# `com.mysanfelipevacation/rentals` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/com.mysanfelipevacation/rentals
- JSON: https://anlyon.dev/api/v1/servers/com.mysanfelipevacation/rentals
- Version: 0.16.1 (active)
- Publisher: com.mysanfelipevacation (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-11-01T20:17:37.696Z

Title and description, as the publisher wrote them:

```untrusted-server-text
My San Felipe Vacation
Live availability, prices and direct booking for vacation rentals in San Felipe, Baja California
```

Scanned 2026-11-01T20:17:49.021Z over streamable-http.

**4 tools: 1 change things and 3 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 1 | ask |
| Only reads | read | 3 | allow |

## Exfil surface

No private-data -> untrusted-input -> outbound path in this server alone: no tool is tagged untrusted-input or outbound.

| Tag | Meaning | Tools |
| --- | --- | --- |
| private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | `mcp__rentals__get_property_details` |
| untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | none |
| outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | none |

## Findings

No check matched anything in these tool definitions.


## Changes things (1)

Creates or changes something that can be changed back. Claude Code: ask.

### `check_availability`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Check whether one My San Felipe Vacation rental can be booked for specific dates and party size. If not, explains why (already booked, minimum-night stay, too many guests, pets not allowed) and suggests nearby open dates when it can. Use get_quote for the price.
```

## Only reads (3)

Looks things up and changes nothing. Claude Code: allow.

### `get_property_details`

- The name "get_property_details" says "get": a word for reading.
- Tag private-data: The description's first sentence says "contact": it reads contacts.

Description, as the server wrote it:

```untrusted-server-text
Full details for one My San Felipe Vacation rental in San Felipe, Baja California: description, bedrooms and bed setup, bathrooms, size, capacity, pet policy, amenities, photos, approximate location, house policies (check-in/out, payment, deposit, cancellation) and office contact. Use get_quote for prices.
```

### `get_quote`

- The name "get_quote" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Get an exact, itemized price quote for one My San Felipe Vacation rental in San Felipe, Baja California, for specific dates and guest count. Returns nightly rates, required fees, the total due, and the refundable security deposit. Prices are in USD and come live from the booking system.
```

### `search_properties`

- The name "search_properties" says "search": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Search My San Felipe Vacation rentals in San Felipe, Baja California, Mexico that are available for the given dates and party size. Returns live total prices in USD for the whole stay (rent plus required fees, excluding the refundable security deposit). Default sort is best fit for the party size (homes that sleep closest to the number of guests first, then cheapest); use sort=price_low for cheapest first. Page through all matches with offset. Unsupported parameters are rejected. Use get_quote with a property_id for the itemized price, and get_property_details for beds, amenities and house rules.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `rentals`:

```json
{
  "permissions": {
    "allow": [
      "mcp__rentals__search_properties",
      "mcp__rentals__get_property_details",
      "mcp__rentals__get_quote"
    ],
    "ask": [
      "mcp__rentals__check_availability"
    ],
    "deny": []
  }
}
```

Capability tags behind the rules (a read tagged outbound is asked about):

- `mcp__rentals__get_property_details`: private-data