← Search

McDonald's Terminal
Food & Drink 📌 Pinned version: commit ab7cce9
🔎 Install prompt analysis · 2026-10-19 : runs commands · makes network calls · installs packages · writes files · uses API keys or tokens
⚙ Needs: Before you start: read this whole install prompt…

McDonald's Terminal

A McDonald's China ordering terminal that stacks your coupons, points and store promos, checks the real price live, and never spends or orders without your yes.

At a glance
What
A McDonald's China ordering terminal that stacks your coupons, points and store promos, checks the real price live, and never spends or orders without your yes.
Cost
Free
Needs
Before you start: read this whole install prompt, tell me in a few lines what this skill does and what installing it involves, and wait for my go-ahead before you do anything else.
Install
Copy the installer prompt below into your Muse — your agent does the rest.

Version:

⌁

Install

Copy the install package below, then paste it into Muse📌 Pinned version: commit ab7cce9
Wanna be extra careful?

The install prompt below already includes the vetting steps: your agent follows the community checklist before installing anything with executable code. Want more?

How to check a build before installing →

🧭 What this touches
  • It can run commands on your Muse’s computer.
  • It can contact outside services over the network.
  • It can download and install software packages.
  • It can create or modify files.
  • It works with an API key or a token that you provide.
Install prompt analysis · 2026-10-19
🔒 Security and provenance
📌 Pinned version: commit ab7cce9 · 2026-10-19
🔎 Install prompt analysis · 2026-10-19 : runs commands · makes network calls · installs packages · writes files · uses API keys or tokens
What the scan found — excerpts from the install prompt
  • runs commands — curl -fsSL --max-time 60 https://gh-proxy.com/https://github.com/Zhangfengmo/mcd-terminal/releases/latest/down · mcd login --token <用户的 MCP Token> # 或让用户自己运行 mcd login · mcd skill install # 装进 Claude Code 的技能目录;其他 agent 用 --dir 指定目录
  • makes network calls — curl -fsSL --max-time 60 https://gh-proxy.com/https://github.com/Zhangfengmo/mcd-terminal/releases/latest/down · curl -fsSL --max-time 60 "https://gh-proxy.com/https://github.com/${{ github.repository }}/releases/download/$ · # curl -fsSL --max-time 60 https://gh-proxy.com/https://github.com/Zhangfengmo/mcd-terminal/releases/latest/do
  • installs packages — pip install -e ".[dev]" && pytest · - run: pip install -e ".[dev]" · - run: pip install . pyinstaller
  • writes files — if gh release view "$TAG" >/dev/null 2>&1; then · - Token 由 `mcd login` 验证有效后才保存到 `~/.config/mcd-terminal/token`(权限 0600,仅本人可读),只发送给 `mcp.mcd.cn`,`mcd logout` 即 · - Token 和设置只存在本机 `~/.config/mcd-terminal/`,`mcd logout` 删除 Token。
  • uses API keys or tokens — 把 `gh-proxy.com` 换成 `ghfast.top` 再试;用了代理的话先 `export https_proxy=http://127.0.0.1:<端口>`。 · 重新打开终端,或执行 `export PATH="$HOME/.local/bin:$PATH"`。 · zsh) RC="$HOME/.zshrc"; LINE="export PATH=\"$BIN_DIR:\$PATH\"" ;;
🔎 Last checked · Oct 19, 2026 : no change detected in the files linked by this install prompt
Skill Harbor never reviews the code of a listed skill. These are dated facts about the install prompt and our install test, not a safety certification. Review a skill yourself before you install it. How we verify

