Amadeus MCP Server: Complete Setup Guide for AI Travel Agents

Amadeus MCP Server: Complete Setup Guide for AI Travel Agents

Building an AI travel agent that can actually search real flights and hotels requires connecting your LLM to live travel data. The Amadeus MCP Server bridges that gap — it wraps Amadeus travel APIs inside the Model Context Protocol so that AI agents can discover and call flight search, inspiration search, and related travel tools without custom integration code for every client.

This guide covers the donghyun-chae/mcp-amadeus community implementation, available on GitHub and PyPI. This is not an official Amadeus product — it is a community-maintained MCP server that wraps the official Amadeus for Developers REST API. Other community implementations exist, but this guide focuses specifically on mcp-amadeus for the tutorial, configuration examples, and tool documentation.

By the end of this guide you will have a working Amadeus MCP Server integrated with your AI client, understand what tools it actually exposes, and know where its limitations are before you build production workflows on top of it.

What the Amadeus MCP Server Actually Is

The Model Context Protocol (MCP) is an open protocol that standardizes how AI applications discover and call external tools. When an LLM client like Claude connects to an MCP server, it receives a manifest of available tools — names, descriptions, and input schemas — and can invoke them during conversations.

The Amadeus MCP Server is a Python process that:

1. Speaks the MCP protocol over stdio (or another transport)
2. Exposes Amadeus travel API endpoints as named MCP tools
3. Authenticates with the Amadeus API using OAuth 2.0 client credentials behind the scenes
4. Returns structured travel data the LLM can reason over

The underlying data source is the Amadeus for Developers API — the same REST API available at developers.amadeus.com. The MCP server does not add proprietary data; it adds the MCP abstraction layer.

Who maintains it: donghyun-chae, a community contributor. Not Amadeus GDS, not Anthropic.

When you need it: When you want an AI agent to search flights autonomously inside a conversation, without you writing custom tool-calling code that maps LLM outputs to Amadeus API calls. The MCP Server handles that plumbing.

When you don't need it: If you're building a traditional backend service that queries Amadeus programmatically, calling the Amadeus REST API directly — or using the official amadeus-python SDK — is simpler, faster, and gives you full control.

Architecture and Data Flow

┌─────────────────────────────────────────────────────────────────┐
│                        AI Client Layer                          │
│                                                                 │
│   ┌──────────────┐    ┌──────────────┐    ┌─────────────────┐  │
│   │ Claude       │    │   Cursor     │    │  Custom Agent   │  │
│   │ Desktop      │    │   IDE        │    │  (Python/JS)    │  │
│   └──────┬───────┘    └──────┬───────┘    └────────┬────────┘  │
└──────────┼───────────────────┼─────────────────────┼───────────┘
           │  MCP Protocol     │  MCP Protocol        │
           │  (stdio/SSE)      │  (stdio/SSE)         │
           ▼                   ▼                      ▼
┌─────────────────────────────────────────────────────────────────┐
│                    mcp-amadeus Server                           │
│                 (donghyun-chae/mcp-amadeus)                     │
│                                                                 │
│  ┌─────────────────────────────────────────────────────────┐   │
│  │  MCP Tool Registry                                      │   │
│  │  • search_flights       • get_flight_inspiration        │   │
│  │  (additional tools per documented implementation)       │   │
│  └──────────────────────────┬──────────────────────────────┘   │
│                             │                                   │
│  ┌──────────────────────────▼──────────────────────────────┐   │
│  │  Amadeus Python SDK (amadeus-python)                     │   │
│  │  OAuth 2.0 Token Cache + Auto-refresh                   │   │
└──┴──────────────────────────┬───────────────────────────────┘  │
                              │  HTTPS REST                       │
                              ▼                                   │
┌─────────────────────────────────────────────────────────────────┐
│               Amadeus for Developers API                        │
│                                                                 │
│   Test: api.sandbox.amadeus.com                                 │
│   Production: api.amadeus.com                                   │
│                                                                 │
│   • Flight Offers Search (v2)                                   │
│   • Flight Inspiration Search                                   │
│   • Additional endpoints per SDK                               │
└─────────────────────────────────────────────────────────────────┘

The key insight from this diagram: the LLM never calls Amadeus directly. It calls the MCP Server, which translates the tool call into an authenticated Amadeus API request and returns the response as structured data. The LLM then interprets that data in natural language.

