Chase TravelBLOCK

AI-powered travel hacking and search with cash, points, miles, and award flights. Drop-in skills and MCP servers for Claude, Codex, and OpenCode.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: chase-travel
description: Search Chase UR travel portal via Patchright for cash prices, points pricing, Points Boost offers, and Chase Edit hotel benefits. Use for pay-with-points portal comparison on Sapphire Reserve/Preferred.
category: portals
summary: Chase UR portal for flights, hotels, Points Boost, Edit benefits. Requires Sapphire.
api_key: None (requires Patchright)
docker_image: ghcr.io/borski/chase-travel
---

# Chase Travel Portal Search

Search the Chase Ultimate Rewards travel portal for flights and hotels via Patchright. Returns cash prices, UR points pricing, Points Boost offers, and Chase Edit hotel benefits.

**Requires Patchright** (undetected Playwright fork). Chase blocks standard Playwright and agent-browser.

**Must run headed (headless=False).** Chase detects headless browsers. On macOS, a Chrome window briefly appears. For background operation, use Docker.

## Prerequisites

```bash
pip install patchright && patchright install chromium
```

Or use Docker (no local install needed):
```bash
docker pull ghcr.io/borski/chase-travel:latest
# or build locally:
docker build -t chase-travel skills/chase-travel/
```

## When to Use

- Compare UR portal pricing against cash and award prices
- Check Points Boost offers (1.5x to 2.0x cpp on select bookings)
- Find Chase Edit hotels with $100 property credit + daily breakfast
- Compare pay-with-points vs transfer-to-airline value

## When NOT to Use

- **Completing purchases.** Find flights and hotels only. Do not book.
- **Non-Chase cards.** This skill requires a Sapphire Reserve or Sapphire Preferred card.

## Card Selection

The script automatically selects the **Sapphire Reserve** card from the account selector (dynamic Points Boost pricing on travel; ~1.5-2.0 cpp typical on CSR but not a guaranteed floor; Edit hotels). Falls back to **Sapphire Preferred** if no Reserve found. Only these cards show Edit hotel benefits and travel portal pricing.

## Usage

### Flight Search

```bash
# Local (opens a Chrome window briefly)
python3 scripts/search_flights.py --origin SFO --dest CDG --depart 2026-08-11

# Round-trip business
python3 scripts/search_flights.py --origin SFO --dest CDG --depart 2026-08-11 --return 2026-09-02 --cabin business

# JSON output
python3 scripts/search_flights.py --origin SFO --dest CDG --depart 2026-08-11 --json

# Docker
docker run --rm \
    -v ~/.chase-travel-profiles:/profiles \
    -v /tmp:/tmp/host \
    -e CHASE_USERNAME -e CHASE_PASSWORD \
    ghcr.io/borski/chase-travel script /scripts/search_flights.py \
    --origin SFO --dest CDG --depart 2026-08-11 --cabin business --json
```

### Hotel Search

```bash
# Local
python3 scripts/search_flights.py --hotel --dest "Paris" --checkin 2026-08-11 --checkout 2026-08-15

# Docker
docker run --rm \
    -v ~/.chase-travel-profiles:/profiles \
    -v /tmp:/tmp/host \
    -e CHASE_USERNAME -e CHASE_PASSWORD \
    ghcr.io/borski/chase-travel script /scripts/search_flights.py \
    --hotel --dest "Oslo" --checkin 2026-08-13 --checkout 2026-08-15 --json
```

### Record Mode (API Discovery)

Capture network traffic during a manual search. Useful for debugging or discovering new API endpoints.

```bash
# Local only (needs interactive browser)
python3 scripts/record_search.py
```

## 2FA Flow

Chase uses SMS **or** mobile-app push for 2FA (some accounts offer only push). On first login, you must complete 2FA manually. After that, device trust persists (2FA skipped on subsequent runs from the same profile). The script auto-detects which method the account offers and takes the matching path.

**How it works:** When 2FA is triggered, the script prints one of two sentinels to stdout, then polls for up to 3 minutes:
- `2FA_CODE_NEEDED` — SMS. Chase texted a code; provide it (below).
- `MOBILE_APP_APPROVAL_NEEDED` — mobile-app push. There is **no code**; the user approves the sign-in in their Chase mobile app, and the script continues once the page clears.

**For agents (SMS):** When you see `2FA_CODE_NEEDED`, **ask the user** for the SMS code Chase just sent to their phone. Once they provide it, write it to the code file:

```bash
echo "12345678" > /tmp/chase-2fa-code.txt
```

The script picks up the file automatically and continues login.

**For agents (mobile push):** When you see `MOBILE_APP_APPROVAL_NEEDED`, **tell the user to approve the sign-in in their Chase mobile app** — there is no code to enter. The script polls for up to 3 minutes for the approval to land, then continues.

**Command hook (optional, for full automation):** Set `CHASE_2FA_COMMAND` to a command that blocks until it has the code, then prints it to stdout. The script runs this instead of polling the file. (Applies to the SMS path only.)

**Docker:** Use `-v /tmp:/tmp/host` to share the temp directory. The script checks both `/tmp/host/chase-2fa-code.txt` and `/tmp/chase-2fa-code.txt`.

After first successful login with device trust, 2FA is skipped on repeat runs.

## Credentials Must Be Resolved Values

`CHASE_USERNAME`/`CHASE_PASSWORD` must contain the **actual** username and password when they reach this script. If you keep secrets in a secret manager, resolve the references into the environment before launching (most managers ship an exec/run wrapper for exactly this).

An unresolved reference (a literal `scheme://vault/item` placeholder) gets typed into the login form, and Chase answers "We can't find that username and password. Try again." — which is easy to misread as bot detection. (It isn't: fresh automated logins from Docker work fine with real credentials, verified live July 2026, including when saved cookies have expired.)

The script fails fast on both forms of this mistake: it prints **`CHASE_BAD_CREDENTIALS`** to stdout (and writes `BAD_CREDENTIALS` to the 2FA status file) when a credential still looks like a secret reference, or when Chase reports the username/password as not found. **For agents:** don't retry on this sentinel — fix how credentials are injected, then re

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (3 observation(s))

Network

declared (1 observation(s))

Shell

declared (1 observation(s))

Dependencies

pinned

Secrets in source

none-found

Findings (8)

1. **Search API:** `POST` to Chase's hotel search endpoint creates session

.agents/skills

.claude/skills

.opencode/skills

skills

AGENTS.md

decoded = base64.b64decode(payload_b64).decode("utf-8")

decoded = base64.b64decode(value).decode("utf-8")

Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.