The README is unusually clear that this is a hardened prototype rather than a multi-tenant platform: the token is shared rather than per-user, and a production deployment would need OAuth or Cloudflare Access, per-user scopes, audit events and a load test. What it does have is a real security boundary — timing-safe comparison, an origin allowlist, rate limiting — which is more than most single-author Workers ship with. Treat it as your own deployment for your own use.
An experimental server that exposes award-flight availability search, backed by the Seats.aero Partner API. It runs as a Cloudflare Worker and speaks Streamable HTTP at `/mcp`. The read-only scope is deliberate: it searches award space, it does not book anything.
- Read-only award-flight search tools backed by the Seats.aero Partner API
- Streamable HTTP transport at `/mcp` — the older HTTP+SSE routes are deliberately not exposed
- A bearer-token boundary on every request, compared using SHA-256 digests and a timing-safe comparison
- An origin allowlist for browser requests, with native clients allowed to omit `Origin`
- Cloudflare rate limiting on both authenticated and unauthenticated requests, without putting raw credentials in the rate-limit key
A Seats.aero Partner API key and a Cloudflare account. Deploy it yourself: `npx wrangler login`, then put `SEATS_AERO_API_KEY`, `MCP_AUTH_TOKEN` and `MCP_ALLOWED_ORIGINS` in as Wrangler secrets and `npm run deploy`. Clients connect to your Worker's `/mcp` URL with `Authorization: Bearer <token>`. For local work, `npm ci` and a `.dev.vars` file with freshly rotated values — no credential belongs in source, logs or issues.