{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "instacart", "name": "Instacart Developer Platform API + MCP", "vendor": "Maplebear Inc. (Instacart)", "vendorUrl": "https://docs.instacart.com/developer_platform_api.md", "kind": "http-api", "category": "shopping", "summary": "The Instacart Developer Platform API and its hosted MCP server turn a recipe or shopping list into an Instacart Marketplace page, where the person picks a store and checks out. It also finds nearby retailers by postal code.", "url": "https://www.anchorterminal.com/tools/instacart", "markdownUrl": "https://www.anchorterminal.com/tools/instacart.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/instacart.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/instacart.json", "license": "Proprietary service under the Instacart Developer Platform Terms and Conditions", "transports": [ "http" ], "remoteUrl": "https://mcp.instacart.com/mcp", "packages": [], "auth": "api-key", "authNotes": "A Bearer API key from the Instacart Developer Dashboard, separate for development and production, with read-only, read-write or admin permission levels. Access starts with an application on www.instacart.com. A production key stays pending until Instacart reviews a screen-recorded demo of the integration (https://docs.instacart.com/developer_platform_api/guide/concepts/launch_activities/approval_process.md). The MCP server takes the same key as a Bearer header.", "pricing": "free", "pricingNotes": "No fee for the API was found. Approved partners can join an affiliate programme on Impact.com that pays commission on attributed orders, with terms shared by email. The developer terms let Instacart add fees for previously free functions (https://docs.instacart.com/developer_platform_api/guide/terms_and_policies/developer_terms.md, checked 14 October 2026).", "priceSummary": "Free", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Developer Platform docs, the MCP tool list or the developer terms (checked 14 October 2026).", "endpoints": [] }, "toolCount": 2, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.instacart.com/developer_platform_api.md", "llmsTxt": "https://docs.instacart.com/llms.txt", "capabilities": [ "shopping.affiliate", "commerce.cart" ], "tags": [ "hosted", "mcp", "api-key", "llms-txt", "grocery", "affiliate", "approval-required" ], "lastRelease": "2026-06-18", "graded": true, "anchor": { "graded": true, "score": 48.3, "grade": "D", "agentReady": false, "rank": 877, "ranked": true, "rankOf": 1076, "categoryRank": 3, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 71, "maintenance": 20, "payments": 20, "reliability": 22, "schema": 80, "security": 61, "transparency": 51 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 22, "points": 4.4, "reason": "No status page was found. status.instacart.com did not answer (0 of 20), so there is no incident history (5 of 30). The docs say the API accepts a limited number of requests a second but give no figure (0 of 15). A 429 comes with advice to retry later and to contact Instacart if it repeats, with no Retry-After or backoff guidance, and the shopping list docs advise caching links instead of recreating them (7 of 15). No SLA (0 of 10). The API and MCP server are in production use with no beta label (10 of 10). Total 22." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 80, "points": 13, "reason": "No public OpenAPI file was found for the Developer Platform API. Both MCP tools have typed JSON Schema inputs with required fields and additionalProperties false (20 of 25). llms.txt and a Markdown version of every page on docs.instacart.com (10 of 10). The REST reference explains each endpoint and its matching rules. The MCP descriptions are one line each and say nothing on when to use them (10 of 20). Required fields, minItems, enums for health filters and a 365-day cap on expires_in. MCP units are free text (11 of 15). Examples in curl, Java, Python and Go, and per-endpoint error tables with codes (14 of 15). Versioned paths (/idp/v1) and a dated changelog (15 of 15). Total 80." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 71, "points": 11.54, "reason": "Two compact MCP tools (25 of 25). Responses are a single URL. The nearby retailers call filters by postal and country code, and line items take brand and health filters (15 of 20). Errors carry an internal code and a meta key that names the failing field (18 of 20). No idempotency keys and no readOnlyHint or destructiveHint annotations. Repeating a call creates another page, which costs nothing but a new link (5 of 20). Two required fields per tool. No official SDKs (8 of 15). Total 71." