doordash-mcp

An MCP server that lets AI agents order food, groceries, and more through DoorDash. Search restaurants, browse menus, build carts, and place orders — all programmatically.

Built with Bun, Patchright, and the Model Context Protocol SDK.

Why

DoorDash doesn't have a consumer API. The existing community MCPs use brittle scraping or outdated endpoints. This one reverse-engineers DoorDash's GraphQL API by running fetch() inside a real Chromium browser context, bypassing Cloudflare's TLS fingerprinting.

How it works

This MCP runs a headless Patchright (undetected Playwright) browser and executes all DoorDash API calls via page.evaluate(fetch(...)) inside the browser's JavaScript context. GraphQL queries were captured from real DoorDash browser sessions and are stored as .graphql files.

Setup

# Install
git clone https://github.com/anthropics/doordash-mcp.git
cd doordash-mcp
bun install
bunx patchright install chromium

# Configure
mkdir -p ~/.doordash-mcp
echo '{ "doordash": { "email": "your@email.com" } }' > ~/.doordash-mcp/config.json

# Initial login (headed browser — required once to earn Cloudflare clearance)
bun run login

# Add to your MCP client

Cursor

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "doordash": {
      "command": "bun",
      "args": ["/path/to/doordash-mcp/src/server.ts"]
    }
  }
}

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "doordash": {
      "command": "bun",
      "args": ["/path/to/doordash-mcp/src/server.ts"]
    }
  }
}

Tools

21 tools covering the full DoorDash lifecycle:

Discovery

Cart

Checkout

Group Orders

Account

Authentication (WIP)

Auth is a work in progress. Fully automated headless login is not yet reliable due to Cloudflare's anti-bot protections. The current approach requires a one-time manual login.

DoorDash requires a browser session. On first use:

1. Run bun run login — opens a headed Chromium browser

2. Log into DoorDash manually (Google, email+OTP, etc.)

3. Close the browser — session is saved to ~/.doordash-mcp/profile/

After the initial login, the MCP server runs headless. The session persists across tool calls within the same server process. If the session expires or the server restarts, you may need to run bun run login again.

The doordash_login / doordash_verify tools attempt automated re-authentication via email + OTP, but this depends on having a valid Cloudflare session from a prior headed login.

Architecture

src/
├── server.ts                    # MCP entrypoint (stdio transport)
└── services/doordash/
    ├── index.ts                 # 21 tool definitions
    ├── browser.ts               # Patchright browser manager + in-page GraphQL
    ├── login.ts                 # Headed login script
    └── queries/                 # GraphQL queries captured from real sessions
        ├── storepageFeed.graphql
        ├── addCartItem.graphql
        ├── createOrderFromCart.graphql
        ├── convenienceSearchQuery.graphql
        └── ... (19 total)

Key design decisions:

• In-page fetch: All API calls run inside the browser via page.evaluate(fetch(...)) to inherit the correct TLS fingerprint

• Persistent profile: Chromium profile at ~/.doordash-mcp/profile/ preserves cookies and session across restarts

• Captured queries: GraphQL queries are stored as files, captured from real browser sessions by intercepting network requests

• Schema discovery: DoorDash has introspection disabled — schemas were discovered by sending invalid queries and reading error messages

Store types

DoorDash has two types of storefronts with different APIs:

The doordash_menu tool auto-detects convenience stores and directs agents to use doordash_convenience_search.

Known limitations

• Cloudflare session: CF clearance may not survive MCP server restarts. A headed login (bun run login) re-earns it.

• VCC cards: Virtual credit cards are blocked by DoorDash's fraud detection. PayPal works.

• updateCartItemV2: DoorDash's quantity update mutation is broken server-side. The tool works around it via remove + re-add.

• Scheduled orders: Only ASAP delivery is supported. Scheduled time slot selection is not yet implemented.

License

MIT