Mmcp.market

trvl MCP server

by MikkoParkkola·io.github.MikkoParkkola/trvl·v1.21.6
No reviews yet

Door-to-door travel MCP + CLI: flights, hotels, trains, cars, ferries. No API keys, Go binary.

D49/100grade D
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
D49/100

full report

Adoption
Established

77 stars238 downloads/wk

Reviews

Write one

Nobody has reviewed trvl yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

trvl tools

No tool declarations could be read from the package source. They show once the server is installed.

Public scan report

scanner v0.1.9 · 2026-09-19 · same rubric, same numbers if you re-run it

1 high2 medium
  • Code scan3 source files scanned3/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 1 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (3)

  • mediumnpm install lifecycle script presentinstall.script
  • highShell command built from a string (injection risk)exec.shell-concat
    bin/install.js: …ich is available since Windows 10 execSync(`tar -xzf "${tmpFile}" -C "${binDir}" trvl.exe`, { stdio: "pipe" }); …
  • mediumnpm install lifecycle script presentinstall.script
    package.json: …in/trvl-mcp.js" }, "scripts": { "postinstall": "node bin/install.js" }, "os": [ …
Overall 49/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Install directly

claude mcp add trvl -- docker run -i --rm ghcr.io/mikkoparkkola/trvl:1.21.6
Add to Cursor

trvl: common questions

Is trvl MCP server safe?
Not recommended: it is graded D (49/100). Read the trvl safety report
How do I install trvl?
It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does trvl need an API key?
Yes. The registry entry asks for TRVL_MCP_TOKEN, TRVL_MCP_READ_TOKEN, TRVL_MCP_WRITE_TOKEN, TRVL_MCP_OAUTH_CLIENT_SECRET and 11 more.
Is trvl maintained?
The last commit was 2 days ago (2026-09-19). The latest release is v1.21.6.
What can I use instead of trvl?
Servers from other publishers that do the same job: RailRoute journey planner MCP server, Rialto Travel - Direct Hotel Bookings with VIP Rate Programs MCP server and Fly Travel Albania MCP server. Compare all trvl alternatives.

Alternatives to trvl

Same job from other publishers: the closest match first, then the best rated.

All trvl alternatives →
  • RailRoute journey planner
    Plan intercity journeys in India by train, flight or both, with a fare for every travel class.
    B
  • Rialto Travel - Direct Hotel Bookings with VIP Rate Programs
    Hotel direct booking for VIP and corporate rates - upgrades and loyalty eligible, 100K+ hotels
    B
  • Fly Travel Albania
    Cached charter package, hotel facts and tour prices from Fly Travel Albania (Tirana); party-aware.
    C
  • Weather Data MCP Server
    17 weather tools, no API keys: forecasts, alerts, air quality, marine, radar, lightning, wildfires
    A
  • Argon
    Versioned MongoDB sandboxes for AI agents: branch, time-travel, merge, and undo over MCP.
    B

More from MikkoParkkola →