Log inSubmit server
Myhotlunchbox MCP logo

Myhotlunchbox MCP

Connects Claude and other MCP clients to a My Hot Lunchbox parent account for lunches, orders, payments, and PDFs.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Myhotlunchbox MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "myhotlunchbox-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "myhotlunchbox-mcp"
      ],
      "env": {
        "MYHOTLUNCHBOX_USERNAME": "YOUR_VALUE_HERE",
        "MYHOTLUNCHBOX_PASSWORD": "YOUR_VALUE_HERE",
        "MYHOTLUNCHBOX_BASE_URL": "YOUR_VALUE_HERE",
        "MYHOTLUNCHBOX_OUTPUT_DIR": "YOUR_VALUE_HERE",
        "MCP_CONFIRM_MODE": "YOUR_VALUE_HERE",
        "MCP_CONFIRM_ELICITATION": "YOUR_VALUE_HERE",
        "MCP_CONFIRM_TTL_SECONDS": "YOUR_VALUE_HERE",
        "MCP_CONFIRM_SECRET": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Automated check passed— started and listed 35 tools correctly (Today).

Overview

  • school-lunch
  • ordering
  • payments
  • mcp
  • claude

The myhotlunchbox-mcp MCP server connects to a My Hot Lunchbox parent account through its server-side API. It exposes tools for reading lunch calendars, managing students and orders, checking billing data, and generating PDF reports. Use it when an agent needs to inspect or manage school lunches without a browser session; checkout can charge a saved payment method. Mutating calls use confirmation flows, while write payload acceptance remains unverified.

Use cases

  • Read a student's school lunch calendar
  • Create or modify a lunch order
  • Review transactions and subscription settings
  • Apply coupons or gift cards
  • Generate PDF lunch and order reports

Key features

  • Read My Hot Lunchbox calendars, menus, students, and orders
  • Create, update, and delete student and order records
  • Inspect transactions, subscriptions, coupons, and gift cards
  • Run confirmed checkout using a saved payment method
  • Generate calendar, order, and transaction PDFs
  • Authenticate with server-side OAuth2 credentials

Tools35

What Myhotlunchbox MCP lets your agent do. Expand a tool for its parameters.

Verified live~8.5k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 3d ago

Recent health check succeeded.

8/8 checks healthy over the last 45d

What it can do

From the 35 tools this server returned when we ran it; 35 declare their own safety hints.

Can delete or modify data · 7Handles credentials · 15Makes network requests · 34Read-only tools · 28
Network at startup3 connections
Files written at startupNone
Install scriptsNone
npm provenanceSigned build
Package age58 days
Maintainers1

Observed 2026-10-22 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 15d ago via OSV.dev · myhotlunchbox-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

npm downloads3.1kPackage downloads in the last 30 days.
Last commit3d agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed35Callable tools this server registers over MCP.
Directory activity1 viewsConfig copies, upvotes, and views on AllMCPs.

How Myhotlunchbox MCP works

What myhotlunchbox-mcp does

The myhotlunchbox-mcp MCP server exposes a My Hot Lunchbox parent account through MCP tools. It can retrieve school lunch calendars, daily menus, students, carts, orders, transactions, subscriptions, gift cards, coupons, and checkout information. It also supports creating, updating, and deleting students or orders, changing subscription settings, applying account credits or coupons, and producing calendar, order, and transaction PDFs.

The server is intended for the parent role. School-admin and vendor-only API areas are not wrapped and may return a role mismatch or HTTP 403 for a parent account.

How it works

The process authenticates directly with ordernow.myhotlunchbox.com using an OAuth2 password grant. It renews the session with the returned refresh token and does not depend on a browser extension, an open signed-in tab, or copied cookies. Nothing is saved to disk for authentication.

Ordering follows a read-modify-write pattern rather than item-level mutations. First retrieve the menu and order form, edit the complete model, and then submit it with the relevant create or update tool. Fields left out of the submitted model are cleared, so callers should preserve fields they do not intend to change.

All mutating operations require confirmation. Depending on the client and settings, confirmation appears as a client prompt or as a preview with a single-use token that must be supplied on a second call. Checkout prices the charge from the order IDs supplied to the server. expectedTotal records the caller's expectation but does not cap or validate the payment amount.

Setup and configuration

Install and run the myhotlunchbox-mcp MCP server with npx myhotlunchbox-mcp, then provide MYHOTLUNCHBOX_USERNAME and MYHOTLUNCHBOX_PASSWORD. It can also be installed as a Claude Code plugin. The process starts without credentials so an install-time tool listing can succeed, but the first actual tool call reports a configuration problem if credentials are unavailable.

MYHOTLUNCHBOX_BASE_URL can replace the default application origin. Set MYHOTLUNCHBOX_OUTPUT_DIR to choose the destination for generated PDFs; otherwise they go to the working directory, and existing files are not overwritten. Confirmation behavior can be adjusted with MCP_CONFIRM_MODE, MCP_CONFIRM_ELICITATION, MCP_CONFIRM_TTL_SECONDS, and MCP_CONFIRM_SECRET.

Tools and capabilities

Tools use the mhlb_ prefix and cover account identity, session reset, health checks, students, calendars, carts, menus, orders, billing, checkout, and reports. Gift-card codes are masked to their final four characters unless a caller explicitly requests the full code.

mhlb_print_calendar, mhlb_print_orders, and mhlb_print_transaction return actual PDFs by writing a file path or, with inline: true, returning the bytes inline. Checkout only supports a card already saved on the account. A new card requires a Stripe token created in a browser, which this server cannot produce.

Read tools were tested against a real parent account at the documented verification point. Write request shapes were captured without sending them upstream, so a successful response does not establish that a write persisted. Re-read the account after approving a write. If checkout fails ambiguously, retry with the same idempotency key to avoid creating a second charge.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Myhotlunchbox MCP

myhotlunchbox-mcp is an MCP server that connects AI clients to a My Hot Lunchbox parent account through its server-side API. Its main tools read calendars, students, menus, carts, orders, billing data, and reports, while also supporting confirmed order changes, checkout, coupon and gift-card actions, and PDF generation.

Install it with `npx myhotlunchbox-mcp`. You can also add the repository as a Claude Code marketplace and install the `myhotlunchbox-mcp` plugin. Set the My Hot Lunchbox username and password before making account tool calls.

It needs `MYHOTLUNCHBOX_USERNAME` and `MYHOTLUNCHBOX_PASSWORD` for a My Hot Lunchbox parent account. The server signs in directly to the service and refreshes its session; it does not require a browser extension, signed-in tab, or captured cookie.

Yes, mutating tools require confirmation before sending a request. Clients with prompt support show a confirmation prompt; other clients receive a preview and single-use `confirmToken` that must be submitted again with unchanged arguments.

No, checkout can only use a payment method already saved on the account. Adding a new card requires a Stripe token minted by Stripe.js in a browser, which this server-side implementation cannot create.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMyhotlunchbox MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/myhotlunchbox-mcp?style=directory)](https://allmcps.com/mcp/myhotlunchbox-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/myhotlunchbox-mcp"><img src="https://allmcps.com/api/badge/myhotlunchbox-mcp?style=directory" alt="Myhotlunchbox MCP on AllMCPs" /></a>