跳到主要内容
Supermarket
返回能力市场
MCP Server
design
AGPL-3.0

TREK

The most complete open-source travel planner: real-time collaboration, bookings, budgets, packing lists, journals, offline PWA, SSO and an AI-ready MCP server, with planet-wide place search and routing built in.

liketrekliketrek
88/ 100

公开评测 · 综合采用结论

证据充分,整体质量与安全表现优秀

查看评测依据 评测我的项目基于公开项目证据,非安全认证或安装推荐
15.5kstars
1.3kforks
最近更新 12小时前
评测生成时间(北京时间)
本报告引擎
v3.17.3
当前引擎
v3.17.3

规则版本一致,但报告只反映生成时的证据,不代表项目代码和安全状态始终不变。

重新评测此项目

进入后确认来源与额度,提交才会创建任务。

核对代码版本与送评文本摘要

仅记录实际送评的受限文本,不是完整仓库审计、安装结果或运行时安全保证。Stars、下载量和仓库元数据为采集时的独立信号,不属于此 commit 快照。

liketrek/TREK @ a0943f8226269bc192c1cda992fbac33333337a1

目录树:54c2542cfb6838877f38a7118bb3037ae3d14b9b

README 来源:README.md

  • README.md · 23084 字符
    SHA-256: b42d796767bb7b81750e9975bd0e1c07bbb567b41c2896e4476b008cea4d5f85
  • docker-compose.yml · 10035 字符
    SHA-256: 5185c913fb1eeb9e55d94e5e408a91734693f3fb13ecef3a4b6e1e613191d451
  • Dockerfile · 9038 字符
    SHA-256: 8b2c76fb9814f26ad67a8b983df726f0c51cb8cf21d484f10fd05e968528a142
  • package.json · 4167 字符
    SHA-256: 55a8fccbff8232c54065f5e412a91249567e0a9e083308701e5bacf7fbc4ece2
  • SECURITY.md · 700 字符
    SHA-256: 6030f6e909cc2029b60d8d5ce692bb2f6d18049b5e6e2472748f8cc9f7caabbb
  • server/.env.example · 17405 字符
    SHA-256: 8247f78de21e51e855e15efb77887e1f64066d4117cb183e369e6a63af2e2172
  • client/package.json · 5379 字符
    SHA-256: e31acc355600e81845a45d899057a2a92843b6807ae80621f8ed9a880f38f604
  • plugin-sdk/package.json · 2253 字符
    SHA-256: 84707349a709e3406b8558ab15d1df657e2a20f4daef2cdb7db5336fc04508b3
  • server/package.json · 5449 字符
    SHA-256: 10808a516efcefffcd171e4771963a902216083fa2de887f66903ec02552c08c
  • shared/package.json · 3462 字符
    SHA-256: 0659264bf8e6149ee464fdf9128016ce0e911243f106f4eed4ea87e48ea1e98f

摘要对应送评 UTF-8 文本,可能为限额节选,不等于 Git blob SHA。来源由采集方提供,摘要本身不证明来源真实性。

Evaluation report

综合采用结论

88
A
满分 100 · 静态采用参考
值得推荐低风险
决策摘要

证据充分,整体质量与安全表现优秀

100%
高置信度
92
文档
100
安全
77
质量
100
活跃
65
采用
  • 基础评测完成+25/25确定性评分与静态安全扫描已完成
  • README 有效证据+25/2515,816 个去重后的有效字符
  • 独立证据来源+20/206 类非重复证据,重复文件不叠加
  • 仓库元数据+10/10已取得仓库状态与采用数据
  • 活跃记录+5/5已取得最近提交时间
  • AI 复核+15/15已完成结构化 AI 证据复核

本报告评了什么

综合分用于静态采用筛选,不是任务成功率,也不代表使用 Skill 后的能力提升。

静态检查范围
记录 10 个文件 · 80,972 字符
只检查采集到的受限文本与已知风险模式;未读取的脚本、依赖和运行环境不在结论内。
AI 内容复核
已使用
复核送评文本的说明和设计,不是安装测试或实际任务执行。记录缺失时不推断已使用或未使用。
真实任务效果
本报告未提供实测证据
没有使用/不使用 Skill 的任务对照、重复运行或耗时与 token 成本结果。采用前仍需在隔离环境验证自己的任务。

