营养跟踪工具

1. Supabase setup

1. Create a Supabase project.
2. Enable Email Auth (Authentication → Providers → Email) and disable email confirmation.
3. Apply the schema. The full schema lives in supabase/migrations/. With the Supabase CLI:

    supabase link --project-ref <your-project-ref>
    supabase db push
    

This creates every table, index, RLS policy, and foreign key the app needs. No local Postgres is involved — migrations run against your hosted project.

1. Copy the service role key from Project Settings → API and use it as SUPABASE_SECRET_KEY.

Deploy

The project includes a Dockerfile for container-based deployment.

1. Push your repo to a hosting provider (e.g. DigitalOcean App Platform)
2. Set the environment variables listed above
3. The app auto-detects the Dockerfile and deploys on port 8080
4. Point your domain to the deployed URL

Quick Start

Already hosted and ready to use — just connect it to your MCP client:

https://nutrition-mcp.com/mcp

On Claude.ai: open Nutrition MCP in the Claude directory and click Connect (see Connect to Claude.ai below)

On first connect, sign in with Google or enter an email and password and choose Create account. Your data persists across reconnections. Trouble connecting? See Troubleshooting.

By connecting you agree to the Terms of Service; how your data is handled is in the Privacy Policy.

Switching from another tracker? See the nutrition-app alternatives — how it compares to MyFitnessPal, Cronometer, Lose It!, MacroFactor, Yazio, and Lifesum. Bring your history with you: say "import my meals" and an importer opens in the chat, where you pick the CSV you exported from your old app, map its columns, and check what will be added before anything is saved. Exports from MyFitnessPal, Cronometer, Lose It! and MacroFactor are recognised automatically; any other CSV works by mapping its columns yourself. In clients that can't show in-chat panels, paste the export instead and the AI imports it for you. If your export has an alcohol column and you want it kept, turn alcohol tracking on before importing — the importer skips that column while tracking is off, and re-importing the same file later won't backfill it.

Demo

Read the story behind it: How I Replaced MyFitnessPal and Other Apps with a Single MCP Server

2. Environment variables

Legacy only — a fresh deploy doesn't need these, since every client registers its own credentials via POST /register. To set the optional OAUTH_CLIENT_* pair for the legacy static client:

bun run generate-oauth-creds

or manually:

openssl rand -hex 16   # use as OAUTH_CLIENT_ID
openssl rand -hex 32   # use as OAUTH_CLIENT_SECRET

Patreon posts, one-time setup: PATREON_ACCESS_TOKEN / PATREON_REFRESH_TOKEN are only ever read once, at server boot, to seed the patreon_tokens table if it's still empty — the server refreshes and stores its own pair from then on, so leaving these two set permanently is safe (every later boot is a no-op). You never need to touch the database by hand.

3. Google sign-in (optional)

Email/password works out of the box. To also offer "Continue with Google", follow docs/google-auth-setup.md to create a Google OAuth client, enable the Google provider in Supabase, and set GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET. This adds the POST /authorize/google and GET /auth/google/callback routes — see API Endpoints.

API Endpoints

Troubleshooting

The full version, in 10 languages, is at nutrition-mcp.com/tools#troubleshooting. In short:

• Won't connect, or keeps asking to sign in: remove the connector and add it again with exactly https://nutrition-mcp.com/mcp, then sign in with the same email and password (or Google account) as before — your data belongs to the account, not the connection. It stays connected as long as you use it at least every 90 days.
• {"error":"session_expired"} on the sign-in page: the page is valid for 10 minutes and resets when the server restarts; reload it or start connecting again. session_mismatch means sign-in was finished in a different browser from the one that opened it.
• Can't sign in / forgot password: use Sign in for an existing account — a wrong email or password shows "Wrong email or password" and never creates a new account; Create account is only for a first visit. If you signed up with Google, use Continue with Google. There is no self-service reset yet — email anton@nutrition-mcp.com from your account's address.
• History gone after reconnecting: each email is a separate account; sign in with the one you used originally.
• The AI answers but doesn't log: check the connector is enabled for the conversation, ask explicitly, and approve tool permission prompts.
• Meals on the wrong day: days follow your timezone (UTC until you set one). Set it with set_timezone; past entries regroup, but one given a specific time while the timezone was wrong keeps that moment — fix it with update_meal. Set it before importing history: re-importing another app's file after a timezone change adds the rows again (a Nutrition MCP export is recognized and not duplicated).
• No charts or cards: widgets need a host that supports MCP Apps; after set_widget_display, start a new conversation. The meal-logged card only appears once goals are set.
• Importer won't open or can't save: ask the AI to import the file itself with bulk_import_meals (duplicates are skipped, so re-sending is safe as long as your timezone hasn't changed in between; set it before the first import). If you use the importer panel and want an alcohol column kept, turn alcohol tracking on first; the panel skips it while tracking is off.
• "Rate limit exceeded" / "Too many failed authentication attempts": 60 requests a minute per account, 30 a minute per network on the sign-in pages. After 20 rejected connection attempts in a row, a network is paused for 5 minutes, growing to at most an hour — usually an old connector retrying; remove and re-add it.
• Barcode not found or wrong: data comes from Open Food Facts (8–14 digits, no caffeine data; added sugar only when the product lists it, marked when Open Food Facts estimated it from the ingredients); when no product is found, the name or a label photo can supply the figures instead.
• USDA data unavailable until a time is named: USDA FoodData Central lookups (search_foods, get_food_macros) share one hourly quota across all users. After USDA's limit is reached, or when the key's hourly allowance is nearly used up, lookups pause for 60 minutes; each user is also capped at 30 lookups per hour. Foods looked up in the last 30 days keep working during a pause. USDA's names are in English, so search with English food names.
• Yesterday isn't in Apple Health yet: days are sent once they are finished, at 05:00 the next morning in your timezone; the next sync after that (opening Health, stopping your alarm, or Sync now) brings it. Every sync covers the last 7 days.
• Apple Health shows more than chat: Health can't lower a value it already has. Delete that day's entries from Shortcuts under Health → Browse → Nutrition → (type) → Show All Data and enter the right total by hand. Never use "Delete All Data from Shortcuts" — it also removes what your other shortcuts logged. If every day looks doubled, another app writes the same types; switch one off under Health → Sharing → Apps.
• Apple Health sync stopped: run Nutrition MCP Health by hand to see why. If it asks to connect again (90 days without a sync, 365 days after connecting, or after Disconnect), sign in on the page it opens within 30 minutes. If it only syncs by hand, check its automations are on and set to Run Immediately; if a notice says a day didn't reach Health, allow Shortcuts to write every nutrition type under Health → Sharing → Apps → Shortcuts.
• Export link doesn't work: links expire after 60 minutes and each export replaces the last; ask for a fresh one. An export reporting 0 meals when you expected history usually means you signed in with a different email.
• Deleting your account: delete_account permanently removes everything after you confirm; export first if you want a copy.
• Reporting a problem: bugs on GitHub Issues (never include your password); security issues privately, as SECURITY.md describes.