
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
okala-mcp
Advanced tools
Unofficial read-only MCP server for Okala: find grocery stores that deliver to you, compare prices across stores, browse deals.
Let your AI agent do the grocery price check on Okala (اُکالا).
An unofficial MCP server for Okala, an Iranian online supermarket where local supermarkets, bakeries and fruit shops deliver to your address:
find the stores that deliver to you, compare one product across nearby stores, check fees, minimum order and delivery slots, and catch today's deals, from Claude, Cursor or Copilot.
For AI agents · Quick start · What it can do · Tools · FAQ · فارسی
For AI agents · Why · What it can do · Quick start · Tools · How it works · Good to know · Optional login · FAQ · Configuration · فارسی · Development · Related servers · Disclaimer · License
uvx okala-mcp or claude mcp add okala -- uvx okala-mcp. Transport: stdio. Needs uv (Python 3.10+).ok_login) unlocks Okala's text search in ok_search. Env vars: OKALA_MCP_PROXY (HTTP proxy), OKALA_MCP_TOKEN (access token instead of the saved login), OKALA_MCP_TOKEN_FILE (where the login is saved).ok_login sends an SMS to the user's phone, ok_login_verify saves the login, ok_logout deletes it. Ask the user before calling ok_login or ok_logout, never log in unless the user asks, and never ask for or repeat tokens.ok_. Every location tool needs lat and lon, so start with ok_locate. Typical sequence: ok_locate → ok_search → ok_compare, or ok_locate → ok_stores → ok_store_products.final_price is what the buyer pays, price is before discount, discount_pct is a whole percent, ratings are 0-5. Pass lat and lon from ok_locate, and store_id from ok_stores, between tools.server.json, and the catalog of all Iranian MCP servers at awesome-iran-mcp (TOOLS.md, servers.json, llms.txt).On Okala every store sets its own price for the same carton of milk, and each one adds its own service and
packaging fee and has its own minimum order. The site shows one store at a time, and there is no search
box without logging in. An agent with okala-mcp checks every store that delivers to you in one go:
You: Where is Kalleh lactose-free milk cheapest near Yousef Abad, Tehran?
Agent: calls
ok_locate(address="یوسف آباد")→ok_search(query="شیر بدون لاکتوز کاله", ...)→ok_compare(category_slug="low-fat-milk", ...)Kalleh fat-free, lactose-free milk (1 L) is sold by 17 open stores nearby. Cheapest: یاران دریان گلریز at 147,875 Toman (12% off 169,000), 1.6 km away, first slot today 08-09, plus 10,500 service and 3,000 packaging. The dearest store asks 180,000, so you save 32,125.
Real tool output from 2026-10-07; prices change all the time. Prices are in Toman.
Every reply is a compact JSON text block, so it does not flood the agent's context.
Example prompts:
You need uv. No API key or account.
claude mcp add okala -- uvx okala-mcp
Settings → Developer → Edit Config, then add:
{
"mcpServers": {
"okala": { "command": "uvx", "args": ["okala-mcp"] }
}
}
Click Install in Cursor above, or add the Claude Desktop block to ~/.cursor/mcp.json (or .cursor/mcp.json in a project).
Click Install in VS Code above, or add to .vscode/mcp.json:
{
"servers": {
"okala": { "type": "stdio", "command": "uvx", "args": ["okala-mcp"] }
}
}
codex mcp add okala -- uvx okala-mcp
Or in ~/.codex/config.toml:
[mcp_servers.okala]
command = "uvx"
args = ["okala-mcp"]
Add to ~/.gemini/settings.json:
{
"mcpServers": {
"okala": { "command": "uvx", "args": ["okala-mcp"] }
}
}
Add the Claude Desktop block to ~/.codeium/windsurf/mcp_config.json.
It's a standard stdio MCP server: run uvx okala-mcp, or pip install okala-mcp and run okala-mcp.
