Lufa Farms MCP Server

Let an AI agent do your weekly grocery shopping on Lufa Farms.

"Add two portions of heirloom tomatoes, a sourdough loaf,
 and whatever goat cheese they have this week to my basket."

Disclaimer: This is an independent personal project, not affiliated with, endorsed by, or officially connected to Lufa Farms in any way. It wraps Lufa Farms' internal, undocumented web endpoints (see Discovered API endpoints) rather than any official or public API.

What is this?

An MCP (Model Context Protocol) server that wraps the Lufa Farms web API, exposing it as tools an AI agent (Claude, etc.) can call. You can browse the catalog, search for products, fill your basket, and inspect your upcoming order — all through natural language.

The server was reverse-engineered from the Lufa Farms web app's network traffic. It uses their internal /superMarket/* JSON endpoints, authenticated via a PHP session cookie.

Related MCP server: Instacart MCP Server

Requirements

• Python 3.12+

• A Lufa Farms account (https://montreal.lufa.com)

pip install -e .

This installs the lufa-farms-mcp (server) and lufa-farms (login CLI) commands.

Project structure

MCP-LufaFarms/
├── src/lufa_farms/
│   ├── server.py     # MCP server — tool declarations and dispatch
│   ├── client.py     # Async HTTP client for the Lufa Farms API
│   ├── cli.py        # `lufa-farms login` / `lufa-farms logout`
│   └── __main__.py   # `python -m lufa_farms` entry point
├── pyproject.toml    # Project metadata
└── README.md

Setup

This is a standard stdio MCP server, so it works with any MCP-compatible agent or client (Claude Code, Claude Desktop, Cursor, Windsurf, etc.) — not just one. After pip install -e ., add it to your client's MCP server config using the installed lufa-farms-mcp command:

{
  "mcpServers": {
    "lufa-farms": {
      "type": "stdio",
      "command": "lufa-farms-mcp"
    }
  }
}

Where that config lives depends on the client, e.g.:

Then restart the client. The tools will be available in every conversation.

Available tools

Authentication

Logging in is not an MCP tool — credentials must never be typed into the agent conversation. Run this yourself in a terminal instead:

lufa-farms login

It prompts for your email and password (password hidden, via getpass) and saves the resulting session to ~/.lufa_session.json. The agent only ever checks or clears that session:

Lufa sessions last ~30 days. If yours expires, any tool call will return a clear message telling you to run lufa-farms login again — no need to watch for raw HTTP errors.

Products

Basket

lufa_add_to_basket / lufa_remove_from_basket persist to Lufa's server immediately — there is no "confirm order" step anywhere in Lufa's actual site (no such button or endpoint exists in the marketplace frontend), so lufa_save_basket has nothing to do and is kept only for backwards compatibility.

Orders

Example prompts

Search for goat cheese and add the cheapest one to my basket.

Show me everything in my basket and tell me the total.

Find all the bread products available this week and describe each one.

Remove the kale from my basket and replace it with spinach.

How much time do I have left before this week's order is delivered?

How authentication works

1. A GET to /en/login seeds the PHPSESSID cookie.

2. A POST to /en/login submits the Yii LoginForm (fields: LoginForm[user_email], LoginForm[password]).

3. The session is validated against /superMarket/GetUserOrderDetails.

4. All cookies are persisted to ~/.lufa_session.json — subsequent runs reuse them without re-logging in.

Delivery countdown

Lufa's API has no explicit "order cutoff" field. lufa_get_checkout_info fills that gap by computing a countdown from the delivery date and delivery window it does return: delivery_window_starts_at (an ISO timestamp) and time_until_delivery (e.g. "3d 22h"). This is time until your delivery window opens, not a confirmed order-lock deadline — Lufa may stop accepting basket changes some time before that, but exactly when hasn't been reverse-engineered. Treat it as a useful approximation, not a hard cutoff.

Discovered API endpoints

Contributing

See CONTRIBUTING.md.

Security

See SECURITY.md for the threat model and how to report an issue.

License

GPL-3.0-or-later.