TREK
The most complete open-source travel planner: real-time collaboration, bookings, budgets, packing lists, journals, offline PWA, SSO and an AI-ready MCP server, with planet-wide place search and routing built in.
- 评测生成时间(北京时间)
- 本报告引擎
- v3.17.3
- 当前引擎
- v3.17.3
规则版本一致,但报告只反映生成时的证据,不代表项目代码和安全状态始终不变。
进入后确认来源与额度,提交才会创建任务。
核对代码版本与送评文本摘要
仅记录实际送评的受限文本,不是完整仓库审计、安装结果或运行时安全保证。Stars、下载量和仓库元数据为采集时的独立信号,不属于此 commit 快照。
liketrek/TREK @ a0943f8226269bc192c1cda992fbac33333337a1目录树:54c2542cfb6838877f38a7118bb3037ae3d14b9b
README 来源:README.md
- README.md · 23084 字符
SHA-256: b42d796767bb7b81750e9975bd0e1c07bbb567b41c2896e4476b008cea4d5f85 - docker-compose.yml · 10035 字符
SHA-256: 5185c913fb1eeb9e55d94e5e408a91734693f3fb13ecef3a4b6e1e613191d451 - Dockerfile · 9038 字符
SHA-256: 8b2c76fb9814f26ad67a8b983df726f0c51cb8cf21d484f10fd05e968528a142 - package.json · 4167 字符
SHA-256: 55a8fccbff8232c54065f5e412a91249567e0a9e083308701e5bacf7fbc4ece2 - SECURITY.md · 700 字符
SHA-256: 6030f6e909cc2029b60d8d5ce692bb2f6d18049b5e6e2472748f8cc9f7caabbb - server/.env.example · 17405 字符
SHA-256: 8247f78de21e51e855e15efb77887e1f64066d4117cb183e369e6a63af2e2172 - client/package.json · 5379 字符
SHA-256: e31acc355600e81845a45d899057a2a92843b6807ae80621f8ed9a880f38f604 - plugin-sdk/package.json · 2253 字符
SHA-256: 84707349a709e3406b8558ab15d1df657e2a20f4daef2cdb7db5336fc04508b3 - server/package.json · 5449 字符
SHA-256: 10808a516efcefffcd171e4771963a902216083fa2de887f66903ec02552c08c - shared/package.json · 3462 字符
SHA-256: 0659264bf8e6149ee464fdf9128016ce0e911243f106f4eed4ea87e48ea1e98f
摘要对应送评 UTF-8 文本,可能为限额节选,不等于 Git blob SHA。来源由采集方提供,摘要本身不证明来源真实性。
综合采用结论
证据充分,整体质量与安全表现优秀
- 基础评测完成+25/25确定性评分与静态安全扫描已完成
- README 有效证据+25/2515,816 个去重后的有效字符
- 独立证据来源+20/206 类非重复证据,重复文件不叠加
- 仓库元数据+10/10已取得仓库状态与采用数据
- 活跃记录+5/5已取得最近提交时间
- AI 复核+15/15已完成结构化 AI 证据复核
本报告评了什么
综合分用于静态采用筛选,不是任务成功率,也不代表使用 Skill 后的能力提升。
- 静态检查范围
- 记录 10 个文件 · 80,972 字符
- 只检查采集到的受限文本与已知风险模式;未读取的脚本、依赖和运行环境不在结论内。
- AI 内容复核
- 已使用
- 复核送评文本的说明和设计,不是安装测试或实际任务执行。记录缺失时不推断已使用或未使用。
- 真实任务效果
- 本报告未提供实测证据
- 没有使用/不使用 Skill 的任务对照、重复运行或耗时与 token 成本结果。采用前仍需在隔离环境验证自己的任务。
脚本引用覆盖
脚本引用覆盖记录不可得;不推断没有引用或已经检查。
TREK 部署与 MCP 接入结构
README 以组件与依赖关系描述部署(容器、反向代理、WebSocket、MCP 端点),无明确时序步骤
左右滑动查看完整图示
- • Get started 命令挂载 -v ./data:/app/data -v ./uploads:/app/uploads
- • Reverse Proxy 章节要求代理支持 /ws 升级并透传 Mcp-Session-Id
- Get started in 30 seconds 章节给出 docker run 命令,含 ENCRYPTION_KEY 与 COOKIE_SECURE=false 说明
- AI assistant and MCP 条目:OAuth 2.1 with mandatory PKCE and dynamic client registration, 410 tools, 30 resources and 4 prompts, 35 scopes
- Reverse Proxy 章节要求代理在 /mcp 双向透传 Mcp-Session-Id,并关闭 proxy_buffering
- Environment variables 章节仅外链 wiki,未在 README 列出变量默认值
- License 章节声明 AGPL v3 及网络服务修改需开源
- 问题与用途描述
- 有效 README
- 安装或接入步骤
- 可执行示例
- 未发现已知高风险模式
- 缺少错误处理或排障
- MCP 仅给出 410 工具、30 资源、4 提示的数量,未列出工具名、参数或调用示例
- 无错误处理与排障章节,仅零散提示 COOKIE_SECURE 与代理缓冲问题
- 环境变量细节外链 wiki,README 内未给出默认值表
- 插件与 AI 助手等大量功能为默认关闭,启用步骤未在 README 展开
需要自托管、多人实时协作旅行规划的个人或小团队、希望通过 MCP 让 AI 客户端操作旅行数据的自托管用户、需要离线 PWA 与地图、预算、打包清单一体化方案的用户
只想调用现成 MCP 工具、需要逐工具参数文档的开发者、无法自行配置 TLS 反向代理与 WebSocket 的环境
也有自己的公开项目?先看完证据,再用当前规则生成独立报告。
评测我的项目 →静态扫描不是安全保证,生产接入前仍应人工复核权限和数据边界。
- 01补充错误处理或排障
方法、证据与局限展开收起
GitHub Repository API
10 个文件 · 80,972 字符
v3.17.3 · AI 内容复核:已使用(deepseek-flash)
- 静态评测不会安装或执行项目代码
- 安全扫描基于高信号文件与已知模式,不能替代人工审计
- 流行度只反映采用程度,不代表安全或工程质量
30 天热度趋势
README
A self-hosted, real-time collaborative travel planner — with maps, budgets, packing lists, a journal, and AI built in.
