Supstack

io.github.DrBaherPublished by GitHub account DrBaherv0.18.2Updated Oct 27, 2026

Evidence-based supplement research, dosing, safety, and interactions as agent-callable tools.

Overview

AI-generated overview

Supstack exposes evidence-based supplement research, dosing, safety and interaction lookups as MCP tools, backed by the public SupStack API.

What you can do
  • Research and search supplements by name or goal, and compare two or three head-to-head
  • Look up studies, interaction pathways, supplement-drug checks and glossary definitions
  • Manage a local supplement stack with dose, timing and brand, and grade it A–F by goal coverage
  • Export the stack and, when signed in, get personalized recommendations, view or set a health profile, list N-of-1 experiments, and log intake or adherence
When to use it
Useful when an assistant should answer supplement questions with cited evidence, check interactions before combining supplements or medications, or help maintain and rate a personal supplement stack and adherence log.
Requirements
Runs as a local stdio process from the npm package @supstack/cli (or Homebrew), started with the mcp subcommand. Needs network access to the SupStack API; anonymous reads work without an account. Account-scoped tools need a sign-in via the login device-code flow or a SUPSTACK_TOKEN. Optional settings include SUPSTACK_API_KEY, SUPSTACK_API_URL and SUPSTACK_HOME.
Before you install
Account-scoped tools require a stored token in the local config file; profile_set and track_log write data and are flagged as non-read-only, and stack push/sync sends local stack data to the account. Health profile details such as age, sex and weight are sent to the SupStack API. Anonymous use is rate limited to 60 requests per minute per IP.

Installation

In SourceWeft

  1. Open Supstack in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@supstack/cli

Evidence-based supplement intelligence in your terminal — and an MCP server for AI agents.

A thin client over the public SupStack API. Read-only, no account required. One capability registry powers both the CLI and the MCP server.

Status: Phase 2 (accounts) in progress. All read commands below work, plus an MCP server and login/whoami. Install with npm install -g @supstack/cli.

Install

bash
# Homebrew (macOS / Linux)brew install drbaher/supstack/supstack
# or npmnpm install -g @supstack/cli
# or run without installingnpx -y @supstack/cli define adaptogen

Then enable shell completion: supstack completion install.

From source (in this directory): npm install && npm run build && node dist/index.js define adaptogen.

Usage

bash
supstack research magnesium --protocol       # full evidence summary for one supplementsupstack search --goal deep-sleep -n 5       # search by name or filtersupstack compare magnesium glycine           # 2–3 head-to-headsupstack studies "sleep" --type rct          # research librarysupstack interactions caffeine l-theanine --pathway   # interaction check (deep pair analysis)supstack interactions magnesium potassium --medication lisinopril   # supplement × drug checksupstack stack add magnesium --dose 400mg --timing bedtime   # local stack (+ dose/timing/brand)supstack stack sync                          # sync local ⇄ your account (login required)supstack goals --category sleep              # list goal ids (for rate/recommend)supstack rate --goals deep-sleep,sharpen-focus   # grade your stack A–F by goal coveragesupstack experiments start magnesium deep-sleep  # run an N-of-1 experiment (requires login)supstack export --format md                  # export your stacksupstack define bioavailability              # glossary lookupsupstack <command> --json                    # machine-readable output on any commandsupstack --help

Account (Phase 2)

bash
supstack login          # sign in via device-code flow (opens the browser to confirm)supstack whoami         # show the signed-in accountsupstack logout         # sign out and revoke this device's token

login shows a one-time code, opens https://supstack.me/activate, and finishes once you approve in the browser. The token lives in ~/.supstack/config.json (0600). Reads work fully anonymously — an account unlocks personalized features.

Once logged in, sync your stack with your account:

bash
supstack stack pull     # local ← your accountsupstack stack push     # local → your account (keeps dosage/timing/brand for kept items)supstack stack sync     # additive merge of both; preserves existing cloud metadata
supstack profile                              # view your health profilesupstack profile set --age 35 --sex male --weight 80 --weight-unit kgsupstack recommend                            # personalized picks from your goals + stacksupstack experiments list                     # your N-of-1 experiments + verdictssupstack track log                            # log today's stack as takensupstack track adherence                      # your adherence rate, streak, per-supplement

As an MCP server

bash
supstack mcp   # stdio MCP server exposing all capabilities as tools

This gives an agent the full SupStack toolset. Read-only (no account needed): supstack_research, supstack_search, supstack_compare, supstack_studies, supstack_interactions, supstack_stack, supstack_rate_stack, supstack_export, supstack_define.

