Bookd
by bookd.direct · remote · no sign-in to list tools · v0.2.0 · published by direct.bookd
Search and request stays at independent hotels, B&Bs, guesthouses and vacation rentals, direct.
6 tools: 2 can delete or cancel things and 4 only read.
Scanned Oct 21, 2026
- Deletes or cancels2Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things0Claude Code: ask
- Only reads4Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http stays https://mcp.bookd.direct/mcpTools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
6 tools
Deletes or cancels 2Claude Code: deny
cancel_bookingCancel a Bookd booking for the guest.Reads text others writeNo findings
Why it is in this group
- The name "cancel_booking" says "cancel": a word for removing or ending something.
- The description says "cannot be undone".
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Cancel a Bookd booking for the guest. First call with confirm=false to see the refund under the property's policy and tell the guest; only call with confirm=true after the guest explicitly agrees. Needs the booking_id and the email used to book. confirm=false changes nothing. confirm=true cancels for good (it cannot be undone): it releases any card hold or refunds under the policy on the property's own Stripe account, frees the dates (and cancels it in the property's booking system when it is connected), and emails the property and the guest.
Annotations the server declares
- title: Cancel a booking
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
request_bookingSend a booking request to the property (hotel, B&B, guesthouse or vacation rental) for a room or unit and dates.Reads text others writeNo findings
Why it is in this group
- The name "request_booking" says "request": a word for a change.
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Send a booking request to the property (hotel, B&B, guesthouse or vacation rental) for a room or unit and dates. The resulting stay contract is directly between the guest and the property; Bookd is only the booking platform. Only call after the guest has confirmed the room, dates, guests, and given their name and email. Returns a booking_id and, when online payments are on, a payment_url for the deposit (card held, charged only if the owner accepts). Usually status is "requested": the request is emailed to the property (the guest is emailed when it answers) and the room is held until the owner answers or the request expires. Instant booking: for properties with instant_booking=true, Bookd checks the room live in the property's own booking system; if it is available, the booking is made there at once and status is "confirmed" (with the booking_id; the guest and property are emailed). With a deposit, the reply has instant_booking=true and a payment_url, and the booking is confirmed as soon as the deposit is paid (check booking_status). If the live check or write fails it stays a normal request; if the room was just taken, an error says nothing was booked. Only tell the guest it is confirmed when status is "confirmed". Not idempotent: each call creates a new request, so do not retry after a booking_id is returned (use booking_status). The guest pays the property directly; Bookd never handles guest money.
Annotations the server declares
- title: Request a booking
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
Only reads 4Claude Code: allow
booking_statusRead-only.No findings
Why it is in this group
- The name "booking_status" says "status": a word for reading.
Description, as the server wrote it Read-only. Status of a Bookd booking by its booking_id (e.g. BKD-AB12CD3): requested, accepted (= confirmed, including instant bookings), declined, expired or cancelled, with dates, room and price. Returns no guest personal data.
Annotations the server declares
- title: Booking status
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
check_availabilityRead-only.No findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it Read-only. Live availability for one Bookd property and dates (re-reads the owner's calendars first; nothing is booked or held), with room/unit prices, totals including any cleaning fee and taxes, cancellation policy and any deposit due.
Annotations the server declares
- title: Check availability
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_propertyRead-only.No findings
Why it is in this group
- The name "get_property" says "get": a word for reading.
Description, as the server wrote it Read-only. Full details of one Bookd property by its slug (from search_stays or a Bookd link): type, description, photos, amenities, house rules, check-in/out times, rooms or units (bedrooms, bathrooms, beds, cleaning fee) and prices from, taxes, cancellation policy and any damage deposit (held by the property).
Annotations the server declares
- title: Get property
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_staysFind independent stays bookable direct on Bookd (hotels, B&Bs, guesthouses, apartments, houses, villas, cabins) for a location and dates.Reads text others writeNo findings
Why it is in this group
- The name "search_stays" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Find independent stays bookable direct on Bookd (hotels, B&Bs, guesthouses, apartments, houses, villas, cabins) for a location and dates. Read-only: nothing is booked or held. Bookd properties come first: only properties with a room or unit free for every night are returned, cheapest first (exact town matches first), paginated. Each result has nightly price, total_price (incl. any cleaning fee and taxes), cancellation policy, bedrooms/bathrooms/beds for whole homes, any information-only damage deposit held by the property, and any deposit due (only when the property takes card deposits; otherwise the guest pays the property directly). If no Bookd property matches a location, the result has partner_results instead: links to partner hotels (accommodation only) on Trip.com and a Stay22 map for that place, dates and guests, with min_price, max_price, stars and currency applied. Partner hotels are not Bookd properties: the guest books and pays on Trip.com or the partner site, under that site's terms, and Bookd may earn a commission. Never call request_booking for them. Finding the partner city sends only the location text to Trip.com.
Annotations the server declares
- title: Search stays
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write3
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Oct 22, 2026, 14:47 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 2
- Protocol version
- 2025-06-18
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- none
- RFC 9728 protected resource metadata
- none
- Authorization servers
- none
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- not observed
- Client ID metadata documents
- not observed
- HighThe whole server
The endpoint served tools/list without credentials, and the list has 2 tools that change things (2 destructive). Whether a call also works without credentials was not tested: tools are never called.
What this check looks forMatched text
https://mcp.bookd.direct/mcp: tools/list returned 6 tools to an anonymous client, including request_booking (destructive), cancel_booking (destructive)
Install
Pinned to version 0.2.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http stays https://mcp.bookd.direct/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__stays__search_stays",
"mcp__stays__get_property",
"mcp__stays__check_availability",
"mcp__stays__booking_status"
],
"ask": [],
"deny": [
"mcp__stays__request_booking",
"mcp__stays__cancel_booking"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as stays. Review it before you use it.
Capability tags behind 3 rules
- mcp__stays__search_stays untrusted-input
- mcp__stays__request_booking untrusted-input
- mcp__stays__cancel_booking untrusted-input