# The MCP server

> Connect any MCP client to Travel Orbit with OAuth sign-in, and the tools it gets for trips, departures, destinations and bookings.

Source: https://docs.bifrostorbit.com/travel/developers/mcp/

Travel Orbit has an MCP (Model Context Protocol) server, so AI assistants can read and write trips the way someone on your team does. The address is:

```text
https://app.bifrostorbit.com/travel/mcp
```

It uses the Streamable HTTP transport. The same address, with install buttons, is on **AI assistants** under **Developers**. For what someone on your team sees, read [Connect an AI assistant](https://docs.bifrostorbit.com/travel/everyone/ai-assistants/).

## Signing in

The server uses OAuth 2.1 with PKCE (S256) and dynamic client registration, so a client needs nothing but the address. An unauthenticated request gets `401` with a `WWW-Authenticate` header that points to the resource metadata.

| What | Where |
| --- | --- |
| Resource metadata | `/travel/.well-known/oauth-protected-resource/mcp` |
| Authorisation server metadata | `/travel/.well-known/oauth-authorization-server`, also at `/.well-known/oauth-authorization-server/travel` |
| Register a client | `POST /travel/oauth/register` |
| Authorise | `/travel/oauth/authorize` |
| Token | `POST /travel/oauth/token` |
| Revoke | `POST /travel/oauth/revoke` |

Clients are public (`token_endpoint_auth_method` is `none`) and register up to ten redirect addresses, each `https`, or `http` on `localhost`, `127.0.0.1` or `[::1]`. The scope is `travel`. The person signs in to Orbit, chooses the organisation and allows the connection. An authorisation code lasts one minute. Access tokens last one hour; the client renews them with the refresh token, which changes each time and lasts 30 days from its last use. A registered client that is never used again is forgotten after 180 days.

Every request runs as the person who connected, with their current Travel Orbit role. If they lose access, requests get `403`. A missing or unknown token gets `401` with 'Connect the assistant to Travel Orbit again'. Requests over 1 MB get `413`. Errors come back as JSON-RPC errors with code `-32001` and the message.

## Tools

| Tool | What it does | Role |
| --- | --- | --- |
| `list_trips` | Trips with id, status and countries, and the organisation's languages | Everyone |
| `get_trip` | A trip's text and itinerary in one language, packages with prices, and how far each language is translated | Everyone |
| `search` | Trips by name, bookings by reference, destinations by name | Everyone |
| `list_departures` | Dates of a trip, or upcoming dates of every trip, with places booked, held and left | Everyone |
| `get_availability` | Places left on a trip's upcoming dates | Everyone |
| `list_bookings`, `get_booking`, `list_requests` | Bookings with reference, trip, date, names and amounts | Everyone |
| `list_destinations`, `get_destination` | Destination pages and how complete they are | Everyone |
| `create_trip` | A new draft trip with its text, priced at 0 | Editor |
| `update_trip_text` | Name, summary, description, highlights, included, not included and day texts, per language | Editor |
| `translate_trip` | Machine-translates what isn't translated into a language yet | Editor |
| `create_departure` | A new date with the trip's prices; closed on a published trip unless `openForBooking` is `true` | Editor |
| `update_destination_text` | A destination page's text, per language | Editor |

Amounts are whole minor units, such as øre or cents. Leave out `locale` for the main language. A translation can only be written for text that exists in the main language.

## Limits

- No tool publishes, refunds, takes payments, or changes Stripe, settings, discount codes or people.
- `update_trip_text` refuses any change to prices, payment plans or cancellation tiers, even if the rest of the trip would save.
- Booking tools return names only: never emails, phone numbers, addresses, passports, dates of birth, answers or notes.
- Every change is in the [audit trail](https://docs.bifrostorbit.com/travel/everyone/audit-trail/) as the person and the client's name, such as "Kari via Claude".

## Try it

With Claude Code:

```bash
claude mcp add --transport http travel-orbit https://app.bifrostorbit.com/travel/mcp
```

Then ask, for example, "Write a Norwegian summary for Lofoten ridge walk".