# `com.bookingbench/booking-bench` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/com.bookingbench/booking-bench
- JSON: https://anlyon.dev/api/v1/servers/com.bookingbench/booking-bench
- Version: 0.1.0 (active)
- Publisher: com.bookingbench (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-11-05T01:17:38.918Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Booking Bench
Find vacation rentals near a US city, check live availability and prices, and see local events.
```

Scanned 2026-11-05T00:18:00.817Z over streamable-http.

**9 tools: 9 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 0 | ask |
| Only reads | read | 9 | allow |

## Exfil surface

No private-data -> untrusted-input -> outbound path in this server alone: no tool is tagged outbound.

| Tag | Meaning | Tools |
| --- | --- | --- |
| private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | `mcp__booking-bench__get_activity` `mcp__booking-bench__get_calendar` `mcp__booking-bench__get_event` |
| untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | `mcp__booking-bench__get_activity` `mcp__booking-bench__get_calendar` `mcp__booking-bench__get_event` `mcp__booking-bench__get_property` `mcp__booking-bench__get_quote` `mcp__booking-bench__list_properties` |
| outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | none |

## Findings

No check matched anything in these tool definitions.


## Only reads (9)

Looks things up and changes nothing. Claude Code: allow.

### `get_activity`

- The name "get_activity" says "get": a word for reading.
- Tag private-data: The description's first sentence says "return" and "contact": it reads contacts.
- Tag untrusted-input: The description's first sentence says "return" and "website": it reads web pages, which anyone can write.

Description, as the server wrote it:

```untrusted-server-text
Returns one activity with its category, location, website, admission, contactInfo, source and commercial.
```

### `get_calendar`

- The name "get_calendar" says "get": a word for reading.
- Tag private-data: The name "get_calendar" says "get" and "calendar": it reads calendars.
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data.

Description, as the server wrote it:

```untrusted-server-text
Returns day-by-day availability and nightly price for one unit over two consecutive months starting at the given month. Prices are per night before cleaning fee and taxes.
```

### `get_event`

- The name "get_event" says "get": a word for reading.
- Tag private-data: The description's first sentence says "return" and "contact": it reads contacts.
- Tag untrusted-input: The description's first sentence says "return" and "ticket": it reads issues, which other people can write.

Description, as the server wrote it:

```untrusted-server-text
Returns one event with its full description, dates and times, location, admission, ticketUrl, contactInfo, source and commercial.
```

### `get_property`

- The name "get_property" says "get": a word for reading.
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data. The description's first sentence says "return" and "review": it reads comments, which other people can write.

Description, as the server wrote it:

```untrusted-server-text
Returns one unit: description, city, bedrooms, bathrooms, maximum guests, amenities, pet and accessibility flags, minimum nights, cancellation policy, house rules, check-in and check-out hours, rating out of 5, up to 5 photos with captions (imageCount gives the total), and the 3 newest written reviews (guest-written text, marked as quoted). indicativeNightlyRate is a guide read from a cache up to 6 hours old, not a price; get_quote returns the price for dates. The unit's street address and coordinates are not included.
```

### `get_quote`

- The name "get_quote" says "get": a word for reading.
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data.

Description, as the server wrote it:

```untrusted-server-text
Returns a live quote for one unit and stay. When the stay can be booked: nights, currency, nightlyRate, cleaningFee, totalPrice (nights plus cleaning fee; taxes and any other fees added at checkout are not included, and taxesIncluded says so), cancellationPolicy, bookingUrl (the site's page for that unit with the dates and guests filled in), and eventsDuringStay (up to 5 events on during the stay, with the total count). When it cannot be booked: available false with a reason (unavailable, closed_arrival, closed_departure, min_stay, max_stay, too_many_guests, invalid_dates) and a message saying what to change.
```

### `list_activities`

- The name "list_activities" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Lists things to do near one Booking Bench site, alphabetically. Each activity has id, name, category, location, website, admission and contactInfo, plus source (who supplied it; property_manager means the site's own manager) and commercial (whether it is a paid placement). The answer gives total, per-category counts and nextCursor.
```

