This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
Lets Claude (and other AI apps) search Migros products, recipes, stores and promotions. Sign in, and it can also manage your basket and look up your orders, receipts and Cumulus points.
Unofficial. Not made or supported by Migros. It uses the same behind-the-scenes addresses as the Migros website, so it can break whenever Migros changes them. Use at your own risk.
This is a fork. herp75/migros-mcp is lewpgs/migros-mcp with security hardening, live tests and more tools (see the CHANGELOG). It comes as a Docker image,
ghcr.io/herp75/migros-mcp, and is listed in the MCP Registry asio.github.herp75/migros-mcp. The npm packagemigros-mcpand the Claude Desktop installermigros-mcp.mcpbare upstream's version, not this one.
It runs on your own computer, so it works in desktop apps that can start a program: Claude Desktop, Claude Code, Cursor and similar. It doesn't work on claude.ai in a browser or in the Claude phone apps. You need Docker or Podman.
Your login, in a file only you can read. Skip this to only search.
install -m 600 /dev/null ~/.config/migros-mcp.env
"${EDITOR:-nano}" ~/.config/migros-mcp.envMIGROS_EMAIL=you@example.com
MIGROS_PASSWORD=your-passwordOne line each, no quotes. $, # and quotes in the password are fine (Docker reads the file as written). For 2FA without being asked for codes, add MIGROS_TOTP_SECRET=... (see Your Migros account).
The saved login lives in the Docker volume migros-mcp, so it survives restarts. That matters: Migros blocks computers that sign in too often.
claude mcp add migros -- docker run -i --rm \
--env-file ~/.config/migros-mcp.env -v migros-mcp:/config \
ghcr.io/herp75/migros-mcp:0.6Leave out --env-file … to only search. With Podman, write podman instead of docker.
Add this to the app's MCP config file, with your home folder in the path:
Claude Desktop: Settings > Developer > Edit Config
Cursor: ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project)
{
"mcpServers": {
"migros": {
"command": "docker",
"args": [
"run", "-i", "--rm",
"--env-file", "/home/you/.config/migros-mcp.env",
"-v", "migros-mcp:/config",
"ghcr.io/herp75/migros-mcp:0.6"
]
}
}
}Other apps (VS Code, Windsurf, Zed and so on) run the same command but lay out their config a little differently. Check your app's MCP instructions.
Each image is signed with cosign, keyless, by the release workflow of this repository:
cosign verify ghcr.io/herp75/migros-mcp:0.6 \
--certificate-identity-regexp '^https://github.com/herp75/migros-mcp/\.github/workflows/(docker|release)\.yml@' \
--certificate-oidc-issuer https://token.actions.githubusercontent.comStart a new chat and ask: "Search Migros for oat milk."
Related MCP server: wegmans-mcp-cloudflare-workers
Optional. Without it, product search, product details, stock, stores, promotions and recipes all work.
With it, Claude can also see and change your basket and shopping lists, look up your orders, in-store receipts and Cumulus points, and put Cumulus coupons on your card. It never places an order or pays. It gives you a checkout link, and you finish on migros.ch yourself.
What to enter depends on how you sign in to migros.ch:
You sign in with | Enter |
Email and password | Email and password. Done. Use a password you use nowhere else: the server keeps it in a file on your computer. |
Email, password and a 6-digit code from an authenticator app | Email and password. When Claude needs to sign in, it asks you for the current code. That only happens when Migros ends the saved login, not in every chat. |
The same, but you never want to be asked for a code | Email, password and your setup key (see below). |
The setup key (also called the TOTP secret) is not the 6-digit code. It's the long code, about 32 letters and digits like JBSWY3DPEHPK3PXP..., that you got when you first added Migros to your authenticator app. It never changes.
Saved in a password manager? Open the Migros entry and look for an option like "View one-time password secret". If you see a link starting with otpauth://, the setup key is the part after secret=.
Not saved anywhere? Migros only shows it while you set up 2FA. In your Migros account settings, remove 2FA and set it up again. Under the QR code is a box saying "Or enter the following key in the authenticator app". Copy that key before you finish, and add the new entry to your authenticator app.
Add it as one more line, MIGROS_TOTP_SECRET=..., in ~/.config/migros-mcp.env (see Install).
Only codes from an authenticator app work. If your account uses a passkey only, or codes by SMS, add an authenticator app in your Migros account settings first.