脚本引用覆盖

脚本引用覆盖记录不可得;不推断没有引用或已经检查。

How it works · 架构图

TREK 部署与 MCP 接入结构

README 以组件与依赖关系描述部署(容器、反向代理、WebSocket、MCP 端点),无明确时序步骤

AI 提取 · 证据约束

左右滑动查看完整图示

TREK 部署与 MCP 接入结构README 以组件与依赖关系描述部署(容器、反向代理、WebSocket、MCP 端点),无明确时序步骤HTTPS请求/ws与/mcp转发挂载存储浏览器或AI客户端调用方TLS反向代理转发TREK容器应用主体data与uploads卷持久化
图示依据
  • • Get started 命令挂载 -v ./data:/app/data -v ./uploads:/app/uploads
  • • Reverse Proxy 章节要求代理支持 /ws 升级并透传 Mcp-Session-Id
五维表现
TREK 是自托管旅行规划器,功能清单与 Docker 一键启动示例具体,MCP 服务端有 OAuth 2.1、PKCE、410 工具与审计日志等设计证据;但 MCP 工具清单、参数与调用示例缺失,排障章节也缺,采用前需自行摸索。
质量证据
  • Get started in 30 seconds 章节给出 docker run 命令,含 ENCRYPTION_KEY 与 COOKIE_SECURE=false 说明
  • AI assistant and MCP 条目:OAuth 2.1 with mandatory PKCE and dynamic client registration, 410 tools, 30 resources and 4 prompts, 35 scopes
  • Reverse Proxy 章节要求代理在 /mcp 双向透传 Mcp-Session-Id,并关闭 proxy_buffering
  • Environment variables 章节仅外链 wiki,未在 README 列出变量默认值
  • License 章节声明 AGPL v3 及网络服务修改需开源
采用建议
优势
  • 问题与用途描述
  • 有效 README
  • 安装或接入步骤
  • 可执行示例
  • 未发现已知高风险模式
关注点
  • 缺少错误处理或排障
  • MCP 仅给出 410 工具、30 资源、4 提示的数量,未列出工具名、参数或调用示例
  • 无错误处理与排障章节,仅零散提示 COOKIE_SECURE 与代理缓冲问题
  • 环境变量细节外链 wiki,README 内未给出默认值表
  • 插件与 AI 助手等大量功能为默认关闭,启用步骤未在 README 展开
适合

需要自托管、多人实时协作旅行规划的个人或小团队、希望通过 MCP 让 AI 客户端操作旅行数据的自托管用户、需要离线 PWA 与地图、预算、打包清单一体化方案的用户

不建议直接用于

只想调用现成 MCP 工具、需要逐工具参数文档的开发者、无法自行配置 TLS 反向代理与 WebSocket 的环境

也有自己的公开项目?先看完证据,再用当前规则生成独立报告。

评测我的项目 →
文档证据
92/100
问题与用途描述10 分
有效 README12 分
安装或接入步骤14 分
可执行示例16 分
输入、参数或工具说明11 分
输出或结果说明9 分
限制、权限或边界12 分
错误处理或排障8 分
许可证信息5 分
结构化章节3 分
安全证据
低风险
未发现已知高风险模式

静态扫描不是安全保证,生产接入前仍应人工复核权限和数据边界。

优先改进清单
  1. 01补充错误处理或排障
方法、证据与局限展开
数据来源

GitHub Repository API

扫描范围

10 个文件 · 80,972 字符

评测引擎

v3.17.3 · AI 内容复核:已使用(deepseek-flash)

局限
  • 静态评测不会安装或执行项目代码
  • 安全扫描基于高信号文件与已知模式,不能替代人工审计
  • 流行度只反映采用程度,不代表安全或工程质量

30 天热度趋势

README

TREK
your trip. your plan.

A self-hosted, real-time collaborative travel planner — with maps, budgets, packing lists, a journal, and AI built in.


Demo   Docker   Sonar Quality Gate   GitHub Actions Workflow Status   Discord   Roadmap   Ko-fi   BMAC
License Latest Release Docker Pulls Stars


TREK, a tour of the app

What you get

Plan, track, share
See all features

Most of what follows is an addon an admin switches on or off. Lists, Costs, Documents, Collab, Tours, Vacay and Atlas ship on; Journey, Collections, MCP, the AI assistant, AI Parsing, Road trip, Dawarich and AirTrail ship off and are marked below.