Prerequisites

Before installation, you need three things:

1. Python Environment

• Python 3.10 or higher
• pip or uv package manager
• uv is recommended because it creates isolated environments automatically — most MCP documentation defaults to it

Install uv if you don't have it:

curl -LsSf https://astral.sh/uv/install.sh | sh

2. An Amadeus Developer Account

Go to developers.amadeus.com and create a free account. Once registered:

1. Navigate to My Apps in the dashboard
2. Create a new application
3. Copy your API Key (Client ID) and API Secret (Client Secret)

Your test environment credentials are available immediately. Production credentials require a separate approval process from Amadeus.

3. An MCP-Compatible Client

For development, Claude Desktop is the easiest starting point. Cursor, Claude Code, and any MCP-compatible host application also work. This guide covers Claude Desktop configuration in detail.

Setting Up Your Amadeus Developer Account

This step is critical and often where developers get stuck. The Amadeus API uses OAuth 2.0 with a client credentials flow — no user login required, just your app's client ID and secret.

Test vs Production Environment

Important: Your test API keys will not work against the production endpoint and vice versa. Many developers waste hours on "invalid credential" errors because they mixed keys between environments. The Amadeus SDK and the mcp-amadeus server default to the test environment. You must explicitly pass hostname='production' to switch.

Getting Your Credentials

Amadeus Dashboard → My Apps → [Your App] → Credentials

API Key:    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX  (this is your Client ID)
API Secret: YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY  (this is your Client Secret)

Store these immediately in a password manager or secrets vault. The secret is shown only once per regeneration.

Installation

Option 1: Install via PyPI with uv (Recommended)

uv pip install mcp-amadeus

Or, to run directly without a permanent install:

uvx mcp-amadeus

The uvx approach is particularly useful for MCP client configurations because it handles environment isolation automatically.

Option 2: Install via pip

pip install mcp-amadeus

Option 3: Install from Source

git clone https://github.com/donghyun-chae/mcp-amadeus.git
cd mcp-amadeus
pip install -e .

Installing from source is useful if you want to inspect exactly what API calls the tools make, modify tool behavior, or contribute fixes upstream.

Verify Installation

python -m mcp_amadeus --help

If the package installed correctly, you'll see the server startup options. If you get a ModuleNotFoundError, check that you're in the correct virtual environment.

Setting Your API Credentials

The mcp-amadeus server reads Amadeus credentials from environment variables:

export AMADEUS_CLIENT_ID="your_api_key_here"
export AMADEUS_CLIENT_SECRET="your_api_secret_here"

For the test environment (default), these two variables are all you need. For production:

export AMADEUS_CLIENT_ID="your_production_api_key"
export AMADEUS_CLIENT_SECRET="your_production_api_secret"
export AMADEUS_HOSTNAME="production"  # check repo for exact env var name

Security note: Never commit API credentials to version control. Never hardcode them in configuration files that are checked into git. If you accidentally expose credentials, regenerate them immediately from the Amadeus dashboard.

Quick Connectivity Test

Before configuring any MCP client, verify your credentials work against the Amadeus API directly:

from amadeus import Client, ResponseError

amadeus = Client(
    client_id='your_api_key',
    client_secret='your_api_secret'
    # defaults to test environment
)

try:
    response = amadeus.shopping.flight_offers_search.get(
        originLocationCode='NYC',
        destinationLocationCode='MAD',
        departureDate='2025-11-01',
        adults=1
    )
    print(f"Success: {len(response.data)} offers found")
except ResponseError as error:
    print(f"Error: {error.response.status_code}")
    print(error.response.body)

If this returns offers, your credentials are valid and the MCP Server will work. If you get a 401, your credentials are wrong. If you get a 429, you've hit rate limits.

