TripWays
REMOTE · MCP.TRIPWAYS.COM · SCANNED SEP 29
Find, price, and book tours, day trips, and activities worldwide, with live dates and prices.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability66
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1161 tokens (~193/item across 6 items; 6 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management3
- Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage82
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 38% of tool parameters carry a description.Partial
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 6 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the TripWays MCP server?
TripWays is a hosted endpoint at https://mcp.tripways.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.tripways.com
claude mcp add --transport http com-tripways-tours 'https://mcp.tripways.com/mcp'
{
"mcpServers": {
"com-tripways-tours": {
"url": "https://mcp.tripways.com/mcp"
}
}
} {
"servers": {
"com-tripways-tours": {
"type": "http",
"url": "https://mcp.tripways.com/mcp"
}
}
} [mcp_servers.com-tripways-tours] url = "https://mcp.tripways.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-tripways-tours": {
"type": "remote",
"url": "https://mcp.tripways.com/mcp",
"enabled": true
}
}
} openclaw mcp add com-tripways-tours --url 'https://mcp.tripways.com/mcp' --transport streamable-http
mcp_servers:
com-tripways-tours:
url: "https://mcp.tripways.com/mcp" {
"McpServers": {
"com-tripways-tours": {
"Transport": "http",
"Url": "https://mcp.tripways.com/mcp"
}
}
} assistant mcp add com-tripways-tours -t streamable-http -u 'https://mcp.tripways.com/mcp'
{
"mcpServers": {
"com-tripways-tours": {
"type": "http",
"url": "https://mcp.tripways.com/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 29 Sept 26 0
- Stability: unverified → 0.03 ▲ functional
- 28 Sept 26 64
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 29 Sept 2026 · Probed https://mcp.tripways.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=tripways.com | CN=WE1,O=Google Trust Services,C=US | 9 Sept 2026 | 8 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | dd2454cf5671ffe70ed455dd332abb3f |
| SANs: tripways.com, mcp.tripways.com, *.mcp.tripways.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.tripways.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| tripways.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.tripways.com/mcp | Verified | 200 | |
| http (plaintext) | http://mcp.tripways.com/mcp | Inconclusive | 405 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_availability Check availability ~206
Check live start times and remaining seats for a TripWays tour on one date or a range of up to 31 days. Pass party_size (seats needed) or a travelers object; slots that cannot fit the group are left out, and party_size wins if both are given. The status field is ok, no_schedule, no_fit, or calendar_gone. Use get_price_quote with the same date, start time, and travelers for the total.
| Name | Type | Req | Description |
|---|---|---|---|
| bokun_id | string | yes | – |
| date | string | yes | – |
| date_end | string | – | Inclusive end; default = date. Max 31 days. |
| party_size | integer | – | Occupied seats to keep (not ticket count). Slots with availabilityCount < party_size are omitted unless unlimited. Wins over travelers when both are set. |
| travelers | object | – | Simple ages; mapped to occupied seats (infants excluded unless the tour has an infant category). Used only when party_size is omitted. |
| Name | Type | Req | Description |
|---|---|---|---|
| bokun_id | string | – | – |
| bookable_natively | boolean | – | – |
| checkout_url | string | – | – |
| note | string | – | – |
| ok | boolean | yes | – |
| reason | string|null | – | – |
| slots | array | – | Open start times that fit the party. |
| status | string | – | ok, no_schedule, no_fit, or calendar_gone. |
No examples provided.
get_booking_link Get a booking link ~148
Get the TripWays checkout link for a tour, optionally preset to a date, start time, rate, and traveler mix. The traveler pays on tripways.com; this tool does not hold seats or take payment. bookable_natively and reason say whether the link opens TripWays checkout or the operator's calendar, and whether a hotel pickup must be chosen at checkout.
| Name | Type | Req | Description |
|---|---|---|---|
| bokun_id | string | yes | – |
| date | string | – | – |
| rate_id | integer | – | – |
| start_time | string | – | HH:MM if start_time_id unknown. |
| start_time_id | integer | – | – |
| travelers | object | – | Simple ages; mapped to Bokun pricing categories. |
| Name | Type | Req | Description |
|---|---|---|---|
| bokun_id | string | – | – |
| bookable_natively | boolean | – | – |
| checkout_url | string | – | Open in the browser to pay on tripways.com. |
| min_participants | integer | – | – |
| ok | boolean | yes | – |
| reason | string|null | – | – |
| spots_left | integer|null | – | – |
| start_time | string | – | – |
No examples provided.
get_destination_info Find a destination ~134
Resolve a place name (a city, region, country, or well-known area such as Khao Sok) to a TripWays destination with bookable tours. Useful before search_tours when a name could mean more than one place. An ambiguous name returns destination_ambiguous with a did_you_mean list; pass country_code (ISO 3166-1 alpha-2, e.g. FR) to choose one. Area names resolve to their parent destination and include resolved_via=area_alias.
| Name | Type | Req | Description |
|---|---|---|---|
| country_code | string | – | Optional ISO2 pin, e.g. FR. |
| query | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| destination | object | – | – |
| ok | boolean | yes | – |
No examples provided.
