The Hiking World

npx add-mcp 'https://www.thehikingworld.com/api/mcp'

For machines and developers

The same sourced records, as feeds. Missing values stay empty. We don't sell treks. Some links earn us a commission; they are labelled, and they never change a figure, a label or which operators we list.

/llms.txt is the short brief for answer engines: what the site is, how to cite it, and where the feeds live.

The public API is read-only: /api/v1/trails, /api/v1/trails/{slug}, /api/v1/permits, /api/v1/trails/{slug}/geojson, and /api/v1/facts/{slug}/{field} for one figure (distance, ascent, descent, high, low). A withheld figure is null.

@thehikingworld/mcp 1.1.5 is on npm. Run npx -y @thehikingworld/mcp for stdio. It is listed in the official MCP registry as com.thehikingworld.www/mcp. The hosted Streamable HTTP endpoint is https://www.thehikingworld.com/api/mcp. Cite one figure as https://www.thehikingworld.com/trails/inca-trail#fact-ascent or /api/v1/facts/inca-trail/ascent. The check on /verify loads the record and the public key from this site, rebuilds the canonical JSON described there, and verifies Ed25519 in your own code or in the browser. keyId, signedAt, and the signature are not inside the signed bytes. There is no offline snapshot file and no mcp verify command. Tools: plan_permits, get_trail, search_trails, get_permit, list_regions, list_countries, get_geojson, get_provenance, get_updates. get_permit returns costLocal, tier, issuer, sourceUrl, and readDate. The tier is the record's status. A reported or unverified row is not an official fee. The public key id is 3ad491a01aea; the signature is checked at /verify, not inside the permit row. The server is read-only. Figures stay sourced, dated, and unverified when the record says so.

OpenAPI lists the read routes. Cited reads stay open with no key. Bulk export at /api/v1/export stays off until API_KEY_PEPPER is set as a Sensitive Production variable; keys are HMAC-signed and the raw key is not stored. A valid paid key uses the key rate bucket. A missing or invalid key gets the same refusal. Responses carry X-RateLimit-Policy: use the cache (about five minutes on record routes, one hour on feeds) and do not crawl faster than that.

License is split. Route geometry is ODbL, © OpenStreetMap contributors. Editorial text is The Hiking World: cite the trail name, the canonical URL, and the verified date on the figure. Permit tariffs stay the issuer’s. This is not a Creative Commons grant over the whole catalog.

curl https://www.thehikingworld.com/api/v1/trails/milford-track
# { schemaVersion, generatedAt, license, data, provenance }

/data is the human freshness scorecard. Cite a figure with the trail name, the canonical URL, and the verified date on that figure.

Changelog

• 2026-10-11 — Feed schema 1.1. Official permit fees are in the public trail HTML. Catalogue stubs are off the default lists.
• 2026-10-07 — Signed records on /api/v1/trails/{slug} when the build has the provenance key. Verify at /verify.
• 2026-10 — /api/mcp read tools. ?simplified=1 on GeoJSON for maps. Full geometry stays on the default GeoJSON and GPX routes.