MCP Client Configuration

Claude Desktop

Locate your Claude Desktop configuration file:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Add the Amadeus MCP Server to your configuration:

{
  "mcpServers": {
    "amadeus": {
      "command": "uvx",
      "args": ["mcp-amadeus"],
      "env": {
        "AMADEUS_CLIENT_ID": "your_api_key_here",
        "AMADEUS_CLIENT_SECRET": "your_api_secret_here"
      }
    }
  }
}

If you installed via pip into a specific virtual environment instead of using uvx:

{
  "mcpServers": {
    "amadeus": {
      "command": "/path/to/your/venv/bin/python",
      "args": ["-m", "mcp_amadeus"],
      "env": {
        "AMADEUS_CLIENT_ID": "your_api_key_here",
        "AMADEUS_CLIENT_SECRET": "your_api_secret_here"
      }
    }
  }
}

After saving the configuration, fully restart Claude Desktop — not just close the window, but quit the application entirely and reopen it. The MCP server is only initialized on startup.

To confirm the server connected: open Claude Desktop, start a new conversation, and look for the hammer/tools icon indicating MCP tools are available. You can also ask Claude directly: "What Amadeus tools do you have available?"

Cursor

In Cursor, MCP servers are configured per-project in .cursor/mcp.json or globally in your Cursor settings.

Project-level configuration (.cursor/mcp.json):

{
  "mcpServers": {
    "amadeus": {
      "command": "uvx",
      "args": ["mcp-amadeus"],
      "env": {
        "AMADEUS_CLIENT_ID": "your_api_key_here",
        "AMADEUS_CLIENT_SECRET": "your_api_secret_here"
      }
    }
  }
}

Cursor will show connected MCP servers in the AI panel. If the server doesn't appear, check Cursor's MCP logs under Settings → MCP.

Claude Code (CLI)

Claude Code (the CLI tool) supports MCP servers via its configuration file or direct flags:

claude mcp add amadeus uvx mcp-amadeus \
  --env AMADEUS_CLIENT_ID=your_api_key \
  --env AMADEUS_CLIENT_SECRET=your_api_secret

Or in the Claude Code config file (~/.claude/config.json):

{
  "mcpServers": {
    "amadeus": {
      "command": "uvx",
      "args": ["mcp-amadeus"],
      "env": {
        "AMADEUS_CLIENT_ID": "your_api_key_here",
        "AMADEUS_CLIENT_SECRET": "your_api_secret_here"
      }
    }
  }
}

Available MCP Tools

This section documents only the tools actually implemented in the mcp-amadeus repository. Do not assume all Amadeus API endpoints are available — the MCP Server exposes a specific subset.

Based on the mcp-amadeus implementation, the server exposes tools wrapping the following Amadeus API capabilities:

search_flights

Wraps the Amadeus Flight Offers Search v2 endpoint (/shopping/flight-offers).

What it does: Searches for available flight offers between an origin and destination for given dates and passenger counts.

Inputs (typical):

• originLocationCode — IATA airport code (e.g., "JFK")
• destinationLocationCode — IATA airport code (e.g., "CDG")
• departureDate — ISO 8601 date string (e.g., "2025-11-15")
• adults — number of adult passengers
• currencyCode — (optional) currency for pricing
• max — (optional) maximum number of offers to return

Returns: Array of flight offer objects including carrier codes, itinerary segments, departure/arrival times, number of stops, and total price.

Example AI prompt: "Find me flights from London Heathrow to Tokyo Narita on November 20th for 2 adults"

get_flight_inspiration

Wraps the Amadeus Flight Inspiration Search endpoint (/shopping/flight-destinations).

What it does: Given an origin city, returns a list of destinations with the cheapest available fares — useful for open-jaw or flexible destination travel planning.

Inputs (typical):

• origin — IATA city or airport code
• departureDate — (optional) specific date or date range
• duration — (optional) trip duration in days
• maxPrice — (optional) maximum price filter

Returns: List of destination options with lowest available prices, useful for "where can I fly cheaply from X?" queries.

Example AI prompt: "Where can I fly from Paris under 200 euros in December?"

Note: Always verify the current tool list against the mcp-amadeus GitHub repository before building production workflows. Community packages evolve, and tools may be added, renamed, or deprecated between versions. For authoritative capability discovery, use the MCPForge Verify tool at mcpforge.dev/verify to inspect the live tool manifest.

