Weight Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Weight Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A personal calorie & protein counter delivered as an MCP server for use inside claude.ai. You log meals from photos or text in a normal Claude chat; this server counts them, tracks weight, and renders an interactive dashboard (weight graph + recently eaten) right in the conversation.
Self-hosted, multi-user: one admin account lives in .env, and the admin registers further accounts from chat — each user sees only their own data. See SPEC.md for the rationale.
dashboard UI to claude.ai.
Dynamic Client Registration flow; the only human step is a username + password form. The admin signs in as admin with the password from .env; everyone else signs in with an account the admin registered.
data/.Every data row is scoped to the account that logged it.
| Tool | What it does |
|---|---|
log_food | Record an eaten item (kcal, protein, …), numbered per day; re-logging a meal number overwrites it (edits). |
delete_food | Remove one of today's meals by its number. |
record_weight | Store a body-weight measurement. |
lookup_nutrition | Query public nutrition databases (Open Food Facts, optional USDA). |
daily_progress | Today's intake vs. your goal. |
intake_history | Per-day totals and averages over a window of days ("calories last week", monthly trends). |
set_goals | Change the daily calorie/protein targets and floor/ceiling mode; optionally set a fiber norm (off by default, fiber_target_g=0 removes it). |
show_dashboard | Renders the dashboard inline as an MCP Apps panel (weight graph + recent meals + today's progress). |
send_daily_report | Sends the day's meals, totals, and latest weight to your accountability partner on Telegram. Only present when the Telegram env vars are set. |
All of the above operate on the calling account's own data. The admin account additionally gets user management:
| Tool (admin only) | What it does |
|---|---|
register_user | Create a non-admin account (username + password, stored hashed in the DB). |
deregister_user | Remove an account and revoke its tokens (its logged data is kept). |
update_user_password | Set a new password for an account, invalidating its existing tokens. |
Copy .env.example to .env and set at least WEIGHT_MCP_PASSWORD (the admin account's password — the only account configured in .env) and WEIGHT_MCP_PUBLIC_BASE_URL. Non-admin accounts are not env config: the admin creates them from chat with register_user. Nutrition sources default to Open Food Facts, filtered to Germany; set WEIGHT_MCP_* to change region or enable USDA.
Goals are not env config — set them from chat with set_goals (they persist in the database). Two modes: floor (eat at least the target — the default, for under-eaters) and ceiling (stay under — for weight loss). Until you set your own, the default is 2600 kcal / 150 g protein, floor. Goals are per account, like all other data.
Accountability reporting is optional: set WEIGHT_MCP_TELEGRAM_BOT_TOKEN (a bot from @BotFather) and WEIGHT_MCP_TELEGRAM_CHAT_ID (your partner's chat — a human, group, or channel; numeric ID or @channelusername) to enable send_daily_report. The bot must be able to message that chat: the partner has to start the bot once (humans), or the bot must be a member/admin (groups/channels).
Local (dev):
uv sync
cp .env.example .env # then edit
uv run weight-mcpDocker (local build):
docker compose up --buildThe runtime image uses distroless Python 3.13 and contains no shell or package manager. Dependencies are installed in a separate build stage; base images are pinned by digest and security updates require rebuilding with updated pins.
This publishes the server on 127.0.0.1:8000 only. It speaks plain HTTP and its login endpoint takes the admin password — which is also the JWT signing root — so never map it to a public interface; TLS termination belongs in front of it. On a Linux host, give the container (uid 10001) the data directory first: sudo chown 10001:10001 data.
For a real deployment you need public HTTPS (claude.ai connects from Anthropic's cloud, not your device). Copy docker-compose.template.yml, put the server behind a TLS reverse proxy, and set WEIGHT_MCP_PUBLIC_BASE_URL to that origin. Pin image: to a digest rather than :latest so a redeploy cannot silently pull different code.
The compose files pass .env as process environment, which makes the admin password readable through docker inspect and /proc/1/environ. Keep the file chmod 600 and treat host access as equivalent to knowing the password.
Customize → Connectors → "Add custom connector" (on Team/Enterprise: Organization settings → Connectors → Add → Custom → Web), paste your server's base URL (https://<your-host> — the MCP endpoint and OAuth live at the origin root, so there is no path to append). claude.ai opens the OAuth page; sign in with your username and password (admin + the .env password for the admin, or credentials the admin registered for you). Done — start a chat and tell Claude what you ate.
uv run ruff check .
uv run mypy
uv run pytest~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.