Flight SearchSAFE
MCP Server implementation for the Model Context Protocol (MCP) enabling AI tool usage - Realtime Flight Search
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A flight search service built with Model Context Protocol (MCP). This service demonstrates how to implement MCP tools for flight search capabilities.
What is Model Context Protocol?
The Model Context Protocol (MCP) is a standard developed by Anthropic that enables AI models to use tools by defining a structured format for tool descriptions, calls, and responses. This project implements MCP tools that can be used by Claude and other MCP-compatible models.
Installation
# Install from PyPI pip install mcp-flight-search # Or install from the project directory (development mode) pip install -e .
Usage
Start the MCP server:
# Using the command-line entry point mcp-flight-search --connection_type http # Or run directly python main.py --connection_type http
You can also specify a custom port:
python main.py --connection_type http --port 5000
Environment Variables
Set the SerpAPI key as an environment variable:
export SERP_API_KEY="your-api-key-here"
Features
- MCP-compliant tools for flight search functionality
- Integration with SerpAPI Google Flights
- Support for one-way and round-trip flights
- Rich logging with structured output
- Modular, maintainable code structure
MCP Tools
This package provides the following Model Context Protocol tools:
search_flights_tool: Search for flights between airports with parameters:origin: Departure airport code (e.g., ATL, JFK)destination: Arrival airport code (e.g., LAX, ORD)outbound_date: Departure date (YYYY-MM-DD)return_date: Optional return date for round trips (YYYY-MM-DD)
server_status: Check if the MCP server is running
Project Structure
mcp-flight-search/ ├── mcp_flight_search/ │ ├── __init__.
bece38164290OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-flight-search --env SERP_API_KEY=${SERP_API_KEY} -- uvx mcp-flight-search{
"mcpServers": {
"mcp-flight-search": {
"command": "uvx",
"args": [
"mcp-flight-search"
],
"env": {
"SERP_API_KEY": "${SERP_API_KEY}"
}
}
}
}Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
search_flights_tool | read | |
server_status | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
build, twine, pytest, black, isort, flake8
fastmcp, google-search-results, rich, pydantic, python-dotenv
Gates applied: no_behavioural_pass.
bece38164290full audit observations/trust-audit/mcp-server/arjunprabhulal__flight-search.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | bece38164290 | SAFE | B | 89 | first audit |
Questions
What is the Flight Search MCP server?
MCP Server implementation for the Model Context Protocol (MCP) enabling AI tool usage - Realtime Flight Search
What tools does Flight Search expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Flight Search safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Flight Search need?
It reads SERP_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (bece38164290), read on 2026-10-08. The repository is watched and re-audited when it changes.