Back to Browse

Cruisescope MCP Server

Developer ToolsModerate5.1MCP RegistryLocal
Free

Server data from the Official MCP Registry

Search cruises, check fares and price history, and look up cabins, ships, lines, ports.

About

Search cruises, check fares and price history, and look up cabins, ships, lines, ports.

Security Report

5.1
Moderate5.1Moderate Risk

cruisescope is a read-only forwarding client for the hosted gangwaze MCP endpoint, with no shell execution, filesystem access, or hardcoded secrets, and its network and env permissions match its purpose. The main concerns are that GANGWAZE_API_KEY is sent to an endpoint that GANGWAZE_MCP_URL can override without any scheme or host validation, and that upstream results are passed verbatim to the model. The test file was truncated, so it was not fully reviewed. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.

8 files analyzed · 9 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-cloudcorprecords-cruisescope": {
      "args": [
        "-y",
        "@reneturcios/cruisescope"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

cruisescope

cruisescope is a small local bridge to gangwaze's hosted MCP server, which catalogues cruise sailings: say where you want to go, when, and what you can spend, and the catalog answers with matching sailings, their fares, and links to the full results on gangwaze.com.

The bridge keeps no catalog of its own. It serves the upstream server's tool list locally, exactly as captured from the live endpoint, and forwards each tool call upstream, returning the result untouched. The whole captured surface only reads — searching sailings, comparing a shortlist, checking fare history and price drops, and looking up cabins, ships, cruise lines, ports, excursions and drink packages — and there is no booking, purchase or payment tool in it.

Tools

  • searchCruises — search upcoming sailings. All filters are optional: destination (a top-level region name), regions, departurePorts, ports, startDate / endDate, nights (a "lo:hi" range), cruiselines, ships, cabin (inside, oceanview, balcony, suite), price / pricePerNight ("lo:hi" ranges), safety, family, tripShape, shipYear, shipSize, lineType, vibes and departureDays. Results are soonest first and each sailing carries an id.
  • compareSailings — two or three sailings side by side: dates, ports, price and price per night, a price verdict against the six-month average, ship age and size, family suitability, rating and CDC score. Required: ids.
  • getPriceHistory — judge one sailing's current fare against its six-month history, with a verdict and a price-drop flag. Required: id.
  • getPriceDrops — the biggest current price drops. Optional: limit (1-10).
  • getCabinDetail — one specific cabin by ship and room number: deck, position, category, known issues and cruiser comments. Required: ship, cabin.
  • getShipCabins — a ship's cabins grouped by type, with categories, counts and size ranges. Required: ship.
  • getShipProfile — one ship: year built and refurbished, size, guests and crew, ratings, venues and editorial. Required: ship.
  • getCruiseLineProfile — one cruise line: who it suits, ratings by traveler type, tier and fleet size. Required: line.
  • getDressCode — a line's dress code: daytime and evening rules, formal nights and venue rules. Required: line.
  • getPortGuide — a cruise port: things to do, beaches, shopping, terminals, safety, wifi and car rental. Required: port.
  • getPortExcursions — bookable shore excursions and day passes in one port, with price, duration and rating. Required: port. Optional: activity, minPrice, maxPrice.
  • getSailingExcursions — excursions for every port of one sailing in one call, in itinerary order. Pass a sailingId, or ship plus date. Optional: activity, minPrice, maxPrice.
  • getBestTimeToVisit — month-by-month temperature and rainfall for a port, region or destination, with the warmest and driest months. Required: place.
  • getDrinkPackages — beverage-package details by cruise line: names, maximum drink value, daily limits and gratuity. Optional: cruiseline (omit for all lines).

Configuration

  • GANGWAZE_MCP_URL (optional) — override the upstream endpoint. Defaults to https://gangwaze.com/api/mcp. (The override hook is this rebuild's own labelled reconstruction.)
  • GANGWAZE_API_KEY (optional) — when set, every upstream request carries an X-Api-Key: <key> header (for higher rate limits). When it is not set, no key header is sent and access is anonymous. No Authorization header is ever sent. (This forwarding is also a labelled reconstruction; the original surface was captured keyless.)

Forwarding mechanics

On the first tool call the client opens a streamable HTTP session with the upstream: a JSON-RPC initialize request (protocolVersion 2025-03-26, clientInfo name cruisescope), then a notifications/initialized notification, then the tools/call request carrying the caller's arguments unchanged. When the upstream answers initialize with an Mcp-Session-Id header, that value rides on every later request of the session, which is reused for the life of the process. Replies may arrive as plain JSON or as server-sent events; both are read.

Successful upstream results pass through verbatim, including any isError flag the upstream sets. Failures — a JSON-RPC error, a non-2xx status, an unreadable response, or a request that cannot be completed — come back as an isError result whose text starts with cruisescope error: (this rendering is this rebuild's own labelled reconstruction).

CLI

Each tool is also a subcommand taking one JSON argument string (omit it for tools that take none):

npx @reneturcios/cruisescope searchCruises '{"destination":"Caribbean","nights":"7:7"}'
npx @reneturcios/cruisescope compareSailings '{"ids":["carnival-breeze:2026-09-21:5","carnival-breeze:2026-09-28:5"]}'
npx @reneturcios/cruisescope getPriceHistory '{"id":"carnival-breeze:2026-09-21:5"}'
npx @reneturcios/cruisescope getPriceDrops '{"limit":5}'
npx @reneturcios/cruisescope getPortGuide '{"port":"Cozumel"}'
npx @reneturcios/cruisescope --version

Exit codes: 0 on success, 1 on an isError result, 2 on a usage error.

MCP server

npx -y @reneturcios/cruisescope mcp

MCP client config:

{
  "mcpServers": {
    "cruisescope": {
      "command": "npx",
      "args": ["-y", "@reneturcios/cruisescope", "mcp"]
    }
  }
}

Docker

docker run -i ghcr.io/cloudcorprecords/cruisescope
docker run --rm ghcr.io/cloudcorprecords/cruisescope --version

The container's default command is mcp, so the first form is a stdio MCP server; any other arguments reach the CLI normally.

Development

npm install
npm run build
npm test
npm run dev

The test suite runs entirely against a stubbed JSON-RPC upstream — no live network calls.

License

MIT — see LICENSE.

Reviews

No reviews yet

Be the first to review this server!