trvl-216ddf — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited trvl-216ddf (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.

Ask your AI assistant to plan a real trip, and it actually can. trvl gives Claude, Cursor, Windsurf, Codex, or any MCP-compatible client one smart tool — the travel router — with live access to flights, hotels, rental cars, trains, buses, ferries, price alerts, award sweet spots, weather, and destination intel. Free, no API keys, no signup. One binary.
You: I have €300 and a free weekend. Surprise me.
>
Claude (with trvl): Dubrovnik, Croatia 🇭🇷 — ✈️ Ryanair HEL→DBV €167 RT · 🏨 Old Town Studios 4.6★ €84 · 🌡️ 26°C, sunny. 📊 Naive €350 → optimized €251 → saved €99 (28%) by flying Friday and splitting airlines.
▶ Try it live, no install: socialistic.ai/trvl-travel-mcp (community-hosted).
Let your AI do it — paste into Claude Code, Cursor, Windsurf, or Codex:
Read https://raw.githubusercontent.com/MikkoParkkola/trvl/main/AGENTS.md and set up trvl
It installs the binary, wires the MCP server, installs the skill, and verifies everything. Under a minute.
Or by hand:
brew install MikkoParkkola/tap/trvl # install
trvl mcp install # auto-detects your AI clientRestart your client. trvl mcp install --client <name> targets a specific one (10 supported: Claude Desktop/Code, Cursor, Windsurf, Codex, VS Code, Zed, Gemini, Amazon Q, LM Studio).
<details> <summary>More ways to install (Go, Docker, raw binary, manual config)</summary>
# Direct binary (no Homebrew)
curl -fsSL https://github.com/MikkoParkkola/trvl/releases/latest/download/trvl_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz | tar xz -C /usr/local/bin trvl
# Go
go install github.com/MikkoParkkola/trvl/cmd/trvl@latest
# Docker
docker run --rm ghcr.io/mikkoparkkola/trvl flights HEL NRT 2026-06-15
# Build from source
git clone https://github.com/MikkoParkkola/trvl.git && cd trvl && make build
# Claude Code CLI
claude mcp add trvl --transport stdio -- trvl mcp
# Manual JSON (Claude Desktop, Cursor, Windsurf, etc.)
# { "mcpServers": { "trvl": { "command": "trvl", "args": ["mcp"] } } }</details>
Paste any of these to your assistant once trvl is wired:
Find the cheapest realistic trip from Helsinki for the long weekend of July 1–5, nonstop, hotel near the center.
Compare award sweet spots HEL→LHR business on Aug 15 with 80k Amex MR + 20k Virgin points.
Create a mistake-fare watch for HEL→BCN, July 1–8, and alert me below €90.More starter prompts and what good answers look like: docs/DEMO.md.
Full head-to-head against Google Flights, KAYAK, Skyscanner, Kiwi, and other travel MCPs: docs/COMPARISON.md.
An AI agent acts on trvl's output without a human checking every result, so the bar is correctness, not just coverage.
AKAMAI_BLOCK, RATE_LIMITED, BOOKING_COOKIES_MISSING) with a fix hint, instead of a fake "nothing found." Estimated values are labelled; currency-mismatched totals are skipped, not faked.trvl status (or the local /dashboard in HTTP mode) shows per-provider success rate, latency, freshness, and circuit-breaker state.Hotel metasearch exposes list-level rates first; some are real, some only firm up after the property detail page reveals the room/tax/cancellation matrix. So trvl separates discovery (search_hotels — fast, lead-in prices) from decisions (search_accommodations — verifies room-level offers before ranking) and drill-down (search_hotels_with_details, hotel_rooms). It provides booking links for manual handoff but never books, holds, or guarantees a rate. Detail: docs/PROVIDERS.md.
trvl flights and trvl hotels accept an optional --stealth flag that routes the fetch through trvl's existing Chrome HTTP/2 fingerprint transport. It is built as a fail-safe scope fence:
--stealth.--stealth, it activates only for hosts on an operator-authorized allowlist read from the TRVL_STEALTH_ALLOWLIST environment variable (comma-separated hostnames; case-insensitive; exact match plus leading-dot suffix such as .google.com). An empty allowlist means stealth never activates — refuse by default.--stealth set for a host that is not on the allowlist, trvl runs the normal fetch path and logs one line (stealth not authorized for host <host>); it does not error, it does not abort.--stealth. Other paths never receive it.Using stealth against sites whose terms prohibit automated access is the operator's responsibility.
Example:
export TRVL_STEALTH_ALLOWLIST=".google.com"
trvl flights HEL NRT 2026-09-01 --stealth
trvl hotels "Helsinki" --checkin 2026-09-01 --checkout 2026-09-04 --stealth| Area | Highlights | Reference |
|---|---|---|
| MCP tools | 1 smart travel router — a natural-language tool that advertises a single tool (~378 tokens) instead of a full per-domain list (~33,500 tokens): ~98.9% smaller tools/list footprint. Older clients that call legacy tool names still work (66 compatibility aliases). | MCP-TOOLS-REFERENCE.md |
| Flights | Google Flights + Kiwi + Skiplagged merged; LCC fares, AFKLM award scan, round-trip (both legs) | PROVIDERS.md |
| Ground | 20 train/bus/ferry providers across Europe, API-first | PROVIDERS.md |
| Hotels | 6 sources, discovery → verification trust model | PROVIDERS.md |
| Travel hacks | 36 parallel detectors (hidden-city, positioning, stopover, multimodal, error-fare…) | PROVIDERS.md |
| CLI | Standalone tool, 56 commands, table/JSON output | CLI.md |
| Profile | Learns home airports, FF status, luggage, preferences from your booking history | traveller-workspace.md |
Yes if you already plan trips with an AI assistant and want it to search real flights, hotels, trains, buses, ferries, and transfers instead of guessing — or if you're building an app that needs travel intent without a paid travel API.
Probably not if you just want to book on a website (use Google Flights), or you want a hosted product with an account and dashboard. trvl is a tool you run, not a service you log into.
Full positioning: docs/POSITIONING.md.
Local stdio is the default and safest transport. trvl mcp --http binds to 127.0.0.1, requires a bearer token, and generates one at startup if unset. Remote exposure, scoped read/write tokens, and OAuth 2.1 introspection: docs/REMOTE-MCP-OAUTH.md.
Glama · LobeHub · Smithery · MCPHub · Cursor Directory · PulseMCP · MCP Market · pkg.go.dev
Independent coverage: Roberto Reale's Budget Travel Pipeline — an independent build-and-test that surfaced real fixes and shaped the v1.10 trust roadmap.
trvl mcp install; confirm which trvl is on $PATH.trvl flights HEL LHR 2026-07-01.--timeout 3m.Full troubleshooting: docs/CLI.md.
Part of a suite of MCP tools: mcp-gateway (universal gateway) · nab (web extraction with anti-bot) · axterminator (macOS GUI automation).
trvl is a personal-use tool that reads public-facing web APIs (Google Flights, Google Hotels, and others). It does not bypass authentication or circumvent rate limits; request patterns are throttled to look like manual browsing. Automated access may violate some providers' Terms of Service — you are responsible for compliance in your jurisdiction.
Licensed under PolyForm Noncommercial 1.0 — free for personal and noncommercial use. Commercial use (company-internal, hosted service, embedding in paid platforms) requires a separate license: EUR 500/month per named project via GitHub Sponsors, see COMMERCIAL.md.
Built on fli, utls, and SerpAPI's parameter reference.
If trvl saved you a browser tab or an API subscription, a star helps other travellers (and their assistants) find it. That's the whole ask.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.