What you get
See all features
Most of what follows is an addon an admin switches on or off. Lists, Costs, Documents, Collab, Tours, Vacay and Atlas ship on; Journey, Collections, MCP, the AI assistant, AI Parsing, Road trip, Dawarich and AirTrail ship off and are marked below.
🧭 Planning
|
🥾 Tours
|
🧳 Bookings and money
|
👥 Collaboration
|
📔 Journey and TREK Studio
|
🗺️ Atlas, Vacay and Collections
|
🤖 AI assistant and MCP
|
🧩 Plugins
|
📱 Mobile and offline
|
⚙️ Admin, accounts and security
|
AI usage
We use LLM-assisted coding tools across parts of this codebase. Nothing ships that a maintainer has not read and understood: every change goes through a pull request, is reviewed and tested, and has a human who can answer for it. "The AI wrote that" is not an answer any of us would accept from ourselves.
See How we use AI in TREK for the details.
Get started in 30 seconds
ENCRYPTION_KEY=$(openssl rand -hex 32) docker run -d --name trek -p 3000:3000 \
-e ENCRYPTION_KEY=$ENCRYPTION_KEY \
-e COOKIE_SECURE=false \
-v ./data:/app/data -v ./uploads:/app/uploads mauriceboe/trek
Open http://localhost:3000, or http://<server-ip>:3000 from another machine. On first boot TREK seeds an admin account — if you set ADMIN_EMAIL/ADMIN_PASSWORD those are used, otherwise the credentials are printed to the container log (docker logs trek).
COOKIE_SECURE=false is only for trying TREK over plain HTTP: without it the browser drops the session cookie and the login does not stick. Once TREK sits behind HTTPS (see Reverse Proxy), remove it.
Tech stack
Real-time sync via WebSocket (ws). Backend on NestJS 11. State with Zustand. Auth via JWT + OAuth 2.1 + OIDC + Passkeys (WebAuthn) + TOTP MFA. Weather via Open-Meteo (no key required). Maps with Leaflet and Mapbox GL.
Docker Compose (production)
The repository ships a ready-to-use docker-compose.yml
with secure defaults and every option documented inline. Download it, then:
docker compose up -d
See Install with Docker Compose for the full walkthrough.
Helm (Kubernetes)
helm repo add trek https://chart.liketrek.com
helm repo update
helm install trek trek/trek
See charts/README.md for values.
Install as App (PWA)
TREK works as a Progressive Web App — no App Store needed.
- Open TREK in the browser (HTTPS required)
- iOS: Share ▸ Add to Home Screen
- Android: Menu ▸ Install app (or Add to Home Screen)
TREK then launches fullscreen with its own icon, just like a native app.
Updating
See Updating — Docker Compose, Docker run, Helm, Portainer, Unraid and Proxmox, plus the encryption-key note.
Reverse Proxy
For production, put TREK behind a TLS-terminating reverse proxy. TREK uses WebSockets for real-time sync, so the proxy must support WebSocket upgrades on /ws.
If you use the MCP addon, the proxy must also pass the Mcp-Session-Id header through in both directions on /mcp — Nginx and Caddy do this by default, but a proxy that strips it makes every tool call open a new session instead of reusing one. See the Reverse Proxy wiki page for details.
Nginx
server {
listen 80;
server_name trek.yourdomain.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
server_name trek.yourdomain.com;
ssl_certificate /etc/ssl/fullchain.pem;
ssl_certificate_key /etc/ssl/privkey.pem;
# 500 MB covers backup-restore uploads (capped at 500 MB server-side).
client_max_body_size 500m;
location / {
proxy_pass http://localhost:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /ws {
proxy_pass http://localhost:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_read_timeout 86400;
}
# Only needed if you use the MCP addon. Responses are Server-Sent Events,
# so buffering must be off or tool results arrive late.
location /mcp {
proxy_pass http://localhost:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffering off;
proxy_read_timeout 3600s;
}
}
Caddy
trek.yourdomain.com {
reverse_proxy localhost:3000
}
Caddy handles TLS and WebSockets automatically.
Environment variables
Every variable, its default and what it does: see Environment Variables.
Star History
Data sources
The Atlas map's country and sub-national (province/county) boundaries come from geoBoundaries (Runfola et al., 2020), licensed CC BY 4.0. See NOTICE.md for full third-party attributions.
License
TREK is AGPL v3. Self-host freely for personal or internal company use. If you modify and offer TREK as a network service to third parties, your modifications must be open-sourced under the same licence.


