MCP.Market

Aa MCP server

by thehesiod·io.github.thehesiod/aa·v0.1.0
No reviews yet

MCP server for read-only American Airlines AAdvantage account access

A92/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
Growing

0 stars25 downloads/wk

Reviews

Write one

Nobody has reviewed Aa yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Aa tools (11)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • check_auth_status

    Check the saved AA session for an account — token expiry, AAdvantage #, cookie count.

  • get_account_summary

    Member info: name, AAdvantage #, mile balance, status, cobranded card, business memberships.

  • get_flight_credits

    Flight credits (single-passenger ticket credits from cancelled flights).

  • get_loyalty_points_progress

    Elite status progress — Loyalty Points YTD + last-year EQDs/EQMs/EQSs + tier thresholds.

  • get_mile_activity

    AAdvantage mile / loyalty-point transaction history.

  • get_notifications

    Account notifications panel.

  • get_partner_offers

    Partner offers / promotions on the dashboard.

  • get_profile_details

    Detailed profile: DOB, partners, sales city, mile expiration, million-miler stats.

  • get_trip_credits

    Trip credits (multi-passenger / itinerary-level credits).

  • get_upcoming_trips

    Upcoming flight reservations with record locators.

  • save_session_from_browser

    Pull cookies from a logged-in Chromium (started by aa-auth-browser) and save them.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • Code scan7 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 3 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Aa compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
92/100
higher than 95% of 48,255 servers
Tools
11
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
25
more than 11% of 12,191 servers with a package

What its tools let an agent do: 10 read · 1 create

Install Aa in Claude Code, Cursor or VS Code

claude mcp add aa -- uvx aa-mcp-server
Add to Cursor

What the publisher says

From the Aa repository's README, as published. We do not edit it. Read it on GitHub

aa-mcp-server

An MCP server that gives Claude (or any MCP-compatible LLM) read-only access to your American Airlines AAdvantage account — mile balance, Loyalty Points progress, transaction history, upcoming trips, travel credits, and partner offers.

This is not a browser-automation wrapper. The server discovers and calls aa.com's underlying JSON APIs directly using session cookies extracted from a Chromium login. All HTTP traffic uses curl_cffi with Chrome TLS impersonation to satisfy aa.com's Akamai Bot Manager.

Tools

Setup

pip install aa-mcp-server

One-time auth

aa.com is fronted by Akamai Bot Manager — you can't log in via headless requests. The flow:

  1. Launch a real Chromium with a persistent profile and a remote-debugging port:
aa-auth-browser              # default account
   aa-auth-browser personal     # named account
  1. Log into aa.com (and complete 2FA if prompted) in the window that opens.
  2. Copy the cookies into the MCP store:
aa-mcp-server --extract-session default

Or call the savesessionfrom_browser MCP tool from Claude.

The cookies live in ~/.aa-mcp/accounts//session.json. The chromium profile lives in ~/.aa-mcp/chrome-profiles//. To refresh after expiry, relaunch aa-auth-browser (the saved profile auto-refreshes the access_token cookie when you visit any aa.com page) and re-run --extract-session.

AAMCPCHROMIUM= overrides the auto-discovery if your Chromium is somewhere unusual.

Multi-account

Every tool takes an optional account parameter. Omit it to use the default account.

get_account_summary()                # default
get_account_summary(account="spouse")

Running

aa-mcp-server                        # stdio transport
aa-mcp-server --setup                # show account status & setup hints
aa-mcp-server --extract-session NAME # save cookies from running Chromium

Add to your MCP client config (e.g. Claude Desktop):

{
  "mcpServers": {
    "aa": {
      "command": "aa-mcp-server"
    }
  }
}

Limitations

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Aa: common questions

Is Aa MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the Aa safety report
How do I install Aa?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Aa need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Aa maintained?
The last commit was 40 days ago (2026-09-25). The latest release is v0.1.0.
How does Aa compare with other MCP servers?
safety score 92/100 (higher than 95% of 48,255 servers); tools 11 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

More from thehesiod →