
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@striderlabs/mcp-american
Advanced tools
MCP server for American Airlines - let AI agents search flights, manage bookings, check in, and access AAdvantage rewards on aa.com
MCP server for American Airlines — let AI agents search flights, manage bookings, check in, retrieve boarding passes, and access AAdvantage rewards on aa.com via Playwright browser automation.
Built by Strider Labs.
npm install -g @striderlabs/mcp-american
npx playwright install chromium
Or run directly with npx:
npx @striderlabs/mcp-american
Add to your claude_desktop_config.json:
{
"mcpServers": {
"american": {
"command": "npx",
"args": ["-y", "@striderlabs/mcp-american"]
}
}
}
Config file locations:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.jsonThis server uses browser automation and stores session cookies locally. To authenticate:
login tool — it opens aa.com in a browser windowstatus to verify and save the sessionSessions are saved to ~/.striderlabs/american/ and reused across invocations. You typically only need to log in once until the session expires.
| Tool | Description |
|---|---|
status | Check login status and session info |
login | Open aa.com for manual login |
logout | Clear saved session and cookies |
search_flights | Search AA flights by route, date, cabin |
get_flight_details | Get detailed info on a search result |
select_flight | Choose outbound/return flight for booking |
get_seat_map | View available seats and fees |
select_seats | Choose seats by seat number |
add_bags | Add checked baggage |
checkout | Complete booking (requires confirm: true) |
get_reservation | Look up reservation by record locator |
modify_trip | Change flights on existing reservation |
cancel_trip | Cancel reservation (requires confirm: true) |
check_in | Online check-in (opens 24h before departure) |
get_boarding_pass | Retrieve digital boarding passes |
get_aadvantage | Check miles, elite status, milestones |
upgrade_request | Request upgrade using miles or elite status |
User: Search for flights from DFW to JFK next Friday
Agent:
1. search_flights { origin: "DFW", destination: "JFK", departureDate: "2025-07-11" }
2. get_flight_details { flightId: "0" }
3. select_flight { outboundFlightId: "0" }
4. get_seat_map {}
5. select_seats { seats: ["14A"] }
6. add_bags { bags: 1 }
7. checkout {} → preview
8. checkout { confirm: true } → booking confirmed
Destructive or financial actions require explicit confirmation:
checkout — pass confirm: true only after user confirms the purchasecancel_trip — pass confirm: true only after user confirms the cancellationWithout confirm: true, these tools return a preview instead of taking action.
Optional — credentials can be provided via environment variables for automated workflows:
| Variable | Description |
|---|---|
AA_USERNAME | AAdvantage number or email |
AA_PASSWORD | Account password |
When set, the server will attempt auto-login on first use.
Cookies and session info are stored at:
~/.striderlabs/american/
├── cookies.json # Browser session cookies
└── session.json # Account info cache
To reset authentication: call logout or delete this directory.
git clone https://github.com/markswendsen-code/mcp-american
cd mcp-american
npm install
npx playwright install chromium
npm run build
npm start
MIT — Strider Labs
FAQs
MCP server for American Airlines - let AI agents search flights, manage bookings, check in, and access AAdvantage rewards on aa.com
The npm package @striderlabs/mcp-american receives a total of 2 weekly downloads. As such, @striderlabs/mcp-american popularity was classified as not popular.
We found that @striderlabs/mcp-american demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.