Aa

io.github.thehesiodPublished by GitHub account thehesiodv0.1.0Updated Oct 27, 2026

MCP server for read-only American Airlines AAdvantage account access

VerifiedSTDIODesktop onlyLocation & LifestyleFinance

Overview

AI-generated overview

Read-only MCP server that lets an assistant view your American Airlines AAdvantage account: miles, Loyalty Points, trips, credits and offers.

What you can do
  • Read account and profile details: name, AAdvantage number, mile balance, status, Loyalty Points progress and profile data
  • Review mile and Loyalty Points transaction history with date ranges, pagination and search
  • Look up upcoming trips and full reservation details by record locator, including segments, passengers, tickets and costs
  • Search alternative flights for a reservation with a price carousel and per-cabin pricing
  • List flight and trip travel credits and dashboard partner offers
  • Check saved-session status and save session cookies from a logged-in Chromium browser
When to use it
Useful when you want an assistant to answer questions about your own AAdvantage balance, status progress, past activity, upcoming trips or travel credits, and to compare rebooking options, without opening aa.com yourself.
Requirements
Runs locally as a Python package (pip install aa-mcp-server) over stdio. Needs a real Chromium browser for a one-time manual login to aa.com, including any 2FA, then cookie extraction into a local session store. Optionally set AA_MCP_CHROMIUM to point at a Chromium binary. No API keys are declared.
Before you install
It stores aa.com session cookies on disk under your home directory, so anyone with access to that machine can read them; treat them as account credentials. It reads personal data such as date of birth, AAdvantage number and reservation details. Sessions expire and must be re-extracted. Read-only: no booking, award redemption or profile edits.

Installation

In SourceWeft

  1. Open Aa in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

aa-mcp-server

An MCP server that gives Claude (or any MCP-compatible LLM) read-only access to your American Airlines AAdvantage account — mile balance, Loyalty Points progress, transaction history, upcoming trips, travel credits, and partner offers.

This is not a browser-automation wrapper. The server discovers and calls aa.com's underlying JSON APIs directly using session cookies extracted from a Chromium login. All HTTP traffic uses curl_cffi with Chrome TLS impersonation to satisfy aa.com's Akamai Bot Manager.

Tools

ToolEndpointReturns
get_account_summary/loyalty/api/member-informationName, AAdvantage #, mile balance, status, cobranded card, business memberships
get_loyalty_points_progress/loyalty/api/progress-qualificationLP YTD, last-year totals, tier thresholds, next-status delta
get_profile_details/api/loyalty/.../profileDOB, partners list, sales city, mile expiration, million-miler stats
get_mile_activity/api/loyalty/.../memberActivityMile/LP transaction history (date range, paginated, searchable)
get_upcoming_trips/loyalty/api/upcoming-tripsReservations with record locators
get_reservation_by_locator/manage-reservation/viewres/api/reservationFull reservation: segments, passengers, tickets, costs, change/cancel eligibility (requires lead-passenger name)
search_change_flights/manage-reservation/reshop/api/reshop/cheapestAlternative flights for a reservation with a ±6-day price carousel, per-cabin pricing (netPrice = delta vs paid). Accepts origin/destination/date changes; pricing is total for all pax (no per-passenger split)
get_flight_credits/api/loyalty/travelCredits/flightCredit/detailsSingle-passenger ticket credits
get_trip_credits/api/loyalty/travelCredits/tripCredit/detailsMulti-passenger / itinerary credits
get_partner_offers/loyalty/api/partnerOffersDashboard partner promotions
get_notifications/loyalty/api/notificationsAccount notifications
check_auth_status—Saved-session info: AA #, token expiry, cookie count
save_session_from_browserCDPPulls cookies from a logged-in Chromium and persists them

Setup

bash
pip install aa-mcp-server

One-time auth

aa.com is fronted by Akamai Bot Manager — you can't log in via headless requests. The flow:

  1. Launch a real Chromium with a persistent profile and a remote-debugging port:
    bash
    aa-auth-browser              # default accountaa-auth-browser personal     # named account
  2. Log into aa.com (and complete 2FA if prompted) in the window that opens.
  3. Copy the cookies into the MCP store:
    bash
    aa-mcp-server --extract-session default
    Or call the save_session_from_browser MCP tool from Claude.

The cookies live in ~/.aa-mcp/accounts/<account>/session.json. The chromium profile lives in ~/.aa-mcp/chrome-profiles/<account>/. To refresh after expiry, relaunch aa-auth-browser (the saved profile auto-refreshes the access_token cookie when you visit any aa.com page) and re-run --extract-session.

AA_MCP_CHROMIUM=<path-to-chrome.exe> overrides the auto-discovery if your Chromium is somewhere unusual.

Multi-account

Every tool takes an optional account parameter. Omit it to use the default account.

python
get_account_summary()                # defaultget_account_summary(account="spouse")

Running

bash
aa-mcp-server                        # stdio transportaa-mcp-server --setup                # show account status & setup hintsaa-mcp-server --extract-session NAME # save cookies from running Chromium

Add to your MCP client config (e.g. Claude Desktop):

json
{  "mcpServers": {    "aa": {      "command": "aa-mcp-server"    }  }}

Limitations

  • Read-only. No booking, no award redemption, no profile edits.
  • Cookie expiry. The access_token JWT lives ~45 min; the refresh_token cookie typically ~30 days. Visiting any aa.com page in the saved Chromium profile silently refreshes both. After a long gap, re-extract.
  • GraphQL coverage. Only the GetCustomer persisted query is wired up. Expanding requires capturing additional sha256Hashes from the browser bundle — easy but a per-feature task.
  • One region tested. All testing has been on US-locale aa.com. International locales may require different referer paths.

License

MIT

mcp-name: io.github.thehesiod/aa

Source: README.md at commit f66f7d1

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts