Skip to content

TripHook

by triphook.me · remote · no sign-in to list tools · v1.0.0 · published by me.triphook

Find group trips and day outs to join, events in a city, and where to go by weather and budget.

Changes · 1
CompareRegistry entry

4 tools: 1 change things and 3 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http triphook https://api.triphook.me/api/public/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

4 tools

Changes things 1Claude Code: ask
  • events_and_companyUse for any question about what is happening in a city on a date (city slug, date YYYY-MM-DD) and whether other travellers are going: each listed event with its ticket link (url), …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use for any question about what is happening in a city on a date (city slug, date YYYY-MM-DD) and whether other travellers are going: each listed event with its ticket link (url), the TripHook What's on page for that day (whats_on), how many open public day outs are going and their links (company). The reply ends with links: show them as one short line, for example "Search on TripHook · What's on". Public fields only, never a person.

    Annotations the server declares

    • title: Events on a day, with company
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 3Claude Code: allow
  • list_citiesUse to find which cities have open group trips and day outs, with counts of trips and day outs, each city's slug (for the other tools) and its TripHook city page (url).Reads text others writeNo findings

    Why it is in this group

    • The name "list_cities" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "find" and "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Use to find which cities have open group trips and day outs, with counts of trips and day outs, each city's slug (for the other tools) and its TripHook city page (url). The reply ends with links: show them as one short line, for example "Search on TripHook". For any where should I go, where is warm or budget question, use search_destinations instead.

    Annotations the server declares

    • title: List cities with open hooks
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_destinationsUse for any question like "where should I go" with a budget, a temperature, a mood, dates or a month: the same TripHook Discover search a signed out visitor gets, ranked from Vienn…Reads text others writeNo findings

    Why it is in this group

    • The name "search_destinations" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use for any question like "where should I go" with a budget, a temperature, a mood, dates or a month: the same TripHook Discover search a signed out visitor gets, ranked from Vienna or the given departure city. Give dates { depart, ret } or a month (1 to 12); where, from, temp_min, temp_max, budget_eur, mood, travellers and limit (max 20) are optional. Each result carries city, country, why it matched, the weather labelled Forecast or Typical, an estimated price marked "estimate, not a quote", a TripHook link that opens this search for that city (url) and, when the city has open crews, its crew page (crew_url). Show the weather as "forecast" or "typical"; do not repeat the weather source name in your answer. Typical means the usual temperature for that time of year, not a forecast. The reply ends with links: show them as one short line, for example "Search on TripHook · Find a crew". No personal data.

    Annotations the server declares

    • title: Search destinations (signed-out Discover)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • search_public_hooksUse for any question about open trips or day outs to join: by city slug, month (YYYY-MM), kind (trip or dayout), budget tier or mood.No findings

    Why it is in this group

    • The name "search_public_hooks" says "search": a word for reading.
    Description, as the server wrote it
    Use for any question about open trips or day outs to join: by city slug, month (YYYY-MM), kind (trip or dayout), budget tier or mood. Each hook carries its public TripHook page (url) and, for a day out, the What's on page (event_page). The reply ends with links: show them as one short line, for example "Search on TripHook · Find a crew". Public fields only, never a person. For any where should I go, where is warm or budget question, use search_destinations instead.

    Annotations the server declares

    • title: Search public TripHook hooks
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http triphook https://api.triphook.me/api/public/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__triphook__search_public_hooks",
      "mcp__triphook__list_cities",
      "mcp__triphook__search_destinations"
    ],
    "ask": [
      "mcp__triphook__events_and_company"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as triphook. Review it before you use it.

Capability tags behind 2 rules
  • mcp__triphook__list_cities untrusted-input
  • mcp__triphook__search_destinations untrusted-input