{ "data": { "similar": [ { "grade": "D", "json": "https://www.anchorterminal.com/tools/logmeal.json", "name": "LogMeal", "score": 49.1, "shared": [ "cooking.food-recognition", "cooking.nutrition", "cooking.meal-plans", "cooking.recipes", "cooking.grocery" ], "slug": "logmeal" }, { "grade": "E", "json": "https://www.anchorterminal.com/tools/eat-this-much.json", "name": "Eat This Much Partner API", "score": 45.7, "shared": [ "cooking.meal-plans", "cooking.grocery", "cooking.nutrition", "cooking.recipes" ], "slug": "eat-this-much" }, { "grade": "E", "json": "https://www.anchorterminal.com/tools/edamam.json", "name": "Edamam", "score": 42.2, "shared": [ "cooking.recipes", "cooking.nutrition", "cooking.food-recognition", "cooking.grocery" ], "slug": "edamam" }, { "grade": "E", "json": "https://www.anchorterminal.com/tools/fatsecret.json", "name": "fatsecret Platform API", "score": 42, "shared": [ "cooking.nutrition", "cooking.recipes", "cooking.food-recognition", "cooking.grocery" ], "slug": "fatsecret" }, { "grade": "F", "json": "https://www.anchorterminal.com/tools/nutritionix.json", "name": "Nutritionix API", "score": 33.6, "shared": [ "cooking.nutrition", "cooking.grocery" ], "slug": "nutritionix" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/instacart.json", "name": "Instacart Developer Platform API + MCP", "score": 48.5, "shared": [ "cooking.grocery" ], "slug": "instacart" } ], "tool": { "slug": "spoonacular", "name": "spoonacular", "vendor": "skycraft GmbH", "vendorUrl": "https://spoonacular.com/food-api", "kind": "http-api", "category": "cooking", "summary": "spoonacular is a recipe and food REST API from skycraft GmbH in Dresden. It searches recipes by ingredients, diet and nutrients, analyses recipes and grocery products, builds meal plans and shopping lists, and has a small open-source MCP server.", "url": "https://www.anchorterminal.com/tools/spoonacular", "markdownUrl": "https://www.anchorterminal.com/tools/spoonacular.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/spoonacular.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/spoonacular.json", "dns": "spoonacular.grade.anchorterminal.com", "repo": "https://github.com/ddsky/spoonacular-mcp", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "spoonacular-mcp" } ], "auth": "api-key", "authNotes": "One API key per account, minted in the console after a browser signup. The docs send it as the `apiKey` query parameter on every request, or as an `x-api-key` header since December 2022. No scopes, expiry or rotation procedure found. Writes to a user's meal plan need a per-user `username` and `hash` pair from the connect-user endpoint.", "pricing": "freemium", "pricingNotes": "Free plan of 50 points a day with no card, then HTTP 402 until the quota resets at midnight UTC. Cook $29 a month for 1,500 points a day (overage $0.005 a point), Culinarian $79 for 4,500 ($0.004), Chef $149 for 10,000 ($0.002), Enterprise from $300. A request costs 1 point plus 0.01 a result, with exceptions listed per endpoint. Academic and hackathon plan $10 a month through RapidAPI.", "priceSummary": "$29 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, pricing page, OpenAPI spec or MCP source (checked 2026-11-03). An exhausted daily quota answers HTTP 402 with no payment requirements; subscriptions are bought in the console through Stripe.", "endpoints": [] }, "toolCount": 6, "popularity": { "githubStars": 6, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://spoonacular.com/food-api/docs", "openapi": "https://raw.githubusercontent.com/ddsky/spoonacular-api-clients/refs/heads/master/spoonacular-openapi-3.json", "capabilities": [ "cooking.recipes", "cooking.nutrition", "cooking.meal-plans", "cooking.pantry", "cooking.grocery", "cooking.food-recognition" ], "tags": [ "hosted", "freemium", "free-tier", "no-card", "api-key", "openapi", "mcp", "typescript", "python", "java", "go", "eu", "closed-source" ], "lastRelease": "2026-02-01", "graded": true, "anchor": { "graded": true, "score": 49, "grade": "D", "agentReady": false, "rank": 1048, "ranked": true, "rankOf": 1349, "categoryRank": 2, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 68, "maintenance": 22, "payments": 40, "reliability": 58, "schema": 65, "security": 20, "transparency": 61 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 58, "points": 11.6, "reason": "Read with the hosted lines. A status page exists at status.spoonacular.com (UptimeRobot), but on 3 November 2026 it rendered 'There was an error while fetching the data' with no components or history, so half credit (10 of 20) and no readable incident record (5). Daily point quotas and requests-per-second limits are published by plan, 60 a minute on Free and 5, 10 and 20 a second on Cook, Culinarian and Chef (15). HTTP 429 and 402 are documented with three quota headers, but there is no Retry-After, backoff guidance or idempotency key for the meal-plan writes (8 of 15). The pricing page states 99 per cent uptime on Cook and Culinarian and 99.9 per cent on Chef, and the FAQ says SLAs are sold above $250 a month (10). The API is generally available (10). 10 + 5 + 15 + 8 + 10 + 10 = 58.", "checked": "2026-11-03" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 65, "points": 10.56, "reason": "Public OpenAPI 3.0.0 document (info version 2.0.2, 97 paths, 99 operations) in the vendor's spoonacular-api-clients repository, linked from the SDK page, and the MCP server's six tools carry JSON Schema inputs (25). No llms.txt (404) and no Markdown docs (0 of 10). Each endpoint states its purpose and point cost, with little on when not to use it (12 of 20). Parameters are typed with required flags, `number` is bounded, but diet, cuisine, intolerance and meal-type values sit in prose lists rather than enums (9 of 15). Request and response examples on every endpoint, 402 and 429 documented in the quota text, but the OpenAPI document lists only 200, 401, 403 and 404 and no error body shape (9 of 15). No version in the path; a dated updates page by month back to February 2020 records field removals with notice, the last in December 2022 for 30 June 2023 (10 of 15). 25 + 0 + 12 + 9 + 9 + 10 = 65.", "checked": "2026-11-03" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 68, "points": 11.05, "reason": "`number` caps results on every search (1 to 100), `addRecipeInformation`, `fillIngredients` and `includeNutrition` switch sections on, and the MCP server lists six compact tools, but there is no field selection and full recipe objects are large (15 of 25). Offset and number pagination with filters by cuisine, diet, intolerances, nutrient ranges, equipment, time and sort keys (18 of 20). 402 and 429 are documented with quota headers, other errors are not, and no error body is shown (10 of 20). Reads are GET and safe to repeat, writes to meal plans and custom foods have no idempotency key, and the MCP tools carry no annotations (10 of 20). No required parameter on complexSearch and generated SDKs in 24 languages (15 of 15). 15 + 18 + 10 + 10 + 15 = 68.", "checked": "2026-11-03" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 20, "points": 3.5, "reason": "One key per account with no scopes, expiry or rotation procedure, documented first as the `apiKey` query parameter and also sent in the query string by the MCP server; the `x-api-key` header is the alternative. One all-powerful key (10) less 10 for the documented query string (0 of 30). The data endpoints are read-only and a user's meal plan is written only with that user's `username` and `hash`, but there is no read-only key mode or confirmation step (10 of 20). Recipe text, instructions and extracted pages come from third-party websites and no guidance on treating them as untrusted was found (5 of 15). The console shows quota use and the headers report it per call, but no request log was found (5 of 15). security.txt returns 404 and no disclosure policy, bug bounty or certification was found (0 of 20). 0 + 10 + 5 + 5 + 0 = 20.", "checked": "2026-11-03" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "No x402, MPP or L402 (0 of 40). Plan prices and per-point overage rates ($0.005, $0.004 and $0.002) are public, with the point cost of every endpoint (20). The Free plan gives 50 points a day with no card (20). A person signs up in the console in a browser, and no key API exists (0 of 20). 