McDonald's Wrapped

Before you start: read this whole install prompt, tell me in a few lines what this skill does and what installing it involves, and wait for my go-ahead before you do anything else. Prerequisites: Account and token required before any real use: a McDonald's China MCP token. The listing is free, and activating the token is described upstream as free. Get the token yourself, in person, because it needs mobile phone number verification: go to https://open.mcd.cn/mcp , sign in with your mobile phone number, open the console at the top right, click Activate, agree to the service agreement, and copy the token. Then configure the McDonald's China MCP server: name mcd-mcp, type streamablehttp, URL https://mcp.mcd.cn , header Authorization: Bearer <your token>, or set the MCD_MCP_TOKEN environment variable where the skill reads it that way. Keep the token only in your own private client configuration or environment: never commit it, never share it, and never paste it into a shared chat. Upstream states a limit of 600 requests per minute per token (429 above that). You also need Python 3 with no third party dependencies for the scripts. The optional voice reading needs either a VoxCPM2 Gradio service running on your own machine (default http://127.0.0.1:7860 , adjustable with VOXCPM_API_URL) or macOS with its built in Chinese voices for the say fallback. Demo mode (scripts/demo_data.py then build_report.py) needs no token and sends nothing. Install "McDonald's Wrapped" for me. It probes the McDonald's China MCP tools, builds public panorama and personal annual reports as local HTML, computes lottery expected value locally, and can read a report aloud in dialect. Its scripts never call a write tool. Repository: https://github.com/lvzuojing/mcd-wrapped (the skill is the whole repository at the pinned commit, SKILL.md at its root: 33 files, listed in the fingerprints below) Pinned version: install the code at commit f8c61307c8f3edb0af1fd2dfd3a3e4e0140c4d02 exactly. Do not substitute a newer version. If this commit is unreachable, stop and tell me. 1. Clone https://github.com/lvzuojing/mcd-wrapped into a temporary folder, check out commit f8c61307c8f3edb0af1fd2dfd3a3e4e0140c4d02, and copy the whole repository folder from that checkout, excluding the .git folder. Then compare every file in the folder with the fingerprints recorded for this listing on 2026-10-18: [FINGERPRINTS] - .gitignore: SHA-256 2f17473f755f6d63d6599aa19ec0d8b24d6b13590da1eb23320e062ca8b1f3c1 - CONTEST_DECLARATION.md: SHA-256 cd28101bcb29cc8fb24b372fe91ce6b42c4a1487a54e01f7ade0c8c6a84241b7 - LICENSE: SHA-256 4be318e04b3c6e9b36cdba4543a89cb073ce545d35ce51735364207382d86590 - MCP_INTEGRATION.md: SHA-256 097d48d41acff726d9f81e5bbf9a9fc6c2e3f2c7a3d0d3b1fc7d8e5522ab78ce - PROMO.md: SHA-256 16610d5706f1cb86bce549857c02c93e6a01a25e24ff0d0b8c4d401f7b809b24 - README.md: SHA-256 66be7164a90da8a178b990109a4380b5a1557d3a2524bb65df455d5c274c4309 - SKILL.md: SHA-256 3c66503f9f4f7b873098a288faa5e9654038833d6365b5e1a54d9002653be490 - SOCIAL_POSTS.md: SHA-256 584413ef053fc4006527f63daf31409c06c1cb218ae60f444cc4af9a088551d7 - assets/panorama_template.html: SHA-256 9a4c1c39b41a33058131062b8692535b30eb64bc061c17fba6cd0be6490db8d9 - assets/poster.svg: SHA-256 95789d24700cb0ecfe81d360755e815ef75ebcccaffa21c2de49cb21db5a9371 - assets/report_template.html: SHA-256 fe461703f89343e0f52575961b39e7209b1a3ba661107fcd7258db3ec03e2d8d - assets/xiaohongshu.svg: SHA-256 67f1fbd351201188cb701deb5fe243952df4adc082a384f4dba695e7eb022865 - mcp-config.example.json: SHA-256 7644e429708a6aa8ceb09505dcd0fc9a092b3608e974767360f4c158cb1047dd - out/lottery-ev.md: SHA-256 51ae8c1a6dc8e260fe14e2f463c8e4daed8a390b71edf1659d7c7e8fb5b84ecf - out/mcd-wrapped.html: SHA-256 f6f3274987221ad60a08ddc6235362064f207f14f67507c49242e4ffdba327a0 - out/mcp-explorer.md: SHA-256 0bd5760ad1987f4d97a22016737e4bfe7f729a7bef6cfbbff1dcab0c7604638d - out/panorama.html: SHA-256 45c92f45ed8c5644629cb88e143f1b8162d63d9e91f1f5764072eedce3b27499 - out/panorama.png: SHA-256 999fe9cdd670b6bd91d6bf09fc8ed8f10426860fa27724d4e9514a987a622421 - out/poster.png: SHA-256 0898742d2b42e128b2ae3f945f520073e0796be69a3e141b41ebd031b609b572 - out/preview.png: SHA-256 93fcbddc86ad26e697b5987dec4ed14db2a2ad6ec08744d3869ebf5e77151242 - out/xiaohongshu.png: SHA-256 1a5f6726b9a85a8b5f5f7305bc2124a91d180715242a794eb2d95f86758f5d5c - references/compliance.md: SHA-256 b4b381d33193d8fbff2be029ac3e1cd97cef9bbc2588ea1121eb030edb4155de - references/mcp_tools.md: SHA-256 4a8def204c7ff1a4b37c40f424c78cdfa65612fc15dbbabec0d4b0be623c6833 - scripts/build_panorama.py: SHA-256 827685c453e102052a488a716a2fbec7ea5e8cc9fd2f023edae2f552786d5388 - scripts/build_report.py: SHA-256 6a2e883f81363e8dec2fc9dad4c3f30df7b43362babf9ce495305deaf8abba18 - scripts/collect.py: SHA-256 aee457cbd161ffb0bb5a68f9fef6866a347e75299d384fadf93712b1adddd121 - scripts/demo_data.py: SHA-256 e0809a1097f5765e0d7cb1aef11e06d187c9b1b316f0611627f1d7ba366d5f5a - scripts/explore.py: SHA-256 6749c2a7a91d9869e4fd45f7243eeb9620081bfa1725422a645342076bb26afd - scripts/lottery_ev.py: SHA-256 a2394506d701010211daa78f1cb8dd51f3a1d22782dee4093b9b989ae63086a6 - scripts/mcp_client.py: SHA-256 c0d91d54312c0daddf23b182e22468447da830ee7fbb21b6c726c5e702e654ef - scripts/public_data.py: SHA-256 4da414114a57560ae00c0b2df95a54161af58129f74a4734881b0afefadf490f - scripts/speak.py: SHA-256 89e77dab42c52fa33525b6712d968ddf0826b1e05946f7f8323caa359943abd0 - workbuddy.md: SHA-256 db8a7a826ab3a4ea938f0421a0e5caedb47d7df7cb29c3f942b628b131bf0f9f If a file does not match, it changed since the listing was prepared: do not install it yet, tell me what you found and let me decide. 