io.github.chrischall/alltrails-mcp
NPM · ALLTRAILS-MCP · SCANNED SEP 20
Unofficial AllTrails MCP for Claude — search trails, get details, reviews, photos, saved lists
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 0 of 8 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to chrischall/alltrails-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability73
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2004 tokens (~154/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 13 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the io.github.chrischall/alltrails-mcp server?
io.github.chrischall/alltrails-mcp runs locally as an npm package, launched with npx -y alltrails-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · alltrails-mcp
claude mcp add chrischall-alltrails-mcp -- npx -y alltrails-mcp
{
"mcpServers": {
"chrischall-alltrails-mcp": {
"command": "npx",
"args": [
"-y",
"alltrails-mcp"
]
}
}
} {
"servers": {
"chrischall-alltrails-mcp": {
"command": "npx",
"args": [
"-y",
"alltrails-mcp"
]
}
}
} codex mcp add chrischall-alltrails-mcp -- npx -y alltrails-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"chrischall-alltrails-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"alltrails-mcp"
],
"enabled": true
}
}
} openclaw mcp add chrischall-alltrails-mcp --command npx --arg -y --arg alltrails-mcp
mcp_servers:
chrischall-alltrails-mcp:
command: "npx"
args: ["-y", "alltrails-mcp"] {
"McpServers": {
"chrischall-alltrails-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"alltrails-mcp"
]
}
}
} assistant mcp add chrischall-alltrails-mcp -t stdio -c npx -a -y alltrails-mcp
{
"mcpServers": {
"chrischall-alltrails-mcp": {
"command": "npx",
"args": [
"-y",
"alltrails-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 0
- MCP protocol: Implements a current MCP spec version (2026-07-28). functional
- Package version: 3.0.0 → 3.1.0 functional
- 19 Sept 26 −3
- Stability: pass → 0.80 functional
- 18 Sept 26 +1
- Stability: 0.97 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Stability: 0.97 → pass security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: 0.86 → 1.00 ▲ functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Package version: 2.3.5 → 3.0.0 functional
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 15 Sept 26 +1
- Malware scan: unverified → pass ▲ security
- Package version: 2.3.4 → 2.3.5 functional
- 14 Sept 26 −15
- Malware scan: pass → unverified ▼ security
- Stability: 0.83 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Package version: 2.3.3 → 2.3.4 functional
- 13 Sept 26 +13
- Malware scan: unverified → pass ▲ security
- Stability: pass → 0.83 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/alltrails-mcp@3.1.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | chrischall/alltrails-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/chrischall/alltrails-mcp/.github/workflows/release-please.yml@refs/heads/main |
| Rekor log index | 2893921745 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:9c212441efca32dcc085b7344d29a0b5c3f682584b27e97160caeb8a4284315edf71d9f043d4fa51337f6037e553b06c279b5d4ec3499e3682b1e98b5 |
Background: How many MCP packages publish verified provenance →
Dependencies 8 packages
| Packages resolved | 8 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
alltrails_get_activity_feed ~275
Get an AllTrails user's activity feed (recorded hikes and posts). Defaults to the signed-in user; pass a userId to target a specific public profile. Without a feed argument this returns the feed DIRECTORY (the available feeds: local, timeline (following), personal (own posts)) — pass feed to get the actual items. Returns slim projections by default; pass view:"full" for the whole records.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Opaque nextCursor from a previous page, for pagination |
| feed | string | – | Which feed to read: local (nearby activity), timeline (people you follow), personal (own posts). Omit to list the available feeds. |
| maxItems | integer | – | Max items per page (server-side) |
| userId | string | – | Numeric AllTrails user id. Defaults to the signed-in user. |
| view | string | – | Response shape: "compact" (default) drops fields the response already carries elsewhere; "full" returns every field this server understands. compact returns { count, hasNextPage, nextCursor, items: [… |
No output schema declared.
No examples provided.
alltrails_get_list_items ~207
Get the trails saved in an AllTrails list by its numeric list id (from alltrails_list_user_lists, or a public "list" record from alltrails_search). Items are sparse references: each carries a trailId (hydrate with alltrails_get_trail), the curator's order, and any notes — not trail details. Returns slim { trailId, type, order, notes, addedAt } entries sorted by order by default; pass view:"full" for the whole records.
| Name | Type | Req | Description |
|---|---|---|---|
| listId | string | yes | Numeric AllTrails list id |
| view | string | – | Response shape: "compact" (default) drops fields the response already carries elsewhere; "full" returns every field this server understands. compact returns { count, items: [{ trailId, type, order, n… |
No output schema declared.
No examples provided.
alltrails_get_profile ~35
Get the signed-in AllTrails user profile (via /api/alltrails/me). Requires a signed-in session.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
alltrails_get_trail ~240
Get details for a single AllTrails trail by its numeric trail id. Returns name, location, length, elevation gain, difficulty, rating, route type, and (at higher detail levels) route geometry. Returns a slim projection by default (name, overview, length in m+mi, elevation gain, difficulty, rating, route type, location); pass view:"full" for the whole record and geometry.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | string | – | Detail level. "medium" (default) is a good overview; "offline" includes full route geometry. |
| trailId | string | yes | Numeric AllTrails trail id (e.g. "10236086") |
| view | string | – | Response shape: "compact" (default) drops fields the response already carries elsewhere; "full" returns every field this server understands. compact returns { name, overview, length in m+mi, elevatio… |
No output schema declared.
No examples provided.
alltrails_get_trail_gpx ~83
Export an AllTrails trail's route as a GPX 1.1 document (track points with per-point elevation), built from the trail's offline-detail route geometry. Returns raw GPX XML suitable for saving to a .gpx file or importing into navigation apps.
| Name | Type | Req | Description |
|---|---|---|---|
| trailId | string | yes | Numeric AllTrails trail id |
No output schema declared.
