Atlas / MCP servers / gongrzhe / Travel Planner

Travel PlannerBLOCK

Name: Travel Planner
Author: gongrzhe

mcp/gongrzhe/travel-planner

MCP server by gongrzhe · Audited 2026-10-07

⚑ Report / re-scan Source ↗

Verdict

BLOCK

Grade

Trust score

31 /100

Exposed tools

5 4r · 1w · 0d

Transport

sse · stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://smithery.ai/server/@GongRzhe/TRAVEL-PLANNER-MCP-Server)

A Travel Planner Model Context Protocol (MCP) server implementation for interacting with Google Maps and travel planning services. This server enables LLMs to perform travel-related tasks such as location search, place details lookup, and travel time calculations.

Installation & Usage

Installing via Smithery

To install Travel Planner for Claude Desktop automatically via Smithery:

npx -y @smithery/cli install @GongRzhe/TRAVEL-PLANNER-MCP-Server --client claude

Installing Manually

# Using npx (recommended)
npx @gongrzhe/server-travelplanner-mcp

# With environment variable for Google Maps API
GOOGLE_MAPS_API_KEY=your_api_key npx @gongrzhe/server-travelplanner-mcp

Or install globally:

# Install globally
npm install -g @gongrzhe/server-travelplanner-mcp

# Run after global installation
GOOGLE_MAPS_API_KEY=your_api_key @gongrzhe/server-travelplanner-mcp

Components

Tools

searchPlaces
Search for places using Google Places API
Input:
query (string): Search query for places
location (optional): Latitude and longitude to bias results
radius (optional): Search radius in meters

getPlaceDetails
Get detailed information about a specific place
Input:
placeId (string): Google Place ID to retrieve details for

calculateRoute
Calculate route between two locations
Input:
origin (string): Starting location
destination (string): Ending location
mode (optional): Travel mode (

Read from source at commit 23ca956963e5OBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add server-travelplanner-mcp -- npx -y @gongrzhe/[email protected]

claude-desktop

{
  "mcpServers": {
    "server-travelplanner-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@gongrzhe/[email protected]"
      ]
    }
  }
}

Exposed tools (5)

4 read · 1 write · 0 destructive.

Tool	Risk	Description
`create_itinerary`	write	Creates a personalized travel itinerary based on user preferences
`get_accommodations`	read	Searches for accommodation options in a specified location
`get_transport_options`	read	Retrieves available transportation options between two points
`optimize_itinerary`	read	Optimizes an existing itinerary based on specified criteria
`search_attractions`	read	Searches for attractions and points of interest in a specified location

Trust audit

BLOCKgrade F · trust 31/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (8 observation(s))
Shell: declared (10 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

node_modules/@types/node/sqlite.d.ts:81

exec(sql: string): void;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

node_modules/depd/index.js:425

var deprecatedfn = new Function('fn', 'log', 'deprecate', 'message', 'site',

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

node_modules/depd/index.js:427

'return function (' + args + ') {' +

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

node_modules/function-bind/implementation.js:74

bound = Function('binder', 'return function (' + joiny(boundArgs, ',') + '){ return binder.apply(this,arguments); }')(binder);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

node_modules/shelljs/src/common.js:334

if (options.unix === false) { // this branch is for exec()

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHSupply chain · supply.typosquat · CWE-829, CWE-1357

node_modules/form-data/package.json

request ~ requests

Why it matters. dependency name one edit from a popular package

Fix. verify the package; likely typosquat

HIGHSupply chain · supply.typosquat · CWE-829, CWE-1357

node_modules/iconv-lite/package.json

request ~ requests

Why it matters. dependency name one edit from a popular package

Fix. verify the package; likely typosquat

MEDIUMInventory / provenance · inv.symlink · CWE-1104

node_modules/.bin/resolve

node_modules/.bin/resolve

Why it matters. link not followed

MEDIUMInventory / provenance · inv.symlink · CWE-1104

node_modules/.bin/shjs

node_modules/.bin/shjs

Why it matters. link not followed

MEDIUMInventory / provenance · inv.symlink · CWE-1104

node_modules/.bin/shx

node_modules/.bin/shx

Why it matters. link not followed

MEDIUMInventory / provenance · inv.symlink · CWE-1104

node_modules/.bin/tsc

node_modules/.bin/tsc

Why it matters. link not followed

MEDIUMInventory / provenance · inv.symlink · CWE-1104

node_modules/.bin/tsserver

node_modules/.bin/tsserver

Why it matters. link not followed

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

node_modules/@types/node/url.d.ts:560

* console.log(myURL.password);

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

node_modules/proxy-from-env/test.js:313

testProxyUrl(env, '', 'http://10.0.0.1/');

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

node_modules/proxy-from-env/test.js:314

testProxyUrl(env, '', 'http://10.0.0.1:80/');

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

node_modules/proxy-from-env/test.js:315

testProxyUrl(env, '', 'http://10.0.0.1:1337/');

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

node_modules/proxy-from-env/test.js:317

testProxyUrl(env, '', 'http://10.0.0.2/');

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

node_modules/iconv-lite/encodings/sbcs-data-generated.js:100

"chars": "€پ‚ƒ„...†‡ˆ‰ٹ‹Œچژڈگ‘’“”•–—کTMڑ›œں ،¢£¤¥¦§ ̈©ھ«¬® ̄°±23 ́μ¶· ̧1؛»1⁄41⁄23⁄4؟ہءآأؤإئابةتثجحخدذرزسشصض×طظعغـفقكàلâمنهوçèéêëىيîïًٌٍَôُِ÷ّùْûüے"

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

node_modules/iconv-lite/encodings/sbcs-data-generated.js:373

"chars": "«»...“”�•‘’� กขฃคฅฆงจฉชซฌญฎฏฐฑฒณดตถทธนบปผฝพฟภมยรฤลฦวศษสหฬอฮฯะัาําิีึืฺุู–—฿เแโใไๅๆ็่้๊๋์ํTM๏๐๑๒๓๔๕๖๗๘๙®©����"