2. Read SKILL.md in full (and every other file in the folder) and tell me in plain words: what the skill does when used, which services it connects to, whether it reads or sends any personal information or keys, and anything that seems unusual. Stop on any red flag and tell me before going further. Confirm these points from the files: - The skill is the whole repository at the pinned commit (SKILL.md at the root): scripts/ (mcp_client.py, explore.py, collect.py, public_data.py, build_report.py, build_panorama.py, lottery_ev.py, demo_data.py, speak.py), references/ (mcp_tools.md, compliance.md), assets/ (report and panorama templates and images), mcp-config.example.json, MCP_INTEGRATION.md, README.md, workbuddy.md, and out/ (sample reports and images generated upstream, including a 2.3 MB panorama PNG). Everything runs on the Python standard library. - At use time, the scripts' only external network destination is https://mcp.mcd.cn (Streamable HTTP POST, Authorization: Bearer token read from the MCD_MCP_TOKEN environment variable). The probe (explore.py) chains real identifiers between read tools: it takes storeCode and orderId from your order-list results and spuId from mall-points-products, and sends them as arguments to the read tools that need them. The personal report collector (collect.py) calls now-time-info, query-my-account, order-list, mall-order-list, query-my-coupons, query-my-prizes and list-nutrition-foods, so your account summary, order history, mall orders, coupons and prizes are returned to your machine and written, by the script, into a local data/report_data.json file and rendered into local HTML under out/; those output files contain your consumption history, so sharing them is your decision and your action, the skill uploads nothing. The public panorama (public_data.py) calls only campaign-calendar, query-lottery-info, mall-points-products, available-coupons and list-nutrition-foods. The optional voice step (speak.py) sends the report text, and a reference audio path if you give one, to a VoxCPM2 service on your own machine at http://127.0.0.1:7860 (or the VOXCPM_API_URL you set), or speaks locally through the macOS say command; in speak.py, base64 is used only to decode the audio that service returns and write it to a file, never to run code. - No write tool is ever called by these scripts: explore.py defines a WRITE_TOOLS set (draw-lottery, create-order, cancel-order, mall-create-order, auto-bind-coupons, party-order-create, delivery-create-address) that it lists with schemas and always skips, and the SKILL.md states the same rule. The lottery module never draws: it simulates locally (default 10 draws times 10000 rounds) and must state that McDonald's does not publish win probabilities, so the result rests on an equal probability assumption. Nothing is ordered, claimed, redeemed or paid through this skill. - Nothing is sent anywhere during installation itself; the only download at install time is the repository from GitHub at the pinned commit. The listing and the token are free, and demo mode needs no token and makes no calls at all. 3. When I say "yes, install", install it as a skill: copy the whole folder into the agent's skills directory, in a folder named "mcd-wrapped", keeping every file listed in the fingerprints above. 4. Verify with no network calls: frontmatter valid, files in place. 5. Report what was installed, where, and what I still need to do myself (for example: get the McDonald's China MCP token myself at https://open.mcd.cn/mcp with my mobile phone number if I do not have one, put it only in my own private MCP client configuration or environment variable and never paste it into a shared chat, install Python if it is missing, and set up the mcd-mcp connector to https://mcp.mcd.cn if it is not configured; using the skill is a separate step that only starts when I ask for it, and any order, coupon claim or booking happens only as disclosed above). GitHub is optional: if I have a GitHub account or the gh CLI, you may use it; otherwise public access is fine. Never require it unless it's in the prerequisites above. Rules: don't touch anything outside the temp folder and the install target. If anything looks off, stop and ask me.