Travel Server MCP

The materials claim there are no keys/environment variables, yet the feature explicitly depends on the Duffel API, which would normally require API credentials; this inconsistency suggests incomplete documentation. No explicit credential harvesting or abuse is described, but if it truly integrates with a third-party flight API, verify how secrets are sourced, stored, and whether debug logs expose sensitive headers or request contents.

The system fields say there is no remote endpoint, but the description says it uses the Duffel API for flight search, which strongly implies outbound network requests to an external service. The egress appears related to the stated flight-search function, with no explicit red flag toward unrelated or suspicious endpoints, but the missing endpoint list and unclear data scope warrant caution.

The tool is flagged as executes-code, meaning it runs code or a process locally; this is a normal MCP/tool capability and by itself does not justify a high-risk rating. The materials do not indicate additional privileged system capabilities, nor obvious command injection, download-and-execute, or persistence behavior.

The materials only state that it returns flight offers and detailed debug logs, without declaring any need to read/write specific local files or access broad local resources. The main concern is that debug logs may contain user query parameters, response content, or potentially sensitive context; there is no clear sign of overbroad access, but data access boundaries are poorly documented.

The project has a public GitHub repository and is open source, which is a meaningful risk-reducing factor. However, it comes from a third-party registry, has no declared license, no README, only 1 star, and unknown maintenance status, indicating weak community validation and maintenance signals. There is no clear sign of closed-source exfiltration or overtly malicious behavior, so high risk is not warranted, but supply-chain confidence is limited.