Loading…
Book trip logistics in chat: cars, transfers, eSIM, luggage storage, tours and flight compensation.
Do not connect
The assessed surface is high-risk. Remediate the findings before connecting.
Scanned 26 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The trip-logistics-assistant MCP server exposes 6 tools, focused primarily on general-purpose capabilities. Its published description reads: "Book trip logistics in chat: cars, transfers, eSIM, luggage storage, tours and flight compensation". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates trip-logistics-assistant D — the assessed surface is high-risk and should be remediated before use. Its most notable findings include "No authorization on a public remote server" and "Over-broad tool surface". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check trip-logistics-assistant's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add trip-logistics-assistant to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://api.triplogistics.app/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Finds rental car options at an airport or city for specific dates: typical price ranges for the season (economy / compact automatic / SUV, all-inclusive) and a direct link to live offers with free can
Finds bookable attraction tickets (incl. skip-the-line) and self-guided audio tours in a city, with indicative prices, ratings and booking links. Use for requests to buy attraction tickets / museum ti
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: search_car_rentals
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: search_tours
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: search_transfers
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: search_esim
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: search_luggage_storage
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: check_flight_compensation
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
The server exposes one or more ui:// (MCP Apps) resources whose HTML/JS renders inside the host client — a client-side injection / data-exposure surface most scanners ignore. Flagged for review, not damning on its own.
3 ui:// resource(s); e.g. ui://tla/tour-list.htmlRecommendationReview each ui:// resource’s markup and scripts; treat host-rendered UI as untrusted, sandbox it, and never expose secrets or conversation context to it.
Financial data service providing fundamental information for 30,000+ listed companies across the US, Japan, and Korea, sourced directly from SEC, EDINET, and DART regulatory filings.
Search tours, attraction tickets, and holiday packages across 24 countries.
Agentic visitor analytics with five tools for CRO and session analysis.
52 paid x402 API endpoints for AI agents — crypto, data, DeFi, and market intelligence, settled on Base.
Access Vonage API documentation, code snippets, tutorials, and troubleshooting resources.
Books private transfers: airport transfer / airport taxi / private driver / chauffeur, city-to-city rides, group minibuses. Give the pickup location (airport or city) and optionally the destination; r
Finds prepaid travel eSIM data plans for a destination country or region, with real catalog prices in USD: data packages by GB and validity days, incl. unlimited-data and data+calls+texts options, del
Finds bookable luggage storage near the user's location: left luggage points in shops, cafes and hotels with a flat daily rate per bag and insurance included. Use for any request to store / drop off /
Checks if a disrupted flight qualifies for airline compensation (up to €600 per passenger under EU 261 and similar rules) and starts the claim. Use when the user's flight was delayed (3+ hours), cance