Start with ok_locate: every location tool takes lat and lon from it, and store_id comes from ok_stores.
| Tool | What it does |
|---|---|
ok_locate | Address text → coordinates (candidates) plus the street address of the best hit |
ok_stores | Stores that deliver to a point: type, rating, distance, first slot, service / packaging / delivery fee |
ok_store | One store: serves this point?, minimum order, location, open delivery slots (all_slots adds full ones with availability) |
ok_store_reviews | Customer reviews of a store: stars, comment (full_text for whole), liked / disliked reasons |
| Tool | What it does |
|---|---|
ok_search | Products for a query near a point or in one store: Okala's text search when logged in, matching categories as a guest; name matches first, then cheapest |
ok_compare | The same product across nearby stores, cheapest store first, with each store's fees |
ok_store_products | A whole category of one store, sorted, filtered by name (search inside one store) |
ok_product | One product in one store: price, discount, stock, max per order, brand, images, description (full_text for whole) |
ok_categories | Category tree with slugs, near a point or in one store |
ok_brands | Brand ids and slugs (featured brands, or lookup by slug) |
| Tool | What it does |
|---|---|
ok_deals | Deal rows running now near a point or in one store, with end time and top products |
ok_offer | One deal row in full, across stores or in one store, sorted and paged |
| Tool | What it does |
|---|---|
ok_login | Sends an SMS code to the user's phone; asks for the code in a form when the client supports it |
ok_login_verify | Finishes the login with the code the user typed in the chat |
ok_account | Logged in or guest, and as which phone (masked) |
ok_logout | Deletes the saved login; the server continues as a guest |
The 12 shopping tools and ok_account are annotated readOnlyHint: true. ok_login, ok_login_verify and ok_logout are not
(they send an SMS or change the saved login), so your client asks before running them; ok_logout is also
destructiveHint: true. At most 3 login codes are sent per hour.
AI agent (Claude, Cursor, Copilot, ...)
│
│ MCP over stdio
▼
okala-mcp (runs on your machine)
│
│ HTTPS
└──────▶ apigateway.okala.com the JSON API behind okala.com
okala-mcp runs locally and calls the same endpoints the okala.com website uses, as a guest unless you log in.
There's no hosted server in between, no API key, and nothing about you is sent anywhere else
(only the delivery point you ask about goes to Okala). Requests go out through a Chrome-impersonating client, at most
2 at a time with a little jitter; a failed GET is retried up to twice.
final_price is what you pay, price is before discount, discount_pct is a whole percent.ok_compare can line them up.ok_stores), and the basket must reach the store's minimum_order (ok_store). One basket = one store.ok_search uses Okala's real search, near you or inside one store (store_id), brands and product names included (نوتلا). As a guest, ok_search matches your words to category names (شیر → milk) and ranks products by name; for one store, ok_store_products with name_contains reads the whole department.شیر کم چرب, پنیر, تن ماهی). Arabic ي / ك and half-spaces are normalized.ok_search and ok_compare; ok_stores with open_only: false also shows stores that are closed now.kalabarg badge on a product means it can be paid with the government voucher.ok_brands can look up others by slug.lat and lon). Okala can change its API without notice, so keep request rates reasonable.Everything works as a guest. Logging in only unlocks Okala's text search in ok_search (brands and product names,
inside one store too). Just ask your agent:
You: Log me in to Okala, my number is 0912 123 4567
Agent: calls
ok_login→ Okala sends you an SMS → you type the code (in a form if your client shows one, otherwise in the chat) → logged in
~/.okala-mcp/token.json), refreshes itself, is sent only to
apigateway.okala.com, and never appears in a tool reply. If it stops working, the server carries on as a guest.ok_account shows the state; ok_logout deletes the login.Prefer a terminal? The same login works from the command line:
uvx okala-mcp login 09121234567 # sends the code
uvx okala-mcp login 09121234567 12345 # saves the login
uvx okala-mcp logout # deletes it
Restart your MCP client after a command-line login (a running server reads the login once).
No, and that's deliberate. It never touches the cart, order, payment, address or review endpoints, even when logged in. The agent finds the best option; you buy it on okala.com.
Okala doesn't publish an official API for agents. okala-mcp is an unofficial MCP server that wraps the endpoints of
okala.com as 16 tools (12 read-only shopping tools and 4 login tools).