Before you start: read this whole install prompt, tell me in a few lines what this skill does and what installing it involves, and wait for my go-ahead before you do anything else. Prerequisites: Account and token required before any real use: a McDonald's China MCP token. The listing is free, and activating the token is described upstream as free. Get the token yourself, in person, because it needs mobile phone number verification: go to https://open.mcd.cn/mcp , sign in with your mobile phone number, open the console at the top right, click Activate, agree to the service agreement, and copy the token. Then configure the McDonald's China MCP server: name mcd-mcp, type streamablehttp, URL https://mcp.mcd.cn , header Authorization: Bearer <your token>, or set the MCD_MCP_TOKEN environment variable where the skill reads it that way. Keep the token only in your own private client configuration or environment: never commit it, never share it, and never paste it into a shared chat. Upstream states a limit of 600 requests per minute per token (429 above that). This skill's engine is a separate program, and its upstream first use install is a download and run step you must see clearly before it happens: the SKILL.md tells the agent, only after your consent, to run curl -fsSL --max-time 60 https://gh-proxy.com/https://github.com/Zhangfengmo/mcd-terminal/releases/latest/download/install.sh | bash (the gh-proxy.com part is a mirror prefix for slow networks, dropped where GitHub is directly reachable; on Windows: irm <the same release address, install.ps1> | iex). That fetches the latest release program, not this pinned repository copy. The release install script verifies a SHA-256 for the package before installing (the sums are embedded in the released script or fetched from GitHub as SHA256SUMS; mirror hosts gh-proxy.com and ghfast.top may serve the package file, but a copy that fails the hash is discarded and the next source is tried), installs under ~/.local/share/mcd-terminal with a link at ~/.local/bin/mcd, and may append a PATH line to your shell startup file. A source install from this pinned repository is also possible (Python 3.9 or later; pyproject runtime dependencies httpx, typer, rich and segno; the repository copy of install.sh carries empty embedded sums, because release CI stamps them into the released copy). The token is then set by you running mcd login in your own terminal and pasting the token there: it is saved to ~/.config/mcd-terminal/token with owner only permissions (0600), or under $MCD_HOME if you set it. Only if you proactively hand the token to the agent does it use mcd --json login --token, and it must never repeat the token back to you. A --demo mode runs every command on sample data with no token. Install "McDonald's Terminal" for me. It installs the root SKILL.md skill that drives the mcd command line engine: cheapest payment planning across cash, coupons and points with live server pricing, and a hard rule that spending, ordering, drawing, claiming, cancelling and booking happen only after you agree to a shown plan. Repository: https://github.com/Zhangfengmo/mcd-terminal (the skill is the whole repository at the pinned commit, SKILL.md at its root: 98 files, listed in the fingerprints below; the file mcd_terminal/skill/SKILL.md inside the package is a byte identical copy of the root SKILL.md, shipped as package data, and is not a second skill) Pinned version: install the code at commit