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 61, "points": 10.68, "reason": "Revocable API keys with read-only, read-write and admin levels, separate development and production keys, and a documented rotation procedure (25 of 30). The tools only create pages. The person chooses the store and checks out on Instacart, so an agent cannot spend money (18 of 20). The API returns a link and retailer names, with no free text from third parties (10 of 15). The dashboard shows each key's creation, last use and usage statistics (8 of 15). docs.instacart.com has no security.txt, and the one on www.instacart.com could not be read because robots.txt disallows our crawler. No disclosure programme was confirmed (0 of 20). Total 61. The MCP server answered the MCP handshake and tools/list without a key. Tool calls were not tested." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 20, "points": 2.5, "reason": "No x402, MPP or L402 (0 of 40). No price is published, and no page says the API is free. The terms let Instacart add fees later (10 of 20). A development key is free and needs no card, but access starts with an application whose page could not be read (10 of 20). A person applies and a production key needs a demo review (0 of 20). Total 20." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 20, "points": 1.75, "reason": "The newest changelog entry is 18 June 2026, 118 days before this check (10 of 30). No entries in the last 90 days (0 of 20). A dated changelog, a developer support address and an Atlassian service desk (10 of 15). No Instacart server in the official MCP registry, which lists only a community server, and no official SDKs (0 of 15). No public package or repository to assess (0 of 10). Total 20." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 51, "points": 4.46, "note": "editorial 28, provenance 74", "reason": "Closed service with dated developer terms that are clear on restrictions and termination (15 of 30). The terms set security and privacy obligations for the developer and refer to a privacy addendum. The privacy policy itself is on www.instacart.com and was not read (8 of 30). The 18 March 2026 deprecation of quantity and unit was announced with a replacement but no removal date, and the terms allow changes without notice (5 of 20). No subprocessor list or data locations were found for the Developer Platform (0 of 20). Total 28." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Two compact MCP tools (25 of 25). Responses are a single URL. The nearby retailers call filters by postal and country code, and line items take brand and health filters (15 of 20). Errors carry an internal code and a meta key that names the failing field (18 of 20). No idempotency keys and no readOnlyHint or destructiveHint annotations. Repeating a call creates another page, which costs nothing but a new link (5 of 20). Two required fields per tool. No official SDKs (8 of 15). Total 71.", "maintenance": "The newest changelog entry is 18 June 2026, 118 days before this check (10 of 30). No entries in the last 90 days (0 of 20). A dated changelog, a developer support address and an Atlassian service desk (10 of 15). No Instacart server in the official MCP registry, which lists only a community server, and no official SDKs (0 of 15). No public package or repository to assess (0 of 10). Total 20.", "payments": "No x402, MPP or L402 (0 of 40). No price is published, and no page says the API is free. The terms let Instacart add fees later (10 of 20). A development key is free and needs no card, but access starts with an application whose page could not be read (10 of 20). A person applies and a production key needs a demo review (0 of 20). Total 20.", "reliability": "No status page was found. status.instacart.com did not answer (0 of 20), so there is no incident history (5 of 30). The docs say the API accepts a limited number of requests a second but give no figure (0 of 15). A 429 comes with advice to retry later and to contact Instacart if it repeats, with no Retry-After or backoff guidance, and the shopping list docs advise caching links instead of recreating them (7 of 15). No SLA (0 of 10). The API and MCP server are in production use with no beta label (10 of 10). Total 22.", "schema": "No public OpenAPI file was found for the Developer Platform API. Both MCP tools have typed JSON Schema inputs with required fields and additionalProperties false (20 of 25). llms.txt and a Markdown version of every page on docs.instacart.com (10 of 10). The REST