Amadeus MCP Server vs Amadeus API Direct

This is the most important architectural decision you'll make when building travel AI features.

When to Use the MCP Server

• You're building an AI agent (Claude, custom agent) that needs to search flights autonomously during conversation
• You want to rapidly prototype a travel assistant without writing custom function-calling code
• You're doing travel research automation where an LLM synthesizes data across multiple queries
• You want natural language routing to different travel search types without a routing layer

When to Call the Amadeus API Directly

• You're building a production web or mobile app with real users
• You need access to Amadeus endpoints not exposed by the MCP server (hotel offers, seat maps, etc.)
• You require fine-grained control over request parameters, caching, and pagination
• You need to handle high-throughput scenarios where MCP protocol overhead matters
• You're integrating with a non-MCP AI framework (LangChain, LlamaIndex) and already have tool definitions

For teams building serious travel products: use the Amadeus API directly for your backend, and optionally run an MCP Server alongside it for internal AI agent workflows.

Real-World Amadeus MCP Workflows

1. AI Flight Search Assistant

The most direct use case. A user converses naturally with an AI assistant that uses the MCP Server to fetch real-time flight data.

Conversation flow:

User: "I need to fly from San Francisco to Barcelona in late October, 
       flexible on dates, budget around $800"

Claude (internally): calls search_flights with:
  - originLocationCode: "SFO"
  - destinationLocationCode: "BCN"
  - departureDate: "2025-10-20" through "2025-10-31" (multiple calls)
  - adults: 1
  - currencyCode: "USD"

Claude: "I found several options. The cheapest is $743 on October 23rd 
         with Iberia via Madrid (1 stop, 14h total). There's also a 
         direct United flight on October 27th for $812..."

This workflow is entirely driven by the LLM's ability to read the tool manifest and decide when and how to call search_flights. No routing code required.

2. Flexible Destination Discovery Agent

Uses get_flight_inspiration to power open-ended travel planning.

User: "I'm based in London, have 2 weeks in February, 
       and want somewhere warm under £500"

Claude (internally): calls get_flight_inspiration with:
  - origin: "LON"
  - maxPrice: 500
  - duration: 14

Claude: "Based on current fares from London, the best value 
         warm destinations are: Tenerife (£234 return), 
         Marrakech (£189 return), Cape Verde (£387 return)..."

User: "Tell me more about Marrakech and find flights"

Claude: calls search_flights for LON→RAK

This multi-turn workflow chains two tools — inspiration search followed by specific flight search — driven entirely by conversational context.

3. Travel Research Automation

For developers building internal research tools or content pipelines:

# Using Claude's API with MCP to automate travel content research
import anthropic

client = anthropic.Anthropic()

# Claude will use the connected Amadeus MCP server
response = client.messages.create(
    model="claude-opus-4-5",
    max_tokens=4096,
    messages=[{
        "role": "user",
        "content": """
        Research flight options from New York to these 5 European capitals 
        for the first week of December: London, Paris, Amsterdam, Rome, Berlin.
        For each, find the cheapest available fare and note the best airline 
        and number of stops. Format as a comparison table.
        """
    }]
)

This kind of batch research query — impractical to do manually — becomes trivial when Claude can autonomously call search_flights five times and synthesize the results.

4. Itinerary Builder Workflow

A more complex multi-step agent workflow:

1. User specifies destination and dates
2. Agent calls get_flight_inspiration to validate destination accessibility
3. Agent calls search_flights for outbound and return separately
4. Agent synthesizes cheapest combination with layover consideration
5. Agent formats complete itinerary with timing and pricing
6. User refines — agent re-searches with updated constraints

This loop works naturally in Claude Desktop because Claude maintains conversation context between tool calls. Each search result informs the next query.

5. Multi-Agent Travel Coordination

For teams building more complex systems where specialized agents collaborate:

┌─────────────────┐     ┌─────────────────┐     ┌─────────────────┐
│  Orchestrator   │────▶│  Flight Agent   │────▶│  Amadeus MCP    │
│  Agent          │     │  (mcp-amadeus)  │     │  Server         │
└────────┬────────┘     └─────────────────┘     └─────────────────┘
         │
         ├──────────────▶ Hotel Agent (separate MCP or API)
         │
         └──────────────▶ Weather Agent (weather MCP)

The Flight Agent specializes in Amadeus MCP interactions; the Orchestrator aggregates results from all agents into a complete travel package. This architecture keeps each agent focused and makes the Amadeus rate limit impact predictable.