ab7cce9c555590ec5655040ad9236ef8c97aa64c exactly. Do not substitute a newer version. If this commit is unreachable, stop and tell me. 1. Clone https://github.com/Zhangfengmo/mcd-terminal into a temporary folder, check out commit ab7cce9c555590ec5655040ad9236ef8c97aa64c, and and copy the whole repository folder from that checkout, excluding the .git folder. Then compare every file in the folder with the fingerprints recorded for this listing on 2026-10-18: [FINGERPRINTS] - .github/workflows/release.yml: SHA-256 4e5f50f4f530eaf7face99ae364bcdfe8ddad8f40fcafb39312d8966788b8587 - .gitignore: SHA-256 d2faa69340abe058e0e3c7c3006c8519168cae072131acfc2b7ccdf6368338a4 - AGENTS.md: SHA-256 60dac81340f0f65c62c45fbb9cea8b31600406ad29c9d3e2663e5972ad2a68fe - CONTEST_DECLARATION.md: SHA-256 cd28101bcb29cc8fb24b372fe91ce6b42c4a1487a54e01f7ade0c8c6a84241b7 - MCP_INTEGRATION.md: SHA-256 33e7b6ab1dba3988eaf301d68a7bcd9a56ee043b139fc5c54021103ab3310471 - README.md: SHA-256 1ae68e7770d5c02875165d11795124047c3a2f5e60497e085582677326b94e8a - SKILL.md: SHA-256 953ad8f91c8f6380ac4c130686d64da33d5d955fe22fbc8a4dcaba632757b8fa - docs/demo.gif: SHA-256 1a189c4673be1f2c2b87d8b5a3705aacfc1261a1afb0e565bd2585d71810d65e - docs/how-it-works.md: SHA-256 98fd4a952caf571fc5f17b647a32748b60c79681292d845fd99efcb367dcad54 - docs/web-demo.gif: SHA-256 963f13b1e2a4910ade1d9d81b5c78d45d2893a89fc44b0a949beae3b341c605b - install.ps1: SHA-256 2a69deddb7de22e186274cea5d243d70e8a40950465fbd7a6515d08708531d1e - install.sh: SHA-256 dffd07d9016b95a01048aff694ab5c50d0a8a2ead464d0be6036a764961de3a6 - mcd_terminal/__init__.py: SHA-256 75af70aac8bbff6a4a420ba856c3ffbce82333a408818141db18d4d918255c5e - mcd_terminal/__main__.py: SHA-256 c1c0ab2f83e31b9d6be7054aa8985ca093d32df1d6d3035b0f7d43ad43743162 - mcd_terminal/agent.py: SHA-256 78cd52ea2042de36c2789923f9c71a1c6f6f0eea3b2698028ba126f4858c4411 - mcd_terminal/campaigns.py: SHA-256 493a4d36f4ed534b3c5bcebf57cac012e1c471ce03bf111c8244c98f1187c19b - mcd_terminal/cli.py: SHA-256 86fda61042a2c498d56d1c06bb314021bb18438e40e00643812a25bb54e1a74b - mcd_terminal/client.py: SHA-256 cbc8523cef47e4292df0a754a41d140cfcac4a57dca981d70456ac8a74e1bd85 - mcd_terminal/content.py: SHA-256 b4fb857c8d74eeeca12369ae3fcbba1597c327ca7964fc38c4f15b0e1fafb005 - mcd_terminal/demo.py: SHA-256 6ca4e5a523aff3307d879abe839ef79b8683ee1c0149d33a4ac513f9a920fe1d - mcd_terminal/games/__init__.py: SHA-256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 - mcd_terminal/games/fortune.py: SHA-256 0cfc400844589cad720238ae4ed1949bda70f178de3bcaa5c7e56294ceb597fc - mcd_terminal/games/fries.py: SHA-256 220788018635e8932625844f9131ceb72e153c9bab9695c762131333262412b9 - mcd_terminal/games/guess.py: SHA-256 394a7b3591ca49072a5fc7d488cd94b0678f3a0059ae5add2d64c3d0946e2120 - mcd_terminal/games/keys.py: SHA-256 e8ecab5f51d536811081cb6e054b975bee47c87db2d24e5e928adc88618065ea - mcd_terminal/games/kitchen.py: SHA-256 bad2c8c0f34c8802200f8c5802cc59b09b5007a6a4525f93e4b0e2fb429bca06 - mcd_terminal/games/memory.py: SHA-256 0aebf870566a7b1d0477ffb91fb5231131160c119aca373a96ddf6e227011673 - mcd_terminal/games/persona.py: SHA-256 a1cf26576e49c95f3e9cec01710022834d8543cc77e6c9a7cd2b97edc1ddb5c0 - mcd_terminal/games/slot.py: SHA-256 d3cdcdce166e031ce7f1ff22b91f2e1ec2d43b27a46a53c20fd010019e2829cf - mcd_terminal/games/stack.py: SHA-256 b02a0994a9548350261ecc95fcacdb4719c40f5a3ff01b864085ab0d4b21de9b - mcd_terminal/intake.py: SHA-256 875ca4e4b75ee23b43db4c2534414417f225c045d95e9146714e31aab321d3f4 - mcd_terminal/order.py: SHA-256 2f40162c06a3b068e843b24469cd351173fc13135a95c1168f8d7183526fa2db - mcd_terminal/ordering.py: SHA-256 8f7d97dc299e7015856cf0706c695d8306204c3244cd42a090d9a095aa27ae36 - mcd_terminal/party.py: SHA-256 0734d33450bd5706ee09275b7fd1464bef641d7a3d9bc8c24ed44becb387d2ba - mcd_terminal/pay.py: SHA-256 4830f772c0dbb1a904eacf90627ae41a7814cade9ad3998c7266b292eb3d0aff - mcd_terminal/prefs.py: SHA-256 11613591e7d17ae1f916c33a7c590a3a6bee4be255e682b0569ca93c7e3cb37c - mcd_terminal/promos.py: SHA-256 6fa3cfe2103608e0a78a6ac361e3121d3c3f89c9859ebb77445355aa6a49ec98 - mcd_terminal/remind.py: SHA-256 6acc73e6390d5b1551f7ec3a9c1c5de1eb283bd01fbe790c40ad7b16ead39a97 - mcd_terminal/render.py: SHA-256 d61c5db263d54b070cc661dffb7284ee160ee75a13c6e17a7bb39e0a9921e4ff - mcd_terminal/skill/SKILL.md: SHA-256 953ad8f91c8f6380ac4c130686d64da33d5d955fe22fbc8a4dcaba632757b8fa - mcd_terminal/valuation.py: SHA-256 403c31683dbcac878d6f724bee967eae5d4d6f2b6665dd775b38cf4332cff876 - mcd_terminal/web.py: SHA-256 f1d4ba16d95142143ba693c38c6770114a3c691e7a1b165dc040428653d94ad9 - mcd_terminal/web/index.html: SHA-256 73c0cb3b0d589a8bf4acac67281b568643dcd12115c217d928ba4eade7ded29d - mcp-config.example.json: SHA-256 7644e429708a6aa8ceb09505dcd0fc9a092b3608e974767360f4c158cb1047dd - packaging/build.py: SHA-256 52373cacf5f0da9ce5a08b0911eb6159506320a711198e97243ea4af4715bd5f - packaging/e2e.py: SHA-256 ff3d27bc4e4d3d22673fa75162661c20724dbbdb83ab5fe1958b5ee7b467d966 - packaging/mcd_entry.py: SHA-256 01cc256dcab81a2fa76269712300d5522ebbdaf12a52499ad9de3431379b04c1 - packaging/stamp.py: SHA-256 eff6656cd1452e5a6caf2e0dcbd6fcca6b182d2d1cb5bbc633c10b94be0bdb99 - pyproject.toml: SHA-256 eda7e6a40434a50930a39d65f671259232a8c8e746eb2d49724414757207424d - scripts/demo.tape: SHA-256 9af0fa38a9b882b8b7614f0e01294aae696db33f61d3efe2159a2bc991cf26fe - scripts/demo_rc.sh: SHA-256 b39f6a0e90238a07214335ef1e9d30303127845221ace2713e60f99a82d8eddb - scripts/make_demo.sh: SHA-256 c5430f5b8c2d1aa1a2cb1b0fca3b30d0151154a40028173ca55c83e8aa85aa66 - scripts/record_web.py: SHA-256 c81d131f6c2610585839aa712be6816c789782d03636a328a97fc0a2a11f2b75 - tests/__init__.py: SHA-256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 - tests/fixtures/real/available-coupons.txt: SHA-256 28bb0289a00549f8efde49587bbaa9a88a273b418b6984b407d83d3e1d5eb2e9 - tests/fixtures/real/calculate-price.txt: SHA-256 51a5718b25dc55bb72d1fbd84a14d118acc902409833b4ebd0e7d8fc90131d4b - tests/fixtures/real/campaign-calendar.txt: SHA-256 f67eec15db3314b6bdb172d2af1dbd10521726258c72f960020712af3523870d - tests/fixtures/real/delivery-query-addresses.txt: SHA-256 0555ae7099690e9b0dac964843ae1e77fe5c3b2f4f38c969e26eee7e9a18ba9c - tests/fixtures/real/list-nutrition-foods.txt: SHA-256 8d5c4fa57002f29fd00cb569ef228f192f76e77a074f89b9b9abe924bfe81747 - tests/fixtures/real/mall-order-list.txt: SHA-256 ee239febd0f73bc0bece964d8699633732f07ec6a4350b99fe77c0266e259ec7 - tests/fixtures/real/mall-points-products.txt: SHA-256 006a10ef76f9e207e2544bd237bc747b0cb33503b040d3850d2d052d69cb13aa - tests/fixtures/real/mall-product-detail_off-shelf.txt: SHA-256 27d1a5f011a15382b35b976f4c8543ee5008855e32f49202eb0eef4e02a6ccea - tests/fixtures/real/mall-product-detail_on-shelf.txt: SHA-256 ebab4cf2c0402e7dfc6492518443eb1f305b279db85feb65fa3a0f0a749e2ae6 - tests/fixtures/real/mall-product-detail_party-both.txt: SHA-256 b3e83d1d2887f57f5d5ff7b3ab7390955a6e1e74452e27253864f6f0698fe0c6 - tests/fixtures/real/mall-product-detail_party-private.txt: SHA-256 bbcf0f85b9279275549ab0df76e255a3e5f255ee62e02d1234a6c965eda0a0a4 - tests/fixtures/real/now-time-info.txt: SHA-256 e6fefe6f3afd539d65a3d00ac76a737ad43b4b2383c92f99388244ce5f8ef0eb - tests/fixtures/real/order-list.txt: SHA-256 8a16c0e36bc95bd8ad731ae0eade2ab85b8037190e477c7adc2d3d92ef7b396a - tests/fixtures/real/query-lottery-info.txt: SHA-256 6aceb10e5402249c5ede94adaeed8e75e6aa580293c18dee256283d42b9fb64b - tests/fixtures/real/query-meal-detail_combo.txt: SHA-256 d0c064f5fd1a2a3ec6cfbd6fb8ccf5381fc1447ab125ad88c052a96f771ce4de - tests/fixtures/real/query-meal-detail_single.txt: SHA-256 a5608e6e85018b7dd78bfac27c12995e3d93a5bf2b0af6aac18aca85c630ea54 - tests/fixtures/real/query-meals.txt: SHA-256 266595c802cdde1ac56255173cb0fb43029c86e3698a68831978fe70176bcfa9 - tests/fixtures/real/query-my-account.txt: SHA-256 7f208dfd951cbc4b59d354f5bf88a694145c88b55ca90705f749c25b349882ca - tests/fixtures/real/query-my-coupons.txt: SHA-256 38df6b27731d4153af155a772480a216ad01a604949f7b2ab45bc9f313a9e4a5 - tests/fixtures/real/query-my-prizes.txt: SHA-256 90e0927c5f276f87b0030fa157cc2a5a3c2802ff65f48fb3055a650deb0bba7b - tests/fixtures/real/query-nearby-stores_drive.txt: SHA-256 40ce0f8b47e0f0fa05ba754f24f915684b7f26aaca3cf7e047c2282dd5f4320f - tests/fixtures/real/query-nearby-stores_favorites.txt: SHA-256 cdf8655a19f52e84fd4a2ae0920ee979c0509de7d5a233805d1352798c491036 - tests/fixtures/real/query-nearby-stores_location.txt: SHA-256 1aadcb1ea961fe1b43489ecebff80c346a4cd9e5c35c13904731e6e1f226379d - tests/fixtures/real/query-order.txt: SHA-256 8982b4333d37fece28fc94a368133701a5b5b03b1d701e372e2f88a1705ccec0 - tests/fixtures/real/query-party-city.txt: SHA-256 f5753966ff9674d41bc4d9c9e32ffd4f78046793149533047b11cfb59e41bc19 - tests/fixtures/real/query-party-store-date.txt: SHA-256 4a0e9450cf43fbec36723ae4e47dd186a604917be6365f6e20fbbdd0dcbc3b91 - tests/fixtures/real/query-party-store-session.txt: SHA-256 ed0b4cf52846ecce5bd052f2d11e31f09f57a251f0e6a5e2b11b3018687d07d7 - tests/fixtures/real/query-party-store.txt: SHA-256 6c0fc35dff0475a641880dc73dcd609fb0534f45a6aaf9812d5be4c8327220c1 - tests/fixtures/real/query-promotions.txt: SHA-256 5c92a072ba6dc0654e93919b11826e8fc7bf96735d739b3a59ce0af29f8480fa - tests/fixtures/real/query-store-coupons.txt: SHA-256 f69cbf2ae2fdf05caa30d0a17d5069376311742b2f22444beba58a6dfa527d01 - tests/fixtures/real/query-survey-coupon.txt: SHA-256 ce3266ea43977d4376e3730d70c221aab75cef02624b012e31c292d45314b8b4 - tests/test_campaigns.py: SHA-256 94b99d3667f8d56e35f5dccecb298fc32a43a1334865359c8fe39423253f4d10 - tests/test_cli.py: SHA-256 122528d28abb5b22a95f739e5215a871d0ad3f13cd67c101b4f43ce1dfb886e6 - tests/test_client.py: SHA-256 d0902c9656669bdc048194659d60267b85b430137b046457212b9afd79ca4fcf - tests/test_e2e.py: SHA-256 c8fd57179c01a658325e112b9793fd3b96a6fc2779297c74eae15034626b8652 - tests/test_games.py: SHA-256 7a3bbc43f90b68376ae586e8bac8a67437d03d93184d6b3ddb4c409881a684c1 - tests/test_more_tools.py: SHA-256 87b36887cdc7b7c7fdb8fc5b6deb3821b93c2c303d530decc7e3100434eb2308 - tests/test_order.py: SHA-256 a6b4063924f358a8578d3059224f2ff315c3efa4d65056fd728f86426c50ba96 - tests/test_packaging.py: SHA-256 7d85a42c6de1b1adc0cc0e866075c7c01fbe730a5ab84ce028977c03f59f5c0e - tests/test_pay.py: SHA-256 2129c870ee271a5411e35cf59ec7c5e93bd8091393c3c09d6b9d79c2001c6a62 - tests/test_real_payloads.py: SHA-256 830444a4cd9146af4fcd1d37e79802ce57b517301e61ca1db6ac99e0601f789c - tests/test_remind.py: SHA-256 b26d118846e917cf45a53d02ff1d41a609ec91bcc9901e1be91d2a3900336524 - tests/test_valuation.py: SHA-256 74ec95110247e7fc6d6c56ec983e15eb4141c85ecc3fed18fe0749bd6126f3c8 - tests/test_web.py: SHA-256 056b3e46010bcd1de64da822ed36399b92a862eb7b2661dcc0c0b9b18ced6868 If a file does not match, it changed since the listing was prepared: do not install it yet, tell me what you found and let me decide. 