TREK (Sahilghevariya/TREK) is an MCP server listed on the M8ven Trust Index. It scores 0 out of 100, grade F. It declares 20 tools. No publisher has claimed this listing.

F
Warning
0/100

TREK

TREK is a full-stack MERN travel planning platform that helps users organize trips, manage destinations, explore maps, and track travel activities. Built with MongoDB, Express.js, React.js, and Node.js, it includes authentication, real-time updates, PWA support, and responsive UI.

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

Sahilghevariya

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: OIDC_CLIENT_SECRET. We can’t prove the destination matches the brand the credential belongs to.
🚨
Reads files from sensitive locations
Touches: /.dockerenv
🚨
Known vulnerabilities in dependencies: 1 critical, 9 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 3 credentials: ADMIN_PASSWORD, ENCRYPTION_KEY, OIDC_CLIENT_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes158 tools · 80 behind config

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

update_day

Set the title of a day in a trip (e.g. "Arrival in Paris", "Free day").

create_day

Add a new day to a trip (optionally with a specific date and notes).

delete_day

Delete a day from a trip.

create_accommodation

Add an accommodation (hotel, Airbnb, etc.) to a trip, linked to a place and a date range.

create_place_accommodation

Create a new place and immediately set it as an accommodation for a date range in one atomic operation. Use place details from search_place results. Only use when the place does not yet exist — if it already exists, use create_accommodation directly.

update_accommodation

Update fields on an existing accommodation.

delete_accommodation

Delete an accommodation from a trip.

create_day_note

Add a note to a specific day in a trip.

update_day_note

Edit an existing note on a specific day.

delete_day_note

Delete a note from a specific day.

create_reservation

Recommend a reservation for a trip. Created as pending — the user must confirm it. For flights, trains, cars, and cruises, use create_transport instead. Linking: hotel → use place_id + start_day_id + end_day_id (all three required to create the accommodation link); restaurant/event/tour/activity/oth

update_reservation

Update an existing reservation in a trip. Use status "confirmed" to confirm a pending recommendation, or "pending" to revert it. For flights, trains, cars, and cruises, use update_transport instead. Linking: hotel → use place_id to link to an accommodation place; restaurant/event/tour/activity/other

delete_reservation

Delete a reservation from a trip.

reorder_reservations

Update the display order of reservations within a day.

link_hotel_accommodation

Set or update the check-in/check-out day links for a hotel reservation. Creates or updates the accommodation record that ties the reservation to a place and a date range. Use the day IDs from get_trip_summary.

create_transport

Create a transport booking (flight, train, car, or cruise) for a trip. Use endpoints[] to record origin/destination and intermediate stops — for flights, set code to the IATA airport code (use search_airports first). Created as pending — confirm with update_transport.

update_transport

Update an existing transport booking. Pass endpoints[] to replace the full list of stops (origin, destination, intermediates). Use status "confirmed" to confirm.

delete_transport

Delete a transport booking from a trip.

list_trips

List all trips the current user owns or is a member of. Use this for trip discovery before calling get_trip_summary.

get_trip_summary

Get a full denormalized summary of a trip in a single call: metadata, members, days with assignments and notes, accommodations, budget line items (when enabled), packing list (when enabled), reservations, collab notes and poll/message counts (when enabled), and to-do items (when enabled). Use this a

assign_place_to_daybehind config

Assign a place to a specific day in a trip.

unassign_placebehind config

Remove a place assignment from a day.

update_assignment_timebehind config

Set the start and/or end time for a place assignment on a day (e.g. "09:00", "11:30"). Pass null to clear a time.

move_assignmentbehind config

Move a place assignment to a different day.

get_assignment_participantsbehind config

Get the list of users participating in a specific place assignment.

set_assignment_participantsbehind config

Set the participants for a place assignment (replaces current list).

reorder_day_assignmentsbehind config

Reorder places within a day by providing the assignment IDs in the desired order.

create_bucket_list_itembehind config

Add a destination to your personal travel bucket list.

delete_bucket_list_itembehind config

Remove an item from your travel bucket list.

mark_country_visitedbehind config

Mark a country as visited in your Atlas.

unmark_country_visitedbehind config

Remove a country from your visited countries in Atlas.

