accessoticketing-mcp

An MCP server for accesso Passport mobile ticket links — the URL a venue emails you after a purchase. Reads the order and every admission on it, the scannable barcodes, and Google Wallet save links.

accesso powers ticketing for a lot of theme parks, water parks, camps, museums and festivals, so one server covers all of them: the merchant is encoded in the link.

Developed and maintained by AI (Claude Code). Use at your own discretion.

What it needs

No login. These links carry their own credential — the oToken in the query string is what authorises the read. There is no account, no password, no browser session, and no bot wall.

[!WARNING] That also means the link is a secret. Anyone holding it can view and add the order's tickets. Treat it like a password: don't paste it into issues, logs or chats. This server redacts the tokens from its own output and error messages.

Install

npx -y @chrischall/accessoticketing-mcp

// claude_desktop_config.json / .mcp.json
{
  "mcpServers": {
    "accessoticketing": {
      "command": "npx",
      "args": ["-y", "@chrischall/accessoticketing-mcp"],
      "env": { "ACCESSO_TICKET_URL": "https://media-engine.na3.accessoticketing.com/tickets/v1/..." }
    }
  }
}

ACCESSO_TICKET_URL is optional — it just saves passing url on every call. The server starts fine without it and reports the missing link on first use.

Tools

Every tool is read-only; nothing here mutates an order.

> what do we have booked tomorrow?
9:00 AM   Tiny Trekkers Full-Day (Ages 4-7)   — one participant
9:00 AM   Whitewater Kayak Camp I: Intro      — two participants
all-day   Lunch / Snack / Early Drop-Off      — nine more admissions

Shell-out skill

Prefer a shell? skills/accesso-tickets/ does the same reading with curl and a dependency-free parser, no server required. It ships with the package.

Notes on the data

• date / time are the merchant's local wall-clock strings with no timezone attached. They are passed through verbatim rather than converted.
• Merchant-specific detail rows (Guest Number, Web Sales ID, …) are harvested generically into details, so a venue this was never tested against still works.
• An expired link returns HTTP 200, not an error status — the server detects the body and says the link is expired rather than reporting zero tickets.

Development

npm install
npm run build
npm test
npm run test:coverage   # 100% thresholds, enforced in CI

See docs/ACCESSO-API.md for the captured request/response shapes and CLAUDE.md for repo conventions.

License

MIT