2. Read SKILL.md in full (and every other file in the folder) and tell me in plain words: what the skill does when used, which services it connects to, whether it reads or sends any personal information or keys, and anything that seems unusual. Stop on any red flag and tell me before going further. Confirm these points from the files: - The repository holds the root SKILL.md (frontmatter name mcd-terminal) and the engine it drives: the Python package mcd_terminal/ (client.py, the MCP client; cli.py, all commands; ordering.py, order.py and valuation.py, the payment planning; prefs.py, local defaults and the token file; pay.py, payment link handling; remind.py, reminders; web.py plus web/index.html, an optional local web view; agent.py, which can print this SKILL.md or copy it into a skills directory through mcd skill install; demo.py and the small games under games/), pyproject.toml (runtime dependencies httpx, typer, rich and segno), install.sh and install.ps1 (the release installers), packaging/, scripts/, docs/, tests/ (including recorded real MCP response fixtures under tests/fixtures/real/, with identifiers zeroed or emptied upstream: the account fixture shows a zeroed account id and the address fixture an empty address list), README.md, AGENTS.md, MCP_INTEGRATION.md and mcp-config.example.json. The copy at mcd_terminal/skill/SKILL.md is byte identical to the root SKILL.md (same SHA-256, recorded in the fingerprints): it is the copy the program ships and can install, not a separate skill, and the root file is the one this listing covers. The engine is required by the skill: without the mcd program, the SKILL.md workflows cannot run. - At use time, the engine's MCP client (mcd_terminal/client.py, built on httpx) sends data only to the McDonald's China MCP server at https://mcp.mcd.cn (Authorization: Bearer token, read from the MCD_MCP_TOKEN environment variable or the token file set by mcd login). Its read calls cover your account, coupons and claimable coupons, menus and meal details, nutrition, stores near a city and landmark you name, your saved delivery addresses, orders and order history, prizes, the campaign calendar and promotions, party cities, stores, dates and sessions, and survey coupons, so the server receives your token, your store and place words, item names and codes, dates and times, party headcounts and your address choices, and returns your account data to your machine. Adding an address is the one read side flow that sends new personal data: address add sends the city, contact name, phone number, street and detail you provide to McDonald's through delivery-create-address. Saved defaults live locally in ~/.config/mcd-terminal/prefs.json (mode, store code and address id, points usage; no token in that file) and are reused on later orders. The optional web view runs only when you start it yourself (mcd web): it listens on 127.0.0.1 on a random port behind a secret link, and its server only proxies McDonald's image hosts and only makes QR codes for McDonald's payment hosts. The many img.mcd.cn and menu-img.mcd.cn