### `list_events`

- The name "list_events" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Lists upcoming events near one Booking Bench site, earliest first. Each event has id, name, startDate, endDate, location, a short summary, category, admission, ticketUrl and contactInfo, plus source (who supplied it; property_manager means the site's own manager) and commercial (whether it is a paid placement). The answer gives total, per-category counts and nextCursor.
```

### `list_properties`

- The name "list_properties" says "list": a word for reading.
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data.

Description, as the server wrote it:

```untrusted-server-text
Lists the units on one Booking Bench site that can be booked for a stay: open every night and within the unit's minimum stay, maximum stay, arrival and departure rules and guest capacity. checkIn and checkOut are required. guests defaults to 2, and the answer says when the default was used. Optional filters: city (a town on that site), minBedrooms, minBathrooms, amenities (all must be listed), petsAllowed. sort is fit (smallest unit that sleeps the party, then bedrooms, then name; the default), price, or name. No result is ranked by payment. Each result has propertyId, name, city, state, sleeps, bedrooms, bathrooms and averageNightlyRate (per night over the stay, before cleaning fee and taxes). The answer gives returned, totalMatches (or totalMatchesAtLeast when not every unit was checked), nextCursor, refinements (unused filters with how many units would remain) and notes. More than 10 matches return the best 5. Availability is up to 5 minutes old; get_quote is live.
```

### `list_sites`

- The name "list_sites" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Lists live Booking Bench sites that have rental units in or near a destination city in the United States, nearest first, five per page. `city` is the destination the traveler names, never the traveler's own location. Each result has siteSlug, siteName, matchedCity, distanceMiles (straight-line, whole miles, between town centers), the cities the site has units in, and numberOfProperties. The answer states how many sites match in all (totalMatches) and gives nextCursor when more exist. Sites at the same distance are ordered by a daily rotation. A city name used in several states returns candidates; a misspelling returns suggestions.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `booking-bench`:

```json
{
  "permissions": {
    "allow": [
      "mcp__booking-bench__list_sites",
      "mcp__booking-bench__list_properties",
      "mcp__booking-bench__get_property",
      "mcp__booking-bench__get_quote",
      "mcp__booking-bench__get_calendar",
      "mcp__booking-bench__list_events",
      "mcp__booking-bench__get_event",
      "mcp__booking-bench__list_activities",
      "mcp__booking-bench__get_activity"
    ],
    "ask": [],
    "deny": []
  }
}
```

Capability tags behind the rules (a read tagged outbound is asked about):

- `mcp__booking-bench__list_properties`: untrusted-input
- `mcp__booking-bench__get_property`: untrusted-input
- `mcp__booking-bench__get_quote`: untrusted-input
- `mcp__booking-bench__get_calendar`: private-data, untrusted-input
- `mcp__booking-bench__get_event`: private-data, untrusted-input
- `mcp__booking-bench__get_activity`: private-data, untrusted-input

## Remote posture

What an anonymous client saw at the remote endpoint, last 2026-11-05T03:18:29.133Z, unchanged since 2026-11-05T03:18:29.133Z. No credentials were sent and no tool was called. Values are shown as the endpoint returned them. Method: https://anlyon.dev/methodology#remote-posture

| Fact | Observed |
| --- | --- |
| Reachable | `yes` |
| HTTP status of an anonymous initialize | `200` |
| tools/list served without credentials | `yes` |
| Tools that change things, listed without credentials | `0` |
| Protocol version | `2025-06-18` |
| WWW-Authenticate on 401 | `not observed` |
| resource_metadata in WWW-Authenticate | `none` |
| RFC 9728 protected resource metadata | `none` |
| Authorization servers | `none` |
| Legacy HTTP+SSE transport | `no` |
| Dynamic client registration | `not observed` |
| Client ID metadata documents | `not observed` |