How do I install Untappd?

Untappd is a local plugin. Install it using npm package: untappd-mcp and add the generated configuration snippet to your AI app's MCP config file. Then restart your AI app.

Is Untappd safe to use?

Untappd scored 6/10 (moderate risk) in MCP Marketplace's automated security scan. It has 1 high or critical finding to review. It's listed, but review the security report on this page before installing.

What credentials does Untappd need?

Untappd requires the following credentials or environment variables: UNTAPPD_USERNAME, UNTAPPD_PASSWORD, UNTAPPD_CLIENT_ID, UNTAPPD_CLIENT_SECRET. You can find setup instructions on the server detail page.

What AI apps work with Untappd?

Untappd uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Untappd MCP Server

by Chris Hall

Developer ToolsModerate6.0LocalNew

Free

Untappd MCP — search beers/breweries/venues, read check-ins & wishlists, post check-ins

About

Untappd MCP — search beers/breweries/venues, read check-ins & wishlists, post check-ins

Security Report

6.0

Moderate6.0Moderate Risk

This is a well-structured MCP server that implements proper authentication with Untappd's private API. The code demonstrates good security practices including credential management via environment variables, proper error handling, and confirm-gated write operations. Minor code quality observations exist around broad exception handling and logging practices, but these do not constitute material security risks. Permissions align appropriately with the server's purpose of reading and writing user Untappd data. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

7 files analyzed · 7 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

What You'll Need

Set these up before or after installing:

Your Untappd username or login email.Optional

Environment variable: UNTAPPD_USERNAME

Your Untappd account password (used only for xauth login).Required

Environment variable: UNTAPPD_PASSWORD

Untappd mobile app client id (obtained by intercepting the app; see README).Required

Environment variable: UNTAPPD_CLIENT_ID

Untappd mobile app client secret.Required

Environment variable: UNTAPPD_CLIENT_SECRET

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-chrischall-untappd-mcp": {
      "env": {
        "UNTAPPD_PASSWORD": "your-untappd-password-here",
        "UNTAPPD_USERNAME": "your-untappd-username-here",
        "UNTAPPD_CLIENT_ID": "your-untappd-client-id-here",
        "UNTAPPD_CLIENT_SECRET": "your-untappd-client-secret-here"
      },
      "args": [
        "-y",
        "untappd-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

untappd-mcp

An MCP server for Untappd. It talks to Untappd's mobile (v4) API using your own account — search beers, breweries, and venues; read profiles, check-ins, wishlists, distinct beers, badges, friends, and your friend activity feed; and post check-ins, toasts, and comments.

Developed and maintained by AI (Claude Code). Use at your own discretion. This is an unofficial client that uses Untappd's private mobile API; it is not affiliated with or endorsed by Untappd.

How it works

Untappd's iPad/iPhone app authenticates with a username/password xauth login (POST https://api.untappd.com/v4/xauth) that returns an access token, then calls the v4 API. This server reproduces that exactly:

Reads carry the token as an access_token query param.
Writes carry it as an Authorization: Bearer header (with the app's client credentials in the query), matching the app's real requests.

The token is fetched on demand, cached in memory, and refreshed automatically if it goes stale.

Configuration

Variable	Required	Description
`UNTAPPD_USERNAME`	yes	Your Untappd username or login email.
`UNTAPPD_PASSWORD`	yes	Your Untappd password (used only for the xauth login).
`UNTAPPD_CLIENT_ID`	yes	The Untappd mobile app client id (see below).
`UNTAPPD_CLIENT_SECRET`	yes	The Untappd mobile app client secret.
`UNTAPPD_DEVICE_ID`	no	Stable device UUID the token is keyed to (a default is provided).
`UNTAPPD_UTV`	no	API version param (default `4.0.0`).
`UNTAPPD_USER_AGENT`	no	Override the User-Agent (default mimics the app).

Copy .env.example to .env and fill it in for local use.

Obtaining the client id / secret

Untappd does not publish these; they live in the mobile app. Capture them from your own app's traffic with an HTTPS proxy:

Install a proxy such as mitmproxy and trust its CA certificate on the device running the Untappd app.
Point the device (or, on an Apple-silicon Mac running the iPad app, the Mac's system HTTP/HTTPS proxy) at the proxy.
Open Untappd and sign in. Find the POST https://api.untappd.com/v4/xauth request — its query string contains client_id and client_secret.
Put those into UNTAPPD_CLIENT_ID / UNTAPPD_CLIENT_SECRET.

Keep these values private; do not commit them.

Tools

Reads: untappd_search_beer, untappd_beer_info, untappd_beer_activity, untappd_search_brewery, untappd_brewery_info, untappd_brewery_beers, untappd_search_venue, untappd_venue_info, untappd_venue_activity, untappd_user_info, untappd_user_checkins, untappd_user_wishlist, untappd_user_beers, untappd_user_badges, untappd_user_friends, untappd_pending_friends, untappd_activity_feed, untappd_checkin_info, untappd_resolve, untappd_open_url, untappd_user_venues, untappd_venue_by_foursquare, untappd_trending, untappd_notifications, untappd_local_checkins, untappd_healthcheck.

Writes (confirm-gated — return a dry-run preview unless called with confirm: true): untappd_toast, untappd_add_comment, untappd_delete_comment, untappd_checkin, untappd_wishlist_add, untappd_wishlist_remove, untappd_delete_checkin, untappd_add_friend, untappd_accept_friend, untappd_reject_friend, untappd_remove_friend.