Is the Sorted Travel MCP server safe?

No scan can promise that. What its definitions show: 10 tools, 5 of which can change, send or delete something, and 0 findings from fixed checks. Allow the reads, ask before each change, and deny the deletes; the permissions block on this page does that.

Can the Sorted Travel MCP server delete data?

No tool is classed as destructive: going by their definitions, none of them deletes, cancels or revokes anything.

Can the Sorted Travel MCP server do things that cannot be undone?

No tool is classed as irreversible: none of them sends, pays, publishes or merges, going by their definitions.

What tools does the Sorted Travel MCP server have?

10 tools: 5 write, 5 read. render_recommended_destinations, render_destination_info, render_destination_weather, check_visa_requirements, update_profile_preferences, resolve_destination, get_recommended_destinations, get_destination_info and 2 more.

Does the Sorted Travel MCP server need sign-in or OAuth?

Its remote endpoint listed its tools to an anonymous client, without sign-in.

Does the Sorted Travel MCP server send data to outside services?

None of its tools sends, posts or publishes, or takes a recipient, channel or URL.

Has the Sorted Travel MCP server changed its tools?

Not since anlyon.dev started tracking it. Last scanned Nov 7, 2026.

Sorted Travel MCP server

travel.sorted/sorted-travelsorted.travelstreamable-httpv1.2.1Scanned 7 days ago

Travel ranking, place facts, weather, visa, and profile tools for Sorted Travel.

10 tools: 5 change things and 5 only read.

Reads private data · 1
Reads text others write · 0
Can send data out · 0
No findings

Tools listed without sign-in. Remote posture

With Anlyon

5 tools here change things. Govern them.

Anlyon lists the tools and adopts none.
Each tool you adopt gets approvals and receipts.
Your agent never holds the key.

Govern this server →

A tool your agent calls directly is not routed through Anlyon and is not governed by it. anlyon.dev only lists and labels, and these labels are the same either way.

What the Sorted Travel MCP server can do

The Sorted Travel MCP server is published by sorted.travel, a domain the MCP Registry verified. It has 10 tools. It can create or change data (5 tools: render_recommended_destinations, render_destination_info, render_destination_weather, check_visa_requirements and 1 more), but cannot delete data. 5 tools only read.

1 tool reads private data (get_destination_weather).

None of the fixed checks matched anything in its tool definitions. That is not a safety guarantee.

Its remote endpoint lists its tools without sign-in.

Last scanned Nov 7, 2026, version 1.2.1.

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

10 tools

Changes things 5Creates or changes something that can be changed back.Claude Code: ask

check_visa_requirementsCheck visa hassle for a passport country and destination country.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Check visa hassle for a passport country and destination country. Use visa-table country names (Ireland, not Irish; USA, not United States). Common aliases are accepted and normalized. This is planning context, not official immigration advice. Cite only place_url or source_url from this result (sorted.travel only — never invent domains).
Annotations the server declares
- title: Check visa requirements
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
render_destination_infoRender the destination facts card.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Render the destination facts card. Always call get_destination_info first, then pass its structuredContent here. Do not invent destination facts.
Annotations the server declares
- title: Render destination facts
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
render_destination_weatherRender the destination weather card.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Render the destination weather card. Always call get_destination_weather first, then pass its structuredContent here. Do not invent weather data.
Annotations the server declares
- title: Render destination weather
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
render_recommended_destinationsRender the destination recommendations carousel.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Render the destination recommendations carousel. Always call get_recommended_destinations first for a new search, then pass its destinations (and related fields) here. For a follow-up that narrows an existing list, call only this tool with the filtered destinations. Do not invent destination cards.
Annotations the server declares
- title: Render destination recommendations
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
update_profile_preferencesUpdate one saved traveler profile preference for the signed-in user.No findings
Why it is in this group
- The name "update_profile_preferences" says "update": a word for a change.
Description, as the server wrote it
Update one saved traveler profile preference for the signed-in user. Requires an OAuth 2.0 access token with the profile.write scope. Allowed fields: currency, units, sourceAirportCode, passports, visas, passportHolder, airlines, destinationInterests, activityInterests, lists.bookmarked, and lists.ignored. This cannot delete the account, unlink messengers, or change email. Intentionally omitted from OpenAI/ChatGPT tools/list while should_list_profile_preference_tools is false. Ora and other hosts still see the tool; implementation and OAuth gating stay.
Annotations the server declares
- title: Update profile preferences
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false