Authentication Deep Dive

Understanding how authentication flows through the stack prevents a whole class of production errors.

OAuth 2.0 Client Credentials Flow

The Amadeus API uses standard OAuth 2.0 client credentials:

1. mcp-amadeus starts
2. On first tool call, SDK POSTs to:
   https://api.sandbox.amadeus.com/v1/security/oauth2/token
   with: grant_type=client_credentials
         client_id=YOUR_KEY
         client_secret=YOUR_SECRET
3. Amadeus returns: { access_token: "...", expires_in: 1799 }
4. SDK caches token, attaches as Bearer to subsequent API requests
5. SDK auto-refreshes token before expiry

The amadeus-python SDK handles token caching and refresh automatically. The MCP server inherits this behavior. You don't need to manage tokens manually, but you do need to ensure credentials are valid at server startup.

Credential Security in Practice

For Claude Desktop (development):

{
  "mcpServers": {
    "amadeus": {
      "command": "uvx",
      "args": ["mcp-amadeus"],
      "env": {
        "AMADEUS_CLIENT_ID": "from_password_manager",
        "AMADEUS_CLIENT_SECRET": "from_password_manager"
      }
    }
  }
}

This file is stored locally and not synced to version control by default. Keep it that way.

For production deployment:

# Never do this:
export AMADEUS_CLIENT_ID="hardcoded_in_script"

# Do this instead — pull from secrets manager at runtime:
export AMADEUS_CLIENT_ID=$(aws secretsmanager get-secret-value \
  --secret-id amadeus/client-id --query SecretString --output text)

API Rate Limits and Usage Considerations

Rate limits are the most common production failure point for Amadeus integrations.

Test Environment Limits

The Amadeus test environment enforces:

• Approximately 10 transactions per second across all endpoints
• A monthly transaction cap (check your Amadeus dashboard for exact numbers)
• No SLA guarantees on response time

For AI agent workflows that make multiple sequential tool calls, you can hit the TPS limit faster than expected — Claude might call search_flights three times in rapid succession during a single response generation.

Handling Rate Limit Errors

A 429 response from Amadeus looks like:

{
  "errors": [{
    "status": 429,
    "code": 38194,
    "title": "NETWORK_ERROR_WHILE_CONNECTING",
    "detail": "Too many requests"
  }]
}

The mcp-amadeus server will surface this as a tool error. Your AI agent should be prompted to handle it gracefully:

System prompt addition:
"If a flight search tool returns a rate limit error, wait a moment 
and inform the user that data is temporarily unavailable rather than 
retrying immediately."

Production Rate Limit Planning

Production Amadeus API limits depend on your subscription. Before going live:

1. Log into your Amadeus dashboard and review your production plan limits
2. Instrument your MCP server to count API calls per minute
3. Implement client-side queuing if you expect multiple simultaneous agents
4. Consider response caching for repeated identical searches (same route/date/passengers)

Common Errors and How to Fix Them

Error: AMADEUS_CLIENT_ID environment variable not set

Cause: The MCP server started without the required environment variables.

Fix: Check your MCP client configuration's env block. In Claude Desktop, verify the variable names match exactly — they're case-sensitive. Restart the MCP client after updating the config.

Error: 401 Unauthorized from Amadeus API

Cause: Wrong credentials, credentials for the wrong environment (test vs production), or expired/regenerated keys.

Fix:

1. Verify credentials in the Amadeus dashboard
2. Confirm you're using test keys with the test environment (default) or production keys with production
3. If keys were recently regenerated, update your MCP configuration

Error: 429 Too Many Requests

Cause: Exceeded Amadeus API rate limits, most commonly in the test environment.

Fix: Add delays between tool calls in your agent prompts. For development, spread testing over time. For production, upgrade your Amadeus plan and implement request queuing.