get_atlas_statsbehind config

Get atlas statistics — total visited countries, region counts, continent breakdown.

list_visited_regionsbehind config

List all manually visited sub-country regions for the current user.

mark_region_visitedbehind config

Mark a sub-country region as visited.

unmark_region_visitedbehind config

Remove a region from the visited list.

get_country_atlas_placesbehind config

Get places saved in the user's atlas for a specific country.

update_bucket_list_itembehind config

Update a bucket list item (notes, name, target date, location).

create_budget_itembehind config

Add a budget/expense item to a trip.

delete_budget_itembehind config

Delete a budget item from a trip.

update_budget_itembehind config

Update an existing budget/expense item in a trip.

create_budget_item_with_membersbehind config

Create a budget/expense item and optionally set the trip members splitting it in one atomic operation. If userIds is omitted or empty, behaves like create_budget_item. Only use when the place does not yet exist — if it already exists, use set_budget_item_members directly.

set_budget_item_membersbehind config

Set which trip members are splitting a budget item (replaces current member list).

toggle_budget_member_paidbehind config

Mark or unmark a member as having paid their share of a budget item.

create_collab_notebehind config

Create a shared collaborative note on a trip (visible to all trip members in the Collab tab).

update_collab_notebehind config

Edit an existing collaborative note on a trip.

delete_collab_notebehind config

Delete a collaborative note from a trip.

list_collab_pollsbehind config

List all polls for a trip.

create_collab_pollbehind config

Create a new poll in the collab panel.

vote_collab_pollbehind config

Vote on a poll option (or remove vote if already voted for that option).

close_collab_pollbehind config

Close a poll so no more votes can be cast.

delete_collab_pollbehind config

Delete a poll and all its votes.

list_collab_messagesbehind config

List chat messages for a trip (most recent 100, oldest-first).

send_collab_messagebehind config

Send a chat message to a trip's collab channel.

delete_collab_messagebehind config

Delete a chat message (only the message owner can delete their own messages).

react_collab_messagebehind config

Toggle a reaction emoji on a chat message (adds if not present, removes if already reacted).

list_journeysbehind config

List all journeys owned or contributed to by the current user.

get_journeybehind config

Get a full journey including entries, contributors, and linked trips.

list_journey_entriesbehind config

List all entries in a journey.

list_journey_contributorsbehind config

List all contributors (owner and collaborators) of a journey.

get_journey_suggestionsbehind config

Get trip suggestions for creating a new journey (recently completed trips not yet in any journey).

list_journey_available_tripsbehind config

List all trips available to link to a journey.

create_journeybehind config

Create a new journey, optionally linking existing trips.

update_journeybehind config

Update an existing journey's title, subtitle, cover, or status. Owner only.

delete_journeybehind config

Delete a journey. Owner only — this cannot be undone.

add_journey_tripbehind config

Link a trip to a journey. Syncs skeleton entries for all places in the trip.

remove_journey_tripbehind config

Unlink a trip from a journey. Owner only.

create_journey_entrybehind config

Create a new entry in a journey.

update_journey_entrybehind config

Update an existing journey entry.

delete_journey_entrybehind config

Delete a journey entry.

reorder_journey_entriesbehind config

Reorder entries within a journey by providing the desired order of entry IDs.

add_journey_contributorbehind config

Add a contributor to a journey. Owner only.

update_journey_contributor_rolebehind config

Update the role of a journey contributor. Owner only.

remove_journey_contributorbehind config

Remove a contributor from a journey. Owner only.

update_journey_preferencesbehind config

Update per-user preferences for a journey (e.g. hide skeleton entries).

get_journey_share_linkbehind config

Get the current public share link for a journey. Returns null if none exists.

create_journey_share_linkbehind config

Create or update the public share link for a journey. Owner only.

delete_journey_share_linkbehind config

Revoke the public share link for a journey. Owner only.

get_place_detailsbehind config

Fetch detailed information about a place by its Google Place ID.

reverse_geocodebehind config

Get a human-readable address for given coordinates.

resolve_maps_urlbehind config

Resolve a Google Maps share URL to coordinates and place name.

get_weatherbehind config

Get weather forecast for a location and date.

get_detailed_weatherbehind config

Get hourly/detailed weather forecast for a location and date.