0 + 20 + 20 + 0 = 40.", "checked": "2026-11-03" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 22, "points": 1.93, "reason": "Read as a closed service. The newest dated change on the updates page is February 2026 (Nutrition by Photo, recipe extraction from video), more than 180 days before 3 November 2026, and the SDK repository's last push is 2 December 2025 (0 of 30). No dated changes in the last 90 days (0 of 20). Updates page, Discord, contact form and paid support from $99 a month; three open issues on the clients repository could not be read (8 of 15). Generated SDKs in 24 languages, last pushed December 2025, and an npm MCP server, but no vendor entry in the official MCP registry, which lists only third-party spoonacular servers (10 of 15). spoonacular-mcp has one release (1.0.0, 4 August 2025), a test script and no CI (4 of 10). 0 + 0 + 8 + 10 + 4 = 22.", "checked": "2026-11-03" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 61, "points": 5.34, "note": "editorial 38, provenance 83", "reason": "Closed API with terms last updated 16 April 2026 that are clear on caching, attribution and termination; the MCP server is ISC and the clients MIT (15 of 30). The privacy policy, last revised in 2023, names Stripe and unnamed third parties, gives no retention periods and no DPA, while the terms require deleting all data when access ends (10 of 30). The terms allow the API to end without notice, but the updates page records field renames and removals with six months' notice, the last in 2022 (8 of 20). Cloudflare is named on the marketing page and Stripe in the privacy policy, with no subprocessor list or data location (5 of 20). 15 + 10 + 8 + 5 = 38.", "checked": "2026-11-03" } ], "assessment": { "date": "2026-11-03", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "`number` caps results on every search (1 to 100), `addRecipeInformation`, `fillIngredients` and `includeNutrition` switch sections on, and the MCP server lists six compact tools, but there is no field selection and full recipe objects are large (15 of 25). Offset and number pagination with filters by cuisine, diet, intolerances, nutrient ranges, equipment, time and sort keys (18 of 20). 402 and 429 are documented with quota headers, other errors are not, and no error body is shown (10 of 20). Reads are GET and safe to repeat, writes to meal plans and custom foods have no idempotency key, and the MCP tools carry no annotations (10 of 20). No required parameter on complexSearch and generated SDKs in 24 languages (15 of 15). 15 + 18 + 10 + 10 + 15 = 68.", "maintenance": "Read as a closed service. The newest dated change on the updates page is February 2026 (Nutrition by Photo, recipe extraction from video), more than 180 days before 3 November 2026, and the SDK repository's last push is 2 December 2025 (0 of 30). No dated changes in the last 90 days (0 of 20). Updates page, Discord, contact form and paid support from $99 a month; three open issues on the clients repository could not be read (8 of 15). Generated SDKs in 24 languages, last pushed December 2025, and an npm MCP server, but no vendor entry in the official MCP registry, which lists only third-party spoonacular servers (10 of 15). spoonacular-mcp has one release (1.0.0, 4 August 2025), a test script and no CI (4 of 10). 0 + 0 + 8 + 10 + 4 = 22.", "payments": "No x402, MPP or L402 (0 of 40). Plan prices and per-point overage rates ($0.005, $0.004 and $0.002) are public, with the point cost of every endpoint (20). The Free plan gives 50 points a day with no card (20). A person signs up in the console in a browser, and no key API exists (0 of 20). 0 + 20 + 20 + 0 = 40.", "reliability": "Read with the hosted lines. A status page exists at status.spoonacular.com (UptimeRobot), but on 3 November 2026 it rendered 'There was an error while fetching the data' with no components or history, so half credit (10 of 20) and no readable incident record (5). Daily point quotas and requests-per-second limits are published by plan, 60 a minute on Free and 5, 10 and 20 a second on Cook, Culinarian and Chef (15). HTTP 429 and 402 are documented with three quota headers, but there is no Retry-After, backoff guidance or idempotency key for the meal-plan writes (8 of 15). The pricing page states 99 per cent uptime on Cook and Culinarian and 99.9 per cent on Chef, and the FAQ says SLAs are sold above $250 a month (10). The API is generally available (10). 10 + 5 + 15 + 8 + 10 + 10 = 58.", "schema": "Public OpenAPI 3.0.0 document (info version 2.0.2, 97 paths, 99 operations) in the vendor's spoonacular-api-clients repository, linked from the SDK page, and the MCP server's six tools carry JSON Schema inputs (25). No llms.txt (404) and no Markdown docs (0 of 10). Each endpoint states its purpose and point cost, with little on when not to use it (12 of 20). Parameters are typed with required flags, `number` is bounded, but diet, cuisine, intolerance and meal-type values sit in prose lists rather than enums (9 of 15). Request and response examples on every endpoint, 402 and 429 documented in the quota text, but the OpenAPI document lists only 200, 401, 403 and 404 and no error body shape (9 of 15). No version in the path; a dated updates page by month back to February 2020 records field removals with notice, the last in December 2022 for 30 June 2023 (10 of 15). 25 + 0 + 12 + 9 + 9 + 10 = 65.", "security": "One key per account with no scopes, expiry or rotation procedure, documented first as the `apiKey` query parameter and also sent in the query string by the MCP server; the `x-api-key` header is the alternative. One all-powerful key (10) less 10 for the documented query string (0 of 30). The data endpoints are read-only and a user's meal plan is written only with that user's `username` and `hash`, but there is no read-only key mode or confirmation step (10 of 20). Recipe text, instructions and extracted pages come from third-party websites and no guidance on treating them as untrusted was found (5 of 15). The console shows quota use and the headers report it per call, but no request log was found (5 of 15). security.txt returns 404 and no disclosure policy, bug bounty or certification was found (0 of 20). 0 + 10 + 5 + 5 + 0 = 20.", "transparency": "Closed API with terms last updated 16 April 2026 that are clear on caching, attribution and termination; the MCP server is ISC and the clients MIT (15 of 30). The privacy policy, last revised in 2023, names Stripe and unnamed third parties, gives no retention periods and no DPA, while the terms require deleting all data when access ends (10 of 30). The terms allow the API to end without notice, but the updates page records field renames and removals with six months' notice, the last in 2022 (8 of 20). Cloudflare is named on the marketing page and Stripe in the privacy policy, with no subprocessor list or data location (5 of 20). 15 + 10 + 8 + 5 = 38." }, "sources": [ { "what": "Food API overview", "url": "https://spoonacular.com/food-api", "seen": "2026-11-03" }, { "what": "pricing", "url": "https://spoonacular.com/food-api/pricing", "seen": "2026-11-03" }, { "what": "docs (endpoints, authentication, quotas, rate limits, MCP)", "url": "https://spoonacular.com/food-api/docs", "seen": "2026-11-03" }, { "what": "updates page", "url": "https://spoonacular.com/food-api/updates", "seen": "2026-11-03" }, { "what": "terms of use", "url": "https://spoonacular.com/food-api/terms", "seen": "2026-11-03" }, { "what": "privacy policy", "url": "https://spoonacular.com/food-api/privacy", "seen": "2026-11-03" }, { "what": "status page (data error)", "url": "https://status.spoonacular.com/", "seen": "2026-11-03" }, { "what": "FAQ", "url": "https://spoonacular.com/food-api/faq", "seen": "2026-11-03" }, { "what": "SDK page", "url": "https://spoonacular.com/food-api/sdk", "seen": "2026-11-03" }, { "what": "OpenAPI document", "url": "https://raw.githubusercontent.com/ddsky/spoonacular-api-clients/refs/heads/master/spoonacular-openapi-3.json", "seen": "2026-11-03" }, { "what": "MCP server repository, shallow clone", "url": "https://github.com/ddsky/spoonacular-mcp", "seen": "2026-11-03" }, { "what": "npm spoonacular-mcp", "url": "https://registry.npmjs.org/spoonacular-mcp", "seen": "2026-11-03" }, { "what": "GitHub API for the clients and MCP repositories", "url": "https://api.github.com/repos/ddsky/spoonacular-api-clients", "seen": "2026-11-03" }, { "what": "contact and