Error: MCP server not appearing in Claude Desktop

Cause: Configuration file syntax error, wrong file path, or Claude Desktop not fully restarted.

Fix:

1. Validate JSON syntax: cat ~/Library/Application\ Support/Claude/claude_desktop_config.json | python -m json.tool
2. Fully quit and reopen Claude Desktop (Cmd+Q, not just close window)
3. Check Claude Desktop logs for MCP initialization errors

Error: ModuleNotFoundError: No module named 'mcp_amadeus'

Cause: Package not installed, or installed in a different Python environment than what the MCP config invokes.

Fix: Use uvx mcp-amadeus instead of python -m mcp_amadeus. The uvx approach handles environment isolation. If using pip, ensure the Python path in your config points to the environment where you installed the package.

Error: Invalid IATA code or no results returned

Cause: Airport or city code doesn't match Amadeus's expected format, or the test environment doesn't have data for that route.

Fix: Use standard 3-letter IATA codes (e.g., "JFK", "LHR", "CDG"). The Amadeus test environment has good coverage for major routes but may have gaps for obscure airports. Test with a high-traffic route (NYC→LON) first to isolate whether it's a credential or routing issue.

Troubleshooting Checklist

When something doesn't work, go through this in order:

□ Credentials are set correctly as environment variables
□ Credentials are for the correct environment (test vs production)
□ Credentials test successfully against Amadeus API directly (Python test script)
□ mcp-amadeus package is installed (uvx mcp-amadeus --version or pip show mcp-amadeus)
□ MCP config JSON syntax is valid (python -m json.tool)
□ MCP client was fully restarted after config change
□ IATA codes used are valid 3-letter codes
□ Departure date is in the future (Amadeus rejects past dates)
□ Rate limits not exceeded (check Amadeus dashboard usage)
□ MCP server logs reviewed for initialization errors

Limitations You Need to Know

What mcp-amadeus Does NOT Support (As of Current Implementation)

The mcp-amadeus server exposes a subset of the Amadeus API. Unless the repository has been updated since this writing, the following are not available as MCP tools even though the underlying Amadeus API supports them:

• Hotel search and booking (Hotel Offers Search)
• Seat map and ancillary services
• Flight status and schedule lookups
• Points of Interest (POI) search
• Airport and city search
• Transfer and ground transportation
• Flight price analysis

For these capabilities, you need to either call the Amadeus API directly, build additional MCP tools on top of mcp-amadeus, or find a different community implementation.

Inherent MCP Server Limitations

• stdio transport only (by default): Each MCP client gets its own server process. This works fine for single-user scenarios but doesn't scale to multi-tenant applications without architectural changes.
• No response streaming: Tool responses are returned as complete objects. Large result sets (many flight offers) are returned all at once.
• No caching layer: Every tool call results in a live Amadeus API request. Identical searches made seconds apart will both hit the API.
• No request deduplication: If an AI agent calls search_flights twice with the same parameters (which can happen during extended reasoning), both calls hit Amadeus.

Production Deployment Considerations

If you're moving beyond development and running the Amadeus MCP Server in a production context, several additional considerations apply.

Deployment Architecture Options

Option 1: Embedded stdio (per-user, development/small scale) Each user's MCP client spawns its own mcp-amadeus process. Simple but doesn't share state, and each process consumes Amadeus API quota independently.

Option 2: Persistent HTTP/SSE server (production, multi-user) Deploy the MCP server as a long-running HTTP service. Multiple AI clients connect via SSE transport. Enables shared caching, centralized rate limit management, and better monitoring.

# Example Dockerfile for mcp-amadeus as a persistent service
FROM python:3.11-slim

WORKDIR /app

RUN pip install mcp-amadeus

ENV AMADEUS_CLIENT_ID=""
ENV AMADEUS_CLIENT_SECRET=""

# Port depends on transport implementation
EXPOSE 8080

CMD ["python", "-m", "mcp_amadeus", "--transport", "sse", "--port", "8080"]

Verify the actual transport flags supported by checking python -m mcp_amadeus --help after installation.

