# Edenred Plus MCP

Read-only local MCP server for Edenred Plus balances, transactions, and deals.

> [!WARNING]
> This is an unofficial, single-user research preview. It is not affiliated with or endorsed by Edenred. Use it only with an account and API access you are authorized to use, and check Edenred's terms before making live requests.

Visual Demo : 



https://github.com/user-attachments/assets/8ad0c635-af52-42cf-8ea6-093a02bc78fd



## Tools

| Tool | Purpose |
| --- | --- |
| `edenred_start_login` | Opens the Windows default browser in an isolated profile and starts local Edenred login. |
| `edenred_auth_status` | Reports whether login is required, pending, authenticated, expired, or failed without returning secrets. |
| `edenred_get_balances` | Lists every issuer account, benefit wallet, currency balance, spending limit, and associated masked card. Cards do not receive invented balances. |
| `edenred_list_transactions` | Lists transactions whose timestamps fall in an inclusive date range and signs amounts from Edenred's `CREDIT`/`DEBIT` movement. |
| `edenred_find_deals` | Finds active discounts by product, need, brand, or exact category across the deal widgets available to the web account. |

## Install and test

Requirements: Windows, a Chromium-based default browser, Node.js 22.21 or newer, and npm. Node.js 24 is recommended.

```powershell
git clone https://github.com/B-Mahdj/edenred-plus-mcp.git
cd edenred-plus-mcp
npm.cmd ci
npm.cmd test
```

Print the absolute server path needed in desktop-client configuration:

```powershell
(Resolve-Path .\build\index.js).Path.Replace('\', '/')
```

The server uses stdio. Do not print application logs to stdout; stdout is reserved for MCP JSON-RPC.

## Local browser authentication

Call `edenred_start_login` when a data tool reports `AUTH_REQUIRED` or `AUTH_EXPIRED`. The server resolves the browser registered as the Windows HTTPS default, opens a temporary isolated profile, and lets Edenred's own website handle the username, password, and OTP. It captures only the successful Edenred token response through a private debugging pipe, keeps the access token in memory, closes the temporary browser, and deletes the profile.

Automatic capture currently supports Chromium-based default browsers such as Edge, Chrome, Brave, Vivaldi, and Chromium. It never silently substitutes a different browser. Tokens captured from the current web flow last about one hour and have no refresh token, so repeat browser login after expiry. Use `edenred_auth_status` to check progress.

The isolated profile does not reuse normal browser cookies, so you must sign in again. If Edenred temporarily blocks login after repeated attempts, stop retrying and wait or use Edenred's official account-recovery flow; this MCP cannot bypass Edenred security controls.

`EDENRED_ACCESS_TOKEN` remains an optional manual fallback. The server reads it at startup but can replace it in memory after browser login.

Obtain a current bearer token only through Edenred access you are authorized to use. For personal research, this can be the token visible on your own authenticated `prd.smarter.edenred.io/bff-user-api/v1/home` browser request. Never paste a token into source code, `.env` files, chat, issues, or logs.

Set it without placing the value in PowerShell history:

```powershell
$env:EDENRED_ACCESS_TOKEN = Read-Host "Temporary Edenred bearer token"
```

Close that shell when finished. Never export or share a HAR with sensitive data: it can contain the submitted password and token response.

## Codex desktop

Build first:

```powershell
npm.cmd run build
```

Add this to `~/.codex/config.toml` (or a trusted project's `.codex/config.toml`):

```toml
[mcp_servers.edenred_plus]
command = "node"
args = ["C:/absolute/path/to/edenred-plus-mcp/build/index.js"]
```

Restart the desktop app after changing the MCP configuration, then use `/mcp` to verify the server. For the optional manual-token fallback, add `env_vars = ["EDENRED_ACCESS_TOKEN"]`; Codex forwards the named variable without putting its value in `config.toml`. See the [official MCP configuration reference](https://learn.chatgpt.com/docs/extend/mcp#configure-with-configtoml).

## Claude Desktop

Add this server to `%APPDATA%\Claude\claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "edenred-plus": {
      "command": "node",
      "args": ["C:/absolute/path/to/edenred-plus-mcp/build/index.js"]
    }
  }
}
```

Fully quit and reopen Claude Desktop after changing its configuration. Browser login needs no token in this JSON file. If using the manual fallback, Claude Desktop inherits only a limited set of environment variables; do not add the token under the JSON `env` key unless you explicitly accept storing it locally. See the [MCP debugging guidance](https://modelcontextprotocol.io/docs/tools/debugging#environment-variables).

## Inspector

Neither mode requires an Edenred token merely to discover tools:

