"FDC_KEY": "${FDC_KEY}",
"GEMINI_KEY": "${GEMINI_KEY}",
"GROQ_KEY": "${GROQ_KEY}",
"MISTRAL_KEY": "${MISTRAL_KEY}"
}
}
}
}Exposed tools (12)
7 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
create_food | write | |
create_recipe | write | |
delete_entry | destructive | |
get_day | read | |
get_measurements | read | |
get_targets | read | |
log_entry | read | |
log_measurement | read | |
nutri. | read | Registro nutricional personal |
search_catalog | read | |
set_target_bounds | write | |
update_food | write |
Trust audit
CAUTIONgrade B · trust 81/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (15)
.claude/skills
const csv = '' + lines.join('\n');delete_entry
CLAUDE.md
GEMINI.md
({ usdaUrl } = await import('../../api/ai.js'));for (const bad of ['1?api_key=x', '../../v1/foods/search', '', null, undefined, '12a']) {const html = readFileSync(new URL('../../index.html', import.meta.url), 'utf8');const csp = JSON.parse(readFileSync(new URL('../../vercel.json', import.meta.url), 'utf8'))const html = readFileSync(new URL('../../index.html', import.meta.url), 'utf8');sudo apt-get install -y postgresql-common
sudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -y
sudo apt-get install -y postgresql-client-17
@dnd-kit/core, @dnd-kit/sortable, @modelcontextprotocol/sdk, @sentry/react, @supabase/supabase-js, jose, lucide-react, react
Gates applied: no_behavioural_pass, no_license.
3ceea4450551full audit observations/trust-audit/mcp-server/vryahn__nutri.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 3ceea4450551 | CAUTION | B | 81 | first audit |
Questions
What is the nutri MCP server?
Production nutrition-tracking PWA (React, Supabase) built and operated inside Claude Code: production RAG pipeline, hybrid semantic search (pgvector), self-built remote MCP server (OAuth 2.1 + PKCE, RLS-enforced), three-model AI fallback chain, and an LLM eval harness gating every release.
What tools does nutri expose?
12 in total: 7 read-only, 4 that write, and 1 that can delete or overwrite (delete_entry). Every one is listed on this page with its risk.
Is nutri safe to connect to an agent?
With care. The audit graded it B (81/100) and found 15 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does nutri need?
It reads FDC_KEY, GEMINI_KEY, GROQ_KEY, MISTRAL_KEY, VITE_DEV_PASSWORD, VITE_FDC_KEY, VITE_GEMINI_KEY, VITE_GROQ_KEY, VITE_MISTRAL_KEY and VITE_SUPABASE_ANON_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does nutri run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as nutri at 0.0.1.
How current is this page?
The grade is for one exact copy of the source (3ceea4450551), read on 2026-10-11. The repository is watched and re-audited when it changes.