get_price_quote Get a price quote ~129
Get the live total for a TripWays tour on one date and start time for a traveler mix, priced from the operator's booking calendar. A quote does not hold seats or charge anything. Optional extras and promo codes are not included. When the tour's rates cannot price that mix, the result is unpriced.
| Name | Type | Req | Description |
|---|---|---|---|
| bokun_id | string | yes | – |
| date | string | yes | – |
| start_time | string | – | HH:MM if start_time_id unknown. |
| start_time_id | integer | – | – |
| travelers | object | – | Simple ages; mapped to Bokun pricing categories. |
| Name | Type | Req | Description |
|---|---|---|---|
| bokun_id | string | – | – |
| bookable_natively | boolean | – | – |
| checkout_url | string | – | Checkout preset to this date, time, and travelers. |
| currency | string | – | – |
| date | string | – | – |
| from_price | number | – | – |
| includes_required_extras | boolean | – | – |
| min_participants | integer | – | – |
| ok | boolean | yes | – |
| optional_extras_excluded | boolean | – | – |
| package_total | number | – | Total for the whole group, before optional extras and promo codes. |
| promo_applied | boolean | – | – |
| quote_kind | string | – | – |
| rate_title | string | – | – |
| reason | string|null | – | – |
| start_time | string | – | – |
| travelers_priced | object | – | Traveler counts the total covers. |
No examples provided.
get_tour_details Get tour details ~93
Get the full details of one TripWays tour by bokun_id (the number in tripways.com/t/{id}): summary, itinerary stops, inclusions and exclusions, languages, cancellation policy, meeting point or pickup, from-price, rating, hero_image, url, and checkout_url. Live dates and group totals come from check_availability and get_price_quote.
| Name | Type | Req | Description |
|---|---|---|---|
| bokun_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| activities | array | – | – |
| bokun_id | string | – | Tour id; the number in tripways.com/t/{id}. |
| bookable_natively | boolean | – | True when checkout_url opens TripWays checkout; false when it opens the operator calendar. |
| cancellation | string | – | free, flexible, partial, or non_refundable. |
| checkout_url | string | – | TripWays checkout for this tour. |
| destinations | array | – | – |
| duration_hours | number | – | – |
| duration_text | string | – | – |
| exclusions | array | – | – |
| from_price | object | – | Lowest adult price. |
| gttd_eligible | boolean | – | Listed on Google Things to Do. |
| guidance | string | – | – |
| hero_image | string | – | Main photo URL. |
| hotel_pickup | boolean | – | – |
| inclusions | array | – | – |
| itinerary | array | – | – |
| languages | array | – | – |
| meeting_pickup_label | string | – | – |
| ok | boolean | yes | – |
| rating | object | – | – |
| reason | string|null | – | Why checkout works the way it does, e.g. pickup_required. |
| summary | string | – | – |
| themes | array | – | – |
| title | string | – | – |
| url | string | – | The tour's TripWays page. |
No examples provided.
search_tours Search tours ~254
Search the TripWays catalog of bookable tours, day trips, and activities worldwide. Pass a natural-language query plus any filters you already know: destination, price range in USD, duration in hours, activity, theme, or cancellation policy. Returns ranked tours with bokun_id, title, from-price, duration, destinations, rating, cancellation policy, hero_image, the TripWays page (url), and checkout_url. For live dates, remaining seats, or a group total, use check_availability and get_price_quote.
| Name | Type | Req | Description |
|---|---|---|---|
| activity | string | – | Activity facet, e.g. food, hiking, snorkeling. |
| cancellation | string | – | – |
| destination | string | – | Place name (city, region, country, or well-known area/landmark). Resolved against TripWays destinations; a landmark that is not a destination is added to the search text. |
| duration_hours_max | number | – | – |
| duration_hours_min | number | – | – |
| limit | integer | – | – |
| price_max | number | – | – |
| price_min | number | – | – |
| query | string | yes | Natural-language search, e.g. 'family food tour in Rome under $100'. |
| theme | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| destination_resolved | object | – | – |
| guidance | string | – | – |
| note | string | – | Why the list is empty or how the destination was read. |
| ok | boolean | yes | – |
| tours | array | – | Ranked tours; empty when nothing matched (see note). |
No examples provided.
What is the TripWays MCP server?
TripWays is an MCP server listed in the public MCP registry as com.tripways/tours. Find, price, and book tours, day trips, and activities worldwide, with live dates and prices. This page covers its hosted endpoint (https://mcp.tripways.com/mcp).
Is the TripWays MCP server safe to use?
TripWays scores 64 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the TripWays MCP server expose?
TripWays exposes 6 tools: search_tours, get_tour_details, get_destination_info, check_availability, get_price_quote, get_booking_link. Their descriptions and schemas cost roughly 964 tokens of context every time the server is loaded.
Does the TripWays MCP server require authentication?
No. We connected to TripWays without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the TripWays MCP server still maintained?
TripWays is still listed as active in the MCP registry. We last reached this channel on 29 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.