Back to Browse

Simscout MCP Server

Developer ToolsModerate6.1MCP RegistryLocal
Free

Server data from the Official MCP Registry

Compare travel eSIM plans by country, trip length and data, with live catalog prices.

About

Compare travel eSIM plans by country, trip length and data, with live catalog prices.

Security Report

6.1
Moderate6.1Moderate Risk

simscout is a transparent forwarding bridge to the esimoa travel eSIM catalog with a read-only tool surface, no hardcoded secrets, and an optional API key sent only in the X-API-Key header to the pinned upstream. Its permissions (outbound HTTP, env var read for optional config) match its stated purpose. Minor observations include the configurable upstream URL override, which could redirect requests and carry the API key if the environment is attacker-controlled, and the truncated test file that was not fully reviewed. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.

8 files analyzed · 7 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-cloudcorprecords-simscout": {
      "args": [
        "-y",
        "@reneturcios/simscout"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

simscout

simscout is a small local bridge to esimoa's hosted MCP server, which catalogues travel eSIM plans: pick a destination, say how long the trip is and how much data you need, and the catalog answers with matching plans, their prices in KRW, and a link to each plan's page on esimoa.com where a purchase would happen.

The bridge keeps no catalog of its own. It serves the upstream server's tool list locally, exactly as captured from the live endpoint, and forwards each tool call upstream, returning the result untouched. The whole captured surface only reads — searching, fetching one plan, comparing a shortlist and listing destinations — and there is no checkout or payment tool in it.

Tools

  • search_esims — search the catalog for a destination. All filters are optional: country (ISO code or name in any language, e.g. JP or Japan), days (trip length), data_gb / max_data_gb, unlimited, countries (multi-country trips, up to 8), data_type (daily or total), local_number, network (local or roaming), multi_country, min_price_krw / max_price_krw, provider, hotspot, five_g, sort (recommended, price, data, price_per_gb or validity), limit (1-10, default 5) and lang. Each result carries an id and a plan page url.
  • get_esim — the full details of one plan. Required: id (from search_esims). Optional: lang.
  • compare_esims — two to five plans side by side: price, data, validity, price per GB, coverage, network, hotspot and local phone number, plus which plan wins each of lowest price, most data, longest validity and lowest price per GB. Required: ids. Optional: lang.
  • list_countries — every destination where plans are sold, with the plan count and the lowest price per country. Optional: query (name or ISO filter) and lang.
  • search — free-text search in the search/fetch format used by ChatGPT deep research, e.g. "Japan 7 days unlimited". Required: query. Returns ids for fetch. When you can fill filters, prefer search_esims.
  • fetch — one plan as a document, by an id returned from search. Required: id. For plans found with search_esims, use get_esim instead.

Configuration

  • ESIMOA_MCP_URL (optional) — override the upstream endpoint. Defaults to https://api.esimoa.com/mcp. (The override hook is this rebuild's own labelled reconstruction.)
  • ESIMOA_API_KEY (optional) — when set, every upstream request carries an X-API-Key: <key> header (a partner key adds the partner's affiliate code to buy links). When it is not set, no key header is sent and the upstream returns plain links. No Authorization header is ever sent. (This forwarding is also a labelled reconstruction; the original surface was captured keyless.)

Forwarding mechanics

On the first tool call the client opens a streamable HTTP session with the upstream: a JSON-RPC initialize request (protocolVersion 2025-03-26, clientInfo name simscout), then a notifications/initialized notification, then the tools/call request carrying the caller's arguments unchanged. When the upstream answers initialize with an Mcp-Session-Id header, that value rides on every later request of the session, which is reused for the life of the process. Replies may arrive as plain JSON or as server-sent events; both are read.

Successful upstream results pass through verbatim, including any isError flag the upstream sets. Failures — a JSON-RPC error, a non-2xx status, an unreadable response, or a request that cannot be completed — come back as an isError result whose text starts with simscout error: (this rendering is this rebuild's own labelled reconstruction).

CLI

Each tool is also a subcommand taking one JSON argument string (omit it for tools that take none):

npx @reneturcios/simscout search_esims '{"country":"JP","days":7,"sort":"price"}'
npx @reneturcios/simscout get_esim '{"id":"plan-9"}'
npx @reneturcios/simscout compare_esims '{"ids":["plan-9","plan-11"]}'
npx @reneturcios/simscout list_countries '{"query":"Japan"}'
npx @reneturcios/simscout --version

Exit codes: 0 on success, 1 on an isError result, 2 on a usage error.

MCP server

npx -y @reneturcios/simscout mcp

MCP client config:

{
  "mcpServers": {
    "simscout": {
      "command": "npx",
      "args": ["-y", "@reneturcios/simscout", "mcp"]
    }
  }
}

Docker

docker run -i ghcr.io/cloudcorprecords/simscout
docker run --rm ghcr.io/cloudcorprecords/simscout --version

The container's default command is mcp, so the first form is a stdio MCP server; any other arguments reach the CLI normally.

Development

npm install
npm run build
npm test
npm run dev

The test suite runs entirely against a stubbed JSON-RPC upstream — no live network calls.

License

MIT — see LICENSE.

Reviews

No reviews yet

Be the first to review this server!