Yes, Flightaware is free to use.

How do I install Flightaware?

Flightaware is a local plugin. Install it using npm package: @chrischall/flightaware-mcp and add the generated configuration snippet to your AI app's MCP config file. Then restart your AI app.

Is Flightaware safe to use?

Yes. Flightaware passed MCP Marketplace's automated security scan with a score of 7.5/10 (low risk). Every server on MCP Marketplace is security-scanned before it's listed; see the full security report on this page for the findings and permissions.

What credentials does Flightaware need?

Flightaware requires the following credentials or environment variables: AEROAPI_API_KEY, AEROAPI_OUTPUT_DIR, AEROAPI_CACHE_TTL, AEROAPI_STATIC_CACHE_TTL. You can find setup instructions on the server detail page.

What AI apps work with Flightaware?

Flightaware uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Flightaware MCP Server

by Chris Hall

Developer ToolsModerate7.5Local

Free

Live flight tracking and aviation data via FlightAware AeroAPI (flights, airports, alerts).

About

Live flight tracking and aviation data via FlightAware AeroAPI (flights, airports, alerts).

Security Report

7.5

Moderate7.5Low Risk

The FlightAware AeroAPI server authenticates with a key read from AEROAPI_API_KEY, sends it only to the official https://aeroapi.flightaware.com base URL, and gates every alert write behind a confirmation flow. Its permissions (network calls to AeroAPI, env var reads, PNG writes confined to an output directory, and optional .env loading) match its flight-tracking purpose. The only notable concern is that the set-alerts-endpoint tool can redirect flight alert payloads to any https host, which is mitigated by the confirmation requirement. No hardcoded secrets, shell execution, or exfiltration patterns from the confirmed-dangerous list were found. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

7 files analyzed · 6 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

What You'll Need

Set these up before or after installing:

Your FlightAware AeroAPI key (flightaware.com/aeroapi/portal)Required

Environment variable: AEROAPI_API_KEY

Default directory for flight-map PNGs (default: current working directory)Optional

Environment variable: AEROAPI_OUTPUT_DIR

Seconds to cache identical live-data GET responses (default 15; 0 disables)Optional

Environment variable: AEROAPI_CACHE_TTL

Seconds to cache reference data — airports, operators, routes, ownership (default 3600; 0 disables)Optional

Environment variable: AEROAPI_STATIC_CACHE_TTL

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-chrischall-flightaware-mcp": {
      "env": {
        "AEROAPI_API_KEY": "your-aeroapi-api-key-here",
        "AEROAPI_CACHE_TTL": "your-aeroapi-cache-ttl-here",
        "AEROAPI_OUTPUT_DIR": "your-aeroapi-output-dir-here",
        "AEROAPI_STATIC_CACHE_TTL": "your-aeroapi-static-cache-ttl-here"
      },
      "args": [
        "-y",
        "@chrischall/flightaware-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

flightaware-mcp

MCP server for FlightAware AeroAPI (v4) — live flight tracking and aviation data for Claude. Track flights, read airport boards, look up operators and aircraft, fetch scheduled flights, and manage flight alerts, all over stdio.

Developed and maintained by AI (Claude Code). Use at your own discretion.

Quick start

{
  "mcpServers": {
    "flightaware": {
      "command": "npx",
      "args": ["-y", "@chrischall/flightaware-mcp"],
      "env": { "AEROAPI_API_KEY": "your-aeroapi-key-here" }
    }
  }
}

Get a key at flightaware.com/aeroapi/portal. The free Personal tier (500 calls/month) is enough to start; AeroAPI bills per query.

Tools

Area	Tools
Flights	`fa_get_flights`, `fa_search_flights`, `fa_search_flights_advanced`, `fa_search_flight_positions`, `fa_count_flights`, `fa_get_flight_track`, `fa_get_flight_position`, `fa_get_flight_route`, `fa_get_flight_map`, `fa_get_flight_history`, `fa_resolve_flight`
Airports	`fa_get_airport`, `fa_get_airport_flights`, `fa_get_airport_flight_counts`, `fa_get_airport_routes`, `fa_list_airports`, `fa_get_nearby_airports`, `fa_get_airport_delays`, `fa_get_airport_weather`, `fa_resolve_airport`
Operators / aircraft	`fa_get_operator`, `fa_get_operator_flights`, `fa_list_operators`, `fa_get_aircraft_owner`
Schedules / predictive	`fa_get_scheduled_flights`, `fa_foresight_search` (premium tier)
Alerts	`fa_list_alerts`, `fa_get_alert`, `fa_create_alert`, `fa_update_alert`, `fa_delete_alert`, `fa_get_alerts_endpoint`, `fa_set_alerts_endpoint`
Health	`fa_healthcheck` — is this connector working? Reports whether AEROAPI_API_KEY resolved, whether AeroAPI accepted it, and what to fix. Uses a static-cached lookup, so repeat checks are not re-billed.

Alert mutations (fa_create_alert, fa_update_alert, fa_delete_alert, fa_set_alerts_endpoint) ask you to confirm before they write — see Confirmations.

Confirmations

Every alert mutation asks for your confirmation before it touches your AeroAPI account. A client that can show a confirmation prompt (Claude Code) shows one. On a client that cannot (claude.ai, Claude Desktop), the first call makes no network call and returns a preview of the exact request (method, path, body) plus a confirmToken; only a repeat call with that token sends it. A token acts once, expires, and is refused if the request changed since the preview.

variable	default
`MCP_CONFIRM_MODE`	`ask-user`	What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call does nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: writes are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt, unless `MCP_CONFIRM_ELICITATION=off`. An unrecognised value is treated as `refuse`.
`MCP_CONFIRM_ELICITATION`	`on`	`off` never sends a confirmation prompt, so every client gets the `MCP_CONFIRM_MODE` path. Set it for a client that declares it can show prompts but never does (the gated call hangs — opencode 2.0.x). Any other value stays `on`, with a stderr warning.
`MCP_CONFIRM_TTL_SECONDS`	`600`	How long a token stays valid.
`MCP_CONFIRM_SECRET`	random per process	Signing key; set it only if tokens must survive a server restart.

Configuration

Var	Required	Purpose
`AEROAPI_API_KEY`	yes	Your AeroAPI key (sent as the `x-apikey` header).
`AEROAPI_OUTPUT_DIR`	no	Default directory for flight-map PNGs (default: `~/Downloads/flightaware-mcp`). A per-call `output_dir` must be inside this directory (or inside `~/Downloads/flightaware-mcp` when it is unset).
`AEROAPI_CACHE_TTL`	no	Seconds to cache identical live-data GET responses (default: 15; `0` disables). Cuts AeroAPI per-query billing.
`AEROAPI_STATIC_CACHE_TTL`	no	Longer TTL for reference data — airport/operator info, routes, ownership, canonical lookups (default: 3600; `0` disables).