Travel-Planning-Assistant-using-FastMCP

The system correctly loads API keys from environment variables or Streamlit secrets, avoiding hardcoded credentials. All external network requests are made to well-known, legitimate APIs (OpenAI, Amadeus, OpenWeatherMap, Foursquare, Booking.com/RapidAPI). The architecture relies on an LLM agent orchestrating tool calls, which inherently means the LLM's interpretation of prompts dictates tool usage. This is a design choice for agentic systems, not a specific vulnerability in the code itself, assuming the LLM is well-constrained. No 'eval' or other directly dangerous patterns were found.