imprint", "url": "https://spoonacular.com/contact", "seen": "2026-11-03" }, { "what": "about", "url": "https://spoonacular.com/about", "seen": "2026-11-03" }, { "what": "press", "url": "https://spoonacular.com/press", "seen": "2026-11-03" }, { "what": "robots.txt", "url": "https://spoonacular.com/robots.txt", "seen": "2026-11-03" }, { "what": "security.txt (404)", "url": "https://spoonacular.com/.well-known/security.txt", "seen": "2026-11-03" }, { "what": "MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=spoonacular", "seen": "2026-11-03" }, { "what": "RDAP for spoonacular.com", "url": "https://rdap.verisign.com/com/v1/domain/spoonacular.com", "seen": "2026-11-03" } ], "openQuestions": [ "unchecked: the status page's components and 90-day history, which did not render for our reader on 3 November 2026. Reliability scores it as a page with no readable history.", "firstReleased is 1 February 2020, the oldest entry on the updates page, the earliest dated first-hand page about the API. The site is older (the domain dates from 26 December 2012 and the press page lists 2014 items about the recipe search engine), so the API's first public date is not established. lastRelease is February 2026, the updates page's newest month.", "The privacy policy's revision date is written 10/9/2023, which is 10 September or 9 October 2023.", "spoonacular.com/robots.txt names a client called WebFetch among the download tools disallowed from the whole site. Our reader is not that tool and is not named, and the rules for all other crawlers disallow only /l/, which was not fetched. Recorded here for the lander.", "Judgement call on the surface. Graded on the REST API, which is what the SDKs, pricing and docs describe; the stdio MCP server is noted and its six tools counted. Its code sends the key in the query string, which the security note records.", "The official MCP registry lists third-party spoonacular servers (io.github.pipeworx-io/spoonacular 0.2.0 on 29 October 2026, io.github.mrfentmen/spoonacular-mcp 1.0.0) and none from the vendor.", "unchecked: Discord activity and the open issues on the clients repository, which were not read." ] }, "negative": 0, "verdict": "A broad recipe, ingredient, product and meal-plan API with a public OpenAPI document, 24 generated SDKs and a free 50-point day with no card. One key per account travels in the query string by default, the status page showed no data to our reader, and the terms allow caching for an hour at most.", "bestFor": "Agents that need recipe search with diet and nutrient filters, ingredient substitutions and nutrition, and meal plans or shopping lists written to a connected user.", "strengths": [ "Public OpenAPI 3.0 document with 97 paths, and generated SDKs in 24 languages under MIT", "Free plan of 50 points a day with no card, with public plan prices and per-point overage rates", "Quota and rate limits published with numbers, reported in three response headers on every call", "Meal plans, shopping lists and custom foods can be written back through the API for a connected user", "Open-source six-tool MCP server on npm, each tool with a typed JSON Schema and few required fields" ], "weaknesses": [ "One all-powerful key per account, documented in the `apiKey` query parameter and sent that way by the MCP server", "status.spoonacular.com answered with a data error and no history on 3 November 2026, and no incident record could be read", "No security.txt, disclosure policy or certification found, and the privacy policy's last revision is dated 2023", "The newest dated change is February 2026, and the MCP server has had one release, in August 2025", "Terms allow caching user-requested data for one hour only, with written permission, and forbid storing ingredients, instructions and nutrition" ], "agentNotes": [ "Send the key as the `x-api-key` header rather than `apiKey=` in the URL, and keep `number` small, since every result adds 0.01 points to the call's cost", "Read `X-API-Quota-Left` on each response; a 402 means the day's points are gone until midnight UTC and a 429 means the plan's requests-per-second limit, with no Retry-After to wait on", "Use `/recipes/complexSearch` with `addRecipeInformation=true` for one call instead of a search followed by one information call per recipe", "Do not store ingredients, instructions or nutrition between sessions; the terms allow only recipe ids, titles and image urls to be kept", "Show the original recipe source and a link to it with every recipe, as the terms require" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 49 } ], "editorialScores": { "ergonomics": 68, "maintenance": 22, "payments": 40, "reliability": 58, "schema": 65, "security": 20, "transparency": 38 }, "provenanceScore": 83, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-03", "grade": "D", "kind": "listed", "method": "0.7", "score": 49 } ] }, "connect": { "install": "npm install -g spoonacular-mcp", "http": "curl -H \"x-api-key: $SPOONACULAR_API_KEY\" \"https://api.spoonacular.com/recipes/complexSearch?query=pasta\u0026number=5\"", "config": { "mcpServers": { "spoonacular": { "command": "spoonacular-mcp", "env": { "SPOONACULAR_API_KEY": "your_api_key_here" } } } } }, "letme": { "capability": "https://letme.dev/cooking.recipes", "tool": "https://letme.dev/spoonacular" }, "notable": [ "Public OpenAPI 3.0.0 document, info version 2.0.2, with 97 paths and 99 operations on api.spoonacular.com, in the spoonacular-api-clients repository that the SDK page links; its security scheme is the `x-api-key` header (https://raw.githubusercontent.com/ddsky/spoonacular-api-clients/refs/heads/master/spoonacular-openapi-3.json)", "Quota headers `X-API-Quota-Request`, `X-API-Quota-Used` and `X-API-Quota-Left` on every response; the daily points reset at midnight UTC and the free plan answers 402 when they run out (https://spoonacular.com/food-api/docs)", "Request-rate limits by plan with HTTP 429 beyond them, 60 a minute on Free, 5, 10 and 20 a second on Cook, Culinarian and Chef (https://spoonacular.com/food-api/docs)", "Terms of 16 April 2026 allow storing recipe ids, titles and image urls indefinitely, cap any other cache at one hour with written permission, forbid storing ingredients, instructions and nutrition, and require credit and a link to the original recipe source (https://spoonacular.com/food-api/terms)", "Open-source stdio MCP server spoonacular-mcp 1.0.0 on npm since 4 August 2025, ISC, six tools (search_recipes, get_recipe_information, search_ingredients, analyze_nutrition, find_recipes_by_ingredients, get_random_recipes), key read from SPOONACULAR_API_KEY and sent in the query string (https://github.com/ddsky/spoonacular-mcp)", "Generated SDKs in 24 languages in the spoonacular-api-clients repository (MIT, last push 2 December 2025); they work only against the direct API, not RapidAPI (https://spoonacular.com/food-api/sdk)", "The updates page's newest entries are February 2026 (Nutrition by Photo endpoint, recipe extraction from video) after August 2025 and May 2024 (https://spoonacular.com/food-api/updates)", "The imprint names skycraft GmbH, Leibnizstraße 5, 01187 Dresden, CEO Dr. David Urbansky, tax id DE456083001; the terms choose the law and courts of Dresden (https://spoonacular.com/contact)" ], "area": "everyday", "details": [ { "label": "Surface listed", "value": "The REST API at api.spoonacular.com, read from spoonacular.com/food-api (docs, pricing, FAQ, updates, terms, privacy, SDK and contact pages), the OpenAPI document in ddsky/spoonacular-api-clients, a shallow clone of ddsky/spoonacular-mcp and the npm registry on 3 November 2026. No account was made and no call was sent" }, { "label": "Endpoints", "value": "97 paths in the OpenAPI document across recipes (search, information, similar, random, extract from a website, analyse, nutrition, taste, price breakdown, widgets), ingredients, grocery products and UPC lookup, menu items from restaurant chains, meal planning and shopping lists for connected users, wine pairing and misc (food trivia, jokes, image classification)" }, { "label": "MCP server", "value": "spoonacular-mcp 1.0.0 on npm (4 August 2025), stdio, TypeScript on @modelcontextprotocol/sdk, six read-only tools with JSON Schema inputs and no annotations. The key is read from SPOONACULAR_API_KEY and appended to each request url as apiKey" }, { "label": "Quotas", "value": "Points per day by plan (50, 1,500, 4,500, 10,000), 1 point a request plus 0.01 a result with per-endpoint exceptions (0.1 for autocomplete, 3 for PNG widgets, 50 for video extraction), reset at