nutritionix-mcp 1.0.0 → 1.0.2

package/README.md

@@ -26,3 +26,22 @@ The server uses stdio, so it can be connected to Claude Desktop, Cursor, VS Code
 ## Limits and privacy
 
 This project is intentionally narrow. It should be treated as a practical helper, not a complete certification or security audit. Check the implementation and the returned data before using it with sensitive material. Keys stay local and go only to Nutritionix. Read-only.
+
+<!-- paywall -->
+## Premium tools
+
+These tools need a license key:
+
+* `nutrient_food_search`
+* `nutrient_food_profile`
+
+Buy a key at https://mcp-marketplace.io/server/io-github-mrfentmen-nutritionix-mcp and set it in your MCP client config:
+
+```json
+"env": { "MCP_LICENSE_KEY": "mcp_live_..." }
+```
+
+The key is checked against MCP Marketplace, cached for 24 hours, and keeps
+working offline once one check has succeeded. Every other tool on this server
+stays free.
+<!-- /paywall -->

package/dist/api.js

@@ -2,6 +2,9 @@
  * Nutritionix API v2 client. Needs NUTRITIONIX_APP_ID + NUTRITIONIX_API_KEY
  * (free at https://developer.nutritionix.com/).
  * Docs: https://developer.nutritionix.com/docs/v2
+ *
+ * The USDA FoodData Central premium tools moved to the licence gateway
+ * (src/gateway.ts); what remains here is the free Nutritionix client.
  */
 const BASE = "https://trackapi.nutritionix.com/v2";
 export class NutritionixError extends Error {

package/dist/gateway.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Thin client for the premium gateway.
+ *
+ * The premium tools do not run in this package any more. Their bodies live on
+ * the gateway, which checks a Polar licence key before it does any work, so
+ * deleting anything here buys nothing: the answer only exists behind the gate.
+ *
+ * Set `MCP_LICENSE_KEY` to a Polar licence key. `MCP_GATEWAY_URL` overrides the
+ * endpoint, which is only useful for testing.
+ */
+/** Raised when a premium call cannot be completed. `message` is safe to show. */
+export declare class GatewayError extends Error {
+    readonly refused: boolean;
+    constructor(message: string, refused: boolean);
+}
+export declare function premiumTool(tool: string, args: Record<string, unknown>): Promise<string>;

package/dist/gateway.js

@@ -0,0 +1,85 @@
+/**
+ * Thin client for the premium gateway.
+ *
+ * The premium tools do not run in this package any more. Their bodies live on
+ * the gateway, which checks a Polar licence key before it does any work, so
+ * deleting anything here buys nothing: the answer only exists behind the gate.
+ *
+ * Set `MCP_LICENSE_KEY` to a Polar licence key. `MCP_GATEWAY_URL` overrides the
+ * endpoint, which is only useful for testing.
+ */
+const DEFAULT_GATEWAY_URL = 'https://mcp-gateway.contactae2000.workers.dev/mcp';
+const DEFAULT_TIMEOUT_MS = 25000;
+const USER_AGENT = 'mrfentmen-mcp/1.0';
+/** Raised when a premium call cannot be completed. `message` is safe to show. */
+export class GatewayError extends Error {
+    refused;
+    constructor(message, refused) {
+        super(message);
+        this.refused = refused;
+        this.name = 'GatewayError';
+    }
+}
+export async function premiumTool(tool, args) {
+    const key = (process.env.MCP_LICENSE_KEY ?? '').trim();
+    if (!key) {
+        throw new GatewayError(`"${tool}" is a premium tool and no licence key is set. Set MCP_LICENSE_KEY in your MCP client config.`, true);
+    }
+    const url = (process.env.MCP_GATEWAY_URL ?? DEFAULT_GATEWAY_URL).trim();
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT_MS);
+    let response;
+    try {
+        response = await fetch(url, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                accept: 'application/json',
+                'user-agent': USER_AGENT,
+                authorization: `Bearer ${key}`,
+            },
+            body: JSON.stringify({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'tools/call',
+                params: { name: tool, arguments: args },
+            }),
+            signal: controller.signal,
+        });
+    }
+    catch {
+        throw new GatewayError(`"${tool}" could not reach the licence gateway. Check your connection and try again.`, false);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!response.ok) {
+        throw new GatewayError(`"${tool}" could not reach the licence gateway (HTTP ${response.status}).`, false);
+    }
+    let body;
+    try {
+        body = (await response.json());
+    }
+    catch {
+        throw new GatewayError(`"${tool}" got an unreadable answer from the licence gateway.`, false);
+    }
+    if (body.error) {
+        throw new GatewayError(`"${tool}" was refused by the licence gateway: ${body.error.message ?? 'unknown error'}`, false);
+    }
+    const result = body.result ?? {};
+    const text = (result.content ?? [])
+        .map((part) => part.text ?? '')
+        .join('\n')
+        .trim();
+    if (result.isError) {
+        // The gateway marks a licence refusal structurally, so a missing or rejected
+        // key is told apart from a tool that failed after the gate let it through.
+        if (result.structuredContent?.licenceRefusal) {
+            throw new GatewayError(text || `"${tool}" needs a valid licence key.`, true);
+        }
+        throw new GatewayError(text || `"${tool}" failed on the licence gateway.`, false);
+    }
+    if (!text)
+        throw new GatewayError(`"${tool}" returned no data.`, false);
+    return text;
+}

package/dist/server.js

@@ -1,3 +1,4 @@
+import { premiumTool } from "./gateway.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { analyzeMeal, formatFood, NutritionixError, searchFoods } from "./api.js";
@@ -47,6 +48,44 @@ export function createServer() {
             return textError(errorMessage(e));
         }
     });
+    server.registerTool("nutrient_food_search", {
+        title: "Search USDA foods",
+        description: "Search USDA FoodData Central for a food and get its real per-100 g energy, macros, fibre, sugars, sodium, calcium and iron.",
+        inputSchema: z.object({
+            query: z.string().describe("Food name, e.g. 'oat milk', 'cheddar cheese'"),
+            limit: z.number().int().min(1).max(20).default(5),
+            branded: z.boolean().default(false).describe("Also search packaged branded food, whose nutrient data is often missing"),
+        }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        // ---- paywall: nutrient_food_search ----
+        // The body runs on the gateway, behind the licence gate.
+        // ---- paywall: end ----
+        try {
+            return text(await premiumTool("mcp_nutritionix_nutrient_food_search", args));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("nutrient_food_profile", {
+        title: "USDA food nutrient profile",
+        description: "Full nutrient profile for one FoodData Central food by FDC id: macros, sugars, fibre, sodium, calcium, iron plus vitamins and minerals.",
+        inputSchema: z.object({
+            fdcId: z.string().describe("Numeric FDC id from nutrient_food_search, e.g. 2257046"),
+        }),
+        annotations: READ_ONLY,
+    }, async (args) => {
+        // ---- paywall: nutrient_food_profile ----
+        // The body runs on the gateway, behind the licence gate.
+        // ---- paywall: end ----
+        try {
+            return text(await premiumTool("mcp_nutritionix_nutrient_food_profile", args));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
     return server;
 }
 function errorMessage(e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nutritionix-mcp",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "MCP server for Nutritionix: food search, nutrients. Needs free app keys.",
   "type": "module",
   "mcpName": "io.github.mrfentmen/nutritionix-mcp",