Monitoring

For production, instrument the following:

• Amadeus API call count per hour — Alert before hitting rate limits
• API response latency (p50, p95) — Baseline for detecting Amadeus API degradation
• Tool call error rate — Track 401, 429, 500 responses separately
• OAuth token refresh events — Unexpected frequency indicates credential issues

Secret Rotation

Amadeus API keys don't expire automatically, but you should rotate them:

• After team member departures
• If you suspect exposure
• As part of regular security hygiene (quarterly minimum)

When rotating: generate new keys first, update your secrets manager, then deploy the new config, then revoke the old keys. Never revoke before deploying.

For a deeper look at running MCP servers in production environments, see the MCPForge production deployment guide at mcpforge.dev/blog/running-mcp-in-production.

Security Considerations

What's at Risk

Your Amadeus API credentials give access to flight search data and — critically — if your account has production access, they may be tied to billing. An exposed production API key could be used by others to consume your Amadeus quota, potentially generating significant charges.

Key Mitigations

1. Scope separation: Use separate Amadeus app registrations for development and production. This limits blast radius if a key is compromised.

2. Credential file permissions: Ensure claude_desktop_config.json is not readable by other system users:

   bashCopy

   chmod 600 ~/Library/Application\ Support/Claude/claude_desktop_config.json
   

3. Never log tool inputs/outputs in production without scrubbing them first — flight search results contain pricing and availability data that could be sensitive in some business contexts.

4. Monitor for anomalous usage: Set up Amadeus dashboard alerts for unexpected API call spikes.

5. Validate your MCP server before deploying: Use MCPForge Verify at mcpforge.dev/verify to check the server's tool manifest for security anti-patterns and ensure it only exposes the tools you expect. You can also browse community-verified MCP servers at the MCPForge directory at mcpforge.dev/verified to understand what vetted implementations look like.

Best Practices Summary

✅ Use the test environment for all development and CI testing
✅ Store credentials in environment variables, never hardcode
✅ Validate credentials independently before configuring the MCP server
✅ Use IATA codes for all location parameters
✅ Restart your MCP client fully after any configuration change
✅ Monitor Amadeus API usage in your dashboard
✅ Add retry logic with backoff for 429 errors in production
✅ Pin the mcp-amadeus package version in production deployments
✅ Review the mcp-amadeus changelog before upgrading
✅ Scope Amadeus app credentials separately per environment

❌ Don't expose production credentials in development configs
❌ Don't assume all Amadeus API endpoints are available as MCP tools
❌ Don't use stdio transport for multi-user production architectures
❌ Don't skip testing with the Amadeus API directly when debugging
❌ Don't ignore rate limit errors — they indicate real architectural problems
❌ Don't mix test and production API keys

Other Community Implementations

The mcp-amadeus package by donghyun-chae is not the only community Amadeus MCP Server. Other developers have published alternative implementations with different tool sets, transport options, and language choices. If mcp-amadeus doesn't cover your required endpoints, it's worth searching GitHub for alternative implementations.

When evaluating any community MCP server, always:

• Review the source code to confirm it only calls documented APIs
• Check the maintenance activity (last commit date, open issues)
• Run it through a security assessment tool before production use
• Verify the tool manifest matches documented capabilities

The MCPForge verified directory at mcpforge.dev/verified lists community MCP servers that have been reviewed for quality and security signals.

Quick Reference

Essential Commands

# Install
uv pip install mcp-amadeus

# Run directly (for testing)
AMADEUS_CLIENT_ID=your_key AMADEUS_CLIENT_SECRET=your_secret uvx mcp-amadeus

# Check version
pip show mcp-amadeus

# Validate config JSON
python -m json.tool ~/Library/Application\ Support/Claude/claude_desktop_config.json

Key Amadeus Developer Resources

• Amadeus for Developers Portal
• Amadeus Python SDK
• Amadeus API Reference
• Flight Offers Search API
• Flight Inspiration Search API

mcp-amadeus Package

• GitHub Repository
• PyPI Package

Building AI travel agents is genuinely useful work — the gap between what users can express in natural language and what traditional flight search UIs support is enormous. The Amadeus MCP Server closes part of that gap quickly. Start with the test environment, validate your credentials, and layer in production considerations as your use case matures.