addresses in the repository are image URLs inside the recorded response fixtures, not destinations the engine sends your data to. - The write actions are the widest set in this wave, and the SKILL.md gates all of them the same way: without --yes, the commands order, spend, buy, claim, cancel, draw and party --book only return a plan marked needs_confirmation; the agent must present the plan (what, how each item is paid, how many points, the real payable amount) and run the returned confirm_with command, the same command plus --yes, only after you explicitly agree. In concrete terms: order creates an order through create-order, spending points inside it through mall-create-order first when an item is paid with points; spend and buy redeem points through mall-create-order, and points deductions cannot be undone; claim claims your claimable coupons through auto-bind-coupons; cancel cancels through cancel-order; draw draws the points lottery through draw-lottery, once per confirmation, after telling you its cost in draw chances or points (vague assent does not count as confirmation); party --book books a theme party through party-order-create (group bookings auto cancel and refund if the minimum headcount is not reached by the deadline, and booking needs three days lead, both of which the agent must tell you); address add writes a new delivery address as above. Payment is never made by the engine or the agent: a finished order returns scan_url, app_url and pay_url links (on m.mcd.cn) for you to pay yourself. Local side effects beyond the account: config commands change your saved defaults only when you say from now on; remind writes a reminder into the macOS Reminders app through osascript, or an .ics calendar file locally, and talks to no McDonald's server; the install and login steps are disclosed in the prerequisites. - Nothing is sent anywhere during installation of this skill copy itself; the only download at install time is the repository from GitHub at the pinned commit. The engine install described in the prerequisites is a separate first use step that needs your consent before it runs, and it fetches the latest release rather than this pinned code, which is stated there in full. The listing and the token are free; you pay only what a confirmed order or booking charges, on the official payment links, and points you confirm spending are deducted for real. 3. When I say "yes, install", install it as a skill: copy the whole folder into the agent's skills directory, in a folder named "mcd-terminal", keeping every file (.github/workflows/release.yml, .gitignore, AGENTS.md, CONTEST_DECLARATION.md, MCP_INTEGRATION.md, README.md, SKILL.md, docs/demo.gif, docs/how-it-works.md, docs/web-demo.gif, install.ps1, install.sh, mcd_terminal/__init__.py, mcd_terminal/__main__.py, mcd_terminal/agent.py, mcd_terminal/campaigns.py, mcd_terminal/cli.py, mcd_terminal/client.py, mcd_terminal/content.py, mcd_terminal/demo.py, mcd_terminal/games/__init__.py, mcd_terminal/games/fortune.py, mcd_terminal/games/fries.py, mcd_terminal/games/guess.py, mcd_terminal/games/keys.py, mcd_terminal/games/kitchen.py, mcd_terminal/games/memory.py, mcd_terminal/games/persona.py, mcd_terminal/games/slot.py, mcd_terminal/games/stack.py, mcd_terminal/intake.py, mcd_terminal/order.py, mcd_terminal/ordering.py, mcd_terminal/party.py, mcd_terminal/pay.py, mcd_terminal/prefs.py, mcd_terminal/promos.py, mcd_terminal/remind.py, mcd_terminal/render.py, mcd_terminal/skill/SKILL