Fitatu MCP Unofficial

Unofficial Model Context Protocol (MCP) server for Fitatu. It exposes selected Fitatu account operations as typed MCP tools so an MCP client can inspect and update your own meal plan.

Features

• Streamable HTTP MCP endpoint at /mcp.

• Fitatu authentication through local environment variables.

• Safe profile and day-plan read tools.

• Diet summary tool for an inclusive date range, including period energy, key nutrients, and full nutrient details.

• Food search with product and measure identifiers for follow-up mutations.

• Meal item add, update, move, and remove tools.

• Recipe search and complete recipe lifecycle tools: create, inspect, update, and delete.

• Docker workflow for local/private deployment.

Related MCP server: fatsecret-mcp-server

Requirements

• Node.js >=22.18.0

• npm

• A Fitatu account

Quick Start

Install dependencies:

npm install

Create local configuration:

cp .env.example .env

Fill in FITATU_EMAIL and FITATU_PASSWORD in .env, then start the development server:

npm run dev

The MCP endpoint is available at:

http://localhost:3000/mcp

MCP Client Setup

If your MCP client supports remote Streamable HTTP servers, use this endpoint directly:

http://localhost:3000/mcp

For clients that launch MCP servers through a command, use mcp-remote:

{
	"mcpServers": {
		"fitatu": {
			"command": "npx",
			"args": ["mcp-remote", "http://localhost:3000/mcp"]
		}
	}
}

When using a public tunnel, replace the local URL with the tunnel URL and keep the /mcp path.

To test the server manually in a browser-based tool, run the MCP Inspector and connect it to the Streamable HTTP endpoint:

npx @modelcontextprotocol/inspector

Use this URL in the Inspector:

http://localhost:3000/mcp

Available Tools

Configuration

Runtime configuration is read from environment variables and validated at startup.

Do not commit .env. The repository keeps .env.example as documentation only. The mobile client profile defaults match Fitatu 4.14.4 traffic captured on 2026-07-30. Override these values when a newer Fitatu release changes its request profile; no code change is required.

Local Development

Start the server in watch mode:

npm run dev

Build the project:

npm run build

Start the built server:

npm start

Run quality checks:

npm run lint
npm run format:check
npm run test:ci
npm run build

test:ci runs deterministic unit tests with an informational V8 coverage report and does not load Fitatu credentials. Generate the same text, HTML, and JSON coverage reports locally with:

npm run test:coverage

The HTML and JSON summary are written to the ignored coverage/ directory. Run strict TypeScript checks for both production and unit-test code with:

npm run typecheck

Integration tests stay separate:

npm run test:integration

Integration tests require valid Fitatu credentials in .env and may read or mutate meal-plan and recipe data in the authenticated account. Recipe workflow tests create temporary recipes and attempt to remove them during cleanup.

Docker

Create .env before building the image:

cp .env.example .env

Fill in your Fitatu credentials in .env.

Build the Docker image:

docker build -t fitatu-mcp .

The build copies .env into the image so the server can read it at runtime. Treat the built image as sensitive. Do not push it to a public registry or share it with other people.

Run the container:

docker run --name fitatu-mcp -p 3000:3000 fitatu-mcp

If a container with that name already exists, recreate it:

docker stop fitatu-mcp
docker rm fitatu-mcp
docker run --name fitatu-mcp -p 3000:3000 fitatu-mcp

Exposing a Local Server with Cloudflare Tunnel

When the server is running locally on port 3000, expose it through a temporary Cloudflare Tunnel:

cloudflared tunnel --url http://localhost:3000

Cloudflare will print a public tunnel URL. Use that URL with the /mcp path as the MCP endpoint.

Security Notes

• Use this server only with your own Fitatu account.

• Do not commit Fitatu credentials, tokens, cookies, account identifiers, nutrition logs, body measurements, or profile data.

• Do not expose full upstream Fitatu responses in issues, logs, tests, fixtures, or MCP responses.

• Captured HTTP traffic should be used only for legitimate work with your own account and your own network traffic.

• Review mutation tool calls carefully before allowing an MCP client to execute them.

• Treat remove_meal_items as destructive and atomic for its selected day-plan UUIDs.

• delete_recipe soft-deletes only the catalog definition and leaves existing or historical day-plan snapshots intact.

Contributing

See CONTRIBUTING.md for contribution guidelines.

License

This project is licensed under the MIT License.