Cronometer MCP server (rollecode/cronometer-mcp) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 29 tools. No publisher has claimed this listing.

Emerging

74/100

Cronometer MCP server

Item: Cronometer MCP server
Rating: 74
Author: M8ven

Enables reading and writing your Cronometer food diary from Claude.ai and Claude Code, including food entries, notes, biometrics, exercises, and fasts.

→ rollecode/cronometer-mcp · listed on glama

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

rollecode

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

✅

29 tools verified — handlers match their declared behaviour

12 read-only tools verified — handlers contain no write/delete/exec

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 2 credentials: CRONOMETER_PASSWORD, CRONOMETER_TOTP_SECRET

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes29 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

get_food_log

Get all diary entries for a given date.

add_food_entry

Add a food entry to the Cronometer diary.

remove_food_entry

Remove one or more food entries from the Cronometer diary.

mark_day_complete

Mark a diary day as complete or incomplete.

copy_day

Copy all diary entries from the previous day to the given date.

get_daily_nutrition

Get daily nutrition summary with consumed macro and micronutrient totals.

get_nutrition_scores

Get nutrition scores with per-nutrient consumed amounts and category grades.

search_foods

Search Cronometer's food database by name.

get_food_details

Get detailed food information including nutrition and serving sizes.

add_custom_food

Create a custom food with any nutrients you have, from 1 to all 94.

retire_custom_food

Retire a custom food so it stops being offered for new entries.

list_nutrients

Every nutrient add_custom_food accepts, with its unit and category.

get_macro_targets

Get current macro targets including weekly schedule and templates.

get_fasting_history

Get fasting history from Cronometer.

get_fasting_stats

Get aggregate fasting statistics.

list_biometrics

List the biometric metrics tracked in Cronometer.

get_biometrics

Get a biometric time series such as weight or body fat from Cronometer.

edit_food_entry

Change the amount or time of an already logged food entry.

add_note

Add a note to a day in the Cronometer diary.

edit_note

Replace the text of an existing diary note.

add_biometric

Record a biometric measurement, such as weight or body fat.

edit_biometric

Change the value of a recorded biometric.

add_exercise

Log an exercise entry.

edit_exercise

Change the duration or calorie burn of a logged exercise.

add_fast

Record a fast.

edit_fast

Change a recorded fast, including ending one that is still open.

delete_fast

Remove a recorded fast.

get_targets

Nutrient targets for the account, as shown beside the diary totals.

set_nutrient_target

Set a nutrient's daily target, its upper limit, or whether it is tracked.

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configCALL_TIMEOUT_MSHow long a call may go quiet before it is cut off, 120000 by default

configCONFIG_DIR~/.config/cronometer-mcp node set-password.js 'your-password-here'

configISSUERThe public address of the server

configUPSTREAMWhere the MCP server is, http://127.0.0.1:8430 by default

configMCP_PUBLIC_URLPublic address, used to advertise the icon to clients

configMCP_TRANSPORT

configMCP_HOST

configMCP_PORTMCP server port, 8430 by default

configXDG_CACHE_HOME

configCRONOMETER_USERNAMEyou@example.com

🔐 secretCRONOMETER_PASSWORDyour-password

🔐 secretCRONOMETER_TOTP_SECRETYour two-factor secret, only if you have two-factor on. Needs the totp extra

Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.

deployPORT

// quality suggestions

Tool annotations

17/29 tools have annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

12/29 tools missing one or more hints — retire_custom_food (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); edit_food_entry (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); add_note (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +9 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/rollecode/cronometer-mcp)](https://m8ven.ai/mcp/rollecode/cronometer-mcp)

Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.

commit: 20d7acca101761caf63e832b7e9676b9cc18b301

code hash: bb6f49527e97369e58f9f9a5b6f93a7b168b0ab2a4d9993506f8e844bf26123a

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client