reference explains each endpoint and its matching rules. The MCP descriptions are one line each and say nothing on when to use them (10 of 20). Required fields, minItems, enums for health filters and a 365-day cap on expires_in. MCP units are free text (11 of 15). Examples in curl, Java, Python and Go, and per-endpoint error tables with codes (14 of 15). Versioned paths (/idp/v1) and a dated changelog (15 of 15). Total 80.", "security": "Revocable API keys with read-only, read-write and admin levels, separate development and production keys, and a documented rotation procedure (25 of 30). The tools only create pages. The person chooses the store and checks out on Instacart, so an agent cannot spend money (18 of 20). The API returns a link and retailer names, with no free text from third parties (10 of 15). The dashboard shows each key's creation, last use and usage statistics (8 of 15). docs.instacart.com has no security.txt, and the one on www.instacart.com could not be read because robots.txt disallows our crawler. No disclosure programme was confirmed (0 of 20). Total 61. The MCP server answered the MCP handshake and tools/list without a key. Tool calls were not tested.", "transparency": "Closed service with dated developer terms that are clear on restrictions and termination (15 of 30). The terms set security and privacy obligations for the developer and refer to a privacy addendum. The privacy policy itself is on www.instacart.com and was not read (8 of 30). The 18 March 2026 deprecation of quantity and unit was announced with a replacement but no removal date, and the terms allow changes without notice (5 of 20). No subprocessor list or data locations were found for the Developer Platform (0 of 20). Total 28." }, "sources": [ { "what": "Developer Platform introduction", "url": "https://docs.instacart.com/developer_platform_api.md", "seen": "2026-10-14" }, { "what": "MCP tutorial", "url": "https://docs.instacart.com/developer_platform_api/guide/tutorials/mcp.md", "seen": "2026-10-14" }, { "what": "MCP server handshake and tools/list", "url": "https://mcp.instacart.com/mcp", "seen": "2026-10-14" }, { "what": "API reference overview", "url": "https://docs.instacart.com/developer_platform_api/api/overview.md", "seen": "2026-10-14" }, { "what": "Create shopping list page", "url": "https://docs.instacart.com/developer_platform_api/api/products/create_shopping_list_page.md", "seen": "2026-10-14" }, { "what": "Get nearby retailers", "url": "https://docs.instacart.com/developer_platform_api/api/retailers/get_nearby_retailers.md", "seen": "2026-10-14" }, { "what": "Error and status codes", "url": "https://docs.instacart.com/developer_platform_api/api/error_and_status_codes.md", "seen": "2026-10-14" }, { "what": "Changelog", "url": "https://docs.instacart.com/developer_platform_api/api/changelog.md", "seen": "2026-10-14" }, { "what": "Get an API key", "url": "https://docs.instacart.com/developer_platform_api/get_started/api-keys.md", "seen": "2026-10-14" }, { "what": "API key security", "url": "https://docs.instacart.com/developer_platform_api/api/key-rotation.md", "seen": "2026-10-14" }, { "what": "Approval process", "url": "https://docs.instacart.com/developer_platform_api/guide/concepts/launch_activities/approval_process.md", "seen": "2026-10-14" }, { "what": "Pre-launch checklist", "url": "https://docs.instacart.com/developer_platform_api/guide/concepts/launch_activities/pre-launch_checklist.md", "seen": "2026-10-14" }, { "what": "Developer Platform terms and conditions", "url": "https://docs.instacart.com/developer_platform_api/guide/terms_and_policies/developer_terms.md", "seen": "2026-10-14" }, { "what": "Developer guidelines", "url": "https://docs.instacart.com/developer_platform_api/guide/terms_and_policies/developer_guidelines.md", "seen": "2026-10-14" }, { "what": "FAQ", "url": "https://docs.instacart.com/developer_platform_api/faq.md", "seen": "2026-10-14" }, { "what": "llms.txt", "url": "https://docs.instacart.com/llms.txt", "seen": "2026-10-14" }, { "what": "robots.txt disallowing our crawler", "url": "https://www.instacart.com/robots.txt", "seen": "2026-10-14" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=instacart", "seen": "2026-10-14" } ], "openQuestions": [ "robots.txt on www.instacart.com disallows our crawler (User-Agent: * Disallow: /), so the privacy policy, consumer terms, the developer application page and any security.txt there were not read. The lander may hold this listing for that reason.", "unchecked: the privacy policy at https://www.instacart.com/company/privacy and the Instacart