Instacart Developer Platform API + MCP vs MealMe API

Instacart Developer Platform API + MCP 61

Revocable API keys with read-only, read-write and admin levels, separate development and production keys, and a documented rotation procedure (25 of 30). The tools only create pages. The person chooses the store and checks out on Instacart, so an agent cannot spend money (18 of 20). The API returns a link and retailer names, with no free text from third parties (10 of 15). The dashboard shows each key's creation, last use and usage statistics (8 of 15). docs.instacart.com has no security.txt, and the one on www.instacart.com could not be read because robots.txt disallows our crawler. No disclosure programme was confirmed (0 of 20). Total 61. The MCP server answered the MCP handshake and tools/list without a key. Tool calls were not tested.

MealMe API 26

One API key per account in a custom Id-Token header, with no scopes, expiry, rotation or revocation documented (10 of 30). place_order defaults to false and charge_user can be turned off, so an agent can quote without buying, but there is no read-only key (8 of 20). Store descriptions, menus and support-chat messages are untrusted content with no guidance (3 of 15). Get Orders and a tracking webhook give order history; no per-call log for the operator is documented (5 of 15). No security.txt (400), disclosure policy, bug bounty or certification found; the Enterprise plan names a security review (0 of 20). Total 26.

Instacart Developer Platform API + MCP 20

The newest changelog entry is 18 June 2026, 118 days before this check (10 of 30). No entries in the last 90 days (0 of 20). A dated changelog, a developer support address and an Atlassian service desk (10 of 15). No Instacart server in the official MCP registry, which lists only a community server, and no official SDKs (0 of 15). No public package or repository to assess (0 of 10). Total 20.

MealMe API 6

Read as a closed service. The newest dated change is the release note of 6 May 2025 (Get Inventory v4), more than 180 days before 3 November 2026; the pricing and dashboard pages carry no date (0 of 30). No dated change in the last 90 days (0 of 20). A support address, release notes and no community channel (6 of 15). No official SDKs (0). No package to judge (0). Total 6.

Instacart Developer Platform API + MCP 80

No public OpenAPI file was found for the Developer Platform API. Both MCP tools have typed JSON Schema inputs with required fields and additionalProperties false (20 of 25). llms.txt and a Markdown version of every page on docs.instacart.com (10 of 10). The REST reference explains each endpoint and its matching rules. The MCP descriptions are one line each and say nothing on when to use them (10 of 20). Required fields, minItems, enums for health filters and a 365-day cap on expires_in. MCP units are free text (11 of 15). Examples in curl, Java, Python and Go, and per-endpoint error tables with codes (14 of 15). Versioned paths (/idp/v1) and a dated changelog (15 of 15). Total 80.

MealMe API 72

The reference pages are generated from an API description with operation ids (get_search_store_v3), named response schemas (Product_Search_Output) and typed parameters, but no spec file URL was found on the docs, llms.txt or the site (15 of 25). llms.txt at mealmeapi.readme.io and mealme.ai, and every page as Markdown (10). Each operation states its purpose and coverage; several descriptions are truncated in the index and none says when not to use it (12 of 20). Enums on sort, store_type, user_country and search_focus, required flags on latitude and longitude, conditional requirements written in prose (11 of 15). Request and response examples per endpoint, a Create Order errors page with 17 entries, and 400, 401 and 429 schemas on each operation (12 of 15). Versioned paths (v2 to v4) and dated release notes that call out breaking changes, the newest of 6 May 2025 (12 of 15). Total 72.

Instacart Developer Platform API + MCP 53

Closed service with dated developer terms that are clear on restrictions and termination (15 of 30). The terms set security and privacy obligations for the developer and refer to a privacy addendum. The privacy policy itself is on www.instacart.com and was not read (8 of 30). The 18 March 2026 deprecation of quantity and unit was announced with a replacement but no removal date, and the terms allow changes without notice (5 of 20). No subprocessor list or data locations were found for the Developer Platform (0 of 20). Total 28.

MealMe API 47

Closed service. The API and SDK Terms of Use (18 June 2022) and MealMe Connect terms (4 April 2025) name MealMe, Inc. under Delaware law, but the API terms license use for personal, noncommercial purposes while the product is sold to businesses (15 of 30). The privacy policy of 1 January 2025 keeps data as long as needed, names no subprocessor and no DPA; the cookie policy names Google, Adobe, LinkedIn, Twitter and Facebook (10 of 30). Release notes record breaking changes with dates but there is no deprecation policy or notice period (6 of 20). Cookie providers named, no subprocessor list or data location (4 of 20). Total 35.