travel-hacking-toolkit: award search inside Claude Code, Codex and OpenCode

The gap between an AI agent and an award seat

General-purpose chat assistants answer travel questions from memory. Award availability is not something a model can remember: it changes daily, it is spread across 27 mileage programs, and the useful comparison is not the award price alone but the award price against the cash fare for the same route. The README frames the intended interaction directly: ask the AI for a 60,000-mile business class flight to Tokyo and the toolkit will search award availability, compare against cash prices, check loyalty balances, and report the best play. That is a retrieval and comparison job, not a writing job, which is why the project ships as tools rather than as a prompt. The audience is narrow and specific. You need an existing subscription or install of Claude Code, Codex or OpenCode, you need to be comfortable exporting API keys in a shell rc file, and you need enough interest in points and miles to justify a Seats.aero subscription. Someone who books two cash flights a year will get the free servers and little else.

Skills, MCP servers and a subagent in one plugin

The architecture follows the host tool's extension model rather than inventing one. A plugin manifest registers three kinds of component: 42 skills, which are instruction files the agent loads when a task matches; 6 MCP servers, which expose live search as callable tools; and a subagent named travel-hacker. Five of the six MCP servers are free and keyless (Skiplagged, Kiwi, Trivago, Ferryhopper, Airbnb), so cash flight and hotel search works the moment the plugin is installed. The sixth, LiteAPI, needs a key. Award search sits behind separate APIs rather than an MCP server: SEATS_AERO_API_KEY covers the 27 mileage programs, DUFFEL_API_KEY_LIVE and IGNAV_API_KEY supply cash prices from a GDS and a backup REST source, and AWARDWALLET_API_KEY plus AWARDWALLET_USER_ID pull loyalty balances, elite status and transfer ratios. Five further skills (Southwest, American Airlines, Chase, Amex, TicketsAtWork) target sites with no public API and run as Docker images that auto-pull on first use. That split is the honest part of the design: where an API exists the toolkit calls it, and where one does not it ships a container.

Installing from the marketplace versus cloning the repo

Claude Code users get the shortest path. Inside Claude Code, the README gives two commands: /plugin marketplace add borski/travel-hacking-toolkit followed by /plugin install travel-hacker@borski. The README states this installs 42 skills, 6 MCP servers and the travel-hacker subagent, and that /travel-hacker:getting-started verifies the result by reporting which API keys are configured. A shell check is also documented: claude plugin list | grep travel-hacker. Codex uses one command, codex plugin marketplace add borski/travel-hacking-toolkit, after which the plugin appears in /plugins; the README says Codex reads the catalog from .agents/plugins/marketplace.json and the manifest from plugins/travel-hacking-toolkit/.codex-plugin/plugin.json. OpenCode has no plugin format, so OpenCode users clone the repository and run ./scripts/setup.sh (or .\scripts\setup.cmd on Windows, which launches setup.ps1 with an ExecutionPolicy bypass). Contributors use the same clone path and launch with claude --plugin-dir ., which loads skills, MCP servers and the subagent from the working tree so edits take effect immediately. Cowork is the awkward case: it exposes no /plugin slash commands, so the README instructs installing through Claude Code first, because both share ~/.claude/plugins/.

Key handling is deliberate, and the reason is documented

The setup script is the most carefully specified piece of the project. On macOS, Linux, WSL and Git Bash it runs as bash <(curl -fsSL https://raw.githubusercontent.com/borski/travel-hacking-toolkit/main/scripts/setup-keys.sh); Windows has a PowerShell equivalent that downloads to $env:TEMP and deletes the file afterwards. According to the README, the script prompts for each key with masked input, validates it (rejecting values containing single quotes that would break the export, plus a per-key minimum length check), writes it to the correct shell rc with a backup, and never echoes the value back. Exports are single-quoted so other shell metacharacters survive. Manual setup is also documented: export SEATS_AERO_API_KEY, DUFFEL_API_KEY_LIVE, IGNAV_API_KEY, AWARDWALLET_API_KEY and AWARDWALLET_USER_ID in ~/.zshrc or ~/.bashrc, then source the file. The README explains why keys live in the environment rather than in the plugin's userConfig: userConfig does not propagate to skills that shell out to scripts, a limitation the author says was verified empirically and links to two upstream Claude Code issues. For 1Password users the documented launch is op run --no-masking --env-file=.env -- claude, and the README notes the --no-masking flag is required because default masking interferes with Claude Code's TTY detection.

What it costs to keep running, and where it breaks

The toolkit itself is MIT licensed and free. The dependencies are not. The README lists Seats.aero Pro at roughly $8 per month for award search, Duffel as free to search but pay per booking, Ignav at 1,000 free requests per month, and AwardWallet as requiring a business account. That is the maintenance cost: not upgrades to the repository, but a stack of third-party subscriptions and quotas that can change independently of the project. The failure modes follow from the same design. Every capability beyond the five keyless servers is one expired key, one exhausted quota or one upstream API change away from silence, and the agent will not necessarily say which. The Docker-based skills are the heaviest dependency: five containers that auto-pull on first use, so the first invocation is slow and requires a working Docker installation. There are no releases in the retrieved material, so versioning is whatever main currently contains, which suits a plugin that users install by marketplace reference but gives you no pinned artifact to fall back to. And the whole thing is tethered to plugin formats that are still moving: the README itself documents an upstream userConfig bug with two issue links, which is a fair signal that host-side behaviour is not settled.

How this differs from AwardWallet and point.me

AwardWallet, which this toolkit consumes as an API rather than replaces, is a balance and account tracker: you link loyalty programs and it shows what you hold. It does not search award availability across programs for a specific route. point.me approaches the same problem as a consumer search product with its own interface, which means you drive the search. The difference here is the execution surface. travel-hacking-toolkit has no interface of its own; it is a set of tools that an AI agent calls, and the comparison against cash fares happens inside the agent's reasoning rather than in a results table you scan. That is the trade-off worth naming. You gain the ability to chain searches conversationally and to have the agent weigh award price against cash price without you opening three tabs. You lose the visual inventory that a dedicated site gives you, and you take on the responsibility of configuring the keys that make any of it work.

Verify these four things before you rely on it

Start with /travel-hacker:getting-started inside Claude Code, which the README describes as reporting which API keys are configured and pointing at the local setup script for the missing ones. Then confirm the plugin is actually loaded with claude plugin list | grep travel-hacker. If you intend to use the Southwest, American Airlines, Chase, Amex or TicketsAtWork skills, confirm Docker is installed and accept that the first call pulls an image. Finally, check whether you hold an AwardWallet business account, because the README states a business account is required for the balance and elite status pull, and that is the feature that turns a search tool into something that knows your actual position. If any of those four checks fails, you are running the five keyless servers and nothing more, which is a perfectly usable cash flight and hotel search but a different product from the one the README leads with.

Editorial conclusion

Adopt it if you already work inside Claude Code, Codex or OpenCode and you hold points in several programs, because the plugin install is two slash commands and the five keyless servers cover cash flights and hotels immediately. Do not adopt it if you want a standalone booking site or you are unwilling to sign up for Seats.aero at roughly $8 per month, since award search is the part that needs a paid key. Before trusting any output, run /travel-hacker:getting-started to see which keys are actually configured, and confirm whether the Docker-based Southwest, American Airlines, Chase, Amex and TicketsAtWork skills have pulled their images, because those cover the sites with no public API.

Official sources

1. borski/travel-hacking-toolkit on GitHub
2. Issues
3. License: MIT
4. README