All settings are environment variables. With Docker, put them in ~/.config/migros-mcp.env (see Install). None is required.
Variable | Default | What it does |
| none | Your Migros login email. Without email and password, only the tools without an account work. |
| none | Your Migros password. Only ever sent to |
| none | The 2FA setup key, so you're never asked for a code. Works like a second password: keep it as safe. With it in the same file as the password, anyone who gets that file has both factors. |
| on; off in the image |
|
| built in | Overrides the browser name sent with the searches that need no account. Rarely needed. |
| the usual place; | Where the saved login ( |
For development only: MIGROS_TEST_EMAIL, MIGROS_TEST_PASSWORD, MIGROS_TEST_TOTP_SECRET, MIGROS_LIVE_ENV_FILE and MIGROS_LIVE_SESSION_DIR (see Development).
Without an account:
"Search Migros for protein bars"
"What's the nutrition info for this product?"
"Find Migros stores near Zurich"
"What promotions does Migros have right now?"
"Find me a risotto recipe"
With your account:
"What's in my Migros basket?"
"Add 2 litres of milk to my basket"
"Add the ingredients for this recipe to my basket"
"Show me my last 5 Migros orders"
"How much did I spend at Migros last month?"
"Which Migros stores did I shop at last month, and for how much?"
"Which Cumulus coupons do I have? Activate the one for coffee."
"Make a new shopping list for the weekend"
"Give me the link to finish my checkout"
:0.6 follows the newest 0.6.x release (fixes only). To get it, pull the image and restart the app:
docker pull ghcr.io/herp75/migros-mcp:0.6New features come with a new minor version (:0.7): change the tag in your config. Releases are listed on the releases page and in the CHANGELOG. The image doesn't check for updates itself (MIGROS_MCP_UPDATE_CHECK is off in it).
Your email, password and setup key are only ever sent to Migros' own login page (login.migros.ch). A 6-digit code you give Claude is used for that one sign-in and never stored or logged.
Your password and setup key sit in ~/.config/migros-mcp.env, readable only by you, not in the app's config file.
Once you're signed in, the saved login (cookies and an access token) stays on your computer, in session.json in the Docker volume migros-mcp. docker volume rm migros-mcp signs you out. Inside the volume, only the server's user can read it. (Run without Docker, it's in ~/.config/migros-mcp/ on Linux, ~/Library/Application Support/migros-mcp/ on a Mac, %APPDATA%\migros-mcp\ on Windows.)
Your email, password, setup key, cookies and access token are masked in error messages.
Tools that change your basket are marked as such, so your app can ask you before running them. Leave that approval on.
Give Claude the 6-digit code yourself. Don't let an AI that can act on your account also read your codes (for example from a password manager): then a text it reads could get it to sign in, and the second factor protects nothing.
Product texts, recipes and order data come from Migros and other people. migros-mcp tells the AI to treat them as information, not as instructions.
It never places orders or pays. get_checkout_link gives you a link, and you finish on migros.ch.
Found a security problem? See SECURITY.md.
"Too many requests" or other sign-in errors. Migros blocks computers that sign in too often. When that happens, migros-mcp stops trying for a while on its own (30 seconds at first, longer if it keeps happening) and keeps using your current login while it's still valid. The error says until when. Wait until then before trying again. Restarting the app over and over, or a wrong password, makes it worse.
Something that used to work fails. Migros may have changed its website. Update to the newest version (see Updating), and if it still fails, open an issue.
These are what Claude calls behind the scenes. You don't need them to use it.
The Kind column says what a tool does to your account: reads, changes (nothing is lost) or deletes (removes or overwrites something). Your app uses this to decide when to ask you first. Keep that approval on for anything that isn't reads.