```powershell
npm.cmd run inspect       # CLI tool discovery
npm.cmd run inspect:ui    # browser interface
```

The browser interface prints a local URL containing an Inspector proxy token. Treat that URL as temporary and do not share it.

## Example prompts

- "Show each of my Edenred benefit balances and daily limits."
- "Log me in to Edenred using my default browser."
- "List my Edenred transactions created between 2026-07-01 and 2026-07-22."
- "I want to buy a coffee machine. Check my Edenred deals before recommending one."
- "Are there active travel discounts in my Edenred account?"

## Troubleshooting

- Tools missing: run `npm.cmd test`, verify the absolute `build/index.js` path, then fully restart the desktop client.
- `AUTH_REQUIRED` / `AUTH_EXPIRED`: ask the client to call `edenred_start_login`.
- `LOGIN_PENDING`: finish login in the isolated browser, then call `edenred_auth_status`.
- `LOGIN_FAILED`: close the temporary browser and retry only after normal Edenred login works again.
- `BROWSER_UNAVAILABLE`: make a supported Chromium browser the Windows HTTPS default, or use the temporary-token fallback.
- No deals returned: the unofficial web endpoint may expose fewer offers than Edenred's mobile app.

### `UPSTREAM_UNAVAILABLE`

This means the MCP started, but its Node.js process could not complete a request to the Edenred API. The error message now distinguishes an Edenred HTTP response from timeout, DNS, refused/reset connection, TLS trust, and unknown network failures.

First, test the same HTTPS route from Node without sending a token or reading the response body:

```powershell
node --version
node -e "fetch('https://prd.smarter.edenred.io/bff-user-api/v1/home',{redirect:'error',signal:AbortSignal.timeout(15000)}).then(r=>console.log('Reachable: HTTP '+r.status)).catch(e=>{console.error(e.cause?.code??e.name);process.exitCode=1})"
```

Any `Reachable: HTTP ...` result proves that Node can resolve, trust, and connect to the API; the unauthenticated status itself is expected. If the browser works but Node reports a timeout, `ENOTFOUND`, a certificate error, or another network code:

1. Compare `node --version` with the working computer and install a supported current Node release. Node 22.21 or newer can use standard proxy environment variables with [`NODE_USE_ENV_PROXY=1`](https://nodejs.org/api/cli.html#node_use_env_proxy1); Node 22.19 or newer can use the operating-system CA store with [`NODE_USE_SYSTEM_CA=1`](https://nodejs.org/api/cli.html#node_use_system_ca1).
2. On an organization-managed network, ask the administrator for the correct proxy and CA settings. Set `NODE_USE_ENV_PROXY=1` when `HTTPS_PROXY`/`HTTP_PROXY`/`NO_PROXY` are already configured, and set `NODE_USE_SYSTEM_CA=1`. If the administrator supplies a PEM certificate bundle, `NODE_EXTRA_CA_CERTS` can point to it.
3. Restart the desktop client after changing environment variables. Codex users can add `env_vars = ["NODE_USE_ENV_PROXY", "NODE_USE_SYSTEM_CA", "HTTPS_PROXY", "HTTP_PROXY", "NO_PROXY", "NODE_EXTRA_CA_CERTS"]` to the existing `[mcp_servers.edenred_plus]` entry so those named values are forwarded.
4. Check whether a VPN, endpoint-security product, DNS filter, or firewall treats `node.exe` differently from the browser.

Do not set [`NODE_TLS_REJECT_UNAUTHORIZED=0`](https://nodejs.org/api/cli.html#node_tls_reject_unauthorizedvalue); disabling certificate verification would expose the access token and account data.

## Security and limitations

- Requests are restricted to `https://prd.smarter.edenred.io`; redirects are refused.
- Browser login uses the configured Windows default browser, a unique temporary profile, and a private debugging pipe. The MCP never receives the password or OTP.
- The server does not log tokens, response bodies, addresses, or raw traffic; `.gitignore` excludes common capture, token, environment, log, and raw-response files.
- Card PANs are masked, transaction addresses are omitted, and monetary values are returned as decimal strings.
- Deal matching is deterministic text/category matching, not semantic search.
- The captured web home endpoint may expose fewer deals than the mobile app.
- The server does not retry requests or cache personal data.
- The current captured BFF contract targets the French tenant and web application version `19.3.0`; Edenred can change this unofficial contract without notice.

This browser-assisted login is an unofficial local convenience, not an OAuth client issued to this project. Remote HTTPS transport, mobile clients, and marketplace publication still require an Edenred-approved OAuth client and API agreement. The required access is listed in [docs/edenred-partner-access.md](docs/edenred-partner-access.md).

## License

MIT applies only to this source code and grants no rights to Edenred services, data, APIs, or trademarks.