Back to Browse
Free
Server data from the Official MCP Registry
MCP server for read-only American Airlines AAdvantage account access
About
MCP server for read-only American Airlines AAdvantage account access
Security Report
10.0
Low Risk10.0Low RiskValid MCP server (1 strong, 4 medium validity signals). No known CVEs in dependencies. Package registry verified. Imported from the Official MCP Registry.
7 files analyzed · 1 issue found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-thehesiod-aa": {
"args": [
"aa-mcp-server"
],
"command": "uvx"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
aa-mcp-server
An MCP server that gives Claude (or any MCP-compatible LLM) read-only access to your American Airlines AAdvantage account — mile balance, Loyalty Points progress, transaction history, upcoming trips, travel credits, and partner offers.
This is not a browser-automation wrapper. The server discovers and calls aa.com's underlying JSON APIs directly using session cookies extracted from a Chromium login. All HTTP traffic uses curl_cffi with Chrome TLS impersonation to satisfy aa.com's Akamai Bot Manager.
Tools
| Tool | Endpoint | Returns |
|---|---|---|
get_account_summary | /loyalty/api/member-information | Name, AAdvantage #, mile balance, status, cobranded card, business memberships |
get_loyalty_points_progress | /loyalty/api/progress-qualification | LP YTD, last-year totals, tier thresholds, next-status delta |
get_profile_details | /api/loyalty/.../profile | DOB, partners list, sales city, mile expiration, million-miler stats |
get_mile_activity | /api/loyalty/.../memberActivity | Mile/LP transaction history (date range, paginated, searchable) |
get_upcoming_trips | /loyalty/api/upcoming-trips | Reservations with record locators |
get_flight_credits | /api/loyalty/travelCredits/flightCredit/details | Single-passenger ticket credits |
get_trip_credits | /api/loyalty/travelCredits/tripCredit/details | Multi-passenger / itinerary credits |
get_partner_offers | /loyalty/api/partnerOffers | Dashboard partner promotions |
get_notifications | /loyalty/api/notifications | Account notifications |
check_auth_status | — | Saved-session info: AA #, token expiry, cookie count |
save_session_from_browser | CDP | Pulls cookies from a logged-in Chromium and persists them |
Setup
pip install aa-mcp-server
One-time auth
aa.com is fronted by Akamai Bot Manager — you can't log in via headless requests. The flow:
- Launch a real Chromium with a persistent profile and a remote-debugging port:
aa-auth-browser # default account aa-auth-browser personal # named account - Log into aa.com (and complete 2FA if prompted) in the window that opens.
- Copy the cookies into the MCP store:
Or call theaa-mcp-server --extract-session defaultsave_session_from_browserMCP tool from Claude.
The cookies live in ~/.aa-mcp/accounts/<account>/session.json. The chromium profile lives in ~/.aa-mcp/chrome-profiles/<account>/. To refresh after expiry, relaunch aa-auth-browser (the saved profile auto-refreshes the access_token cookie when you visit any aa.com page) and re-run --extract-session.
AA_MCP_CHROMIUM=<path-to-chrome.exe> overrides the auto-discovery if your Chromium is somewhere unusual.
Multi-account
Every tool takes an optional account parameter. Omit it to use the default account.
get_account_summary() # default
get_account_summary(account="spouse")
Running
aa-mcp-server # stdio transport
aa-mcp-server --setup # show account status & setup hints
aa-mcp-server --extract-session NAME # save cookies from running Chromium
Add to your MCP client config (e.g. Claude Desktop):
{
"mcpServers": {
"aa": {
"command": "aa-mcp-server"
}
}
}
Limitations
- Read-only. No booking, no award redemption, no profile edits.
- Cookie expiry. The
access_tokenJWT lives ~45 min; therefresh_tokencookie typically ~30 days. Visiting any aa.com page in the saved Chromium profile silently refreshes both. After a long gap, re-extract. - GraphQL coverage. Only the
GetCustomerpersisted query is wired up. Expanding requires capturing additional sha256Hashes from the browser bundle — easy but a per-feature task. - One region tested. All testing has been on US-locale aa.com. International locales may require different
refererpaths.
License
MIT
mcp-name: io.github.thehesiod/aa
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
80.0K
Stars
4
Installs
6.5
Security
No ratings yet
Local
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
137
Stars
427
Installs
8.0
Security
4.8
Local
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
-
Stars
59
Installs
10.0
Security
5.0
Local
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption
120.0K
Stars
17
Installs
6.0
Security
5.0
Local
mcp-creator-typescript
Freeby mcp-marketplace · Developer Tools
Scaffold, build, and publish TypeScript MCP servers to npm — conversationally
-
Stars
14
Installs
10.0
Security
5.0
Local
Google Workspace MCP
Freeby Taylorwilsdon · Productivity
Control Gmail, Calendar, Docs, Sheets, Drive, and more from your AI
1.6K
Stars
13
Installs
7.0
Security
No ratings yet
Local