ni-c/mealie-mcp

A Model Context Protocol (MCP) server for
Mealie, the self-hosted recipe manager and meal planner.
Lets MCP clients like Claude Code, Claude Desktop or Codex work with your recipe
collection: search and read recipes with their ingredients and steps, import new ones
from a website, keep tags and categories tidy, plan meals, build shopping lists from
those plans, and record what was actually cooked.
Fifty-three tools is the ceiling, not the floor: MEALIE_ALLOW_TOOLS=essential
registers a curated eight instead, and a model picks the right tool far more
reliably from eight than from fifty-four — see
choosing which tools load.
is resolved against the colour scheme of the page showing it, so GitHub
picks the variant that matches its own theme toggle. npm strips and
when it sanitises the README and keeps the , which is why that
fallback brings its own dark card instead of relying on a media query. -->
Mealie's REST API has 259 operations across 175 paths. This server exposes **54
tools**, chosen so that the common tasks are one call and the dangerous surface is
not reachable at all. Verified against **Mealie v3.28.0**; the source of truth for
every request shape is the GET /openapi.json of a running instance, not the
published documentation, which is out of date in several places.
What makes it different
**Fifty-three curated tools out of 259 API operations.** Mealie's REST API is far
larger than a model should reach into; what is here covers the common tasks in one
call — search, read and import recipes, keep tags and categories tidy, plan meals,
build shopping lists, manage cookbooks and ratings.
**update_recipe uses PATCH, not PUT.** Mealie's replace route silently drops
recipe fields that were not sent; only the fields you name change here.
**The dangerous surface is unreachable.** No admin routes, no token minting, no
webhooks and no outbound-HTTP triggers, whatever the token would allow.
Requirements
- Node.js 22 or newer
- A Mealie instance and an API token from **Settings → API Tokens**
Configuration
| Variable | Required | Description |
| ------------------------ | -------- | ---------------------------------------------------------------------------------- |
| MEALIE_URL | yes | Base URL, e.g. https://mealie.example.com |
| MEALIE_API_TOKEN | yes | Token from Settings → API Tokens. It acts as the user who created it. |
| MEALIE_READ_ONLY | no | Exactly true registers the 18 read tools only |
| MEALIE_ACCEPT_LANGUAGE | no | e.g. de-DE; localises unit and label names |
| MEALIE_INSECURE_TLS | no | Exactly true accepts a self-signed certificate, scoped to this connection |
| MEALIE_ALLOW_TOOLS | no | Comma-separated tool names, list_* prefixes, or essential for a curated preset |
| MEALIE_DENY_TOOLS | no | Same syntax; removed from whatever MEALIE_ALLOW_TOOLS left |
| ELICITATION | no | false replaces the approval dialog with the two-call token. **Not prefixed** |
The two booleans are compared against the literal string true, so a typo leaves
them **off** — check the startup line on stderr, which reports the mode in effect.
The token is removed from the process environment once it has been read, so child
processes cannot pick it up out of /proc/ /environ.
Choosing which tools load
MEALIE_ALLOW_TOOLS and MEALIE_DENY_TOOLS take comma-separated tool names;
a trailing * matches a whole family. essential is a curated preset of
eight: search_recipes, get_recipe, import_recipe_from_url, create_recipe, get_todays_meals, create_mealplan_entry, list_shopping_lists, add_recipe_to_shopping_list.
An entry that matches no tool aborts startup and names it, so a typo cannot
silently hide a tool — an absent tool is not something anyone traces back to an
environment variable. A filtered tool is never registered, so it is absent from
tools/list and unknown to tools/call alike, exactly like a write tool under