search_airportsbehind config

Search for airports by name, city, or IATA code. Returns matching airports with IATA code, name, city, country, coordinates, and timezone. Use before create_transport (flight) to get the correct IATA code and timezone for endpoints.

get_airportbehind config

Get a single airport by its IATA code. Returns name, city, country, coordinates, and timezone.

list_notificationsbehind config

List in-app notifications for the current user.

get_unread_notification_countbehind config

Get the number of unread in-app notifications.

mark_notification_readbehind config

Mark a single notification as read.

mark_notification_unreadbehind config

Mark a single notification as unread.

mark_all_notifications_readbehind config

Mark all of the current user's notifications as read.

create_packing_itembehind config

Add an item to the packing checklist for a trip.

toggle_packing_itembehind config

Check or uncheck a packing item.

delete_packing_itembehind config

Remove an item from the packing checklist.

update_packing_itembehind config

Rename a packing item or change its category.

reorder_packing_itemsbehind config

Set the display order of packing items within a trip.

list_packing_bagsbehind config

List all packing bags for a trip.

create_packing_bagbehind config

Create a new packing bag (e.g. "Carry-on", "Checked bag").

update_packing_bagbehind config

Rename or recolor a packing bag.

delete_packing_bagbehind config

Delete a packing bag (items in the bag are unassigned, not deleted).

set_bag_membersbehind config

Assign trip members to a packing bag (determines who packs what bag).

get_packing_category_assigneesbehind config

Get which trip members are assigned to each packing category.

58 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies1 critical9 high18 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@3.2.4GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

highmulter@2.1.1GHSA-535w-7cp7-47q4

multer vulnerable to Denial of Service via oversized array index in field names

highmulter@2.1.1GHSA-72gw-mp4g-v24j

Multer vulnerable to Denial of Service via deeply nested field names

highmulter@2.1.1GHSA-wc9g-mqfw-jrwm

multer vulnerable to Denial of Service via crafted multipart field names

highnodemailer@8.0.5GHSA-2x7j-588g-ccc2

Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configADMIN_EMAIL
🔐 secretADMIN_PASSWORD
configALLOWED_ORIGINS
configALLOW_INTERNAL_NETWORK
configAPP_URL
configAPP_VERSION
configDEFAULT_LANGUAGE
configDEMO_MODE
🔐 secretENCRYPTION_KEY
configFORCE_HTTPS
configHOST
configHSTS_INCLUDE_SUBDOMAINS
configLOG_LEVEL
configMCP_MAX_SESSION_PER_USER
configMCP_RATE_LIMIT
configOIDC_ADMIN_CLAIM
configOIDC_ADMIN_VALUE
configOIDC_CLIENT_ID
🔐 secretOIDC_CLIENT_SECRET
configOIDC_DISCOVERY_URL
configOIDC_DISPLAY_NAME
configOIDC_ISSUER
configOIDC_ONLY
configOIDC_SCOPE
configTRUST_PROXY
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployMONGO_URI
deployPORT
deploySMTP_FROM
deploySMTP_HOST
deploySMTP_PASS
deploySMTP_PORT
deploySMTP_SKIP_TLS_VERIFY
deploySMTP_USER
// quality suggestions

Tool test coverage

120/158 tools referenced in tests (76%)

Write tests that reference each tool by name so every tool has at least one test.

No access to sensitive paths

Reads sensitive paths: /.dockerenv

Remove reads of sensitive system paths. If you genuinely need them, document why in the README.

Secrets stay with their owner

1 secret sent to a request target we could not resolve (OIDC_CLIENT_SECRET → dynamic) — often a configured endpoint, not necessarily third-party

Audit where credentials are sent. A NOTION_TOKEN should only reach api.notion.com — never a third-party host.

Secrets not written to files

2 secret values written to files

Avoid persisting secrets to disk. Keep them in memory or your secret manager.

Production dependencies are patched

0 critical, 9 high severity in production deps — multer@2.1.1 (high), multer@2.1.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/sahilghevariya/trek?variant=verified)](https://m8ven.ai/mcp/sahilghevariya/trek)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 3da5e238be41c7b64a120a0a227d106afe7a14a9
code hash: 05d88c8e90e9006a07d9837228e3bb014a264527795b15e3f11d5375a31960de
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client