Install the server once (see Quick start), then ask in plain language, in Persian or English, with an
address or area so it can find the stores that deliver there. In Claude Code the install is
claude mcp add okala -- uvx okala-mcp.
It is unofficial and free (MIT). Shopping tools are read-only and need no account or API key. It runs on your machine with no hosted server in between; the optional login is saved only on your machine.
ok_search show products that don't match my words?As a guest (mode: "category"), Okala's text search is not available, so ok_search fetches the categories whose
names match your words and puts the products whose names contain your words first. Log in once to get real text search. categories in the reply shows what was used; pass a better
slug to ok_compare, or search one store's department with ok_store_products.
Okala covers Tehran and some other big cities. Check the coordinates with ok_locate (the first candidate can be a
similar name in another district) and try again; ok_stores with open_only: false also shows stores that are closed now.
The server retries a dropped connection or a rate-limit answer twice. If it still fails, check your internet connection. System proxy
variables are ignored on purpose; set OKALA_MCP_PROXY if you need a proxy. If Okala shows a bot-check page, install
the browser extra (pip install "okala-mcp[browser]", then patchright install chromium) and the server clears it
once in a headless browser.
The login is optional. The token is saved on your machine, sent only to apigateway.okala.com and never shown in a tool reply. With a client that supports MCP forms, the SMS code goes straight to the server and not through the model.
npx @modelcontextprotocol/inspector uvx okala-mcp
| Variable | Default | Meaning |
|---|---|---|
OKALA_MCP_PROXY | unset | Optional HTTP proxy URL for okala.com requests, e.g. http://user:pass@host:port; a comma-separated list is used one at a time (next one after a block); system proxy settings are ignored |
OKALA_MCP_TOKEN_FILE | ~/.okala-mcp/token.json | Where okala-mcp login saves the login |
OKALA_MCP_TOKEN | unset | An Okala access token to use instead of the saved login (not refreshed) |
okala-mcp یک سرور MCP غیررسمی برای سوپرمارکت اینترنتی ایرانی اُکالا (okala.com) است و به دستیار هوش مصنوعی شما (Claude، Cursor، Copilot و ...) اجازه میدهد فروشگاههای اُکالا را که به آدرس شما ارسال دارند پیدا کند، قیمت یک کالا را در همهی فروشگاههای نزدیک مقایسه کند، هزینهی خدمات و بستهبندی، حداقل سفارش و زمانهای ارسال را ببیند و تخفیفهای امروز را پیدا کند. برای خرید آنلاین مواد غذایی، مقایسه قیمت سوپرمارکت و پیدا کردن ارزانترین فروشگاه اطراف شما.
نصب در Claude Code:
claude mcp add okala -- uvx okala-mcp
بعد بپرسید: «ارزانترین شیر کم چرب میهن نزدیک یوسفآباد تهران را کدام فروشگاه دارد؟»
برای جستجو کافی است نام کالا و محله یا آدرس خود را به فارسی بنویسید، مثلاً «تن ماهی نزدیک میدان آرژانتین».
git clone https://github.com/sepehr071/okala-mcp && cd okala-mcp
uv sync
uv run pytest # offline, against recorded responses
uv run pytest -m live # real okala.com
uv run ruff check .
Tools live in src/okala_mcp/stores.py, catalog.py, offers.py and account.py; each is a typed async function with a
docstring that tells the agent when to use it. Issues and PRs are welcome, especially new tools and fixes for site changes.
Releases: bump the version in pyproject.toml and server.json, then push a v* tag. GitHub Actions tests,
publishes to PyPI and the MCP Registry, and creates the GitHub Release.
If this saves you clicks, a star helps others find it.
Unofficial and not affiliated with or endorsed by Okala. It uses the endpoints of the okala.com website, which can change without notice. Please keep request rates reasonable.
FAQs
Unofficial read-only MCP server for Okala: find grocery stores that deliver to you, compare prices across stores, browse deals.
The pypi package okala-mcp receives a total of 408 weekly downloads. As such, okala-mcp popularity was classified as not popular.
We found that okala-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.