TREK (Sahilghevariya/TREK) is an MCP server listed on the M8ven Trust Index. It scores 0 out of 100, grade F. It declares 20 tools. No publisher has claimed this listing.
TREK is a full-stack MERN travel planning platform that helps users organize trips, manage destinations, explore maps, and track travel activities. Built with MongoDB, Express.js, React.js, and Node.js, it includes authentication, real-time updates, PWA support, and responsive UI.
Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
Sahilghevariya
Source: github_code
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
update_daySet the title of a day in a trip (e.g. "Arrival in Paris", "Free day").
create_dayAdd a new day to a trip (optionally with a specific date and notes).
delete_dayDelete a day from a trip.
create_accommodationAdd an accommodation (hotel, Airbnb, etc.) to a trip, linked to a place and a date range.
create_place_accommodationCreate a new place and immediately set it as an accommodation for a date range in one atomic operation. Use place details from search_place results. Only use when the place does not yet exist — if it already exists, use create_accommodation directly.
update_accommodationUpdate fields on an existing accommodation.
delete_accommodationDelete an accommodation from a trip.
create_day_noteAdd a note to a specific day in a trip.
update_day_noteEdit an existing note on a specific day.
delete_day_noteDelete a note from a specific day.
create_reservationRecommend a reservation for a trip. Created as pending — the user must confirm it. For flights, trains, cars, and cruises, use create_transport instead. Linking: hotel → use place_id + start_day_id + end_day_id (all three required to create the accommodation link); restaurant/event/tour/activity/oth…
update_reservationUpdate an existing reservation in a trip. Use status "confirmed" to confirm a pending recommendation, or "pending" to revert it. For flights, trains, cars, and cruises, use update_transport instead. Linking: hotel → use place_id to link to an accommodation place; restaurant/event/tour/activity/other…
delete_reservationDelete a reservation from a trip.
reorder_reservationsUpdate the display order of reservations within a day.
link_hotel_accommodationSet or update the check-in/check-out day links for a hotel reservation. Creates or updates the accommodation record that ties the reservation to a place and a date range. Use the day IDs from get_trip_summary.
create_transportCreate a transport booking (flight, train, car, or cruise) for a trip. Use endpoints[] to record origin/destination and intermediate stops — for flights, set code to the IATA airport code (use search_airports first). Created as pending — confirm with update_transport.
update_transportUpdate an existing transport booking. Pass endpoints[] to replace the full list of stops (origin, destination, intermediates). Use status "confirmed" to confirm.
delete_transportDelete a transport booking from a trip.
list_tripsList all trips the current user owns or is a member of. Use this for trip discovery before calling get_trip_summary.
get_trip_summaryGet a full denormalized summary of a trip in a single call: metadata, members, days with assignments and notes, accommodations, budget line items (when enabled), packing list (when enabled), reservations, collab notes and poll/message counts (when enabled), and to-do items (when enabled). Use this a…
assign_place_to_daybehind configAssign a place to a specific day in a trip.
unassign_placebehind configRemove a place assignment from a day.
update_assignment_timebehind configSet the start and/or end time for a place assignment on a day (e.g. "09:00", "11:30"). Pass null to clear a time.
move_assignmentbehind configMove a place assignment to a different day.
get_assignment_participantsbehind configGet the list of users participating in a specific place assignment.
set_assignment_participantsbehind configSet the participants for a place assignment (replaces current list).
reorder_day_assignmentsbehind configReorder places within a day by providing the assignment IDs in the desired order.
create_bucket_list_itembehind configAdd a destination to your personal travel bucket list.
delete_bucket_list_itembehind configRemove an item from your travel bucket list.
mark_country_visitedbehind configMark a country as visited in your Atlas.
unmark_country_visitedbehind configRemove a country from your visited countries in Atlas.
get_atlas_statsbehind configGet atlas statistics — total visited countries, region counts, continent breakdown.
list_visited_regionsbehind configList all manually visited sub-country regions for the current user.
mark_region_visitedbehind configMark a sub-country region as visited.
unmark_region_visitedbehind configRemove a region from the visited list.
get_country_atlas_placesbehind configGet places saved in the user's atlas for a specific country.
update_bucket_list_itembehind configUpdate a bucket list item (notes, name, target date, location).
create_budget_itembehind configAdd a budget/expense item to a trip.
delete_budget_itembehind configDelete a budget item from a trip.
update_budget_itembehind configUpdate an existing budget/expense item in a trip.
create_budget_item_with_membersbehind configCreate a budget/expense item and optionally set the trip members splitting it in one atomic operation. If userIds is omitted or empty, behaves like create_budget_item. Only use when the place does not yet exist — if it already exists, use set_budget_item_members directly.
set_budget_item_membersbehind configSet which trip members are splitting a budget item (replaces current member list).
toggle_budget_member_paidbehind configMark or unmark a member as having paid their share of a budget item.
create_collab_notebehind configCreate a shared collaborative note on a trip (visible to all trip members in the Collab tab).
update_collab_notebehind configEdit an existing collaborative note on a trip.
delete_collab_notebehind configDelete a collaborative note from a trip.
list_collab_pollsbehind configList all polls for a trip.
create_collab_pollbehind configCreate a new poll in the collab panel.
vote_collab_pollbehind configVote on a poll option (or remove vote if already voted for that option).
close_collab_pollbehind configClose a poll so no more votes can be cast.
delete_collab_pollbehind configDelete a poll and all its votes.
list_collab_messagesbehind configList chat messages for a trip (most recent 100, oldest-first).
send_collab_messagebehind configSend a chat message to a trip's collab channel.
delete_collab_messagebehind configDelete a chat message (only the message owner can delete their own messages).
react_collab_messagebehind configToggle a reaction emoji on a chat message (adds if not present, removes if already reacted).
list_journeysbehind configList all journeys owned or contributed to by the current user.
get_journeybehind configGet a full journey including entries, contributors, and linked trips.
list_journey_entriesbehind configList all entries in a journey.
list_journey_contributorsbehind configList all contributors (owner and collaborators) of a journey.
get_journey_suggestionsbehind configGet trip suggestions for creating a new journey (recently completed trips not yet in any journey).
list_journey_available_tripsbehind configList all trips available to link to a journey.
create_journeybehind configCreate a new journey, optionally linking existing trips.
update_journeybehind configUpdate an existing journey's title, subtitle, cover, or status. Owner only.
delete_journeybehind configDelete a journey. Owner only — this cannot be undone.
add_journey_tripbehind configLink a trip to a journey. Syncs skeleton entries for all places in the trip.
remove_journey_tripbehind configUnlink a trip from a journey. Owner only.
create_journey_entrybehind configCreate a new entry in a journey.
update_journey_entrybehind configUpdate an existing journey entry.
delete_journey_entrybehind configDelete a journey entry.
reorder_journey_entriesbehind configReorder entries within a journey by providing the desired order of entry IDs.
add_journey_contributorbehind configAdd a contributor to a journey. Owner only.
update_journey_contributor_rolebehind configUpdate the role of a journey contributor. Owner only.
remove_journey_contributorbehind configRemove a contributor from a journey. Owner only.
update_journey_preferencesbehind configUpdate per-user preferences for a journey (e.g. hide skeleton entries).
get_journey_share_linkbehind configGet the current public share link for a journey. Returns null if none exists.
create_journey_share_linkbehind configCreate or update the public share link for a journey. Owner only.
delete_journey_share_linkbehind configRevoke the public share link for a journey. Owner only.
get_place_detailsbehind configFetch detailed information about a place by its Google Place ID.
reverse_geocodebehind configGet a human-readable address for given coordinates.
resolve_maps_urlbehind configResolve a Google Maps share URL to coordinates and place name.
get_weatherbehind configGet weather forecast for a location and date.
get_detailed_weatherbehind configGet hourly/detailed weather forecast for a location and date.
search_airportsbehind configSearch for airports by name, city, or IATA code. Returns matching airports with IATA code, name, city, country, coordinates, and timezone. Use before create_transport (flight) to get the correct IATA code and timezone for endpoints.
get_airportbehind configGet a single airport by its IATA code. Returns name, city, country, coordinates, and timezone.
list_notificationsbehind configList in-app notifications for the current user.
get_unread_notification_countbehind configGet the number of unread in-app notifications.
mark_notification_readbehind configMark a single notification as read.
mark_notification_unreadbehind configMark a single notification as unread.
mark_all_notifications_readbehind configMark all of the current user's notifications as read.
create_packing_itembehind configAdd an item to the packing checklist for a trip.
toggle_packing_itembehind configCheck or uncheck a packing item.
delete_packing_itembehind configRemove an item from the packing checklist.
update_packing_itembehind configRename a packing item or change its category.
reorder_packing_itemsbehind configSet the display order of packing items within a trip.
list_packing_bagsbehind configList all packing bags for a trip.
create_packing_bagbehind configCreate a new packing bag (e.g. "Carry-on", "Checked bag").
update_packing_bagbehind configRename or recolor a packing bag.
delete_packing_bagbehind configDelete a packing bag (items in the bag are unassigned, not deleted).
set_bag_membersbehind configAssign trip members to a packing bag (determines who packs what bag).
get_packing_category_assigneesbehind configGet which trip members are assigned to each packing category.
58 further tools are not listed here. The complete surface is in the source.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
multer vulnerable to Denial of Service via oversized array index in field names
Multer vulnerable to Denial of Service via deeply nested field names
multer vulnerable to Denial of Service via crafted multipart field names
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
ADMIN_EMAILADMIN_PASSWORDALLOWED_ORIGINSALLOW_INTERNAL_NETWORKAPP_URLAPP_VERSIONDEFAULT_LANGUAGEDEMO_MODEENCRYPTION_KEYFORCE_HTTPSHOSTHSTS_INCLUDE_SUBDOMAINSLOG_LEVELMCP_MAX_SESSION_PER_USERMCP_RATE_LIMITOIDC_ADMIN_CLAIMOIDC_ADMIN_VALUEOIDC_CLIENT_IDOIDC_CLIENT_SECRETOIDC_DISCOVERY_URLOIDC_DISPLAY_NAMEOIDC_ISSUEROIDC_ONLYOIDC_SCOPETRUST_PROXYMONGO_URIPORTSMTP_FROMSMTP_HOSTSMTP_PASSSMTP_PORTSMTP_SKIP_TLS_VERIFYSMTP_USERTool test coverage
120/158 tools referenced in tests (76%)
Write tests that reference each tool by name so every tool has at least one test.
No access to sensitive paths
Reads sensitive paths: /.dockerenv
Remove reads of sensitive system paths. If you genuinely need them, document why in the README.
Secrets stay with their owner
1 secret sent to a request target we could not resolve (OIDC_CLIENT_SECRET → dynamic) — often a configured endpoint, not necessarily third-party
Audit where credentials are sent. A NOTION_TOKEN should only reach api.notion.com — never a third-party host.
Secrets not written to files
2 secret values written to files
Avoid persisting secrets to disk. Keep them in memory or your secret manager.
Production dependencies are patched
0 critical, 9 high severity in production deps — multer@2.1.1 (high), multer@2.1.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/sahilghevariya/trek)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check