Account-scoped tools are also exposed — supstack_recommend, supstack_profile_get / supstack_profile_set, supstack_experiments_list / supstack_experiments_get, supstack_track_log, supstack_track_adherence (plus cloud supstack_stack pull/push/sync). These require the user to be signed in (supstack login, or a SUPSTACK_TOKEN); without a token they return a clear "not logged in" error rather than failing. Mutating tools (profile_set, track_log) are flagged readOnlyHint: false for the agent.

Claude Code (one command):

bash
claude mcp add supstack -- supstack mcp

Claude Desktop — add to claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json):

json
{  "mcpServers": {    "supstack": {      "command": "supstack",      "args": ["mcp"]    }  }}

Or run it without a global install via "command": "npx", "args": ["-y", "@supstack/cli", "mcp"]. To use a local checkout, point at the built entrypoint — "command": "node", "args": ["/absolute/path/to/supstack-cli/dist/index.js", "mcp"] (run npm run build first).

Configuration

Env varDefaultPurpose
SUPSTACK_API_URLhttps://supstack.me/api/v1API base URL (override for local dev)
SUPSTACK_API_KEY—Optional API key (anonymous works at 60/min/IP)
SUPSTACK_CACHE_TTL3600Response cache TTL in seconds
SUPSTACK_NO_CACHE—Set to disable the response cache
SUPSTACK_TIMEOUT20Per-request timeout in seconds (or use --timeout)
SUPSTACK_HOME~/.supstackDirectory for config, stack, and cache
SUPSTACK_TOKEN—Override the stored account token (from supstack login)
SUPSTACK_NO_ANON_TOKEN—Disable auto-minting of the anonymous instant-token
SUPSTACK_NO_UPDATE_CHECK—Disable the "update available" notice (also honours NO_UPDATE_NOTIFIER)
NO_COLOR—Disable ANSI colour
FORCE_COLOR—Force ANSI colour on (even when piped)

Global flags available on any command: --json, --no-cache, --timeout <seconds>, --color / --no-color, -q, --quiet.

supstack auth set-key <key> persists a key to ~/.supstack/config.json (written 0600).

Response cache

Read-only API responses are cached under ~/.supstack/cache/ (1-hour TTL by default) to keep repeat lookups well under the 60/min rate limit. Bypass it per command with --no-cache, or manage it with supstack cache clear / supstack cache path. The cache is bounded (oldest entries pruned past a cap).

Shell completion

One-step install for your current shell (writes the script and wires your rc file idempotently; uninstall reverses it):

bash
supstack completion install      # detects bash | zsh | fish from $SHELL

…or generate the script yourself:

bash
supstack completion bash >> ~/.bashrcsupstack completion zsh  > "${fpath[1]}/_supstack"supstack completion fish > ~/.config/fish/completions/supstack.fish

Completions are dynamic — the script forwards what you've typed to supstack __complete, which offers the right thing for the position:

  • top-level commands and sub-actions (stack <TAB> → add remove list pull push sync)
  • supplement slugs where a slug is expected (research <TAB>, compare a <TAB>, stack add <TAB>, track log <TAB>)
  • goal ids after search --goal <TAB>

Slug/goal lists are fetched once from the API and cached under ~/.supstack/completion/ (24-hour TTL). Pre-warm or refresh them with:

bash
supstack completion refresh

Exit codes

Commands exit with a semantic code so scripts and MCP wrappers can branch on the kind of failure:

CodeMeaning
0Success
1Generic error (incl. 5xx)
2Auth required/rejected (not logged in, 401, 403)
3Not found (404)
4Rate limited (429)
5Network failure / timeout
6Invalid input (bad/missing args or flags, unknown command, schema validation, 400/422)

Develop

bash
npm test            # unit tests (mocked fetch)npm run type-check  # tsc --noEmitnpm run build       # tsup → dist/

See CLAUDE.md for the capability pattern and how to add a command.

License

MIT

Source: README.md at commit 03d5516

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.18.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts