cronometer-api-mcp 0.2.1__tar.gz → 0.2.3__tar.gz

cronometer_api_mcp-0.2.3/.env.example

@@ -0,0 +1,6 @@
+CRONOMETER_USERNAME=
+CRONOMETER_PASSWORD=
+# Only for accounts with two-factor authentication: the base32 key shown at 2FA setup
+CRONOMETER_TOTP_SECRET=
+# Optional IANA timezone override, for example America/Los_Angeles
+CRONOMETER_ACCOUNT_TZ=

{cronometer_api_mcp-0.2.1 → cronometer_api_mcp-0.2.3}/Dockerfile

@@ -51,6 +51,10 @@ RUN uv python install 3.14 \
 # in supergateway's own node_modules to a release that covers the versions the
 # Python `mcp` package negotiates.
 #
+# Python mcp 2.x still handshakes at 2025-11-25, which this Node SDK range
+# covers; its 2026-07-28 revision is reachable only via `server/discover`.
+# Re-check this pin only if a release adds a *handshake* version.
+#
 # NOTE: this is a per-image mitigation, not the durable fix. supergateway
 # proxies `initialize` verbatim but then validates the negotiated version
 # against its own (possibly older) SDK, so the skew recurs whenever the wrapped

{cronometer_api_mcp-0.2.1 → cronometer_api_mcp-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: cronometer-api-mcp
-Version: 0.2.1
+Version: 0.2.3
 Summary: MCP server for Cronometer nutrition data using the mobile REST API
 Author: Randy
 License-Expression: MIT
@@ -11,10 +11,9 @@ Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
-Classifier: Topic :: Scientific/Engineering :: Medical Science Apps.
 Requires-Python: >=3.14
 Requires-Dist: httpx[socks]>=0.27.0
-Requires-Dist: mcp<2,>=1.29.0
+Requires-Dist: mcp<3,>=2.0.0
 Requires-Dist: python-dotenv>=1.0.0
 Requires-Dist: tzdata>=2024.1
 Description-Content-Type: text/markdown
@@ -60,6 +59,20 @@ export CRONOMETER_USERNAME="your@email.com"
 export CRONOMETER_PASSWORD="your-password"
 ```
 
+#### Optional: two-factor authentication
+
+If the account has two-factor authentication enabled, `/api/v2/login`
+answers `TOTP_CODE_REQUIRED` unless the request carries the current 6-digit
+code. Give the server the base32 key that Cronometer showed when 2FA was set
+up (the same key you scanned into your authenticator app) and it derives the
+code itself at every login (RFC 6238, SHA-1, 30 s period):
+
+```bash
+export CRONOMETER_TOTP_SECRET="ABCD EFGH IJKL MNOP QRST UVWX YZ23 4567"
+```
+
+Spaces and lowercase are fine. Leave it unset for accounts without 2FA.
+
 #### Optional: override the account timezone
 
 Diary entries are stamped in your Cronometer account's timezone, which the
@@ -89,7 +102,9 @@ cached session, so it also overrides a stale cached timezone.
       "command": ["uvx", "cronometer-api-mcp"],
       "environment": {
         "CRONOMETER_USERNAME": "{env:CRONOMETER_USERNAME}",
-        "CRONOMETER_PASSWORD": "{env:CRONOMETER_PASSWORD}"
+        "CRONOMETER_PASSWORD": "{env:CRONOMETER_PASSWORD}",
+        "CRONOMETER_TOTP_SECRET": "{env:CRONOMETER_TOTP_SECRET}",
+        "CRONOMETER_ACCOUNT_TZ": "{env:CRONOMETER_ACCOUNT_TZ}"
       },
       "enabled": true
     }
@@ -107,7 +122,9 @@ cached session, so it also overrides a stale cached timezone.
       "args": ["cronometer-api-mcp"],
       "env": {
         "CRONOMETER_USERNAME": "your@email.com",
-        "CRONOMETER_PASSWORD": "your-password"
+        "CRONOMETER_PASSWORD": "your-password",
+        "CRONOMETER_TOTP_SECRET": "your-base32-key",
+        "CRONOMETER_ACCOUNT_TZ": "America/Los_Angeles"
       }
     }
   }
@@ -138,6 +155,8 @@ cached session, so it also overrides a stale cached timezone.
 | `add_food_entry` | Log a food serving to the diary |
 | `remove_food_entry` | Remove one or more diary entries |
 | `add_custom_food` | Create a custom food with specified nutrition |
+| `add_recipe` | Create a recipe from existing foods referenced by ID and gram weight |
+| `import_recipe` | Create a recipe from a free-text ingredient list; Cronometer matches each line to a database food and converts the amount to grams |
 | `copy_day` | Copy all entries from the previous day |
 | `mark_day_complete` | Mark a diary day as complete or incomplete |
 
@@ -186,6 +205,8 @@ The API uses two protocols:
 - **v2 (`POST /api/v2/*`)** -- JSON-body auth, used for most operations (food search, diary read/write, nutrition, fasting, macros, biometrics)
 - **v3 (`DELETE /api/v3/user/{id}/*`)** -- Header-based auth (`x-crono-session`), used for diary entry deletion
 
+Recipe import is the one asynchronous operation: `import_recipe` returns a job id, and `poll_async_result` is polled until the server reports 100% progress and attaches the parsed ingredients.
+
 ## Python API
 
 You can use the client directly:
@@ -212,6 +233,13 @@ client.add_serving(
 # Get today's diary
 diary = client.get_diary()
 
+# Import a recipe from a free-text ingredient list
+recipe = client.import_recipe("one hot dog\nketchup\nbun")
+print(recipe["food_id"], recipe["ingredients"])
+
+# Parse without saving, to review the matches first
+preview = client.import_recipe("2 tbsp olive oil\n200g chicken", save=False)
+
 # Get nutrition scores
 scores = client.get_nutrition_scores()
 ```