midnight UTC, reported in X-API-Quota-Request, X-API-Quota-Used and X-API-Quota-Left" }, { "label": "Rate limits", "value": "HTTP 429 beyond 60 requests a minute on Free, 120 on Starter, 5, 10 and 20 a second on Cook, Culinarian and Chef, with 2, 5, 10 and 20 concurrent requests. No Retry-After or backoff guidance documented" }, { "label": "SLA", "value": "99 per cent uptime on Cook and Culinarian, 99.9 per cent on Chef per the pricing page; the FAQ says SLAs are for plans above $250 a month through sales. No SLA document or credits found" }, { "label": "Data licence", "value": "Recipe ids, titles and image urls may be stored indefinitely; other data may be cached for one hour with written permission; reselling, scraping and copying derived data are forbidden; credit and a link to the recipe source are required; all data must be deleted when access ends" }, { "label": "SDKs", "value": "Generated clients for 24 languages (Android, Angular, C#, C++, Clojure, Dart, Elixir, Elm, Erlang, Go, Groovy, Haskell, Java, JavaScript, Kotlin, Lua, Objective-C, Perl, PHP, Python, Ruby, Rust, Scala, TypeScript) in ddsky/spoonacular-api-clients, MIT, last push 2 December 2025" }, { "label": "Also sold through", "value": "RapidAPI, where a card is required and the academic and hackathon plan ($10 a month, up to 5,000 requests a day, manual approval within 72 hours) is sold" }, { "label": "Legal entity", "value": "skycraft GmbH, Leibnizstraße 5, 01187 Dresden, Germany, CEO Dr. David Urbansky, per the imprint. The terms and privacy policy name only spoonacular" } ], "unitPrices": [ { "item": "Cook plan", "unit": "month", "usd": 29, "note": "1,500 points a day, 5 requests a second" }, { "item": "Culinarian plan", "unit": "month", "usd": 79, "note": "4,500 points a day, 10 requests a second" }, { "item": "Chef plan", "unit": "month", "usd": 149, "note": "10,000 points a day, 20 requests a second" }, { "item": "Overage point on Cook", "unit": "credit", "usd": 0.005, "note": "$0.004 on Culinarian, $0.002 on Chef; a request is usually 1 point plus 0.01 a result" }, { "item": "Academic or hackathon plan", "unit": "month", "usd": 10, "note": "Through RapidAPI, up to 5,000 requests a day, manual approval" } ], "provenance": { "legalEntity": "skycraft GmbH", "domain": "spoonacular.com", "domainRegistered": "2012-12-26", "endpointOnVendorDomain": true, "terms": "https://spoonacular.com/food-api/terms", "privacy": "https://spoonacular.com/food-api/privacy", "statusPage": "https://status.spoonacular.com/", "changelog": "https://spoonacular.com/food-api/updates", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "skycraft GmbH is named only in the imprint at spoonacular.com/contact, with Dr. David Urbansky as CEO. The terms (last updated 16 April 2026) choose the law and courts of Dresden and name no entity. The privacy policy's last revision is written 10/9/2023.", "The terms forbid scraping the API and storing its data beyond recipe ids, titles and image urls. They do not address automated reading of the website. spoonacular.com/robots.txt disallows /l/ for all crawlers and disallows the whole site for a list of named download tools and crawlers (including GoogleBot and a client named WebFetch); ClaudeBot and anthropic-ai are not named. Only pages outside /l/ were read.", "status.spoonacular.com is an UptimeRobot page that answered 'There was an error while fetching the data' on 3 November 2026, with no components, history or uptime figures rendered.", "RDAP gives spoonacular.com a registration date of 26 December 2012.", "/.well-known/security.txt returns 404. No llms.txt (404)." ], "score": 83, "checks": [ { "check": "Legal entity named", "value": "skycraft GmbH", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "spoonacular.com, registered 2012-12-26 (13 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "spoonacular.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 3 clauses that cost points", "points": 3.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 5 of the 8 things a reader expects", "points": 7.8, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.spoonacular.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "1 named with their role, 1 with a public profile", "points": 10, "max": 10, "state": "ok" }, { "check": "Support route", "value": "help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://spoonacular.com/food-api/terms", "state": "read", "readAt": "2026-11-03", "statedDate": "2026-04-16", "words": 1643, "points": 3.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated on April 16, 2026", "says": "Last updated 2026-04-16" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "All disputes arising out of or in connection with the terms and conditions of this Agreement shall be subject to the exclusive jurisdiction of the courts of Dresden.", "says": "Disputes go to the courts of Dresden" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "IN NO EVENT WILL SPOONACULAR BE LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT, CONSEQUENTIAL, OR LOST PROFIT DAMAGES, ARISING OUT OF OR IN CONNECTION WITH THESE API", "says": "Rules out indirect and consequential losses, with no cap named in this sentence" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "If you stop using the spoonacular API or if your access to the API is suspended for any reason, then you must delete all" }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "You may not create the impression that your site or application is endorsed by spoonacular, nor may you use any spoonacular brands/logos to promote your site/app" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "Uptime Status" } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "You may not scrape the spoonacular API or in any way attempt to copy or store the information it provides, including any derived, hashed, or transformed data.", "costsPoints": true }, { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "application meant to provide the same experience as spoonacular. Should spoonacular determine that your website or application is attempting to compete with", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "We reserve the right to discontinue the spoonacular API or to withdraw your permission to use the spoonacular API at any time for any reason without notice.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "We reserve the right to discontinue the spoonacular API or to withdraw your permission to use the spoonacular API at any time for any reason without notice." } ], "notes": [ { "date": "2026-11-03", "text": "Spoonacular may use the customer's logo and company name as a reference unless told in writing not to.", "quote": "You also agree that spoonacular may use your logo and company name as a professional reference/use case. If you do not want this, please let us know in written form." }, { "date": "2026-11-03", "text": "API data may be cached for at most one hour and only with prior written permission, apart from recipe ids, titles and image URLs.", "quote": "prior written permission from spoonacular, you may cache user-requested data to improve performance (for a maximum of 1 hour). After 1 hour, you must delete your cache" }, { "date": "2026-11-03", "text": "All data obtained from the API must be deleted when the customer stops using it or access is suspended.", "quote": "If you stop using the spoonacular API or if your access to the API is suspended for any reason, then you must delete all" } ] }, { "kind": "privacy", "url": "https://spoonacular.com/food-api/privacy", "state": "read", "readAt": "2026-11-03", "words": 478, "points": 7.8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "API-Collected Information:We collect usage information based on your API key, such as which endpoints are used and which parameters are set." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": false }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We may share your information with trusted third parties who assist us in operating our API and servicing you as an API subscriber, as long as those parties agree to keep this information confidential." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "You have the right to access, correct, or delete your API account and associated data." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions regarding this Privacy Policy, please contact us." }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "We do not sell, trade, or otherwise transfer your information to outside parties." } ] } ] }, "humans": { "slug": "spoonacular", "checked": "2026-11-03", "company": "skycraft GmbH", "people": [ { "name": "David Urbansky", "role": "CEO, skycraft GmbH", "github": "https://github.com/ddsky", "bio": "Dr. David Urbansky is the CEO of skycraft GmbH in Dresden, the company behind spoonacular, per the site's imprint. He is the author of the spoonacular-mcp package on npm and of the spoonacular-api-clients repository under his ddsky account, whose profile gives his name and website.", "bioSources": [ "https://spoonacular.com/contact", "https://registry.npmjs.org/spoonacular-mcp", "https://api.github.com/users/ddsky" ], "page": "/people/david-urbansky/" } ], "peopleNote": "The imprint at spoonacular.com/contact names skycraft GmbH, Leibnizstraße 5, 01187 Dresden, and names Dr. David Urbansky as CEO. No page read calls him a founder or gives a founding year, so the founder flag is left off. His GitHub account is the one named as author in the npm package and the clients repository; the profile gives the name David Urbansky and davidurbansky.com. No LinkedIn or X account for him is linked from the site. Investors were looked for on the about, press, contact and food-api pages; the about page says the service is free and takes donations through Donorbox, and no page mentions funding or backers.", "companySocial": { "x": "https://x.com/spoonacular", "github": "https://github.com/ddsky" }, "support": { "urls": [ "https://spoonacular.com/contact", "https://spoonacular.com/food-api/faq" ], "community": [ { "label": "Discord", "url": "https://discord.gg/EkYYnVF", "kind": "discord" }, { "label": "MCP server issues", "url": "https://github.com/ddsky/spoonacular-mcp/issues", "kind": "github" } ], "contactUrls": [ "https://spoonacular.com/contact" ] }, "sources": [ "https://spoonacular.com/contact", "https://spoonacular.com/about", "https://spoonacular.com/press", "https://spoonacular.com/food-api", "https://spoonacular.com/food-api/faq", "https://registry.npmjs.org/spoonacular-mcp", "https://api.github.com/users/ddsky" ], "ownership": { "status": "private", "checked": "2026-11-03", "sources": [ "https://spoonacular.com/contact", "https://spoonacular.com/about" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/spoonacular.json", "live": { "slug": "spoonacular", "vendorStatus": { "page": "https://status.spoonacular.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-04T15:32:36.661395014Z" }, "securityTxt": { "url": "https://spoonacular.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:00.134240883Z" }, "updatedAt": "2026-11-04T15:53:00.134240883Z" } }, "verify": { "accepts": "a page on spoonacular.com or one of its subdomains, or the README at the root of github.com/ddsky/spoonacular-mcp", "badgeUrl": "https://www.anchorterminal.com/badges/spoonacular.svg", "body": { "slug": "spoonacular", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/spoonacular", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/spoonacular\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/spoonacular.svg\" alt=\"spoonacular on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![spoonacular on Anchor Terminal](https://www.anchorterminal.com/badges/spoonacular.svg)](https://www.anchorterminal.com/tools/spoonacular)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/spoonacular\"\u003espoonacular on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/spoonacular", "json": "https://www.anchorterminal.com/tools/spoonacular.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/spoonacular.md", "mcp": "https://www.anchorterminal.com/mcp", "pricing": "https://www.anchorterminal.com/tools/spoonacular#pricing", "reviews": "https://www.anchorterminal.com/tools/spoonacular#reviews", "slim": "https://www.anchorterminal.com/tools/spoonacular.min.md" }, "markdown": "## Overview\n\n**Grade D · 49/100 · rank #1048 of 1349 · #2 in Cooking, recipes \u0026 meal planning · not agent-ready · confidence medium**\n\n\n## Assessment\n\nA broad recipe, ingredient, product and meal-plan API with a public OpenAPI document, 24 generated SDKs and a free 50-point day with no card. One key per account travels in the query string by default, the status page showed no data to our reader, and the terms allow caching for an hour at most.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | skycraft GmbH (https://spoonacular.com/food-api) |\n| Kind | HTTP API |\n| Category | Cooking, recipes \u0026 meal planning (https://www.anchorterminal.com/categories/cooking) |\n| Transport | stdio |\n| Auth | API key · One API key per account, minted in the console after a browser signup. The docs send it as the `apiKey` query parameter on every request, or as an `x-api-key` header since December 2022. No scopes, expiry or rotation procedure found. Writes to a user's meal plan need a per-user `username` and `hash` pair from the connect-user endpoint. |\n| Pricing | Freemium ($29 / mo) · Free plan of 50 points a day with no card, then HTTP 402 until the quota resets at midnight UTC. Cook $29 a month for 1,500 points a day (overage $0.005 a point), Culinarian $79 for 4,500 ($0.004), Chef $149 for 10,000 ($0.002), Enterprise from $300. A request costs 1 point plus 0.01 a result, with exceptions listed per endpoint. Academic and hackathon plan $10 a month through RapidAPI. |\n| x402 | No · No x402, MPP or L402 in the docs, pricing page, OpenAPI spec or MCP source (checked 2026-11-03). An exhausted daily quota answers HTTP 402 with no payment requirements; subscriptions are bought in the console through Stripe. |\n| Licence | unknown |\n| Tools exposed | 6 |\n| Packages | npm: `spoonacular-mcp` |\n| Source | https://github.com/ddsky/spoonacular-mcp |\n| Docs | https://spoonacular.com/food-api/docs |\n| llms.txt | not found |\n| Last release | 2026-02-01 |\n| GitHub stars | 6 (as of 2026-11-03) |\n| Surface listed | The REST API at api.spoonacular.com, read from spoonacular.com/food-api (docs, pricing, FAQ, updates, terms, privacy, SDK and contact pages), the OpenAPI document in ddsky/spoonacular-api-clients, a shallow clone of ddsky/spoonacular-mcp and the npm registry on 3 November 2026. No account was made and no call was sent |\n| Endpoints | 97 paths in the OpenAPI document across recipes (search, information, similar, random, extract from a website, analyse, nutrition, taste, price breakdown, widgets), ingredients, grocery products and UPC lookup, menu items from restaurant chains, meal planning and shopping lists for connected users, wine pairing and misc (food trivia, jokes, image classification) |\n| MCP server | spoonacular-mcp 1.0.0 on npm (4 August 2025), stdio, TypeScript on @modelcontextprotocol/sdk, six read-only tools with JSON Schema inputs and no annotations. The key is read from SPOONACULAR_API_KEY and appended to each request url as apiKey |\n| Quotas | Points per day by plan (50, 1,500, 4,500, 10,000), 1 point a request plus 0.01 a result with per-endpoint exceptions (0.1 for autocomplete, 3 for PNG widgets, 50 for video extraction), reset at midnight UTC, reported in X-API-Quota-Request, X-API-Quota-Used and X-API-Quota-Left |\n| Rate limits | HTTP 429 beyond 60 requests a minute on Free, 120 on Starter, 5, 10 and 20 a second on Cook, Culinarian and Chef, with 2, 5, 10 and 20 concurrent requests. No Retry-After or backoff guidance documented |\n| SLA | 99 per cent uptime on Cook and Culinarian, 99.9 per cent on Chef per the pricing page; the FAQ says SLAs are for plans above $250 a month through sales. No SLA document or credits found |\n| Data licence | Recipe ids, titles and image urls may be stored indefinitely; other data may be cached for one hour with written permission; reselling, scraping and copying derived data are forbidden; credit and a link to the recipe source are required; all data must be deleted when access ends |\n| SDKs | Generated clients for 24 languages (Android, Angular, C#, C++, Clojure, Dart, Elixir, Elm, Erlang, Go, Groovy, Haskell, Java, JavaScript, Kotlin, Lua, Objective-C, Perl, PHP, Python, Ruby, Rust, Scala, TypeScript) in ddsky/spoonacular-api-clients, MIT, last push 2 December 2025 |\n| Also sold through | RapidAPI, where a card is required and the academic and hackathon plan ($10 a month, up to 5,000 requests a day, manual approval within 72 hours) is sold |\n| Legal entity | skycraft GmbH, Leibnizstraße 5, 01187 Dresden, Germany, CEO Dr. David