Privacy Addendum named in the developer terms.", "unchecked: whether tool calls on the MCP server reject a missing key. Only the handshake and tools/list were sent, without a key.", "unchecked: a vulnerability disclosure or bug bounty programme. The HackerOne page did not render for our reader.", "unchecked: the rate limit figure, which the docs do not publish.", "The API overview says to contact an Instacart representative for a key, while the key guide describes self-service creation in the dashboard after applying. The two pages disagree." ] }, "negative": 0, "verdict": "Two compact MCP tools and a small REST API with structured errors let an agent turn a list into an Instacart cart link. The agent cannot search products, see prices, place an order or follow one, and production keys need a demo review that Instacart puts at 30 to 40 days. No status page or published rate figure was found.", "bestFor": "Grocery list and recipe hand-off for meal planning and recipe agents in the US and Canada.", "strengths": [ "Hosted MCP server at https://mcp.instacart.com/mcp with two tools, create-recipe and create-shopping-list, each with typed JSON Schema inputs", "Errors return an HTTP code, an internal error code and a meta key naming the field, with per-endpoint error tables", "Separate development and production hosts and keys, with key rotation and revocation documented", "Line items accept UPCs, brand filters and health filters such as ORGANIC and GLUTEN_FREE for product matching", "Dated changelog on docs.instacart.com, with entries from 18 September 2025 to 18 June 2026" ], "weaknesses": [ "No product search, price, order, order status or return endpoint. The person picks the store and checks out on Instacart", "Production keys need a screen-recorded demo and review, and Instacart puts access request to production at about 30 to 40 days", "No status page and no rate limit figure, only a 429 with advice to retry later", "The MCP tool schema still uses quantity and unit, which the REST API deprecated on 18 March 2026", "www.instacart.com disallows our crawler in robots.txt, so the privacy policy and application page were not read" ], "agentNotes": [ "Connect to https://mcp.instacart.com/mcp over Streamable HTTP with Authorization: Bearer and an Instacart Developer Platform key. Test against https://mcp.dev.instacart.tools/mcp with a development key", "Give the person the returned products_link_url to choose a store and check out. No call places or tracks an order", "Cache each generated link and create a new one only when the list changes, as the docs advise", "Send line_item_measurements rather than quantity and unit on the REST shopping list endpoint, since those fields are deprecated", "Do not show priced items from more than one retailer on one screen or move items between retailer baskets. The developer terms forbid both" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 48.3 } ], "editorialScores": { "ergonomics": 71, "maintenance": 20, "payments": 20, "reliability": 22, "schema": 80, "security": 61, "transparency": 28 }, "provenanceScore": 74 }, "connect": { "http": "curl --request POST --url 'https://connect.dev.instacart.tools/idp/v1/products/products_link' --header 'Authorization: Bearer \u003cAPI-key\u003e' --header 'Content-Type: application/json' --data '{\"title\":\"Groceries\",\"line_items\":[{\"name\":\"eggs\"}]}'", "config": { "mcpServers": { "instacart": { "headers": { "Authorization": "Bearer \u003cAPI-key\u003e" }, "type": "http", "url": "https://mcp.instacart.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/shopping.affiliate", "tool": "https://letme.dev/instacart" }, "notable": [ "An unauthenticated MCP handshake and tools/list request against https://mcp.instacart.com/mcp answered on 14 October 2026 with server InstacartRecipeServer 1.0.0 and the tools create-recipe and create-shopping-list. No tool call was made", "The pre-launch checklist asks for a screen recording and fixes the call-to-action text, size and colours, and Instacart says it replies within 5 business days (https://docs.instacart.com/developer_platform_api/guide/concepts/launch_activities/pre-launch_checklist.md)", "Instacart puts the average time from access request to production key at about 30 to 40 days (https://docs.instacart.com/developer_platform_api/get_started/overview.md)", "The developer terms forbid scraping, showing priced items from several retailers on one screen and moving items between retailer baskets (https://docs.instacart.com/developer_platform_api/guide/terms_and_policies/developer_terms.md)", "www.instacart.com