Hermes Nutrition Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Hermes Nutrition Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A small local-first nutrition tracker exposed as an HTTP MCP server for Hermes.
The database is the source of truth. Hermes should call tools here to remember foods, aliases, recipes, and meal logs instead of storing nutrition facts in agent memory.
The server stores three useful concepts:
babybel, default tuna, or pizza dough.tuna pizza = 165g dough + 60g tuna + 40g cheese.Recipes can be logged with one-off adjustments. For example, after creating a tuna pizza recipe, Hermes can log it with:
{
"alias": "tuna pizza",
"adjustments": [
{"alias": "cheese", "delta_grams": 20}
]
}The logged meal stores macro snapshots and a component snapshot, so historical logs do not change when you later edit a food or recipe.
Tracked nutrients are calories, protein, carbs, fat, fiber, sugars, saturated fat, and salt. Salt is stored as grams of salt from nutrition labels, not sodium in milligrams.
http://HOST:8765/mcpFastMCPGET /GET /healthIf MCP_TOKEN is set, every HTTP request must include:
Authorization: Bearer <token>Core tools:
add_foodupdate_foodadd_aliasget_foodsearch_foodslist_foodslog_foodget_dayget_entriesdelete_entrydelete_foodupdate_entryfinalize_dayget_weekly_reportlist_aliaseshealthRecipe tools:
add_recipeupdate_recipeget_recipesearch_recipeslog_recipedelete_recipeInside the container:
/data/nutrition.db/data/exports/data/exports/daily/YYYY-MM-DD.md/data/exports/csv/YYYY-MM-DD.csv/data/exports/json/YYYY-MM-DD.jsonpy -m venv .venv
.\.venv\Scripts\python -m pip install -e ".[test]"
.\.venv\Scripts\pytest
.\.venv\Scripts\python -m app.mainOn Linux/macOS:
python -m venv .venv
. .venv/bin/activate
python -m pip install -e ".[test]"
pytest
python -m app.mainTest the health endpoint:
curl http://localhost:8765/healthWith a token:
curl -H "Authorization: Bearer change-me" http://localhost:8765/healthAfter the server is running, add demo foods through MCP:
{
"name": "Babybel",
"serving_name": "1 piece",
"kcal": 70,
"protein_g": 4,
"carbs_g": 0,
"fat_g": 5,
"fiber_g": 0,
"sugars_g": 0,
"saturated_fat_g": 0,
"salt_g": 0,
"aliases": ["babybel"]
}{
"name": "Greek yogurt",
"serving_name": "1 serving",
"kcal": 180,
"protein_g": 20,
"carbs_g": 8,
"fat_g": 4,
"fiber_g": 0,
"sugars_g": 0,
"saturated_fat_g": 0,
"salt_g": 0,
"aliases": ["greek yogurt"]
}Example recipe ingredients use grams when the food has grams_per_serving:
{
"name": "Tuna pizza",
"aliases": ["tuna pizza"],
"ingredients": [
{"alias": "pizza dough", "grams": 165},
{"alias": "default tuna", "grams": 60},
{"alias": "cheese", "grams": 40}
]
}Build:
docker build -t nutrition-mcp:0.3.0 .Run:
docker run -d \
--name nutrition-mcp \
-p 8765:8765 \
-e TZ=Europe/Bucharest \
-e MCP_TOKEN=change-me \
-e PUBLIC_HOSTS=192.168.1.142,nutrition-mcp \
-v /mnt/user/appdata/nutrition-mcp:/data \
nutrition-mcp:0.3.0For a published image:
docker run -d \
--name nutrition-mcp \
-p 8765:8765 \
-e TZ=Europe/Bucharest \
-e MCP_TOKEN=change-me \
-e PUBLIC_HOSTS=192.168.1.142,nutrition-mcp \
-v /mnt/user/appdata/nutrition-mcp:/data \
ghcr.io/REPLACE_ME/nutrition-mcp:0.3.0nutrition-mcpghcr.io/REPLACE_ME/nutrition-mcp:0.3.0bridge8765 -> container 8765 TCP/mnt/user/appdata/nutrition-mcp -> /dataTZ=Europe/BucharestMCP_TOKEN=<long random token>PUBLIC_HOSTS=192.168.1.142,nutrition-mcphttp://[IP]:[PORT:8765]/If Hermes connects over LAN:
mcp_servers:
nutrition:
url: "http://192.168.1.142:8765/mcp"
headers:
Authorization: "Bearer change-me"If Hermes and this server are on the same custom Docker network:
mcp_servers:
nutrition:
url: "http://nutrition-mcp:8765/mcp"
headers:
Authorization: "Bearer change-me"DATA_DIR=/data
TZ=Europe/Bucharest
MCP_TOKEN=
PUBLIC_HOSTS=192.168.1.142,nutrition-mcp
HOST=0.0.0.0
PORT=8765/data.entry_id.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.