A prototype that tells you exactly what it isn't.

The README is unusually clear that this is a hardened prototype rather than a multi-tenant platform: the token is shared rather than per-user, and a production deployment would need OAuth or Cloudflare Access, per-user scopes, audit events and a load test. What it does have is a real security boundary — timing-safe comparison, an origin allowlist, rate limiting — which is more than most single-author Workers ship with. Treat it as your own deployment for your own use.

What it is

An experimental server that exposes award-flight availability search, backed by the Seats.aero Partner API. It runs as a Cloudflare Worker and speaks Streamable HTTP at /mcp. The read-only scope is deliberate: it searches award space, it does not book anything.

What you get

Read-only award-flight search tools backed by the Seats.aero Partner API
Streamable HTTP transport at /mcp — the older HTTP+SSE routes are deliberately not exposed
A bearer-token boundary on every request, compared using SHA-256 digests and a timing-safe comparison
An origin allowlist for browser requests, with native clients allowed to omit Origin
Cloudflare rate limiting on both authenticated and unauthenticated requests, without putting raw credentials in the rate-limit key

Requirements

A Seats.aero Partner API key and a Cloudflare account. Deploy it yourself: npx wrangler login, then put SEATS_AERO_API_KEY, MCP_AUTH_TOKEN and MCP_ALLOWED_ORIGINS in as Wrangler secrets and npm run deploy. Clients connect to your Worker's /mcp URL with Authorization: Bearer <token>. For local work, npm ci and a .dev.vars file with freshly rotated values — no credential belongs in source, logs or issues.

Setup effort

Build from source — git clone https://github.com/lztrifunovic/mcp-rewardsflights-public.git

See installation options

USE CASES

01

Hunting for award availability on a route

Search Seats.aero's partner data from a conversation instead of the web UI.

02

Comparing dates for a redemption

Run the search repeatedly across a window and let the model summarise what is open.

03

Giving an agent flight data without giving it your account

Deploy the Worker with your API key held as a secret and hand the agent only the bearer token.

BEFORE YOU INSTALL

What to know first

Requires

SEATS_AERO_API_KEY in your environment
MCP_AUTH_TOKEN in your environment

INSTALLATION

Connect your client

This one is built from source rather than installed with a single command.

Server setup

TERMINAL

git clone https://github.com/lztrifunovic/mcp-rewardsflights-public.git
cd mcp-rewardsflights-public
npm ci
npx wrangler login
npx wrangler secret put SEATS_AERO_API_KEY
npx wrangler secret put MCP_AUTH_TOKEN
npx wrangler secret put MCP_ALLOWED_ORIGINS
npm run deploy

Connect your MCP client to https://<YOUR_WORKER>.<YOUR_ACCOUNT>.workers.dev/mcp (Streamable HTTP) and send your MCP_AUTH_TOKEN as Authorization: Bearer <YOUR_TOKEN> through the client's own credential setting — the README documents no client-specific configuration

Rewards Flights Public MCP