Doordash

An MCP server that lets AI agents order food, groceries, and more through DoorDash. Search restaurants, browse menus, build carts, and place orders — all programmatically.

Built with CycleTLS, the Model Context Protocol SDK, and DoorDash's internal GraphQL API. No browser, Chromium, or Puppeteer/Playwright required.

Setup

git clone https://github.com/ashah360/doordash-mcp.git
cd doordash-mcp
npm install
npm run build

Create a .env file (see .env.example):

[email protected]
DOORDASH_PASSWORD=your-password

Cursor

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "doordash": {
      "command": "node",
      "args": ["/path/to/doordash-mcp/dist/index.js"],
      "env": {
        "DOORDASH_EMAIL": "[email protected]",
        "DOORDASH_PASSWORD": "your-password"
      }
    }
  }
}

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "doordash": {
      "command": "node",
      "args": ["/path/to/doordash-mcp/dist/index.js"],
      "env": {
        "DOORDASH_EMAIL": "[email protected]",
        "DOORDASH_PASSWORD": "your-password"
      }
    }
  }
}

HTTP transport

Set the PORT environment variable to start an HTTP server instead of stdio:

PORT=3000 node dist/index.js

The MCP endpoint will be available at http://localhost:3000/mcp.

Tools

21 tools covering the full DoorDash lifecycle:

Discovery

Tool	Description
doordash_search	Search restaurants and stores by name, cuisine, or food type
doordash_menu	Get a restaurant's full menu with items, prices, and option flags
doordash_convenience_search	Search items within grocery/convenience/alcohol stores
doordash_item_options	Get customization options for menu items (sides, extras, sizes)

Cart

Tool	Description
doordash_add_to_cart	Add items to cart with nested customization options
doordash_cart	View all active carts with items and subtotals
doordash_modify_cart	Update item quantity or remove items
doordash_delete_cart	Delete a cart

Checkout

Tool	Description
doordash_checkout	Preview fees, delivery time, and total
doordash_place_order	Place an order (charges the account)
doordash_order_status	Check payment and delivery status

Group Orders

Tool	Description
doordash_create_group_order	Create a group order and get a share link
doordash_group_order_status	View each person's items and finalization status

Account

Tool	Description
doordash_login	Automated login with email + password
doordash_verify	Enter MFA verification code
doordash_orders	View order history
doordash_addresses	List saved delivery addresses
doordash_set_address	Set active delivery address
doordash_add_address	Add a new delivery address
doordash_payment_methods	List saved payment methods
doordash_add_card	Add a payment card (tokenized via Stripe)

How it works

DoorDash doesn't have a public consumer API. This project reverse-engineers their internal GraphQL API — the same one doordash.com uses in the browser.

The hard part is Cloudflare. DoorDash sits behind Cloudflare's bot detection, which fingerprints TLS handshakes (JA3). A normal fetch() from Node.js gets blocked instantly because its TLS fingerprint doesn't look like a real browser.

CycleTLS solves this by establishing TLS connections with a Chrome-like JA3 fingerprint at the network level. No browser needed — just a spoofed handshake. Combined with a matching User-Agent header, requests look indistinguishable from a real Chrome session to Cloudflare.

GraphQL queries were captured from real DoorDash browser sessions and are stored as .graphql files in queries/.

Authentication

Login is fully automated — no manual browser step required.

1. The server calls DoorDash's identity endpoint with your email and password
2. If MFA is required, it prompts for a verification code via doordash_verify
3. Session cookies are persisted to ~/.doordash-mcp/session.json
4. Subsequent starts restore the session from disk — no re-login needed until cookies expire

Architecture

src/
├── index.ts              # MCP server bootstrap (stdio + HTTP transports)
├── tools/
│   └── index.ts          # 21 tool registrations
├── api/
│   ├── graphql.ts        # GraphQL client + query loader
│   ├── search.ts         # Restaurant/store search
│   ├── menu.ts           # Menus + item options
│   ├── cart.ts           # Cart management
│   ├── checkout.ts       # Checkout + order placement
│   ├── orders.ts         # Order history + status
│   ├── group.ts          # Group orders
│   └── account.ts        # Addresses, payment methods, Stripe tokenization
├── auth/
│   └── login.ts          # Login + MFA flow
├── client/
│   ├── http.ts           # CycleTLS HTTP client (JA3 spoofing)
│   ├── cookies.ts        # Cookie jar with domain matching + expiry
│   └── session.ts        # Session persistence to disk
└── logging/
    └── traffic.ts        # Request/response logging with redaction
queries/
└── *.graphql             # Captured GraphQL queries

Known limitations

• Real money: doordash_place_order charges your account. There is no sandbox.
• Cart quantity updates: DoorDash's updateCartItemV2 mutation is broken server-side. The tool works around it via remove + re-add.
• Scheduled orders: Only ASAP delivery is supported.
• Address geocoding: doordash_add_address requires lat/lng coordinates.
• VCC cards: Virtual credit cards are blocked by DoorDash's fraud detection.

License

MIT