robots.txt ends with User-Agent: * Disallow: / and names no Anthropic agent, so no page on that host was fetched", "The official MCP registry lists only a community server, io.github.markswendsen-code/instacart, which drives the website with a browser and is not Instacart's (https://registry.modelcontextprotocol.io/v0/servers?search=instacart)" ], "area": "everyday", "details": [ { "label": "Endpoints", "value": "POST /idp/v1/products/products_link (shopping list page), POST /idp/v1/products/recipe (recipe page), GET /idp/v1/retailers (nearby retailers by postal and country code) on https://connect.instacart.com, development on https://connect.dev.instacart.tools" }, { "label": "MCP server", "value": "Production https://mcp.instacart.com/mcp and development https://mcp.dev.instacart.tools/mcp, Streamable HTTP, API key as a Bearer header. Server name InstacartRecipeServer 1.0.0, protocol 2024-11-05, tools create-recipe and create-shopping-list" }, { "label": "Credentials", "value": "API keys of the form keys.\u003cid\u003e created in the Instacart Developer Dashboard, development or production, with read-only, read-write and admin permission levels, rotation and revocation. Production keys stay pending until Instacart approves a demo" }, { "label": "Matching", "value": "Instacart matches products from the line item name, or from UPCs or product IDs when given, with brand and health filters. SKUs are not supported and the retailer cannot be chosen by the developer" }, { "label": "Links", "value": "expires_in up to 365 days on shopping list pages. The returned URL opens the Instacart app or web page, where the person selects a store and checks out" }, { "label": "Affiliate", "value": "Approved partners are invited to Instacart's affiliate programme on Impact.com, with tracking parameters appended to generated links automatically" }, { "label": "Errors", "value": "200, 400, 401, 403, 404, 408, 429, 500 and 503, with single and multiple error JSON formats carrying error.code and meta.key" }, { "label": "Terms", "value": "Instacart Developer Platform Terms and Conditions of Maplebear Inc. dba Instacart, last updated 3 July 2024. Scraping forbidden, access can end at any time, the API can change without notice" } ], "provenance": { "legalEntity": "Maplebear Inc. dba Instacart", "domain": "instacart.com", "domainRegistered": "1996-10-31", "endpointOnVendorDomain": true, "terms": "https://docs.instacart.com/developer_platform_api/guide/terms_and_policies/developer_terms.md", "privacy": "https://www.instacart.com/company/privacy", "statusPage": "", "changelog": "https://docs.instacart.com/developer_platform_api/api/changelog.md", "securityTxt": "unknown", "checked": "2026-10-14", "notes": [ "The developer terms, last updated 3 July 2024, are entered into by Maplebear Inc. dba Instacart and name the privacy policy at https://www.instacart.com/company/privacy.", "www.instacart.com robots.txt disallows every path for agents it does not name, including ours, so the privacy policy and security.txt on that host were not read.", "docs.instacart.com/.well-known/security.txt returned 404. status.instacart.com did not answer and no other status page was found.", "RDAP gives instacart.com a registration date of 31 October 1996." ], "score": 74, "checks": [ { "check": "Legal entity named", "value": "Maplebear Inc. dba Instacart", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "instacart.com, registered 1996-10-31 (29 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "mcp.instacart.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "could not be fetched", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://docs.instacart.com/developer_platform_api/guide/terms_and_policies/developer_terms.md", "state": "unreadable", "reason": "not a text document (application/octet-stream)", "readAt": "2026-10-14", "points": 7, "max": 10 }, { "kind": "privacy", "url": "https://www.instacart.com/company/privacy", "state": "unreadable", "reason": "robots.txt asks readers like ours not to fetch it", "readAt": "2026-10-14", "points": 7, "max": 10 } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/instacart.json", "live": { "slug": "instacart", "probe": { "target": "https://mcp.instacart.com/mcp", "method": "get", "lastAt": "2026-10-14T09:41:54.373790409Z", "lastOk": true, "lastStatus": 404, "lastMs": 345, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 342, "p95ms24h": 489, "samples24h": 17, "samples30d": 17, "days": [ { "date": "2026-10-14", "probes": 17, "ok": 17 } ] }, "updatedAt": "2026-10-14T09:41:54.373790409Z" } } }