Is io.github.thehesiod/aa safe to use?

io.github.thehesiod/aa has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install io.github.thehesiod/aa?

io.github.thehesiod/aa supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can io.github.thehesiod/aa do?

io.github.thehesiod/aa provides 4 tools: Tools, Setup, Running, Limitations. See the full tools list on the server page for descriptions and parameters.

What AI clients work with io.github.thehesiod/aa?

io.github.thehesiod/aa is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse transport.

Is io.github.thehesiod/aa actively maintained?

io.github.thehesiod/aa is recently maintained — last commit was 48 days ago.

io.github.thehesiod/aa

aa-mcp-server

MCP server for read-only American Airlines AAdvantage account access

4 tools GitHub PyPI

No known CVEs

No license

Maintained

Last commit 48d ago

Works with most clients

Transport: stdio, sse

4 tools · ~94 tok

Grade A · 0.0% of 200K ctx

Edit this pageView history

Other

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "aa": {
      "command": "aa-mcp-server"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-thehesiod-aa)](https://mcppedia.org/s/io-github-thehesiod-aa)

Read me

What io.github.thehesiod/aa does

An MCP server that gives Claude (or any MCP-compatible LLM) read-only access to your American Airlines AAdvantage account — mile balance, Loyalty Points progress, transaction history, upcoming trips, travel credits, and partner offers.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'aa-mcp-server' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

82/100across 5 weighted dimensions

How we score →

0255075100

−18

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked aa-mcp-server against OSV.dev.

Inventory

Tools (4)

Click any tool to inspect its schema.

~94 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.thehesiod/aa safe to use?: io.github.thehesiod/aa has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.thehesiod/aa?: io.github.thehesiod/aa supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.thehesiod/aa do?: io.github.thehesiod/aa provides 4 tools: Tools, Setup, Running, Limitations. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.thehesiod/aa?: io.github.thehesiod/aa is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse transport.
Is io.github.thehesiod/aa actively maintained?: io.github.thehesiod/aa is recently maintained — last commit was 48 days ago.

Similar servers

Others in other

View all →

Pi Lean Ctx95

Pi Coding Agent extension (CLI-first) — routes bash/read/grep/find/ls through lean-ctx CLI for strong token savings. Optional MCP bridge can register advanced tools.

3.0k 6

io.github.asklokesh/loki-mode95

Autonomous spec-to-product coding-agent CLI with an MCP server exposing 34 tools over stdio.

992 8

Headroom95

Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.

52.8k 3

Sigmap94

97% token reduction for AI coding sessions — zero deps, 21 languages, MCP server

531 6

MCP Security Weekly

Get CVE alerts and security updates for io.github.thehesiod/aa and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Other

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "aa": {
      "command": "aa-mcp-server"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-thehesiod-aa)](https://mcppedia.org/s/io-github-thehesiod-aa)

Read me

What io.github.thehesiod/aa does

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'aa-mcp-server' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

aa-mcp-server

An MCP server that gives Claude (or any MCP-compatible LLM) read-only access to your American Airlines AAdvantage account — mile balance, Loyalty Points progress, transaction history, upcoming trips, travel credits, and partner offers.

This is not a browser-automation wrapper. The server discovers and calls aa.com's underlying JSON APIs directly using session cookies extracted from a Chromium login. All HTTP traffic uses curl_cffi with Chrome TLS impersonation to satisfy aa.com's Akamai Bot Manager.

