
Product
Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.
@cookmd/mcp
Advanced tools
MCP server for Cooklang recipes and cook.md: validate, plan, shop, pantry, reports, nutrition and import
An MCP server that gives your AI agent (Claude Code, Claude Desktop, Cursor, ChatGPT, or any other MCP client) access to your Cooklang recipe collection. Recipes stay as plain .cook and .menu files in a folder you own. The agent can read, search, validate and write them, build shopping lists, track a pantry and render reports, all locally and without an account. With a cook.md login it can also compute nutrition and import recipes from photos and social links.
Claude Code:
claude mcp add cook -- npx -y @cookmd/mcp
Any client that takes an mcpServers config:
{
"mcpServers": {
"cook": {
"command": "npx",
"args": ["-y", "@cookmd/mcp"],
"env": { "COOK_RECIPES_DIR": "/path/to/recipes" }
}
}
}
If COOK_RECIPES_DIR is not set, the client's working directory is the recipe root.
Supported platforms: macOS (arm64, x64) and Linux (x64, arm64, glibc 2.35 or newer). There are no Windows builds yet.
Setup notes for specific clients: https://cook.md/help/mcp
| Tool | What it does |
|---|---|
list_recipes | List recipes, meal plans or report templates (kind: recipe, menu, template, all) |
read_recipe | Read a recipe or menu: source plus parsed ingredients, cookware, steps and metadata; optional scaling |
search_recipes | Search names and contents, optionally filtered by tag |
validate | Check a file, a folder, the whole collection, or unsaved content for errors and broken references |
write_recipe | Save a .cook recipe (validated first) |
write_menu | Save a .menu meal plan (validated first) |
write_config | Save config/aisle.conf, config/pantry.conf, or a .jinja report template under reports/ or config/reports/ |
shopping_list | Build a shopping list from recipes and/or menus: merges duplicates, groups by aisle, subtracts the pantry |
pantry_list | Show the pantry, by section |
pantry_expiring | Items expiring soon |
pantry_depleted | Items at or below their low-stock threshold |
pantry_recipes | Which recipes you can cook with what is in the pantry |
pantry_update | Add, update or remove pantry items |
render_report | Render a jinja report template against a recipe or menu (plain templates need no login) |
| Tool | What it does |
|---|---|
login | Start a cook.md device login; shows a code and a URL |
auth_status | Show login status, plan and import allowance |
get_nutrition | Nutrition facts for one ingredient amount |
aggregate_nutrition | Sum nutrition across many ingredient lines |
lookup_ingredient | Fuzzy-search the ingredient catalog |
convert_units | Convert between units (volume to mass needs a density) |
check_category | Check whether an ingredient belongs to a category |
branded_lookup | Look up a packaged product by barcode or text |
reference_intakes | Daily reference-intake tables (RDA/DV) |
import_recipe | Convert a web page, photos or pasted text to Cooklang |
import_recipe from a web page or pasted text works without a login. Photos and social-media links need a cook.md account and use your import allowance. It returns Cooklang text and does not save it; the agent validates it and calls write_recipe. Nutrition functions inside render_report also need Cook Basic or Pro.
Prompts: meal-planning, shopping-list, pantry, import-recipe, edit-recipe, nutrition-report, nutrition-goals.
Resources:
cooklang://spec: the Cooklang specificationcooklang://syntax: a syntax referencecooklang://menu-format: the .menu meal plan formatcooklang://skills/<name>: working guides for the agent: cooklang-editing, cooklang-validation, meal-planning, metadata, nutrition-goals, nutrition-reports, pantry, recipe-import, report-authoring, shopping-list>> metadata syntax is refused. Use YAML frontmatter.@./ reference, may still be followed. This only matters if you put symlinks pointing outside the folder into your recipes.| Var | Default | Meaning |
|---|---|---|
COOK_RECIPES_DIR | the client's working directory | Recipe root. Every path is relative to it. |
COOKMD_BASE_URL | https://cook.md | Login, entitlements, import |
NUTRITION_API_URL | https://nutrition.cook.md | Nutrition service |
NUTRITION_API_TOKEN | none | Org key or pre-made token. Takes priority over the stored login. |
COOK_MCP_AUTH_PATH | ~/.config/cook-mcp/auth.json | Token store. The old NUTRITION_MCP_AUTH_PATH still works as an alias. |
cargo build --release
cargo test
The binary is target/release/cook-mcp. It speaks MCP over stdio. cook-mcp login and cook-mcp logout manage the cook.md login from a terminal.
@cookmd/nutrition-mcp keeps working: it is now a thin shim that runs @cookmd/mcp. To switch, change the package name in your MCP config to @cookmd/mcp. Your login carries over.
Two things changed. Recipe tools need COOK_RECIPES_DIR (old configs did not set it), or start the client in your recipe folder; without either, recipe tools tell the agent that no recipe folder is set. And render_report paths are now relative to the recipe folder.
MIT
FAQs
MCP server for Cooklang recipes and cook.md: validate, plan, shop, pantry, reports, nutrition and import
The npm package @cookmd/mcp receives a total of 0 weekly downloads. As such, @cookmd/mcp popularity was classified as not popular.
We found that @cookmd/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.

Security News
Fixes for eMudhra and Brotli are out. Getting them everywhere they’re needed means tracking down bundled libraries, runtimes, and certificate stores.

Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.