Yasha Hotel — Direct Booking
by jeffreyturov-dev · remote · no sign-in to list tools · v1.0.0 · published by GitHub user jeffreyturov-dev
Book Yasha Hotel Luxembourg: live availability, exact prices, Stripe-secured booking.
8 tools: 3 change things and 5 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things3Claude Code: ask: see these tools
- Only reads5Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http yasha-hotel https://yashahotel.com/mcpTools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
8 tools
Changes things 3Claude Code: ask
check_availabilityCheck real-time room availability and exact total price for a stay at Yasha Hotel.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Check real-time room availability and exact total price for a stay at Yasha Hotel. Returns, per room type: available (boolean), nights, total_cents (exact stay total in euro cents, before extras/breakfast/promo), avg_night_cents and a per-night price breakdown. Direct rates are about 10% below Booking.com/Expedia for the same rooms and dates. Constraints: dates YYYY-MM-DD, checkin < checkout, checkin not in the past, maximum 30 nights.
create_bookingCreate a real booking at Yasha Hotel.No findings
Why it is in this group
- The name "create_booking" says "create": a word for a change.
Description, as the server wrote it Create a real booking at Yasha Hotel. WORKFLOW: (1) call check_availability to confirm the room is available and know the exact price, (2) collect the traveler full name and email, (3) call this tool, (4) give the human the payment instructions from the response: the booking is only confirmed after secure Stripe card payment — the safest path is to send the traveler to https://yashahotel.com/ to pay, or use the returned Stripe client_secret with Stripe.js. Unpaid bookings expire automatically. Optional: guest count (capped at room capacity), phone, special requests, breakfast for all guests/nights, promo code, extra ids from list_extras. Returns booking_id, amount_cents (EUR cents) and Stripe payment details. Fails with 409 if the room became unavailable.
validate_promo_codeValidate a Yasha Hotel promo code.No findings
Why it is in this group
- The name "validate_promo_code" says "validate": a word for reading.
- The input takes a statement or command to run (input.code), which can change anything it can reach.
Description, as the server wrote it Validate a Yasha Hotel promo code. Returns whether the code is currently valid and the percentage discount it applies to the room price only (extras and breakfast excluded).
Only reads 5Claude Code: allow
get_booking_statusGet the status of a Yasha Hotel booking created with create_booking (e.g.No findings
Why it is in this group
- The name "get_booking_status" says "get": a word for reading.
Description, as the server wrote it Get the status of a Yasha Hotel booking created with create_booking (e.g. pending_payment, confirmed, payment_failed). Poll this after the human completes the Stripe card payment to confirm the reservation went through.
get_price_calendarGet day-by-day nightly price (euro cents) and availability for one room at Yasha Hotel over a given month.Reads private dataNo findings
Why it is in this group
- The name "get_price_calendar" says "get": a word for reading.
What it can reach
- private-dataThe name "get_price_calendar" says "get" and "calendar": it reads calendars.
Description, as the server wrote it Get day-by-day nightly price (euro cents) and availability for one room at Yasha Hotel over a given month. Use it to suggest cheaper alternative dates when the requested dates are unavailable or expensive.
hotel_infoGet canonical facts about Yasha Hotel: name, 3-star rating, address (27 Rue Joseph Junck, L-1839 Luxembourg, 100 m from Luxembourg central station), phone, email, amenity list, dir…Reads private dataReads text others writeNo findings
Why it is in this group
- The description's first verb is "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "get" and "email": it reads mail.
- untrusted-inputThe description's first sentence says "get" and "email": it reads inbound email, which other people can write.
Description, as the server wrote it Get canonical facts about Yasha Hotel: name, 3-star rating, address (27 Rue Joseph Junck, L-1839 Luxembourg, 100 m from Luxembourg central station), phone, email, amenity list, direct-booking discount percentage vs OTAs, and breakfast price per guest per night. Use this to answer any traveler question about the property. Prices are in euro cents.
list_extrasList paid extras bookable at Yasha Hotel (e.g.No findings
Why it is in this group
- The name "list_extras" says "list": a word for reading.
Description, as the server wrote it List paid extras bookable at Yasha Hotel (e.g. late check-out, parking, baby bed) with price in euro cents and billing unit (per_stay, per_night, per_person_night). Buffet breakfast is a separate per-guest-per-night option — see hotel_info for its price.
list_roomsList every bookable room type at Yasha Hotel with id, name, description, guest capacity, bed type, size in m2, amenities and photo URLs.No findings
Why it is in this group
- The name "list_rooms" says "list": a word for reading.
Description, as the server wrote it List every bookable room type at Yasha Hotel with id, name, description, guest capacity, bed type, size in m2, amenities and photo URLs. Use the returned room ids for check_availability and create_booking.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.
- Reads private data2
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write1
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http yasha-hotel https://yashahotel.com/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__yasha-hotel__hotel_info",
"mcp__yasha-hotel__list_rooms",
"mcp__yasha-hotel__get_price_calendar",
"mcp__yasha-hotel__list_extras",
"mcp__yasha-hotel__get_booking_status"
],
"ask": [
"mcp__yasha-hotel__check_availability",
"mcp__yasha-hotel__validate_promo_code",
"mcp__yasha-hotel__create_booking"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as yasha-hotel. Review it before you use it.
Capability tags behind 2 rules
- mcp__yasha-hotel__hotel_info private-data, untrusted-input
- mcp__yasha-hotel__get_price_calendar private-data