{cronometer_api_mcp-0.2.1 → cronometer_api_mcp-0.2.3}/README.md

@@ -39,6 +39,20 @@ export CRONOMETER_USERNAME="your@email.com"
 export CRONOMETER_PASSWORD="your-password"
 ```
 
+#### Optional: two-factor authentication
+
+If the account has two-factor authentication enabled, `/api/v2/login`
+answers `TOTP_CODE_REQUIRED` unless the request carries the current 6-digit
+code. Give the server the base32 key that Cronometer showed when 2FA was set
+up (the same key you scanned into your authenticator app) and it derives the
+code itself at every login (RFC 6238, SHA-1, 30 s period):
+
+```bash
+export CRONOMETER_TOTP_SECRET="ABCD EFGH IJKL MNOP QRST UVWX YZ23 4567"
+```
+
+Spaces and lowercase are fine. Leave it unset for accounts without 2FA.
+
 #### Optional: override the account timezone
 
 Diary entries are stamped in your Cronometer account's timezone, which the
@@ -68,7 +82,9 @@ cached session, so it also overrides a stale cached timezone.
       "command": ["uvx", "cronometer-api-mcp"],
       "environment": {
         "CRONOMETER_USERNAME": "{env:CRONOMETER_USERNAME}",
-        "CRONOMETER_PASSWORD": "{env:CRONOMETER_PASSWORD}"
+        "CRONOMETER_PASSWORD": "{env:CRONOMETER_PASSWORD}",
+        "CRONOMETER_TOTP_SECRET": "{env:CRONOMETER_TOTP_SECRET}",
+        "CRONOMETER_ACCOUNT_TZ": "{env:CRONOMETER_ACCOUNT_TZ}"
       },
       "enabled": true
     }
@@ -86,7 +102,9 @@ cached session, so it also overrides a stale cached timezone.
       "args": ["cronometer-api-mcp"],
       "env": {
         "CRONOMETER_USERNAME": "your@email.com",
-        "CRONOMETER_PASSWORD": "your-password"
+        "CRONOMETER_PASSWORD": "your-password",
+        "CRONOMETER_TOTP_SECRET": "your-base32-key",
+        "CRONOMETER_ACCOUNT_TZ": "America/Los_Angeles"
       }
     }
   }
@@ -117,6 +135,8 @@ cached session, so it also overrides a stale cached timezone.
 | `add_food_entry` | Log a food serving to the diary |
 | `remove_food_entry` | Remove one or more diary entries |
 | `add_custom_food` | Create a custom food with specified nutrition |
+| `add_recipe` | Create a recipe from existing foods referenced by ID and gram weight |
+| `import_recipe` | Create a recipe from a free-text ingredient list; Cronometer matches each line to a database food and converts the amount to grams |
 | `copy_day` | Copy all entries from the previous day |
 | `mark_day_complete` | Mark a diary day as complete or incomplete |
 
@@ -165,6 +185,8 @@ The API uses two protocols:
 - **v2 (`POST /api/v2/*`)** -- JSON-body auth, used for most operations (food search, diary read/write, nutrition, fasting, macros, biometrics)
 - **v3 (`DELETE /api/v3/user/{id}/*`)** -- Header-based auth (`x-crono-session`), used for diary entry deletion
 
+Recipe import is the one asynchronous operation: `import_recipe` returns a job id, and `poll_async_result` is polled until the server reports 100% progress and attaches the parsed ingredients.
+
 ## Python API
 
 You can use the client directly:
@@ -191,6 +213,13 @@ client.add_serving(
 # Get today's diary
 diary = client.get_diary()
 
+# Import a recipe from a free-text ingredient list
+recipe = client.import_recipe("one hot dog\nketchup\nbun")
+print(recipe["food_id"], recipe["ingredients"])
+
+# Parse without saving, to review the matches first
+preview = client.import_recipe("2 tbsp olive oil\n200g chicken", save=False)
+
 # Get nutrition scores
 scores = client.get_nutrition_scores()
 ```

