# @ni-c/mealie-mcp MCP server for Mealie, the self-hosted recipe manager and meal planner - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 0.2.0 - **Author:** io.github.ni-c - **License:** Unknown - **npm:** @ni-c/mealie-mcp - **Source:** https://github.com/ni-c/mealie-mcp - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 1 day ## Security scan - **Status:** clean - **Scanned:** 2026-09-01T21:44:56.996Z - **Version scanned:** 0.2.0 - **CVEs:** none found by OSV at scan time ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `list_cookbooks` — Lists the cookbooks of the household. A cookbook is a saved filter over - `get_cookbook` — Fetches a cookbook and the recipes it currently matches. Accepts the - `create_cookbook` — Creates a cookbook — a named, saved view of the recipe collection. - `delete_cookbook` — Deletes a cookbook. The recipes it matched are not touched — a cookbook - `set_recipe_rating` — Sets the personal rating of a recipe and/or marks it as a favourite. - `add_recipe_comment` — Adds a comment to a recipe. Comments are visible to everyone in the - `delete_recipe_comment` — Deletes a comment. Requires confirmation: call once to receive a token, - `create_timeline_event` — Adds an entry to a recipe's timeline — typically a note about having - `list_foods` — Lists the structured foods of the group — the ingredient vocabulary - `list_units` — Lists the measurement units of the group, with their abbreviations. - `parse_ingredients` — Splits free-text ingredient lines into quantity, unit, food and note, - `create_food` — Adds a food to the group vocabulary so ingredient lines can be matched - `create_unit` — Adds a measurement unit to the group vocabulary. - `preview_recipe_url` — Fetches a URL and reports what Mealie would extract from it, WITHOUT - `import_recipe_from_url` — Has Mealie fetch a recipe page and save it as a new recipe. The fetch - `import_recipe_from_html_or_json` — Creates a recipe from HTML or schema.org recipe JSON supplied directly, - `import_recipe_from_image` — Creates a recipe from a photo of one — a cookbook page, a handwritten - `get_about` — Reports the Mealie version and the identity the API token acts as: user, - `list_mealplans` — Lists the meal plan of the household in a date range. Each entry is - `get_todays_meals` — Returns the recipes planned for today, as Mealie computes "today" for - `create_mealplan_entry` — Puts a recipe or a free-text note on the meal plan for one day. Give - `create_random_meal` — Lets Mealie pick a recipe for a day and slot, honouring the meal plan - `update_mealplan_entry` — Moves an entry to another day or slot, or replaces the recipe behind it. - `delete_mealplan_entry` — Removes one entry from the meal plan. The recipe itself is not touched. - `list_organizers` — Lists the tags, categories or tools defined in the group, with their - `create_organizer` — Creates a tag, category or recipe tool. Assigning one to a recipe with - `update_organizer` — Renames a tag, category or tool. Mealie regenerates the slug from the - `delete_organizer` — Deletes a tag, category or tool. The recipes themselves are kept, but - `search_recipes` — Searches the recipe collection. Returns summaries — name, slug, id, - `get_recipe` — Fetches one recipe with everything needed to cook it: ingredients, - `suggest_recipes` — Suggests recipes that can be cooked from the foods and tools marked as - `list_recipe_comments` — Lists the comments other users of the instance left on a recipe. - `list_recipe_timeline` — Lists the timeline of a recipe: when it was created, updated and each - `create_recipe` — Creates a recipe from the given fields. To add one from a website use - `update_recipe` — Changes individual fields of a recipe. Only the fields given are - `duplicate_recipe` — Creates a copy of a recipe under a new name, leaving the original - `set_recipe_last_made` — Records when a recipe was last cooked. Mealie shows this on the recipe - `delete_recipe` — Deletes a recipe permanently, together with its comments, timeline and - `list_share_tokens` — Lists the public share links that currently exist, with the recipe each - `create_share_token` — Creates a link that lets anyone read one recipe without logging in. ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"mealie\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@ni-c/mealie-mcp\"\n ],\n \"env\": {\n \"MEALIE_API_TOKEN\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `MEALIE_API_TOKEN` — Mealie API Token (required) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 1 credential (1 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Extensive blast radius — deletes data; holds an api key. - Floor 56, ceiling 56 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/%40ni-c%2Fmealie-mcp - Install plan: https://forgeregistry.com/api/v1/packages/%40ni-c%2Fmealie-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/%40ni-c%2Fmealie-mcp - HTML page: https://forgeregistry.com/registry/%40ni-c%2Fmealie-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.