Tools

Tool	Endpoint	Returns
`get_account_summary`	`/loyalty/api/member-information`	Name, AAdvantage #, mile balance, status, cobranded card, business memberships
`get_loyalty_points_progress`	`/loyalty/api/progress-qualification`	LP YTD, last-year totals, tier thresholds, next-status delta
`get_profile_details`	`/api/loyalty/.../profile`	DOB, partners list, sales city, mile expiration, million-miler stats
`get_mile_activity`	`/api/loyalty/.../memberActivity`	Mile/LP transaction history (date range, paginated, searchable)
`get_upcoming_trips`	`/loyalty/api/upcoming-trips`	Reservations with record locators
`get_reservation_by_locator`	`/manage-reservation/viewres/api/reservation`	Full reservation: segments, passengers, tickets, costs, change/cancel eligibility (requires lead-passenger name)
`search_change_flights`	`/manage-reservation/reshop/api/reshop/cheapest`	Alternative flights for a reservation with a ±6-day price carousel, per-cabin pricing (`netPrice` = delta vs paid). Accepts origin/destination/date changes; pricing is total for all pax (no per-passenger split)
`get_flight_credits`	`/api/loyalty/travelCredits/flightCredit/details`	Single-passenger ticket credits
`get_trip_credits`	`/api/loyalty/travelCredits/tripCredit/details`	Multi-passenger / itinerary credits
`get_partner_offers`	`/loyalty/api/partnerOffers`	Dashboard partner promotions
`get_notifications`	`/loyalty/api/notifications`	Account notifications
`check_auth_status`	—	Saved-session info: AA #, token expiry, cookie count
`save_session_from_browser`	CDP	Pulls cookies from a logged-in Chromium and persists them

Setup

pip install aa-mcp-server

One-time auth

aa.com is fronted by Akamai Bot Manager — you can't log in via headless requests. The flow:

Launch a real Chromium with a persistent profile and a remote-debugging port:

aa-auth-browser              # default account
aa-auth-browser personal     # named account

Log into aa.com (and complete 2FA if prompted) in the window that opens.
Copy the cookies into the MCP store:
```
aa-mcp-server --extract-session default
```
Or call the save_session_from_browser MCP tool from Claude.

The cookies live in ~/.aa-mcp/accounts/<account>/session.json. The chromium profile lives in ~/.aa-mcp/chrome-profiles/<account>/. To refresh after expiry, relaunch aa-auth-browser (the saved profile auto-refreshes the access_token cookie when you visit any aa.com page) and re-run --extract-session.

AA_MCP_CHROMIUM=<path-to-chrome.exe> overrides the auto-discovery if your Chromium is somewhere unusual.

Multi-account

Every tool takes an optional account parameter. Omit it to use the default account.

get_account_summary()                # default
get_account_summary(account="spouse")

Running

aa-mcp-server                        # stdio transport
aa-mcp-server --setup                # show account status & setup hints
aa-mcp-server --extract-session NAME # save cookies from running Chromium

Add to your MCP client config (e.g. Claude Desktop):

{
  "mcpServers": {
    "aa": {
      "command": "aa-mcp-server"
    }
  }
}

Limitations

Read-only. No booking, no award redemption, no profile edits.
**Co

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

82/100across 5 weighted dimensions

How we score →

0255075100

−18

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked aa-mcp-server against OSV.dev.

Inventory

Tools (4)

Click any tool to inspect its schema.

~94 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.thehesiod/aa safe to use?: io.github.thehesiod/aa has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.thehesiod/aa?: io.github.thehesiod/aa supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.thehesiod/aa do?: io.github.thehesiod/aa provides 4 tools: Tools, Setup, Running, Limitations. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.thehesiod/aa?: io.github.thehesiod/aa is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse transport.
Is io.github.thehesiod/aa actively maintained?: io.github.thehesiod/aa is recently maintained — last commit was 48 days ago.

Similar servers

Others in other

View all →

Pi Lean Ctx95

Pi Coding Agent extension (CLI-first) — routes bash/read/grep/find/ls through lean-ctx CLI for strong token savings. Optional MCP bridge can register advanced tools.

3.0k 6

io.github.asklokesh/loki-mode95

Autonomous spec-to-product coding-agent CLI with an MCP server exposing 34 tools over stdio.

992 8

Headroom95

Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.

52.8k 3

Sigmap94

97% token reduction for AI coding sessions — zero deps, 21 languages, MCP server

531 6

MCP Security Weekly

Get CVE alerts and security updates for io.github.thehesiod/aa and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?