[![M8ven Score](https://m8ven.ai/badge/mcp/hchzr-m-connect-1q109p?v=fe50c18358617a685afb76a8b951b9ad)](https://m8ven.ai/mcp/hchzr-m-connect-1q109p?s=readme)
# M-Connect

An unofficial client for the Migros mobile API. It comes in two parts:

- **An MCP server** so Claude (or any MCP client) can search the Migros
  catalogue, check offers and stores, and read your own Cumulus data.
- **A local web dashboard** for the same thing, in your browser.

It is not affiliated with Migros. See [Legal](#legal) before using it.

## What you can do

Without logging in: search products with prices and filters, scan barcodes,
browse offers and promotions, find stores and check stock, look up recipes.

Signed in with your Migros account: see your Cumulus points, coupons, bons and
stampcards, read your digital receipts and spending, and see which coupons match
the products you buy most.

It is read-only by default. Anything that changes your account needs an explicit
`confirm=true`.

## Install

```bash
python3 -m venv .venv && source .venv/bin/activate
pip install -e '.[web]'
```

## Log in

The login uses your own Migros credentials. The app's OAuth client secret is not
in this repo; it is read at runtime from your own copy of the app, so point
`MIGROS_APP_LIBRARY` at the app binary:

```bash
export MIGROS_APP_LIBRARY=/path/to/Payload/migros.app/Frameworks/MigrosAppLibrary.framework/MigrosAppLibrary
migros-login
```

This opens your browser. Log in, and you land on a `www.migros.ch` page whose
URL contains `?code=...`. Copy that full URL and paste it back when asked.
Tokens are saved to `~/.migros/tokens.json`.

## Run

MCP server (for Claude Desktop or Claude Code):

```bash
migros-mcp
```

Add it to Claude Desktop in `~/Library/Application Support/Claude/claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "migros": {
      "command": "/absolute/path/.venv/bin/migros-mcp",
      "env": { "MIGROS_APP_LIBRARY": "/path/to/MigrosAppLibrary" }
    }
  }
}
```

Web dashboard:

```bash
migros-web          # http://127.0.0.1:8765
```

## Config

All optional, set as environment variables.

| Variable | Default | Meaning |
|---|---|---|
| `MIGROS_APP_LIBRARY` | none | path to the app binary (loads the OAuth secret for login) |
| `MIGROS_FIREBASE_PLIST` | none | path to the app's `GoogleService-Info.plist` (shopping-list items) |
| `MIGROS_LANGUAGE` | `de` | `de`, `fr`, `it`, `en` |
| `MIGROS_ZIP` | none | postcode to shop from (sets your region and prices) |
| `MIGROS_IMPERSONATE` | off | e.g. `safari18_0`, if the gateway blocks plain requests (needs `pip install '.[impersonate]'`) |

## Notes

- The production gateway sits behind Cloudflare. A normal client usually gets
  through; if you see a `403` maintenance page, set `MIGROS_IMPERSONATE` or run
  from a different network.
- Editing your shopping list is not possible from here. The app guards that data
  with Firebase App Check (device attestation), which a script cannot produce.

## Tests

```bash
make test
```

## Legal

This is an independent, personal-use project. It is not affiliated with,
authorised by, or endorsed by Migros.

- It ships no Migros code, assets, keys, or data. You use your own login, and
  the OAuth secret and Firebase config are read from your own copy of the app.
- Use it with your own account only, at human scale. Do not scrape, poll, or
  automate at a scale a person would not.
- You are responsible for following Migros's terms and your local law.
- Found a security issue in Migros's app or services? Report it to Migros, not
  here.
- No warranty. It may break when Migros changes its API.

"Migros" and "Cumulus" are trademarks of their owners.

## License

MIT. See [LICENSE](LICENSE).