Read accesso mobile ticket links: orders, admissions, barcodes and Google Wallet passes.
About
Read accesso mobile ticket links: orders, admissions, barcodes and Google Wallet passes.
Security Report
This is a well-engineered MCP server for reading accesso ticketing data. The codebase demonstrates strong security practices: proper input validation, comprehensive error handling, intentional token redaction, SSRF protection, and read-only operations. The server requires no authentication (the accesso link itself is the credential), which is appropriate for the use case. Minor code quality observations exist but do not constitute security vulnerabilities. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue.
7 files analyzed · 6 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
What You'll Need
Set these up before or after installing:
Environment variable: ACCESSO_TICKET_URL
Environment variable: ACCESSO_OUTPUT_DIR
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-chrischall-accessoticketing-mcp": {
"env": {
"ACCESSO_OUTPUT_DIR": "your-accesso-output-dir-here",
"ACCESSO_TICKET_URL": "your-accesso-ticket-url-here"
},
"args": [
"-y",
"@chrischall/accessoticketing-mcp"
],
"command": "npx"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
accessoticketing-mcp
An MCP server for accesso Passport mobile ticket links — the URL a venue emails you after a purchase. Reads the order and every admission on it, the scannable barcodes, and Google Wallet save links.
accesso powers ticketing for a lot of theme parks, water parks, camps, museums and festivals, so one server covers all of them: the merchant is encoded in the link.
Developed and maintained by AI (Claude Code). Use at your own discretion.
What it needs
No login. These links carry their own credential — the oToken in the query
string is what authorises the read. There is no account, no password, no browser
session, and no bot wall.
[!WARNING] That also means the link is a secret. Anyone holding it can view and add the order's tickets. Treat it like a password: don't paste it into issues, logs or chats. This server redacts the tokens from its own output and error messages.
Install
npx -y @chrischall/accessoticketing-mcp
// claude_desktop_config.json / .mcp.json
{
"mcpServers": {
"accessoticketing": {
"command": "npx",
"args": ["-y", "@chrischall/accessoticketing-mcp"],
"env": { "ACCESSO_TICKET_URL": "https://media-engine.na3.accessoticketing.com/tickets/v1/..." }
}
}
}
ACCESSO_TICKET_URL is optional — it just saves passing url on every call. The
server starts fine without it and reports the missing link on first use.
| Variable | Required | Purpose |
|---|---|---|
ACCESSO_TICKET_URL | no | Default ticket link, used when a tool is called without url. |
ACCESSO_OUTPUT_DIR | no | Where accesso_save_barcodes writes PNGs. Defaults to cwd. |
ACCESSO_NO_FILE_OUTPUT | no | Set to 1 where the filesystem isn't the user's (a hosted deployment) so barcodes return inline. |
Tools
| Tool | Does |
|---|---|
accesso_get_order | The order and every admission: product, participant, date, start time, instructions. compact for a slim list. |
accesso_get_ticket | One admission in full, by index. |
accesso_save_barcodes | Writes barcode PNGs and returns paths, or returns the images inline. |
accesso_get_wallet_passes | Google Wallet save links for the tickets. |
accesso_resolve_link | Unwraps an email click-tracking link to the accesso URL it hides. |
accesso_healthcheck | Confirms reachability and whether a default link is configured. |
Every tool is read-only; nothing here mutates an order.
> what do we have booked tomorrow?
9:00 AM Tiny Trekkers Full-Day (Ages 4-7) — one participant
9:00 AM Whitewater Kayak Camp I: Intro — two participants
all-day Lunch / Snack / Early Drop-Off — nine more admissions
Shell-out skill
Prefer a shell? skills/accesso-tickets/ does the same reading with curl and a
dependency-free parser, no server required. It ships with the package.
Notes on the data
date/timeare the merchant's local wall-clock strings with no timezone attached. They are passed through verbatim rather than converted.- Merchant-specific detail rows (
Guest Number,Web Sales ID, …) are harvested generically intodetails, so a venue this was never tested against still works. - An expired link returns HTTP 200, not an error status — the server detects the body and says the link is expired rather than reporting zero tickets.
Development
npm install
npm run build
npm test
npm run test:coverage # 100% thresholds, enforced in CI
See docs/ACCESSO-API.md for the captured request/response shapes and CLAUDE.md
for repo conventions.
License
MIT
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.
FinAgent
Freeby mcp-marketplace · Finance
Free stock data and market news for any MCP-compatible AI assistant.