🧭 Planning

  • Day plans: drag places, notes and bookings between days with undo, or drop a map marker straight onto a day
  • Maps: Leaflet, Mapbox GL or MapLibre GL (OpenFreeMap, no token) with clustering, photo markers, route lines and a whole-trip route overview
  • Places: search the TREK Places index and OpenStreetMap with no key, or Google Places and Amap with one. Descriptions, hours and photos from Wikipedia, Wikidata and Wikimedia Commons, plus a rating and a custom image per place
  • Explore: nearby places by category for the map view, from the TREK Places index with Overpass as fallback
  • Routes: auto-sort a day (nearest neighbour then 2-opt, locked stops and hotels stay put), a travel mode per leg over OSRM or Valhalla, then open the day in Google Maps or CoMaps and a place in seven navigation apps
  • Public transport: door-to-door itineraries over Transitous, or Google where Transitous has no data
  • Import and export: Google Maps and Naver Maps lists, Google Maps directions links, GPX, KML and KMZ in; GPX and an ICS feed per trip or across all trips out
  • Weather: 16-day forecast from Open-Meteo, no key, and the archive for dates beyond it
  • Trip dates: move a trip and its days re-date themselves, with the bookings along or re-anchored. Trips also copy and archive
  • Road trip (off by default): drives with stops, day windows and arrival times that recompute, route alternatives, hazards and EV charging with range

🥾 Tours

  • Seven tour types: hike, city walk, run, bike (touring, road, gravel, MTB), paddle (kayak, canoe, SUP), horse ride, and ski and winter (alpine, cross-country, touring, snowshoe, winter hike)
  • Routing: legs routed over Valhalla with shaping points, hand-drawn legs, route variants, round hikes of a wished length and trip places as stops, all with undo
  • Hikes: routed within a maximum SAC grade (T1 to T6), the trail grades along the way, and via ferratas on the map
  • Terrain: elevation profile, ascent and descent, and a 3D terrain map with grade colouring and a flyover, no token needed. Topo, hiking, cycling and satellite bases with sea marks and ski pistes as overlays
  • Multi-day tours: one route cut into stages and spread across the trip's days
  • Along the way: viewpoints, huts, water, food and more within a corridor of the route, inserted as a stop with the detour it adds
  • Ski, paddle and city walks: a piste router by difficulty and lift type; a water router with portages, locks and a wind forecast; city walks with stays, opening hours and transit between stops
  • Plan against reality: link a recorded GPX to a planned day and compare distance, ascent and time. Import trails from a wanderer instance, save tours to a collection and take them into another trip

🧳 Bookings and money

  • Reservations: 18 booking types with status, confirmation code, travellers and attached files
  • Flights and trains: several legs with stopovers and endpoint timezones, against 4,045 bundled airports so local times resolve without a key
  • Accommodation: a stay spans a range of nights with a check-in window
  • Booking import: EML, PDF, PKPass, HTML, TXT and photos of confirmations, through KItinerary or an AI model, with a review step before anything is saved. Prices become linked costs
  • AirTrail (off by default): import flights from a self-hosted AirTrail instance and keep them in sync
  • Costs: split in integer cents with equal or custom shares, several payers, settle-up suggestions, a per-person summary, a settlement log and CSV export. A receipt photo can fill in an expense
  • Currencies: one per expense with the rate frozen at entry, from Frankfurter with no key
  • Packing lists and to-dos: categories, templates, assignees and visibility tiers; bags with weights as an admin switch; to-dos with due dates, priorities and reminders
  • Files: attach to a trip, place, day or booking, 50 MB each and 500 MB for video, with trash and restore
  • PDF export: cover, place photos, day notes, bookings and costs, with an optional page break per day

👥 Collaboration

  • Real-time sync (WebSocket): edits land live for everyone who has the trip open
  • Members: add by email or username, hand over ownership, or add guests who have no login at all
  • Permissions: an admin maps each of 17 trip actions to admin, trip owner, trip member or everybody
  • Invites: one reusable link per trip with an optional expiry, and admin signup invites that drop a new account straight into a trip
  • Public share: a read-only trip page without an account, with switches for map, bookings, packing, costs and chat
  • Collab: group chat with replies, reactions and link previews, shared notes, links, polls and a What's Next list, each one its own switch
  • Notifications: an inbox grouped by day with answers right from the notification, and a per-user matrix of events against in-app, email, webhook, ntfy, Web Push and plugin channels

