Initial commit: google-flights MCP server (docs, server.json, npm/PyPI launchers, contract test)

Author: sergey-ermakovich

.github/ISSUE_TEMPLATE/inaccuracy.md

@@ -0,0 +1,21 @@
+---
+name: Something in the README is wrong
+about: A tool table, a response sample or a documented behaviour does not match reality
+labels: documentation
+---
+
+**Where in the README**
+
+Section or heading.
+
+**What it says**
+
+Quote the line.
+
+**The call you made**
+
+Tool name and arguments, or the equivalent REST URL with your key removed.
+
+**What came back**
+
+Trimmed response, with anything private removed.

.github/workflows/contract.yml

@@ -0,0 +1,31 @@
+# The tool contract is checked on a schedule as well as on push, because the upstream tool list
+# can change without a single commit in this repository.
+name: tool contract
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  contract:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      # Forks cannot read repository secrets. The suite skips its live checks when the key is
+      # absent, so a pull request from a fork stays green instead of failing for a reason the
+      # contributor cannot fix.
+      - name: Assert the tool list still matches the README
+        env:
+          HASDATA_API_KEY: ${{ secrets.HASDATA_API_KEY }}
+        run: npm test

.github/workflows/publish.yml

@@ -0,0 +1,65 @@
+# Publishes the npm and PyPI wrapper packages on a version tag, using OIDC
+# trusted publishing. No NPM_TOKEN or PYPI_TOKEN is stored anywhere: GitHub
+# mints a short-lived OIDC token per run, and npmjs.org / pypi.org accept it
+# because this repo + workflow are configured as trusted publishers.
+#
+# One-time setup, done once per package on the registries (not in this repo):
+#   npmjs.org  -> package settings -> Trusted Publisher -> GitHub Actions,
+#                 repo HasData/google-flights-mcp, workflow publish.yml
+#   pypi.org   -> the hasdata org -> Publishing -> add a trusted publisher
+#                 (pending publisher works before the first release),
+#                 repo HasData/google-flights-mcp, workflow publish.yml
+#
+# The MCP registry entry (com.hasdata/google-flights) is NOT published here. It uses
+# domain auth, which would need the namespace-wide Ed25519 key as a secret in
+# every repo. That key stays off CI; the registry entry is published by hand
+# when server.json changes, after the package versions below are live.
+#
+# Release: bump nothing by hand. Tag the commit `vX.Y.Z` and push the tag; the
+# tag is the single source of the version and is written into both manifests.
+
+name: publish
+
+on:
+  push:
+    tags: ['v*.*.*']
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  npm:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
+      - name: Set version from the tag
+        run: npm version "${GITHUB_REF_NAME#v}" --no-git-tag-version --allow-same-version
+      - name: Publish to npm (OIDC, no token)
+        run: npm publish --access public
+
+  pypi:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Set version from the tag
+        run: |
+          python - "${GITHUB_REF_NAME#v}" <<'PY'
+          import re, sys
+          v = sys.argv[1]
+          p = "pyproject.toml"
+          t = open(p, encoding="utf-8").read()
+          t = re.sub(r'(?m)^version = ".*"$', f'version = "{v}"', t, count=1)
+          open(p, "w", encoding="utf-8", newline="\n").write(t)
+          PY
+      - name: Build the wheel and sdist
+        run: pipx run build
+      - name: Publish to PyPI (OIDC, no token)
+        uses: pypa/gh-action-pypi-publish@release/v1

.gitignore

@@ -0,0 +1,11 @@
+node_modules/
+package-lock.json
+dist/
+build/
+*.egg-info/
+__pycache__/
+*.pyc
+.env
+.env.*
+.DS_Store
+*.log

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 HasData
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.