.md, mcd_terminal/valuation.py, mcd_terminal/web.py, mcd_terminal/web/index.html, mcp-config.example.json, packaging/build.py, packaging/e2e.py, packaging/mcd_entry.py, packaging/stamp.py, pyproject.toml, scripts/demo.tape, scripts/demo_rc.sh, scripts/make_demo.sh, scripts/record_web.py, tests/__init__.py, tests/fixtures/real/available-coupons.txt, tests/fixtures/real/calculate-price.txt, tests/fixtures/real/campaign-calendar.txt, tests/fixtures/real/delivery-query-addresses.txt, tests/fixtures/real/list-nutrition-foods.txt, tests/fixtures/real/mall-order-list.txt, tests/fixtures/real/mall-points-products.txt, tests/fixtures/real/mall-product-detail_off-shelf.txt, tests/fixtures/real/mall-product-detail_on-shelf.txt, tests/fixtures/real/mall-product-detail_party-both.txt, tests/fixtures/real/mall-product-detail_party-private.txt, tests/fixtures/real/now-time-info.txt, tests/fixtures/real/order-list.txt, tests/fixtures/real/query-lottery-info.txt, tests/fixtures/real/query-meal-detail_combo.txt, tests/fixtures/real/query-meal-detail_single.txt, tests/fixtures/real/query-meals.txt, tests/fixtures/real/query-my-account.txt, tests/fixtures/real/query-my-coupons.txt, tests/fixtures/real/query-my-prizes.txt, tests/fixtures/real/query-nearby-stores_drive.txt, tests/fixtures/real/query-nearby-stores_favorites.txt, tests/fixtures/real/query-nearby-stores_location.txt, tests/fixtures/real/query-order.txt, tests/fixtures/real/query-party-city.txt, tests/fixtures/real/query-party-store-date.txt, tests/fixtures/real/query-party-store-session.txt, tests/fixtures/real/query-party-store.txt, tests/fixtures/real/query-promotions.txt, tests/fixtures/real/query-store-coupons.txt, tests/fixtures/real/query-survey-coupon.txt, tests/test_campaigns.py, tests/test_cli.py, tests/test_client.py, tests/test_e2e.py, tests/test_games.py, tests/test_more_tools.py, tests/test_order.py, tests/test_packaging.py, tests/test_pay.py, tests/test_real_payloads.py, tests/test_remind.py, tests/test_valuation.py, tests/test_web.py). 4. Verify with no network calls: frontmatter valid, files in place. 5. Report what was installed, where, and what I still need to do myself (for example: get the McDonald's China MCP token myself at https://open.mcd.cn/mcp with my mobile phone number if I do not have one, put it only in my own private MCP client configuration or environment variable and never paste it into a shared chat, install Python if it is missing, and set up the mcd-mcp connector to https://mcp.mcd.cn if it is not configured; using the skill is a separate step that only starts when I ask for it, and any order, coupon claim or booking happens only as disclosed above). GitHub is optional: if I have a GitHub account or the gh CLI, you may use it; otherwise public access is fine. Never require it unless it's in the prerequisites above. Rules: don't touch anything outside the temp folder and the install target. If anything looks off, stop and ask me.

?

Questions

How do I install a build?

Every product page includes a copy-paste install prompt. Paste it into your Muse and it sets the build up for you — no manual configuration.

Where does my money go?

Straight to the seller. Skill Harbor never processes payments: checkout happens on the seller’s own page, usually Stripe.

What does the ✓ next to a creator’s name mean?

It means we confirmed the identity of the person behind the listing. It says nothing about the code itself — always check a build before installing it.