📔 Journey and TREK Studio

  • Journey (off by default): dated entries with story, mood, weather and tags, photos and video from uploads, Immich or Synology Photos, map views, co-authors, drafts and a public share link
  • Linked journal: a trip can show one journal as its own, with the members picked on the trip as viewers or editors
  • Recorded days (with Dawarich): keep a day's recorded route and turn its stays into entries
  • TREK Studio: turn a journal into a printable photo book. 34 print-licensed typefaces, 17 themes, 108 designed pages in twelve styles, 160 recolourable stickers, text effects, layers and a Travel tab with route maps, country stamps and trip figures
  • Auto layout: lays the whole book on the designed pages in the style of its theme, every photo in a frame, or rebuilds one spread
  • Print and share: PDF export as pages or spreads with crop marks, several people editing at once, and design files to move a spread into another book

🗺️ Atlas, Vacay and Collections

  • Atlas: countries and regions visited on geoBoundaries outlines, a bucket list, travel stats, and a tour activities tab with planned against recorded totals
  • Vacay: leave calendar with half days, public holidays from date.nager.at, school holidays for 16 European countries, company holidays, carry-over between years, and joint or read-only sharing
  • Collections (off by default): a place library outside any trip with lists, labels, ratings, a status per place, cover images, GPX and file export, copy into a trip, and sharing by invite
  • Dawarich (off by default): link a Dawarich instance for recorded tracks, suggested stays and countries for the Atlas

🤖 AI assistant and MCP

  • AI assistant (off by default): a chat that plans with you in a trip, across all your trips, in a journal and in Studio, and works with tours, costs, bookings, packing, Vacay and the Atlas
  • Your own model: an API key for Anthropic, OpenAI, Gemini or OpenRouter, a ChatGPT plan, or any OpenAI-compatible endpoint, set for the instance or per user
  • You stay in charge: reads run at once, every change waits as a card to apply or discard and can be undone for 15 minutes. Nothing leaves before you agree to the provider, and a file's text only with your consent
  • Attachments: drop a booking confirmation, a GPX file or a photo into the chat, and the assistant offers what to do with it
  • MCP server (off by default): OAuth 2.1 with mandatory PKCE and dynamic client registration, 410 tools, 30 resources and 4 prompts, 35 scopes in 17 groups ticked on the consent screen, and every call in the audit log
  • Addon-aware: twelve addon gates decide which tools a session sees, and flipping one re-registers live sessions

🧩 Plugins

  • Third-party plugins: install from the TREK registry or sideload a zip, with their own pages under /plugins/<id>
  • Sandboxed: one child process per plugin, 66 grantable permissions, an admin-edited outbound host allowlist, memory and call caps
  • Trust: registry downloads are pinned by sha256 and checked against the author's minisign key, a sideloaded zip is marked unverified, and TREK_PLUGINS_ENABLED=false turns the whole system off
  • Extension points: map layers, place details, day schedules, PDF sections, Atlas layers, journal rows, trip warnings, search and photo providers, route profiles, notification channels and MCP tools
  • SDK: trek-plugin-sdk with a CLI to create, validate, run against real data, sign and publish

📱 Mobile and offline

  • Installable: iOS and Android straight from the browser, no App Store, standalone with a themed status bar
  • Phone layouts: their own screens for every part of the app, with a bottom bar and dashboard widgets the user orders
  • Offline reads: the app shell is precached and trips, places, tours, files and nearby places live in a per-user IndexedDB store, so a trip opens with no network
  • Offline writes: changes queue and replay with an X-Idempotency-Key, and a stale edit waits for a keep-mine or keep-theirs choice
  • Offline maps: raster and vector tiles of a trip downloaded ahead, and a switch that takes the whole app offline on purpose

⚙️ Admin, accounts and security

  • Sign-in: password, OIDC and passkeys each switch on and off on their own, OIDC_ONLY leaves SSO as the only way in, and an OIDC claim can grant admin
  • SSO and 2FA: one OIDC provider by discovery with PKCE (Authentik, Keycloak, Google and the like), TOTP with backup codes that an admin can require, and passkeys that count as the second factor
  • Sessions: every sign-in is a session you can see and end, one by one or all others at once
  • Hardening: rate limits on sign-in, reset and 2FA, a password policy, secrets encrypted at rest and masked on read, and an SSRF guard on every URL you configure
  • Admin panel: users and the permission matrix, defaults for new users, categories and templates, addons, plugins, storage, notifications, MCP tokens, backups, audit log and releases
  • Backups and storage: scheduled backups with retention that restore their own secrets, and local or S3-compatible storage per content category with replicas
  • Appearance: light, dark or follow the OS, seven colour schemes plus a custom accent, transparency, density, reduced motion and text size
  • 27 languages: en, de, es, fr, it, nl, hu, ru, zh, zh-TW, pl, cs, ar (right to left), br, id, tr, ja, ko, uk, gr, sv, vi, ca, az, et, sk, th
  • Help center: a ? in the top bar with 381 step-by-step guides with screenshots, searched together with the wiki that ships in the image

