mfp-mcp

A Model Context Protocol (MCP) server that connects AI assistants to your MyFitnessPal data. Lets Claude read your food diary, nutrition goals, weight measurements, and more.

MFP has no official API - this uses the myfitnesspal Python library which scrapes the website using browser cookies.

Quick start

# Install
git clone https://github.com/jevy/myfitnesspal-mcp.git
cd myfitnesspal-mcp
uv sync --extra browser

# Authenticate (must be logged into MFP in your browser first)
mfp-mcp auth --from-browser chrome

# Verify
mfp-mcp auth-status

# Start the server
mfp-mcp serve

Related MCP server: Hevy MCP

Adding to Claude Code

Run mfp-mcp config to get the JSON snippet, or add this to your Claude Code project settings (.claude/settings.json):

{
  "mcpServers": {
    "myfitnesspal": {
      "command": "/path/to/your/.venv/bin/mfp-mcp",
      "args": ["serve"]
    }
  }
}

Replace the path with the output of which mfp-mcp after installing.

Tools

CLI reference

mfp-mcp auth --from-browser <browser>   Authenticate (extract + store cookies)
mfp-mcp auth-status                     Check stored credential validity
mfp-mcp auth-clear                      Remove stored credentials
mfp-mcp config                          Output Claude Code MCP config JSON
mfp-mcp serve                           Start stdio MCP server
mfp-mcp help                            Show help

Authentication

MFP requires browser cookies for access. The auth command extracts cookies from your browser and stores them securely.

# Auto-detect browser
mfp-mcp auth --from-browser auto

# Specific browser
mfp-mcp auth --from-browser chrome
mfp-mcp auth --from-browser firefox
mfp-mcp auth --from-browser safari

You must be logged into myfitnesspal.com in the browser first.

How authentication works

Credentials are stored using a layered system (checked in order):

1. Environment variable (MFP_COOKIES) - for CI/testing

2. System keyring - macOS Keychain, GNOME Keyring, etc.

3. Encrypted file - ~/.config/myfitnesspal-mcp/credentials.enc

The encrypted file uses AES-256-GCM with a key derived via PBKDF2-HMAC-SHA256 (600,000 iterations) bound to machine-specific identifiers. File permissions are set to 600 (owner-only).

Cookie values are never logged, never included in error messages, and never returned to Claude. Multiple layers of defence prevent accidental leakage:

• repr=False on all cookie fields

• Custom __repr__ implementations that mask values

• Result sanitisation before returning tool responses

Architecture

src/mfp_mcp/
├── cli.py              # CLI entry point
├── server.py           # stdio MCP server, tool registration
├── auth/
│   ├── storage.py      # Unified credential storage (env → keyring → file)
│   ├── keyring.py      # System keyring backend
│   ├── encrypted.py    # AES-256-GCM file backend
│   ├── browser.py      # Browser cookie extraction
│   └── validator.py    # Cookie validation via NextAuth session
├── client/
│   ├── mfp.py          # Async wrapper around myfitnesspal library
│   └── models.py       # Pydantic response models
└── tools/
    ├── _validation.py  # Pydantic input validation
    ├── diary.py        # mfp_get_diary
    ├── nutrition.py    # mfp_get_nutrition_summary
    ├── goals.py        # mfp_get_goals
    ├── measurements.py # mfp_get_measurements
    ├── food.py         # mfp_search_food, mfp_get_food_details
    ├── profile.py      # mfp_get_profile
    ├── auth_status.py  # mfp_auth_status
    └── refresh_auth.py # mfp_refresh_auth

Technical notes

MFP WAF workaround

The upstream myfitnesspal library's __init__ hits /user/auth_token which MFP's WAF now blocks (HTTP 403). This server works around the issue by:

1. Creating the library's Client object without calling __init__ (via object.__new__())

2. Setting up the HTTP session manually with plain requests (cloudscraper also gets blocked)

3. Getting the username from MFP's NextAuth session endpoint (/api/auth/session)

4. The HTML scraping methods (get_date, get_measurements) continue to work normally

Rate limiting

Requests to MFP are throttled to one every 500ms with a lock to prevent concurrent requests. This is conservative to avoid triggering MFP's rate limits.

Development

# Install with dev dependencies
uv sync --extra dev --extra browser

# Run tests
pytest

# Lint
ruff check src/ tests/

Requirements

• Python 3.12+

• A MyFitnessPal account with an active browser session

• uv for dependency management