cronometer-api-mcp

<!-- mcp-name: io.github.rwestergren/cronometer-api-mcp -->

Hosted version for Claude.ai, ChatGPT, and Grok coming soon. Join the waitlist →

An MCP (Model Context Protocol) server for Cronometer nutrition tracking, built on the reverse-engineered mobile REST API.

Unlike cronometer-mcp, which takes a comprehensive GWT-RPC approach against Cronometer's web backend, this server talks to the same JSON REST API used by the Cronometer Android app -- with clean payloads and stable, versioned endpoints.

Features

• Food log -- diary entries with food names, amounts, meal groups
• Nutrition data -- daily macro/micro totals and nutrition scores with per-nutrient confidence
• Food search -- search the Cronometer food database, get detailed nutrition info
• Diary management -- add/remove entries, copy days, mark days complete
• Custom foods -- create foods with custom nutrition data
• Macro targets -- read weekly schedule and saved templates
• Fasting -- view history and aggregate statistics
• Biometrics -- weight, body fat, heart rate, and other tracked metrics over a date range

Quick Start

1. Install uv

curl -LsSf https://astral.sh/uv/install.sh | sh

2. Set credentials

export CRONOMETER_USERNAME="your@email.com"
export CRONOMETER_PASSWORD="your-password"

3. Configure your MCP client

uvx downloads and runs the server on demand -- no separate install step.

OpenCode (opencode.json)

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cronometer": {
      "type": "local",
      "command": ["uvx", "cronometer-api-mcp"],
      "environment": {
        "CRONOMETER_USERNAME": "{env:CRONOMETER_USERNAME}",
        "CRONOMETER_PASSWORD": "{env:CRONOMETER_PASSWORD}"
      },
      "enabled": true
    }
  }
}

Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "cronometer": {
      "command": "uvx",
      "args": ["cronometer-api-mcp"],
      "env": {
        "CRONOMETER_USERNAME": "your@email.com",
        "CRONOMETER_PASSWORD": "your-password"
      }
    }
  }
}

Available Tools

Food Log & Nutrition

Tool	Description
get_food_log	Diary entries for a date, each enriched with food name, source, serving measure/count, and that food's per-entry nutrient contribution, plus an energy_summary (target/consumed/remaining kcal) and a nutrition_summary of consumed totals for every tracked nutrient
get_daily_nutrition	Consumed macro and micronutrient totals for every nutrient tracked in Cronometer
get_nutrition_scores	Category scores (Vitamins, Minerals, etc.) with per-nutrient consumed amounts and confidence levels

Food Search & Details

Tool	Description
search_foods	Search the Cronometer food database by name
get_food_details	Full nutrition profile and serving sizes for a food

Targets & Tracking

Tool	Description
get_macro_targets	Weekly macro schedule and saved target templates
get_fasting_history	Fasting history within a date range
get_fasting_stats	Aggregate fasting statistics

All date parameters use YYYY-MM-DD format and default to today when omitted.

Diary Management

Tool	Description
add_food_entry	Log a food serving to the diary
remove_food_entry	Permanently delete diary entries — no undo
add_custom_food	Create a custom food with specified nutrition
copy_day	Copy all entries from the previous day
mark_day_complete	Mark a diary day as complete or incomplete

FORK: hardened fork, read/write. This fork ran read-only through its first eight phases; the owner enabled writes on 2026-07-27. Write tools carry readOnlyHint: False and remove_food_entry carries destructiveHint: True, so clients can warn before mutating. Every tool — read and write — is rate-limited and audited. The biometrics tools (list_biometrics, get_biometrics) remain removed, holding the surface at exactly 13. tests/test_tool_surface.py pins that surface in both directions.

Date ranges are capped at 90 days per call, calls are rate-limited to 60/hour, and every call is logged (shapes and counts only, never contents). See CLAUDE.md for the constraints, AUDIT.md for the upstream security review, and RUNBOOK.md for operations.