Atlas · dashboard · trip planner Mobile PWA · dashboard, day plan, map, costs Collections · journey journal · costs

AI usage

We use LLM-assisted coding tools across parts of this codebase. Nothing ships that a maintainer has not read and understood: every change goes through a pull request, is reviewed and tested, and has a human who can answer for it. "The AI wrote that" is not an answer any of us would accept from ourselves.

See How we use AI in TREK for the details.


Get started in 30 seconds

ENCRYPTION_KEY=$(openssl rand -hex 32) docker run -d --name trek -p 3000:3000 \
  -e ENCRYPTION_KEY=$ENCRYPTION_KEY \
  -e COOKIE_SECURE=false \
  -v ./data:/app/data -v ./uploads:/app/uploads mauriceboe/trek

Open http://localhost:3000, or http://<server-ip>:3000 from another machine. On first boot TREK seeds an admin account — if you set ADMIN_EMAIL/ADMIN_PASSWORD those are used, otherwise the credentials are printed to the container log (docker logs trek).

COOKIE_SECURE=false is only for trying TREK over plain HTTP: without it the browser drops the session cookie and the login does not stick. Once TREK sits behind HTTPS (see Reverse Proxy), remove it.

Docker Compose  ·  Helm / Kubernetes  ·  Install as PWA  ·  Reverse Proxy


Tech stack

Node.js NestJS SQLite React Vite TypeScript Tailwind Leaflet Docker

Real-time sync via WebSocket (ws). Backend on NestJS 11. State with Zustand. Auth via JWT + OAuth 2.1 + OIDC + Passkeys (WebAuthn) + TOTP MFA. Weather via Open-Meteo (no key required). Maps with Leaflet and Mapbox GL.


Docker Compose (production)

The repository ships a ready-to-use docker-compose.yml with secure defaults and every option documented inline. Download it, then:

docker compose up -d

See Install with Docker Compose for the full walkthrough.


Helm (Kubernetes)

helm repo add trek https://chart.liketrek.com
helm repo update
helm install trek trek/trek

See charts/README.md for values.


Install as App (PWA)

TREK works as a Progressive Web App — no App Store needed.

  1. Open TREK in the browser (HTTPS required)
  2. iOS: Share ▸ Add to Home Screen
  3. Android: Menu ▸ Install app (or Add to Home Screen)

TREK then launches fullscreen with its own icon, just like a native app.


Updating

See Updating — Docker Compose, Docker run, Helm, Portainer, Unraid and Proxmox, plus the encryption-key note.


Reverse Proxy

For production, put TREK behind a TLS-terminating reverse proxy. TREK uses WebSockets for real-time sync, so the proxy must support WebSocket upgrades on /ws.

If you use the MCP addon, the proxy must also pass the Mcp-Session-Id header through in both directions on /mcp — Nginx and Caddy do this by default, but a proxy that strips it makes every tool call open a new session instead of reusing one. See the Reverse Proxy wiki page for details.

Nginx
server {
    listen 80;
    server_name trek.yourdomain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name trek.yourdomain.com;

    ssl_certificate     /etc/ssl/fullchain.pem;
    ssl_certificate_key /etc/ssl/privkey.pem;

    # 500 MB covers backup-restore uploads (capped at 500 MB server-side).
    client_max_body_size 500m;

    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /ws {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_read_timeout 86400;
    }

    # Only needed if you use the MCP addon. Responses are Server-Sent Events,
    # so buffering must be off or tool results arrive late.
    location /mcp {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        proxy_read_timeout 3600s;
    }
}
Caddy
trek.yourdomain.com {
    reverse_proxy localhost:3000
}

Caddy handles TLS and WebSockets automatically.


Environment variables

Every variable, its default and what it does: see Environment Variables.

Star History

Star History Chart

Data sources

The Atlas map's country and sub-national (province/county) boundaries come from geoBoundaries (Runfola et al., 2020), licensed CC BY 4.0. See NOTICE.md for full third-party attributions.


License

TREK is AGPL v3. Self-host freely for personal or internal company use. If you modify and offer TREK as a network service to third parties, your modifications must be open-sourced under the same licence.