Mealie MCP Server

Item: Mealie MCP Server
Rating: 37
Author: M8ven

A security-conscious MCP server for self-hosted Mealie that enables recipe management, meal planning, and shopping list operations with robust security defaults.

→ bitmonster/mealie-mcp-server · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Tool descriptions don’t match what handlers do

1 tool describes read intent but its handler mutates — mealie_api_download (line 2331: target.unlink(missing_ok=True))

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 2 credentials: MEALIE_API_TOKEN, MEALIE_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configMEALIE_BASE_URL

configMEALIE_PUBLIC_URL

🔐 secretMEALIE_API_TOKEN— "[REDACTED]"

configMEALIE_USERNAME— [REDACTED]

🔐 secretMEALIE_PASSWORD— [REDACTED]

configMEALIE_MCP_ALLOW_MUTATIONS— Read-only by default: mutations require =true.

configMEALIE_MCP_MUTATION_SCOPE— comma-separated scopes>

configMEALIE_MCP_TIMEOUT— 30 seconds HTTP timeout

configMEALIE_MCP_DATA_DIR— ~/.cache/mealie-mcp Runtime data root

configMEALIE_MCP_DOWNLOAD_DIR— $DATA_DIR/downloads Controlled download directory

configMEALIE_MCP_MAX_DOWNLOAD_BYTES— 100 MiB Maximum binary download size

configMEALIE_MCP_MAX_JSON_BYTES— 10 MiB Maximum JSON response size

configMEALIE_MCP_MAX_OPENAPI_BYTES— 20 MiB Maximum OpenAPI response size

configMEALIE_MCP_MAX_IMAGE_PIXELS— 40,000,000 Maximum decoded image pixels

configMEALIE_MCP_OCR_TIMEOUT— 60 seconds Tesseract timeout per OCR call

configMEALIE_MCP_MAX_OCR_TEXT_CHARS

configMEALIE_MCP_MAX_CHEFKOCH_BYTES

configMEALIE_MCP_ALLOWED_LOCAL_ROOTS— empty Additional local upload roots, separated by the OS path separator

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 8 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/bitmonster-mealie-mcp-server-jbpzys)](https://m8ven.ai/mcp/bitmonster-mealie-mcp-server-jbpzys)

commit: 6e13e85959c82c2f9cece1f83724fb70f3d35bbb

code hash: 9351247b3743cf44b72621ae6b205a8ccbaba63a44f6b6a3085fc86ca0e31622

verified: 7/31/2026, 9:17:37 AM

view raw JSON →