Skip to content
anlyon.devby Anlyon

CruiseHops

com.cruisehops/cruisehopscruisehops.comstreamable-httpv1.4.0Scanned

Search Carnival and Royal Caribbean cruises, compare fare history and find Viator port experiences.

11 tools: 3 change things and 8 only read.

Tools: 0 delete, 0 irreversible, 3 write, 8 read.
  • Reads private data · 0
  • Reads text others write · 4
  • Can send data out · 0
  • 1 finding

Anlyon alternative

3 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

11 tools

Changes things 3Claude Code: ask
  • present_cruisesPresent the final shortlist of one to three selected sailings in ONE interactive widget.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Present the final shortlist of one to three selected sailings in ONE interactive widget. Call once after research, preserving exact offer IDs, cabin classes and event selectors. Research tools do not render widgets. Do not repeat all widget details in prose.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • present_excursionsOpen ONE interactive port-experience browser when the user wants excursions, tours or activities.Reads text others write1 finding

    Why it is in this group

    • The description's first verb is "open": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "present_excursions" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "open": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Open ONE interactive port-experience browser when the user wants excursions, tours or activities. Omit portId to let the user choose a port without calling Viator. Supply a supported local portId and optional visit date and activity keywords q to show matching experiences. This makes a fresh on-demand search; use the returned data as the current result. Preserve requested filters. Do not fetch details for every result. Users can change ports, dates, keywords and pages, inspect one selected experience and open Viator booking links. Suggestions are not verified to fit time ashore; no live availability. Use only on an experience request, never automatically for every cruise search.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • suggest_cruise_termsSuggest matching ship, port, destination and cruise line names, including suffix words.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Suggest matching ship, port, destination and cruise line names, including suffix words. Returns stable term IDs for search filters.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 8Show 8 read-only tools
  • compare_sailingsCompare two to four distinct sailings and optional exact offer IDs.No findings

    Why it is in this group

    • The name "compare_sailings" says "compare": a word for reading.
    Description, as the server wrote it
    Compare two to four distinct sailings and optional exact offer IDs. Defaults to lowest current captured two-adult offer; occupancy is explicit per offer. No live or family quote.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • find_port_excursionsSearch Viator on demand only when the user asks for activities or excursions.Reads text others writeNo findings

    Why it is in this group

    • The name "find_port_excursions" says "find": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Search Viator on demand only when the user asks for activities or excursions. Use a port ID from list_excursion_ports or get_sailing itinerary.portId. Pass the port visit date, not the cruise departure date. Optional q searches activity keywords such as snorkeling or food tours within that port; preserve it across pagination. Returns suggestions near the port, NOT verified time-ashore matches or live availability. Prices are indicative, may differ for the date/party, and are not cruise fares. Preserve complete affiliate URLs. No reviews or protected unique content. No widget.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_excursionFetch details only for a Viator product the user selected from find_port_excursions.Reads text others writeNo findings

    Why it is in this group

    • The name "get_excursion" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Fetch details only for a Viator product the user selected from find_port_excursions. Returns allowed product content and an affiliate booking URL; no reviews, protected content or live availability. Verify meeting point, return timing and availability on Viator.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_price_historyRead one exact captured offer context's price history.No findings

    Why it is in this group

    • The name "get_price_history" says "get": a word for reading.
    Description, as the server wrote it
    Read one exact captured offer context's price history. contextKey is required from get_sailing offers. Never blends cabins, fares, markets, guest counts or events. Dates select overlapping captured observation spans; maxPoints retains the latest points.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_sailingExplore a CruiseHops sailing page: itinerary, cabin fares, price-history context and links to the website and official provider.Reads text others writeNo findings

    Why it is in this group

    • The name "get_sailing" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "website": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Explore a CruiseHops sailing page: itinerary, cabin fares, price-history context and links to the website and official provider. Research only; no widget. Read sailing itinerary, cabin-filtered offers and booking URLs. Amenities and media are omitted by default; request them explicitly only when needed. No live availability or party total is guaranteed.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_departuresList bounded, paginated unique dated sailings for a public ship-itinerary group ID.No findings

    Why it is in this group

    • The name "list_departures" says "list": a word for reading.
    Description, as the server wrote it
    List bounded, paginated unique dated sailings for a public ship-itinerary group ID. Preserves cabin/date filters; older event-specific group IDs remain supported.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_excursion_portsList local cruise ports and whether excursion searches are supported.No findings

    Why it is in this group

    • The name "list_excursion_ports" says "list": a word for reading.
    Description, as the server wrote it
    List local cruise ports and whether excursion searches are supported. No Viator product request. Use the returned port ID for find_port_excursions.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_cruisesFind cruise recommendations and deals on CruiseHops across Carnival and Royal Caribbean by destination, departure port, dates, cabin and budget.No findings

    Why it is in this group

    • The name "search_cruises" says "search": a word for reading.
    Description, as the server wrote it
    Find cruise recommendations and deals on CruiseHops across Carnival and Royal Caribbean by destination, departure port, dates, cabin and budget. Returns sailing links for further exploration on CruiseHops. Research only; no widget. Default three choices. Do not add cabin or budget constraints the user did not give. Search captured cruise sailings using typed filters. Prices are USD cents per person for two guests, not live or family quotes. Filter before grouping and choosing lowest cabin price. Use term IDs from suggest_cruise_terms for precise names.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write4
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnpresent_excursions

    The server marks "present_excursions" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "open": a word for a change.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.4.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http cruisehops https://cruisehops.com/mcp
claude mcp add --transport http cruisehops https://cruisehops.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__cruisehops__search_cruises",
      "mcp__cruisehops__list_departures",
      "mcp__cruisehops__get_sailing",
      "mcp__cruisehops__get_price_history",
      "mcp__cruisehops__compare_sailings",
      "mcp__cruisehops__list_excursion_ports",
      "mcp__cruisehops__find_port_excursions",
      "mcp__cruisehops__get_excursion"
    ],
    "ask": [
      "mcp__cruisehops__suggest_cruise_terms",
      "mcp__cruisehops__present_cruises",
      "mcp__cruisehops__present_excursions"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as cruisehops. Review it before you use it.

Capability tags behind 4 rules
  • mcp__cruisehops__get_sailing untrusted-input
  • mcp__cruisehops__present_excursions untrusted-input
  • mcp__cruisehops__find_port_excursions untrusted-input
  • mcp__cruisehops__get_excursion untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.cruisehops/cruisehops/verify?hash=8ff0d2602863b86d1634c3ebc1f11b01c4142aae52da9227f986367054dc1664" | jq -e '.changed == false'

Pinned hash 8ff0d2602863, from Oct 27, 2026, 10:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.cruisehops/cruisehops/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.cruisehops/cruisehops
[![anlyon.dev](https://anlyon.dev/badge/com.cruisehops/cruisehops.svg)](https://anlyon.dev/servers/com.cruisehops/cruisehops)

Source: MCP Registry. Synced Oct 27, 2026, 10:17 UTC.