FliSAFE
mcp/punitarani/fli
Google Flights MCP, CLI and Python Library
Verdict
SAFE
Grade
B
Trust score
87 /100
Exposed tools
1 1r · 0w · 0d
Transport
stdio
License
MIT
Stars
3,179
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://deepwiki.com/punitarani/fli)
A powerful Python library that provides programmatic access to Google Flights data with an elegant CLI interface. Search flights, find the best deals, and filter results with ease.
🚀 What makes `fli` special? Unlike other flight search libraries that rely on web scraping, Fli directly interacts with Google Flights' API through reverse engineering. This means: Fast: Direct API access means faster, more reliable results Zero Scraping: No HTML parsing, no browser automation, just pure API interaction Reliable: Less prone to breaking from UI changes Modular: Extensible architecture for easy customization and integration
MCP Server
pipx install flights # Run the MCP server on STDIO fli-mcp # Run the MCP server over HTTP (streamable) fli-mcp-http # serves at http://127.0.0.1:8000/mcp/
Connecting to Claude Desktop
{
"mcpServers": {
"fli": {
"command": "/Users//.local/bin/fli-mcp"
}
}
}Note: Replace ` with your actual username. You can also find the path to the MCP server by running which fli-mcp` in your terminal.MCP Tools Available
The MCP server provides two main tools:
search_flights Parameters
Read from source at commit
1982dacd7b52OBSERVED · 2026-09-2202
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude-code
claude mcp add fli-js -- npx -y [email protected]
claude-desktop
{
"mcpServers": {
"fli-js": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}03
Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
search_flights | read | return { |
04
Trust audit
SAFEgrade B · trust 87/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
skills/fli/SKILL.md:92
- `fli-mcp-http` - MCP server over HTTP, defaulting to `http://127.0.0.1:8000/mcp/`
LOWInventory / provenance · inv.binary · CWE-1104
tests/search/fixtures/booking_results_aa_jfk_lax.bin
booking_results_aa_jfk_lax.bin
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
tests/search/fixtures/flight_search_buf_ath_min_layover_120.bin
flight_search_buf_ath_min_layover_120.bin
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
tests/search/fixtures/flight_search_jfk_fra_oneworld.bin
flight_search_jfk_fra_oneworld.bin
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
tests/search/fixtures/flight_search_jfk_lax_eur.bin
flight_search_jfk_lax_eur.bin
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
tests/search/fixtures/flight_search_jfk_lax_exclude_dl.bin
flight_search_jfk_lax_exclude_dl.bin
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.hidden_file · CWE-1104
.actrc
.actrc
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
fli-js/.oxlintrc.json
.oxlintrc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
fli-js/src/models/google-flights/base.ts:10
import { parseIsoDate } from "../../core/dates.ts";LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
fli-js/src/models/google-flights/dates.ts:7
import { formatIsoDate, parseIsoDate } from "../../core/dates.ts";LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
fli-js/tests/core/airports.test.ts:7
import { airportDisplayName, searchAirports } from "../../src/core/airports.ts";LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
fli-js/tests/core/builders.test.ts:13
} from "../../src/core/builders.ts";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
fli-js/tests/core/builders.test.ts:14
import { Airport } from "../../src/models/airport.ts";LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
AGENTS.md:18
- **MCP HTTP server**: `uv run fli-mcp-http` (serves at `http://127.0.0.1:8000/mcp/`)
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:27
fli-mcp-http # serves at http://127.0.0.1:8000/mcp/
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:410
fli-mcp-http # serves at http://127.0.0.1:8000/mcp/
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/guides/mcp.md:41
Once running, the MCP endpoint is served at `/mcp/`, for example: `http://127.0.0.1:8000/mcp/`.
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
fli-js/tests/search/tfs.test.ts:85
"CBwQAhpIEgoyMDMwLTA5LTE1KAEyCE9ORVdPUkxEagcIARIDSkZLagcIARIDRVdScgcIARIDTEhScgcIARIDTEdXegNEVUKIATyQAfABGkgSCjIwMzAtMDktMTkoATIIT05FV09STERqBwgBEgNMSFJqBwgBEgNMR1dyBwgBEgNKRktyBwgBEgNFV1J6A0RVQogBPJA
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
fli-js/src/core/currency.ts:95
const binary = atob(standard);
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
fli-js/src/search/proto.ts:68
const bin = atob(standard);
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
tests/search/test_proto.py:41
b_built = base64.b64decode(built + "=" * ((4 - len(built) % 4) % 4))
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
examples/typescript/package.json
fli-js
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
fli-js/package.json
zod, @biomejs/biome, @types/bun, @types/node, oxlint, typescript
Why it matters. 6 dependency range(s) float
Fix. pin exact versions or ship a lockfile
INFOInventory / provenance · inv.oversize · CWE-1104
docs/assets/mcp-demo.gif
docs/assets/mcp-demo.gif
Why it matters. 5471715 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
docs/assets/mcp-demo.mp4
docs/assets/mcp-demo.mp4
Why it matters. 4615914 bytes not read
Gates applied: no_behavioural_pass.
Audited 2026-09-22 · audit v0.4.1 · source sha
1982dacd7b52full audit observations/trust-audit/mcp-server/punitarani__fli.json · Report an issue / request a re-scan05
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-22 | 1982dacd7b52 | SAFE | B | 87 | source changed, verdict held |
| 2026-09-18 | 2d0ccbce3705 | SAFE | B | 87 | first audit |
06
Questions
What is the Fli MCP server?
Google Flights MCP, CLI and Python Library
What tools does Fli expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Fli safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (87/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Fli need?
No credential environment variables were found in its source, so it appears to need none.
How does Fli run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as fli-js at 0.0.4.
How current is this page?
The grade is for one exact copy of the source (1982dacd7b52), read on 2026-09-22. The repository is watched and re-audited when it changes.