Is Instacart MCP server safe?
Probably. Read the findings first.
Use with care. Some checks failed or could not be verified.
Public scan report
scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it
no findings
- Code scan13 source files scanned25/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitystatic API keys via environment variables6/15
- Maintenancelast push 109 days ago8/15
- Maintainer identityregistry namespace matches repository owner6/10
Overall 69/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON
Other servers that do what Instacart does
- not reviewedGrowingB
- Polymarket ToolkitRead-only Polymarket data tools for AI agents: profiles, PnL, market scans. No keys, no orders.not reviewedEstablishedB
- Sv NumberPhone numbers for AI agents: order a private number, read the SMS verification code, hand it back.not reviewedEstablishedB