Strider Hertz

Rent cars from Hertz via Strider Labs MCP connector. Search available vehicles, compare rates, make reservations, and manage Gold Plus Rewards membership.

Security Scan

The skill's requested resources and instructions are consistent with a Hertz connector that runs an npm package via npx, but it relies on executing third‑party npm code and omits details about token storage and publisher provenance — review the npm package and storage details before use.

Purpose & Capability

Name/description (Hertz connector) align with what the SKILL.md asks for: it requires npx and installs/runs @striderlabs/mcp-hertz from npm to provide search/reserve/GC rewards functionality. No unrelated credentials, binaries, or config paths are requested.

Instruction Scope

Runtime instructions stay within the connector scope: how to install, configure MCP to run the connector, available tool schemas, and OAuth flow. The SKILL.md does not instruct reading arbitrary host files or unrelated environment variables. It does assert tokens are "stored encrypted per-user" but gives no storage or key-management details (privacy/operational detail missing).

Install Mechanism

The skill is instruction-only and expects an npm package to be installed or executed via npx. Using npm/npx is a common, expected mechanism for an MCP connector, but npx will fetch and execute third-party code at runtime — this grants the package the ability to run arbitrary code in the environment where it's invoked. No registry install spec is present in the skill metadata, so the package provenance and exact install behavior are not enforced by the skill bundle itself.

Credentials

No environment variables or unrelated credentials are requested in the metadata. OAuth to Hertz is required (expected for booking/reservations). The only open question is how/where OAuth tokens are persisted and who holds the encryption keys; this is a privacy/operational detail rather than an explicit mismatch.

Persistence & Privilege

The skill does not request always:true or other elevated platform privileges. It is user-invocable and allowed to be invoked autonomously (platform default). The skill does not declare or attempt to modify other skills or global agent settings.

Assessment

This connector is internally consistent with its stated purpose, but it works by installing/executing an npm package via npx (third‑party code). Before installing or running it, do the following: 1) Verify the npm package (@striderlabs/mcp-hertz) on npmjs.com — check publisher identity, download count, and release history. 2) If possible, inspect the package source or repository for any unexpected network calls, file system access, or secrets handling. 3) Ask the publisher (or documentation) where OAuth tokens are stored, how they are encrypted, and who controls the encryption keys and retention policy. 4) Run the connector in an isolated/sandboxed environment (or CI runner) if you plan to execute npx locally. 5) Prefer installing a published release pinned to a specific version, or a signed release, rather than running npx against an unpinned/latest package. If you cannot verify package provenance and storage practices, treat usage as higher risk.

Strider Hertz Connector

MCP connector for Hertz car rental. Part of the Strider Labs action execution layer for AI agents.

Installation

npm install @striderlabs/mcp-hertz

MCP Configuration

Add to your MCP client configuration (Claude Desktop, Cursor, etc.):

{
  "mcpServers": {
    "hertz": {
      "command": "npx",
      "args": ["-y", "@striderlabs/mcp-hertz"]
    }
  }
}

Available Tools

hertz.search_vehicles

Search available rental cars.

Input Schema:

{
  "pickup_location": "string (airport code or address)",
  "pickup_date": "string (YYYY-MM-DD)",
  "pickup_time": "string (HH:MM)",
  "return_date": "string",
  "return_time": "string",
  "vehicle_class": "economy | compact | midsize | suv | luxury (optional)"
}

Output:

{
  "vehicles": [{
    "class": "midsize",
    "make_model": "Toyota Camry or similar",
    "daily_rate": 45.99,
    "total_price": 183.96,
    "features": ["Bluetooth", "Backup Camera"],
    "seats": 5,
    "bags": 3
  }]
}

hertz.make_reservation

Book a rental car.

Input Schema:

{
  "vehicle_id": "string",
  "pickup_location": "string",
  "pickup_date": "string",
  "return_date": "string",
  "add_insurance": "boolean (optional)",
  "add_gps": "boolean (optional)"
}

hertz.get_reservations

List upcoming reservations.

hertz.modify_reservation

Change an existing reservation.

hertz.cancel_reservation

Cancel a rental booking.

hertz.get_gold_status

Check Gold Plus Rewards status and points.

Authentication

First use triggers OAuth authorization:

1. User redirected to Hertz login
2. Gold Plus Rewards linked automatically
3. Tokens stored encrypted per-user

No API key required — connector manages OAuth flow.

Usage Examples

Search rentals:

Find a midsize car at LAX for next weekend

Book a car:

Book the cheapest SUV at Denver airport March 20-23

Check reservations:

What Hertz reservations do I have?

Modify booking:

Change my Hertz reservation to return a day later

Error Handling

Code	Meaning	Action
AUTH_EXPIRED	Session expired	Re-authenticate
NO_AVAILABILITY	No cars available	Try different dates/location
RESERVATION_NOT_FOUND	Invalid confirmation	Check number
RATE_LIMITED	Too many requests	Retry after delay

Use Cases

• Business travel: book rental cars for work trips
• Airport pickups: reserve vehicles at airports
• Weekend trips: rent cars for short getaways
• Rewards tracking: monitor Gold Plus points
• Fleet comparison: compare prices across vehicle classes

Links

• npm: https://npmjs.com/package/@striderlabs/mcp-hertz
• Strider Labs: https://striderlabs.ai