Only reads 5Looks things up and changes nothing.Show 5 read-only tools

get_destination_infoGet Sorted on-the-ground facts for one destination handle.No findings
Why it is in this group
- The name "get_destination_info" says "get": a word for reading.
Description, as the server wrote it
Get Sorted on-the-ground facts for one destination handle. Default tool for generic destination info ("info on Dubai", "tell me about Lisbon", "what is Tokyo like"). Returns brief, safety, currency, phone code, eSIM notes, and taxi apps. Use a sitemap handle such as hanoi, paris, or tokyo. If you only have a city, country, or airport name, call resolve_destination first. Do not use get_destination_weather for those generic info asks. Use get_destination_weather only when the traveler explicitly asks for current weather, a 7-day forecast, monthly climate, or when to visit. Send the traveler to place_url for the full page. Do not use this for bookings. This tool returns data only. After a successful call, always call render_destination_info so the place card appears.
Annotations the server declares
- title: Get destination facts
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_destination_weatherGet current weather, forecast, climate, and when-to-visit notes for one place.Reads private dataNo findings
Why it is in this group
- The name "get_destination_weather" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "get" and "note": it reads notes.
Description, as the server wrote it
Get current weather, forecast, climate, and when-to-visit notes for one place. Use when the traveler explicitly asks for current weather, a 7-day forecast, monthly climate averages, or when to visit a named destination. Do not use this for generic destination info ("info on Dubai", "tell me about Lisbon", "what is Tokyo like") — use get_destination_info instead. This tool already includes seasonal when-to-visit months; do not look for a separate when-to-visit tool. Use a sitemap handle such as hanoi, paris, or tokyo. If you only have a city, country, or airport name, call resolve_destination first. The 7-day forecast is from Foreca; credit Foreca if you paraphrase it. Send the traveler to place_url for the full page. Do not use this for bookings. This tool returns data only. After a successful call, always call render_destination_weather so the weather card appears.
Annotations the server declares
- title: Get destination weather
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_profile_preferencesRead the signed-in traveler's saved Sorted profile preferences.No findings
Why it is in this group
- The name "get_profile_preferences" says "get": a word for reading.
Description, as the server wrote it
Read the signed-in traveler's saved Sorted profile preferences. Requires an OAuth 2.0 access token with the profile.read scope. Returns passports, home airport, currency, units, destination and activity interests, preferred airlines, and bookmark or ignore lists. Does not return chat history or account-deletion controls. Intentionally omitted from OpenAI/ChatGPT tools/list while should_list_profile_preference_tools is false. Ora and other hosts still see the tool; implementation and OAuth gating stay.
Annotations the server declares
- title: Get profile preferences
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_recommended_destinationsRecommend destinations from a departure airport.No findings
Why it is in this group
- The name "get_recommended_destinations" says "get": a word for reading.
Description, as the server wrote it
Recommend destinations from a departure airport. Use this whenever the traveler asks where to go. Only set filter arguments they explicitly asked for (month, airport, budget, weather, visa, tags). Omit all other filters so Sorted keeps its defaults. Never set a filter to false just because they did not mention it. When they name a continent or region, always set destination_tags (Africa → africa, Asia → asia, Europe → europe, Americas → americas, Middle East → middle-east, Caribbean → caribbean, Australia/Oceania → australia-oceania). Do not enable direct flights unless they asked. Passport names must match the visa table (USA, United Kingdom); aliases such as United States are accepted and normalized. source_location_code must be a supported origin, a city alias (PAR, LON, NYC), or ANYWHERE. ANYWHERE is fine for weather, region, or vibe asks that are not flight- or price-sensitive; it skips flight prices and direct-route filters. Use a supported airport (not ANYWHERE) for direct, cheap/budget, flight time, or layover asks. Do not use a destination airport_code from resolve_destination unless it is in the supported list. Never invent a destination list. Do not use this for live flight tickets. This tool returns data only. After a successful call, always call render_recommended_destinations so the destination carousel appears.
Annotations the server declares
- title: Recommend destinations
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
resolve_destinationResolve a city, country, region, or airport onto Sorted destinations.No findings
Why it is in this group
- The name "resolve_destination" says "resolve": a word for reading.
Description, as the server wrote it
Resolve a city, country, region, or airport onto Sorted destinations. Use this when the traveler names a place and you do not already have a sitemap handle (paris, hanoi) or IATA code. Returns handle, name, country, airport_code, and place_url for a few live matches. After resolve: for generic info / what a place is like, call get_destination_info (not weather). Call get_destination_weather only when they asked for weather, forecast, climate, or when to visit. For where-to-go ranking, call get_recommended_destinations with airport_code. One place per call. Do not invent a handle.
Annotations the server declares
- title: Resolve a destination
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged untrusted-input or outbound.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; get_destination_weather
Reads text others write0: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Nov 8, 2026, 06:19 UTC, unchanged since Nov 8, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 5
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: not observed
RFC 9728 protected resource metadata: https://sorted.travel/.well-known/oauth-protected-resource/mcp
Authorization servers: https://sorted.travel
Legacy HTTP+SSE transport: no
Dynamic client registration: yes
Client ID metadata documents: yes

WarnThe whole server
The endpoint served tools/list without credentials, and the list has 5 tools that change things (5 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://sorted.travel/mcp: tools/list returned 10 tools to an anonymous client, including render_recommended_destinations (write), render_destination_info (write), render_destination_weather (write), check_visa_requirements (write), update_profile_preferences (write)
What this check looks for

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.2.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http sorted-travel https://sorted.travel/mcp

claude mcp add --transport http sorted-travel https://sorted.travel/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__sorted-travel__resolve_destination",
      "mcp__sorted-travel__get_recommended_destinations",
      "mcp__sorted-travel__get_destination_info",
      "mcp__sorted-travel__get_destination_weather",
      "mcp__sorted-travel__get_profile_preferences"
    ],
    "ask": [
      "mcp__sorted-travel__render_recommended_destinations",
      "mcp__sorted-travel__render_destination_info",
      "mcp__sorted-travel__render_destination_weather",
      "mcp__sorted-travel__check_visa_requirements",
      "mcp__sorted-travel__update_profile_preferences"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as sorted-travel. Review it before you use it.

Capability tags behind 1 rule

mcp__sorted-travel__get_destination_weather private-data

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/travel.sorted/sorted-travel/verify?hash=307b5cc718d2ce94fafe2bf64671b1d9ad68bc482da92fce96e126b0c11fc719" | jq -e '.changed == false'

Pinned hash 307b5cc718d2, from Nov 7, 2026, 21:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/travel.sorted/sorted-travel/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/travel.sorted/sorted-travel.svg)](https://anlyon.dev/servers/travel.sorted/sorted-travel)

Source: MCP Registry · repository. Synced Nov 7, 2026, 22:19 UTC.