The last tool in the chain places the order and charges your saved payment method, so it is worth being deliberate about how much of the sequence the assistant runs unattended. The OAuth mode is the better setup for more than one reason: real login rather than tokens scraped from DevTools, and tokens that never touch disk. Expect breakage when iFood changes its site, since there is no published API here to depend on.
An unofficial MCP server for iFood, wrapping the consumer website's API. It goes the whole way from discovery to checkout: an assistant can find açaí near your coordinates, read the menu and the reviews, build a cart and place the order. Not affiliated with iFood, and the endpoints it uses can change without notice.
- Discovery — `ifood_search` by term and location, `ifood_filter_options` for the available filters, `ifood_home` for the localized feed, `ifood_browse_page`, `ifood_categories`
- Merchants — `ifood_merchant_info` for fees, hours, rating and address, `ifood_merchant_catalog` for the full menu with prices and add-ons, `ifood_item_detail`, `ifood_reviews`, `ifood_merchant_payment_methods`, and `ifood_customer_merchant_items` for what you have ordered there before
- Your account — `ifood_customer_me`, `ifood_addresses` (which carry coordinates), `ifood_contact_methods`, `ifood_external_identities`
- Orders — `ifood_orders_list`, `ifood_order_detail`, `ifood_reorder` to pre-fill a cart from a past order
- Loyalty and money — `ifood_loyalty_cards`, `ifood_benefits` for coupons and promotions near a location, `ifood_payment_methods`
- Cart and checkout — `ifood_cart_create`, `ifood_cart_set_delivery_method` for DEFAULT, PRIORITY or TAKEOUT, `ifood_cart_set_payment_method`, `ifood_checkout` as the final step
- 25 tools in total, backing both transports identically
An active iFood account and Node.js ≥ 20; clone the repository and `npm run build`. Two ways to authenticate. The HTTP mode runs an OAuth 2.1 flow with iFood's real OTP login — generate an `MCP_JWT_SECRET` of at least 32 characters, set `PORT`, start it, and register `http://localhost:3001/mcp` as an HTTP server; the browser handles the six-digit code that arrives by WhatsApp, SMS or email. The stdio mode instead needs four values you copy out of browser DevTools — `IFOOD_ACCESS_TOKEN`, `IFOOD_ACCOUNT_ID`, `IFOOD_DEVICE_ID` and `IFOOD_SESSION_ID`. In HTTP mode the iFood tokens stay in memory and are refreshed in the background, so a process restart means logging in again. Package `@aol/ifood-mcp`, MIT.