Urbansky, per the imprint. The terms and privacy policy name only spoonacular |\n| Capabilities | cooking.recipes, cooking.nutrition, cooking.meal-plans, cooking.pantry, cooking.grocery, cooking.food-recognition |\n| Tags | hosted, freemium, free-tier, no-card, api-key, openapi, mcp, typescript, python, java, go, eu, closed-source |\n| JSON | https://www.anchorterminal.com/api/v1/tools/spoonacular.json |\n\n## Score breakdown (methodology v0.7, October 2026 research run)\n\nAssessed 2026-11-03 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 58 | 11.6 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 65 | 10.6 |\n| Agent ergonomics | 13% | 16.2 | 68 | 11.1 |\n| Security \u0026 auth | 14% | 17.5 | 20 | 3.5 |\n| Payments \u0026 pricing | 10% | 12.5 | 40 | 5.0 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 22 | 1.9 |\n| Transparency \u0026 trust (editorial 38, provenance 83) | 7% | 8.8 | 61 | 5.3 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **49 → D** |\n\n### Why each score\n\n- Reliability 58 (checked 2026-11-03): Read with the hosted lines. A status page exists at status.spoonacular.com (UptimeRobot), but on 3 November 2026 it rendered 'There was an error while fetching the data' with no components or history, so half credit (10 of 20) and no readable incident record (5). Daily point quotas and requests-per-second limits are published by plan, 60 a minute on Free and 5, 10 and 20 a second on Cook, Culinarian and Chef (15). HTTP 429 and 402 are documented with three quota headers, but there is no Retry-After, backoff guidance or idempotency key for the meal-plan writes (8 of 15). The pricing page states 99 per cent uptime on Cook and Culinarian and 99.9 per cent on Chef, and the FAQ says SLAs are sold above $250 a month (10). The API is generally available (10). 10 + 5 + 15 + 8 + 10 + 10 = 58.\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 65 (checked 2026-11-03): Public OpenAPI 3.0.0 document (info version 2.0.2, 97 paths, 99 operations) in the vendor's spoonacular-api-clients repository, linked from the SDK page, and the MCP server's six tools carry JSON Schema inputs (25). No llms.txt (404) and no Markdown docs (0 of 10). Each endpoint states its purpose and point cost, with little on when not to use it (12 of 20). Parameters are typed with required flags, `number` is bounded, but diet, cuisine, intolerance and meal-type values sit in prose lists rather than enums (9 of 15). Request and response examples on every endpoint, 402 and 429 documented in the quota text, but the OpenAPI document lists only 200, 401, 403 and 404 and no error body shape (9 of 15). No version in the path; a dated updates page by month back to February 2020 records field removals with notice, the last in December 2022 for 30 June 2023 (10 of 15). 25 + 0 + 12 + 9 + 9 + 10 = 65.\n- Agent ergonomics 68 (checked 2026-11-03): `number` caps results on every search (1 to 100), `addRecipeInformation`, `fillIngredients` and `includeNutrition` switch sections on, and the MCP server lists six compact tools, but there is no field selection and full recipe objects are large (15 of 25). Offset and number pagination with filters by cuisine, diet, intolerances, nutrient ranges, equipment, time and sort keys (18 of 20). 402 and 429 are documented with quota headers, other errors are not, and no error body is shown (10 of 20). Reads are GET and safe to repeat, writes to meal plans and custom foods have no idempotency key, and the MCP tools carry no annotations (10 of 20). No required parameter on complexSearch and generated SDKs in 24 languages (15 of 15). 15 + 18 + 10 + 10 + 15 = 68.\n- Security \u0026 auth 20 (checked 2026-11-03): One key per account with no scopes, expiry or rotation procedure, documented first as the `apiKey` query parameter and also sent in the query string by the MCP server; the `x-api-key` header is the alternative. One all-powerful key (10) less 10 for the documented query string (0 of 30). The data endpoints are read-only and a user's meal plan is written only with that user's `username` and `hash`, but there is no read-only key mode or confirmation step (10 of 20). Recipe text, instructions and extracted pages come from third-party websites and no guidance on treating them as untrusted was found (5 of 15). The console shows quota use and the headers report it per call, but no request log was found (5 of 15). security.txt returns 404 and no disclosure policy, bug bounty or certification was found (0 of 20). 0 + 10 + 5 + 5 + 0 = 20.\n- Payments \u0026 pricing 40 (checked 2026-11-03): No x402, MPP or L402 (0 of 40). Plan prices and per-point overage rates ($0.005, $0.004 and $0.002) are public, with the point cost of every endpoint (20). The Free plan gives 50 points a day with no card (20). A person signs up in the console in a browser, and no key API exists (0 of 20). 0 + 20 + 20 + 0 = 40.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 22 (checked 2026-11-03): Read as a closed service. The newest dated change on the updates page is February 2026 (Nutrition by Photo, recipe extraction from video), more than 180 days before 3 November 2026, and the SDK repository's last push is 2 December 2025 (0 of 30). No dated changes in the last 90 days (0 of 20). Updates page, Discord, contact form and paid support from $99 a month; three open issues on the clients repository could not be read (8 of 15). Generated SDKs in 24 languages, last pushed December 2025, and an npm MCP server, but no vendor entry in the official MCP registry, which lists only third-party spoonacular servers (10 of 15). spoonacular-mcp has one release (1.0.0, 4 August 2025), a test script and no CI (4 of 10). 0 + 0 + 8 + 10 + 4 = 22.\n- Transparency \u0026 trust 61 (checked 2026-11-03): Closed API with terms last updated 16 April 2026 that are clear on caching, attribution and termination; the MCP server is ISC and the clients MIT (15 of 30). The privacy policy, last revised in 2023, names Stripe and unnamed third parties, gives no retention periods and no DPA, while the terms require deleting all data when access ends (10 of 30). The terms allow the API to end without notice, but the updates page records field renames and removals with six months' notice, the last in 2022 (8 of 20). Cloudflare is named on the marketing page and Stripe in the privacy policy, with no subprocessor list or data location (5 of 20). 15 + 10 + 8 + 5 = 38.\n\nFix list, everything this grade says the listing lacks, the biggest gain first (17 items). What it covers is at https://www.anchorterminal.com/fixes/spoonacular.md (JSON https://www.anchorterminal.com/fixes/spoonacular.json). The whole list for a coding agent comes from `POST https://www.anchorterminal.com/api/v1/fix-list` with `{\"listing\": \"spoonacular\", \"plan\": \"read\"}`, free while the beta runs\n\n### What we couldn't check\n\n- unchecked: the status page's components and 90-day history, which did not render for our reader on 3 November 2026. Reliability scores it as a page with no readable history.\n- firstReleased is 1 February 2020, the oldest entry on the updates page, the earliest dated first-hand page about the API. The site is older (the domain dates from 26 December 2012 and the press page lists 2014 items about the recipe search engine), so the API's first public date is not established. lastRelease is February 2026, the updates page's newest month.\n- The privacy policy's revision date is written 10/9/2023, which is 10 September or 9 October 2023.\n- spoonacular.com/robots.txt names a client called WebFetch among the download tools disallowed from the whole site. Our reader is not that tool and is not named, and the rules for all other crawlers disallow only /l/, which was not fetched. Recorded here for the lander.\n- Judgement call on the surface. Graded on the REST API, which is what the SDKs, pricing and docs describe; the stdio MCP server is noted and its six tools counted. Its code sends the key in the query string, which the security note records.\n- The official MCP registry lists third-party spoonacular servers (io.github.pipeworx-io/spoonacular 0.2.0 on 29 October 2026, io.github.mrfentmen/spoonacular-mcp 1.0.0) and none from the vendor.\n- unchecked: Discord activity and the open issues on the clients repository, which were not read.