No examples provided.
alltrails_get_trail_photos ~180
Get photos for an AllTrails trail by its numeric trail id. Returns just { id, title, likeCount, user, uploadedAt, url } per photo by default — the url serves the actual image; pass view:"full" for the whole records.
| Name | Type | Req | Description |
|---|---|---|---|
| trailId | string | yes | Numeric AllTrails trail id |
| view | string | – | Response shape: "compact" (default) drops fields the response already carries elsewhere; "full" returns every field this server understands. compact returns { count, photos: [{ id, title, likeCount,… |
No output schema declared.
No examples provided.
alltrails_get_trail_reviews ~157
Get user reviews for an AllTrails trail by its numeric trail id. Returns just { user, rating, comment } per review by default; pass view:"full" for the whole records.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max reviews to return (default 20) |
| trailId | string | yes | Numeric AllTrails trail id |
| view | string | – | Response shape: "compact" (default) drops fields the response already carries elsewhere; "full" returns every field this server understands. compact returns { count, reviews: [{ user, rating, comment… |
No output schema declared.
No examples provided.
alltrails_get_trail_weather ~43
Get the weather overview for an AllTrails trail by its numeric trail id.
| Name | Type | Req | Description |
|---|---|---|---|
| trailId | string | yes | Numeric AllTrails trail id |
No output schema declared.
No examples provided.
alltrails_healthcheck Verify the fetchproxy bridge end-to-end ~137
Round-trips a small public www.alltrails.com URL (/api/alltrails/v3/trails/10236086?detail=basic) through the fetchproxy bridge and returns diagnostics: the bridge's role (host/peer/null), port, version, the extension link (linked / pair pending / not attached / never answered), the elapsed round-trip time, and a plain-English hint distinguishing 'bridge never came up' from 'extension not connected' from 'real www.alltrails.com-side problem'. Read-only, no auth required. Call this when a real tool fails and you want to know which hop broke.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
alltrails_list_completed_trails ~64
List the trails an AllTrails user has marked completed. Defaults to the signed-in user; pass a userId to target a specific public profile.
| Name | Type | Req | Description |
|---|---|---|---|
| userId | string | – | Numeric AllTrails user id. Defaults to the signed-in user. |
No output schema declared.
No examples provided.
alltrails_list_user_lists ~65
List an AllTrails user's saved lists (favorites, custom lists). Defaults to the signed-in user; pass a userId to target a specific public profile.
| Name | Type | Req | Description |
|---|---|---|---|
| userId | string | – | Numeric AllTrails user id. Defaults to the signed-in user. |
No output schema declared.
No examples provided.
alltrails_resolve_location ~182
Resolve a place name to AllTrails location records — country / state / city / area / point of interest — with each one's kind, coordinates, URL slug, and disambiguation label. Useful for pinning down which "Oregon" (state vs the towns) or getting a place's coordinates/slug. NOTE: the returned id is an Algolia search id and is NOT the id the trail-listing tools take; to find trails for a place, feed the resolved name back into alltrails_search.
| Name | Type | Req | Description |
|---|---|---|---|
| kinds | array | – | Which place kinds to return (default: all — country, state, city, area, poi) |
| limit | integer | – | Max results to return (default 10) |
| query | string | yes | Place name to resolve, e.g. "portland oregon" or "zion" |
No output schema declared.
No examples provided.
alltrails_search ~336
Search AllTrails by name. A free-text query goes to the suggestions endpoint the alltrails.com search box itself uses — relevance is good and the limit is honored. Results may mix record types (trail, poi, area, city, …); pass types=["trail"] to narrow. lat/lng are accepted for backward compatibility but verified ignored by the API (2026-07-02) — results carry an implicit account/IP geo bias instead. Without a query this falls back to the legacy explore search, which returns trails anchored to the signed-in account's location. Results come back as slim per-result summaries, capped at limit client-side, by default; pass view:"full" for AllTrails' whole records.
| Name | Type | Req | Description |
|---|---|---|---|
| lat | number | – | Deprecated — the API ignores it (verified 2026-07-02) |
| limit | integer | – | Max results to return (default 20) |
| lng | number | – | Deprecated — the API ignores it (verified 2026-07-02) |
| query | string | – | Free-text search, e.g. "angels landing" or "waterfall trails" |
| types | array | – | Record types to return (default: all). e.g. ["trail"] for trails only. Only applied when query is provided; silently ignored on the no-query legacy browse fallback. |
| view | string | – | Response shape: "compact" (default) drops fields the response already carries elsewhere; "full" returns every field this server understands. compact returns slim per-result summaries capped at limit;… |
No output schema declared.
No examples provided.
What is the io.github.chrischall/alltrails-mcp server?
io.github.chrischall/alltrails-mcp is listed in the public MCP registry as io.github.chrischall/alltrails-mcp. Unofficial AllTrails MCP for Claude, search trails, get details, reviews, photos, saved lists. This page covers its npm package (alltrails-mcp).
Is the io.github.chrischall/alltrails-mcp server safe to use?
io.github.chrischall/alltrails-mcp scores 92 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.chrischall/alltrails-mcp server expose?
io.github.chrischall/alltrails-mcp exposes 13 tools: alltrails_get_trail, alltrails_get_trail_reviews, alltrails_get_trail_photos, alltrails_get_trail_gpx, alltrails_get_trail_weather, and 8 more. Their descriptions and schemas cost roughly 2,004 tokens of context every time the server is loaded.
Is the io.github.chrischall/alltrails-mcp server still maintained?
io.github.chrischall/alltrails-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.chrischall/alltrails-mcp server under?
io.github.chrischall/alltrails-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.