cronometer-api-mcp

Hosted version for Claude.ai, ChatGPT, and Grok coming soon. Join the waitlist →

An MCP (Model Context Protocol) server for Cronometer nutrition tracking, built on the reverse-engineered mobile REST API.

Unlike cronometer-mcp, which takes a comprehensive GWT-RPC approach against Cronometer's web backend, this server talks to the same JSON REST API used by the Cronometer Android app -- with clean payloads and stable, versioned endpoints.

Features

• Food log -- diary entries with food names, amounts, meal groups

• Nutrition data -- daily macro/micro totals and nutrition scores with per-nutrient confidence

• Food search -- search the Cronometer food database, get detailed nutrition info

• Diary management -- add/remove entries, copy days, mark days complete

• Custom foods -- create foods with custom nutrition data

• Macro targets -- read weekly schedule and saved templates

• Fasting -- view history and aggregate statistics

• Biometrics -- weight, body fat, heart rate, and other tracked metrics over a date range

Related MCP server: nutrition-mcp

Quick Start

1. Install uv

curl -LsSf https://astral.sh/uv/install.sh | sh

2. Set credentials

export CRONOMETER_USERNAME="your@email.com"
export CRONOMETER_PASSWORD="your-password"

3. Configure your MCP client

uvx downloads and runs the server on demand -- no separate install step.

OpenCode (opencode.json)

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cronometer": {
      "type": "local",
      "command": ["uvx", "cronometer-api-mcp"],
      "environment": {
        "CRONOMETER_USERNAME": "{env:CRONOMETER_USERNAME}",
        "CRONOMETER_PASSWORD": "{env:CRONOMETER_PASSWORD}"
      },
      "enabled": true
    }
  }
}

Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "cronometer": {
      "command": "uvx",
      "args": ["cronometer-api-mcp"],
      "env": {
        "CRONOMETER_USERNAME": "your@email.com",
        "CRONOMETER_PASSWORD": "your-password"
      }
    }
  }
}

Available Tools

Food Log & Nutrition

Food Search & Details

Targets & Tracking

All date parameters use YYYY-MM-DD format and default to today when omitted.

Diary Management

FORK: hardened fork, read/write. This fork ran read-only through its first eight phases; the owner enabled writes on 2026-07-27. Write tools carry readOnlyHint: False and remove_food_entry carries destructiveHint: True, so clients can warn before mutating. Every tool — read and write — is rate-limited and audited. The biometrics tools (list_biometrics, get_biometrics) remain removed, holding the surface at exactly 13. tests/test_tool_surface.py pins that surface in both directions.

Date ranges are capped at 90 days per call, calls are rate-limited to 60/hour, and every call is logged (shapes and counts only, never contents). See CLAUDE.md for the constraints, AUDIT.md for the upstream security review, and RUNBOOK.md for operations.

Remote Deployment

The server supports remote deployment with OAuth 2.1 authorization (PKCE) for use with Claude.ai and other remote MCP clients.

Environment Variables

FORK: the four variables marked Remote are mandatory whenever MCP_TRANSPORT is sse or streamable-http — the server refuses to start without them. Upstream treated them as optional and served the diary unauthenticated when they were absent, so a forgotten secret was a silent downgrade to no authentication at all.

Dokku / Heroku Deployment

The project includes a Procfile and .python-version for direct deployment with the Heroku Python buildpack:

# Create app
dokku apps:create cronometer-api-mcp

# Set environment
dokku config:set cronometer-api-mcp \
  MCP_TRANSPORT=streamable-http \
  MCP_AUTH_TOKEN=$(openssl rand -hex 32) \
  MCP_OAUTH_CLIENT_ID=my-client \
  MCP_OAUTH_CLIENT_SECRET=$(openssl rand -hex 32) \
  MCP_BASE_URL=https://your-domain.com \
  CRONOMETER_USERNAME=your@email.com \
  CRONOMETER_PASSWORD=your-password

# Deploy
git push dokku main

Claude.ai Remote Connection

When deployed remotely with OAuth configured, connect from Claude.ai using:

• Server URL: https://your-domain.com/mcp

• OAuth Client ID: Value of MCP_OAUTH_CLIENT_ID

• OAuth Client Secret: Value of MCP_OAUTH_CLIENT_SECRET

Claude.ai will open a browser tab for authorization. Click Authorize to complete the connection.

Development

For local development, copy .env.example to .env and fill in your credentials:

cp .env.example .env
# edit .env
uv run cronometer-api-mcp

The CLI auto-loads .env on startup (dev convenience only). Real environment variables always win over .env, so production deployments and MCP client env blocks are unaffected.

How It Works

This server communicates with mobile.cronometer.com -- the same REST API used by the Cronometer Android/Flutter app. The API was reverse-engineered through:

1. Static analysis of libapp.so (Dart AOT snapshot) from the APK to discover endpoint names

2. Traffic interception via Frida + mitmproxy to capture exact request/response formats

3. Trial-and-error against the live API to confirm payload shapes

The API uses two protocols:

• v2 (POST /api/v2/*) -- JSON-body auth, used for most operations (food search, diary read/write, nutrition, fasting, macros, biometrics)

• v3 (DELETE /api/v3/user/{id}/*) -- Header-based auth (x-crono-session), used for diary entry deletion

Python API

You can use the client directly:

from cronometer_api_mcp.client import CronometerClient
from datetime import date

client = CronometerClient()

# Search for foods
results = client.search_food("chicken breast")

# Get food details
food = client.get_food(results[0]["id"])

# Log a serving
client.add_serving(
    food_id=food["id"],
    measure_id=food["defaultMeasureId"],
    grams=200,
)

# Get today's diary
diary = client.get_diary()

# Get nutrition scores
scores = client.get_nutrition_scores()

License

MIT