\n\n### Sources\n\n- Food API overview: \u003chttps://spoonacular.com/food-api\u003e (seen 2026-11-03)\n- pricing: \u003chttps://spoonacular.com/food-api/pricing\u003e (seen 2026-11-03)\n- docs (endpoints, authentication, quotas, rate limits, MCP): \u003chttps://spoonacular.com/food-api/docs\u003e (seen 2026-11-03)\n- updates page: \u003chttps://spoonacular.com/food-api/updates\u003e (seen 2026-11-03)\n- terms of use: \u003chttps://spoonacular.com/food-api/terms\u003e (seen 2026-11-03)\n- privacy policy: \u003chttps://spoonacular.com/food-api/privacy\u003e (seen 2026-11-03)\n- status page (data error): \u003chttps://status.spoonacular.com/\u003e (seen 2026-11-03)\n- FAQ: \u003chttps://spoonacular.com/food-api/faq\u003e (seen 2026-11-03)\n- SDK page: \u003chttps://spoonacular.com/food-api/sdk\u003e (seen 2026-11-03)\n- OpenAPI document: \u003chttps://raw.githubusercontent.com/ddsky/spoonacular-api-clients/refs/heads/master/spoonacular-openapi-3.json\u003e (seen 2026-11-03)\n- MCP server repository, shallow clone: \u003chttps://github.com/ddsky/spoonacular-mcp\u003e (seen 2026-11-03)\n- npm spoonacular-mcp: \u003chttps://registry.npmjs.org/spoonacular-mcp\u003e (seen 2026-11-03)\n- GitHub API for the clients and MCP repositories: \u003chttps://api.github.com/repos/ddsky/spoonacular-api-clients\u003e (seen 2026-11-03)\n- contact and imprint: \u003chttps://spoonacular.com/contact\u003e (seen 2026-11-03)\n- about: \u003chttps://spoonacular.com/about\u003e (seen 2026-11-03)\n- press: \u003chttps://spoonacular.com/press\u003e (seen 2026-11-03)\n- robots.txt: \u003chttps://spoonacular.com/robots.txt\u003e (seen 2026-11-03)\n- security.txt (404): \u003chttps://spoonacular.com/.well-known/security.txt\u003e (seen 2026-11-03)\n- MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=spoonacular\u003e (seen 2026-11-03)\n- RDAP for spoonacular.com: \u003chttps://rdap.verisign.com/com/v1/domain/spoonacular.com\u003e (seen 2026-11-03)\n\n## Score history\n\nEvery move of a score since the listing was graded, newest first, with its cause. A score can't move without an entry here. JSON: https://www.anchorterminal.com/api/v1/tools/spoonacular/history.json\n\n- 2026-11-03: graded 49 D (methodology 0.7)\n\n## Who's behind it (provenance 83/100, checked 2026-11-03)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | skycraft GmbH | 20/20 |\n| Domain age | spoonacular.com, registered 2012-12-26 (13 years) | 15/15 |\n| Endpoint on the vendor's domain | spoonacular.com | 15/15 |\n| Terms of service | read, states 6 of the 7 things a reader expects, and has 3 clauses that cost points | 3.1/10 |\n| Privacy policy | read, states 5 of the 8 things a reader expects | 7.8/10 |\n| Status page | status.spoonacular.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n| People named | 1 named with their role, 1 with a public profile | 10/10 |\n| Support route | help pages, a community | 5/5 |\n\nskycraft GmbH is named only in the imprint at spoonacular.com/contact, with Dr. David Urbansky as CEO. The terms (last updated 16 April 2026) choose the law and courts of Dresden and name no entity. The privacy policy's last revision is written 10/9/2023.\n\nThe terms forbid scraping the API and storing its data beyond recipe ids, titles and image urls. They do not address automated reading of the website. spoonacular.com/robots.txt disallows /l/ for all crawlers and disallows the whole site for a list of named download tools and crawlers (including GoogleBot and a client named WebFetch); ClaudeBot and anthropic-ai are not named. Only pages outside /l/ were read.\n\nstatus.spoonacular.com is an UptimeRobot page that answered 'There was an error while fetching the data' on 3 November 2026, with no components, history or uptime figures rendered.\n\nRDAP gives spoonacular.com a registration date of 26 December 2012.\n\n/.well-known/security.txt returns 404. No llms.txt (404).\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://spoonacular.com/food-api/terms), read 2026-11-03, dated 2026-04-16, states 6 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"You may not scrape the spoonacular API or in any way attempt to copy or store the information it provides, including any derived, hashed, or transformed data.\"\n- To know. Restricts benchmarking or competitive use (costs points). \"application meant to provide the same experience as spoonacular. Should spoonacular determine that your website or application is attempting to compete with\"\n- To know. Says the terms or the service can change without notice (costs points). \"We reserve the right to discontinue the spoonacular API or to withdraw your permission to use the spoonacular API at any time for any reason without notice.\"\n- To know. Says access can be ended without notice or for any reason. \"We reserve the right to discontinue the spoonacular API or to withdraw your permission to use the spoonacular API at any time for any reason without notice.\"\n- Gives the date it was last updated. Last updated 2026-04-16.\n- Names the governing law or courts. Disputes go to the courts of Dresden.\n- States a limit on its liability. Rules out indirect and consequential losses, with no cap named in this sentence.\n- Not found in the text. Says how changes to the terms are announced.\n- Also in the text (2026-11-03). Spoonacular may use the customer's logo and company name as a reference unless told in writing not to. \"You also agree that spoonacular may use your logo and company name as a professional reference/use case. If you do not want this, please let us know in written form.\"\n- Also in the text (2026-11-03). API data may be cached for at most one hour and only with prior written permission, apart from recipe ids, titles and image URLs. \"prior written permission from spoonacular, you may cache user-requested data to improve performance (for a maximum of 1 hour). After 1 hour, you must delete your cache\"\n- Also in the text (2026-11-03). All data obtained from the API must be deleted when the customer stops using it or access is suspended. \"If you stop using the spoonacular API or if your access to the API is suspended for any reason, then you must delete all\"\n\n**Privacy policy** (https://spoonacular.com/food-api/privacy), read 2026-11-03, gives no date, states 5 of the 8 things a reader expects.\n\n- Not found in the text. Gives the date it was last updated.\n- Not found in the text. Says how long data is kept.\n- Not found in the text. Says whether personal data is sold or shared for advertising.\n\n## Humans behind the project (researched 2026-11-03 from public pages, not part of the grade)\n\n### Key people\n\n- David Urbansky, CEO, skycraft GmbH. GitHub: https://github.com/ddsky\n- Note: The imprint at spoonacular.com/contact names skycraft GmbH, Leibnizstraße 5, 01187 Dresden, and names Dr. David Urbansky as CEO. No page read calls him a founder or gives a founding year, so the founder flag is left off. His GitHub account is the one named as author in the npm package and the clients repository; the profile gives the name David Urbansky and davidurbansky.com. No LinkedIn or X account for him is linked from the site. Investors were looked for on the about, press, contact and food-api pages; the about page says the service is free and takes donations through Donorbox, and no page mentions funding or backers.\n- skycraft GmbH: X https://x.com/spoonacular GitHub https://github.com/ddsky\n\n### Getting support\n\n- Discord: https://discord.gg/EkYYnVF\n- Help: https://spoonacular.com/contact\n- Help: https://spoonacular.com/food-api/faq\n- Community (MCP server issues): https://github.com/ddsky/spoonacular-mcp/issues\n- Sources: https://spoonacular.com/contact, https://spoonacular.com/about, https://spoonacular.com/press, https://spoonacular.com/food-api, https://spoonacular.com/food-api/faq, https://registry.npmjs.org/spoonacular-mcp, https://api.github.com/users/ddsky\n\n## Live (updated 2026-11-04 15:53 UTC)\n\n- Vendor status page: unknown, no machine-readable status found\n- security.txt: none\n- Always current: https://www.anchorterminal.com/api/v1/live/spoonacular.