Without an account (all reads)
Tool | What it does |
| Search products by name or keyword, including ones sold only online (such as "Partner" products). |
| Nutrition, ingredients, allergens, price and ratings. Online-only products also get their online price and a Partner flag. |
| Whether a product is in stock at a given store. Updated once a day. "Unknown" when Migros has no data. |
| All Migros product categories. |
| Stores near a place, with addresses and opening hours. |
| Current promotions and deals. |
| Search Migusto, Migros' recipe site, by text and/or ingredients. German, French and Italian only. |
| A full recipe: ingredients, steps, photos, nutrition. |
| The Migros products Migusto suggests for a recipe, with name and price, ready for |
With your account
Tool | Kind | What it does |
| changes | Sign in with the current 6-digit code. Only used when no setup key is saved. |
| reads | Your name, email and language. |
| reads | Your saved delivery and billing addresses. |
| reads | Your shopping lists by name, for people with more than one. |
| changes | Start a new, empty list. |
| deletes | Give a list a new name (the old one is replaced). |
| deletes | Delete a list with its items. Only after you confirm, and never your only list. |
| reads | What's in your basket (a shopping list). |
| deletes | Add a product (1 by default). If it's already there, its quantity is replaced by the new number, not added to. |
| deletes | Set how many of an item you want (0 removes it). |
| deletes | Remove an item. |
| deletes | Add a note to an item, such as "laktosefrei" (replaces an earlier note). |
| reads | A link to finish checkout on migros.ch. The link is the same for every list: with several lists, check on migros.ch that the right one is shown. |
| reads | Your online orders, page by page, filterable by status. |
| reads | One order in full. |
| reads | Your Cumulus card: points collected this period, card number, cardholder, memberships. |
| reads | Your current personal Cumulus coupons, and which can be activated. |
| changes | Put a coupon on your Cumulus card for your next purchase. Nothing is bought. |
| changes | Take a coupon off the card again. |
| reads | Your Cumulus bons (vouchers). You redeem them yourself at checkout. |
| reads | Your in-store receipts (Kassenbons) for a date range: store, date, amount, points. |
| reads | The link to the receipts page on migros.ch, where you open a receipt to see its items (the same link for every receipt; the items aren't available to this server). |
Without an account, it uses migros-api-wrapper and the same addresses the Migros website calls, with a guest token it fetches at startup.
With an account, it signs in at login.migros.ch the way a browser does (email, then password, then the 2FA code if your account has one) and saves the login. The access token only lasts a short while, so it's renewed quietly from the saved login, without signing in again. A full sign-in only happens when Migros ends the saved login.
Saving the login matters because Migros' sign-in page sits behind Cloudflare, which blocks computers that sign in too often.
Without a setup key, once it knows your account needs a code, it waits until Claude has one before sending your password. That way it never starts a sign-in it can't finish.
How the code is laid out, and how a tool is added: docs/architecture.md. How to contribute: CONTRIBUTING.md.
git clone https://github.com/herp75/migros-mcp.git
cd migros-mcp
npm install
npm run build
npm testBefore a pull request, run the same checks as CI:
npm run typecheck # TypeScript, including the tests
npm run lint # ESLint
npm run format:check # Prettier (npm run format fixes it)
npm run test:coverage # tests, failing below 80 % line coverage of src/git config blame.ignoreRevsFile .git-blame-ignore-revs hides the one big formatting commit from git blame.
Check the tools that need no account against the live Migros website. GitHub also runs this every Monday, so a change on Migros' side shows up early:
npm run live-checkCheck the tools that need an account, with a dedicated test account (never your own). Put its login in .env.live (git-ignored, chmod 600) as MIGROS_TEST_EMAIL, MIGROS_TEST_PASSWORD and, for 2FA, MIGROS_TEST_TOTP_SECRET. --write also adds a product to the basket, changes its quantity and removes it again, checking that the basket ends up as before. The test login is kept in .live-session/, so repeated runs don't sign in again each time.
Migros answers logins from GitHub's servers with a bot check, so this runs weekly on a computer instead: scripts/migros-live-check.sh pulls the published image (edge, built from main), checks its cosign signature, and runs the check with --write inside that image with rootless podman, so it tests what people install and nothing from the repo runs outside a container. It needs podman and cosign; the saved test login is kept in ~/.local/state/migros-live-check/. To schedule it, copy scripts/systemd/migros-live-check.service and .timer to ~/.config/systemd/user/ and run systemctl --user enable --now migros-live-check.timer; results are in journalctl --user -u migros-live-check. The live workflow on GitHub can still be started by hand, to see whether GitHub's servers get through again.
npm run live-account # read-only
npm run live-account -- --write # with the basket round tripTry it with the MCP Inspector:
npx -y @modelcontextprotocol/inspector node dist/index.jsMIT, see LICENSE.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
This server cannot be deployed
Search independent stores, check recalls and product facts, and prepare checkout at the store.
Grocery lists, recipes, menu plan, household, supermarket offers and receipt photos to track costs
Compare prices across Swiss and European shops — barcode (GTIN) lookup and daily price history.
Grocery meal planning, budgets, and flyer deals for Canadian households. Auth required.