Remote Deployment

The server supports remote deployment with OAuth 2.1 authorization (PKCE) for use with Claude.ai and other remote MCP clients.

Environment Variables

Variable	Required	Description
CRONOMETER_USERNAME	Yes	Cronometer account email
CRONOMETER_PASSWORD	Yes	Cronometer account password
MCP_TRANSPORT	No	Transport mode: stdio (default), sse, or streamable-http
MCP_AUTH_TOKEN	Remote	HMAC key used to sign and verify access tokens
MCP_OAUTH_CLIENT_ID	Remote	OAuth client ID, verified at /token
MCP_OAUTH_CLIENT_SECRET	Remote	OAuth client secret, verified at /token
MCP_AUTHORIZE_PASSPHRASE	Remote	FORK: required to complete /authorize
MCP_BASE_URL	Remote	Public base URL; must match the deployed URL exactly
MCP_ALLOWED_REDIRECT_ORIGINS	No	FORK: allowed OAuth redirect origins (default https://claude.ai,https://claude.com)
PORT	No	Listen port for remote transports (default 8000)

FORK: the four variables marked Remote are mandatory whenever MCP_TRANSPORT is sse or streamable-http — the server refuses to start without them. Upstream treated them as optional and served the diary unauthenticated when they were absent, so a forgotten secret was a silent downgrade to no authentication at all.

Dokku / Heroku Deployment

The project includes a Procfile and .python-version for direct deployment with the Heroku Python buildpack:

# Create app
dokku apps:create cronometer-api-mcp

# Set environment
dokku config:set cronometer-api-mcp \
  MCP_TRANSPORT=streamable-http \
  MCP_AUTH_TOKEN=$(openssl rand -hex 32) \
  MCP_OAUTH_CLIENT_ID=my-client \
  MCP_OAUTH_CLIENT_SECRET=$(openssl rand -hex 32) \
  MCP_BASE_URL=https://your-domain.com \
  CRONOMETER_USERNAME=your@email.com \
  CRONOMETER_PASSWORD=your-password

# Deploy
git push dokku main

Claude.ai Remote Connection

When deployed remotely with OAuth configured, connect from Claude.ai using:

• Server URL: https://your-domain.com/mcp
• OAuth Client ID: Value of MCP_OAUTH_CLIENT_ID
• OAuth Client Secret: Value of MCP_OAUTH_CLIENT_SECRET

Claude.ai will open a browser tab for authorization. Click Authorize to complete the connection.

Development

For local development, copy .env.example to .env and fill in your credentials:

cp .env.example .env
# edit .env
uv run cronometer-api-mcp

The CLI auto-loads .env on startup (dev convenience only). Real environment variables always win over .env, so production deployments and MCP client env blocks are unaffected.

How It Works

This server communicates with mobile.cronometer.com -- the same REST API used by the Cronometer Android/Flutter app. The API was reverse-engineered through:

1. Static analysis of libapp.so (Dart AOT snapshot) from the APK to discover endpoint names
2. Traffic interception via Frida + mitmproxy to capture exact request/response formats
3. Trial-and-error against the live API to confirm payload shapes

The API uses two protocols:

• v2 (POST /api/v2/*) -- JSON-body auth, used for most operations (food search, diary read/write, nutrition, fasting, macros, biometrics)
• v3 (DELETE /api/v3/user/{id}/*) -- Header-based auth (x-crono-session), used for diary entry deletion

Python API

You can use the client directly:

from cronometer_api_mcp.client import CronometerClient
from datetime import date

client = CronometerClient()

# Search for foods
results = client.search_food("chicken breast")

# Get food details
food = client.get_food(results[0]["id"])

# Log a serving
client.add_serving(
    food_id=food["id"],
    measure_id=food["defaultMeasureId"],
    grams=200,
)

# Get today's diary
diary = client.get_diary()

# Get nutrition scores
scores = client.get_nutrition_scores()

License

MIT