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Cook plan | $29 | per month (plan) | 1,500 points a day, 5 requests a second |\n| Culinarian plan | $79 | per month (plan) | 4,500 points a day, 10 requests a second |\n| Chef plan | $149 | per month (plan) | 10,000 points a day, 20 requests a second |\n| Overage point on Cook | $0.005 | per credit | $0.004 on Culinarian, $0.002 on Chef; a request is usually 1 point plus 0.01 a result |\n| Academic or hackathon plan | $10 | per month (plan) | Through RapidAPI, up to 5,000 requests a day, manual approval |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Public OpenAPI 3.0 document with 97 paths, and generated SDKs in 24 languages under MIT\n- Free plan of 50 points a day with no card, with public plan prices and per-point overage rates\n- Quota and rate limits published with numbers, reported in three response headers on every call\n- Meal plans, shopping lists and custom foods can be written back through the API for a connected user\n- Open-source six-tool MCP server on npm, each tool with a typed JSON Schema and few required fields\n\n## Weaknesses\n\n- One all-powerful key per account, documented in the `apiKey` query parameter and sent that way by the MCP server\n- status.spoonacular.com answered with a data error and no history on 3 November 2026, and no incident record could be read\n- No security.txt, disclosure policy or certification found, and the privacy policy's last revision is dated 2023\n- The newest dated change is February 2026, and the MCP server has had one release, in August 2025\n- Terms allow caching user-requested data for one hour only, with written permission, and forbid storing ingredients, instructions and nutrition\n\n\n\n## Before you call it (notes for agents)\n\n1. Send the key as the `x-api-key` header rather than `apiKey=` in the URL, and keep `number` small, since every result adds 0.01 points to the call's cost\n2. Read `X-API-Quota-Left` on each response; a 402 means the day's points are gone until midnight UTC and a 429 means the plan's requests-per-second limit, with no Retry-After to wait on\n3. Use `/recipes/complexSearch` with `addRecipeInformation=true` for one call instead of a search followed by one information call per recipe\n4. Do not store ingredients, instructions or nutrition between sessions; the terms allow only recipe ids, titles and image urls to be kept\n5. Show the original recipe source and a link to it with every recipe, as the terms require\n\n## Connect\n\nInstall:\n\n```bash\nnpm install -g spoonacular-mcp\n```\n\nFirst request:\n\n```bash\ncurl -H \"x-api-key: $SPOONACULAR_API_KEY\" \"https://api.spoonacular.com/recipes/complexSearch?query=pasta\u0026number=5\"\n```\n\nMCP client configuration:\n\n```json\n{\n \"mcpServers\": {\n \"spoonacular\": {\n \"command\": \"spoonacular-mcp\",\n \"env\": {\n \"SPOONACULAR_API_KEY\": \"your_api_key_here\"\n }\n }\n }\n}\n```\n\nThrough letme: https://letme.dev/spoonacular (letme picks it for cooking.pantry, the top-graded tool for the job). letme answers with the pick and how to call it direct. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| LogMeal | D | 49.1 | 1045 | cooking.food-recognition, cooking.nutrition, cooking.meal-plans, cooking.recipes, cooking.grocery | no | https://www.anchorterminal.com/tools/logmeal.md |\n| Eat This Much Partner API | E | 45.7 | 1129 | cooking.meal-plans, cooking.grocery, cooking.nutrition, cooking.recipes | no | https://www.anchorterminal.com/tools/eat-this-much.md |\n| Edamam | E | 42.2 | 1187 | cooking.recipes, cooking.nutrition, cooking.food-recognition, cooking.grocery | no | https://www.anchorterminal.com/tools/edamam.md |\n| fatsecret Platform API | E | 42 | 1193 | cooking.nutrition, cooking.recipes, cooking.food-recognition, cooking.grocery | no | https://www.anchorterminal.com/tools/fatsecret.md |\n| Nutritionix API | F | 33.6 | 1259 | cooking.nutrition, cooking.grocery | no | https://www.anchorterminal.com/tools/nutritionix.md |\n| Instacart Developer Platform API + MCP | D | 48.5 | 1067 | cooking.grocery | no | https://www.anchorterminal.com/tools/instacart.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- Public OpenAPI 3.0.0 document, info version 2.0.2, with 97 paths and 99 operations on api.spoonacular.com, in the spoonacular-api-clients repository that the SDK page links; its security scheme is the `x-api-key` header (source: \u003chttps://raw.githubusercontent.com/ddsky/spoonacular-api-clients/refs/heads/master/spoonacular-openapi-3.json\u003e)\n- Quota headers `X-API-Quota-Request`, `X-API-Quota-Used` and `X-API-Quota-Left` on every response; the daily points reset at midnight UTC and the free plan answers 402 when they run out (source: \u003chttps://spoonacular.com/food-api/docs\u003e)\n- Request-rate limits by plan with HTTP 429 beyond them, 60 a minute on Free, 5, 10 and 20 a second on Cook, Culinarian and Chef (source: \u003chttps://spoonacular.com/food-api/docs\u003e)\n- Terms of 16 April 2026 allow storing recipe ids, titles and image urls indefinitely, cap any other cache at one hour with written permission, forbid storing ingredients, instructions and nutrition, and require credit and a link to the original recipe source (source: \u003chttps://spoonacular.com/food-api/terms\u003e)\n- Open-source stdio MCP server spoonacular-mcp 1.0.0 on npm since 4 August 2025, ISC, six tools (search_recipes, get_recipe_information, search_ingredients, analyze_nutrition, find_recipes_by_ingredients, get_random_recipes), key read from SPOONACULAR_API_KEY and sent in the query string (source: \u003chttps://github.com/ddsky/spoonacular-mcp\u003e)\n- Generated SDKs in 24 languages in the spoonacular-api-clients repository (MIT, last push 2 December 2025); they work only against the direct API, not RapidAPI (source: \u003chttps://spoonacular.com/food-api/sdk\u003e)\n- The updates page's newest entries are February 2026 (Nutrition by Photo endpoint, recipe extraction from video) after August 2025 and May 2024 (source: \u003chttps://spoonacular.com/food-api/updates\u003e)\n- The imprint names skycraft GmbH, Leibnizstraße 5, 01187 Dresden, CEO Dr. David Urbansky, tax id DE456083001; the terms choose the law and courts of Dresden (source: \u003chttps://spoonacular.com/contact\u003e)\n\n- #2 of 8 in Best recipe, nutrition and meal planning APIs for AI agents: https://www.anchorterminal.com/best/cooking/index.md\n- All 28 cooking comparisons: https://www.anchorterminal.com/compare/cooking/index.md\n\n## Compare\n\n- [fatsecret Platform API vs spoonacular](https://www.anchorterminal.com/compare/fatsecret-vs-spoonacular.md): E 42 vs D 49\n- [Nutritionix API vs spoonacular](https://www.anchorterminal.com/compare/nutritionix-vs-spoonacular.md): F 33.6 vs D 49\n- [Edamam vs spoonacular](https://www.anchorterminal.com/compare/edamam-vs-spoonacular.md): E 42.2 vs D 49\n- [Eat This Much Partner API vs spoonacular](https://www.anchorterminal.com/compare/eat-this-much-vs-spoonacular.md): E 45.7 vs D 49\n- [LogMeal vs spoonacular](https://www.anchorterminal.com/compare/logmeal-vs-spoonacular.md): D 49.1 vs D 49\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on spoonacular.com or one of its subdomains, or the README at the root of github.com/ddsky/spoonacular-mcp. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"spoonacular\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/spoonacular\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/spoonacular.svg\" alt=\"spoonacular on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![spoonacular on Anchor Terminal](https://www.anchorterminal.com/badges/spoonacular.svg)](https://www.anchorterminal.com/tools/spoonacular)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/spoonacular\"\u003espoonacular on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say spoonacular is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/spoonacular-dark.png\n- Light: https://www.anchorterminal.com/assets/share/spoonacular-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Cooking, recipes \u0026 meal planning", "url": "https://www.anchorterminal.com/categories/cooking" }, { "name": "spoonacular", "url": "" } ], "description": "spoonacular is a recipe and food REST API from skycraft GmbH in Dresden. It searches recipes by ingredients, diet and nutrients, analyses recipes and grocery products, builds meal plans and shopping lists, and has a small open-source MCP server.", "facts": [ "rank #1048 of 1349", "API key auth", "0 desk reviews" ], "h1": "spoonacular", "image": "https://www.anchorterminal.com/assets/og/tools-spoonacular.png", "path": "/tools/spoonacular", "published": "2026-10-01", "section": "tools", "title": "spoonacular review (2026): pricing, alternatives and grade D", "toc": null, "updated": "2026-11-04", "url": "https://www.anchorterminal.com/tools/spoonacular" }, "tokens": { "markdown": 8050, "slim": 1980 }, "version": 1 }