{cronometer_api_mcp-0.2.1 → cronometer_api_mcp-0.2.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cronometer-api-mcp"
-version = "0.2.1"
+version = "0.2.3"
 description = "MCP server for Cronometer nutrition data using the mobile REST API"
 readme = "README.md"
 license = "MIT"
@@ -19,11 +19,9 @@ classifiers = [
     "License :: OSI Approved :: MIT License",
     "Programming Language :: Python :: 3",
     "Programming Language :: Python :: 3.14",
-    "Topic :: Scientific/Engineering :: Medical Science Apps.",
 ]
 dependencies = [
-    # <2 until the MCPServer migration: 2.x moved mcp.server.fastmcp
-    "mcp>=1.29.0,<2",
+    "mcp>=2.0.0,<3",
     "httpx[socks]>=0.27.0",
     "python-dotenv>=1.0.0",
     "tzdata>=2024.1",
@@ -40,3 +38,10 @@ dev = [
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/cronometer_api_mcp"]
+
+[tool.ruff.lint.per-file-ignores]
+# Tools have to hand every failure back as a structured error string; an
+# exception escaping into the stdio stream kills the session.
+"src/cronometer_api_mcp/server.py" = ["BLE001"]
+# Diary enrichment is best-effort and degrades to an unenriched diary.
+"src/cronometer_api_mcp/client.py" = ["BLE001"]

{cronometer_api_mcp-0.2.1 → cronometer_api_mcp-0.2.3}/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/rwestergren/cronometer-api-mcp",
     "source": "github"
   },
-  "version": "0.2.1",
+  "version": "0.2.3",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "cronometer-api-mcp",
-      "version": "0.2.1",
+      "version": "0.2.3",
       "transport": {
         "type": "stdio"
       },
@@ -27,6 +27,18 @@
           "description": "Your Cronometer account password",
           "isRequired": true,
           "isSecret": true
+        },
+        {
+          "name": "CRONOMETER_TOTP_SECRET",
+          "description": "Base32 key for accounts with two-factor authentication",
+          "isRequired": false,
+          "isSecret": true
+        },
+        {
+          "name": "CRONOMETER_ACCOUNT_TZ",
+          "description": "Optional IANA timezone override, for example America/Los_Angeles",
+          "isRequired": false,
+          "isSecret": false
         }
       ]
     }