Skip to content

HotelUse - Hotel Metasearch

io.github.leo9/hoteluseleo9streamable-httpv1.0.1Scanned

Compare hotel prices, room options and booking providers with live HotelUse searches.

3 tools: 3 only read.

Tools: 0 delete, 0 irreversible, 0 write, 3 read.
  • Reads private data · 0
  • Reads text others write · 3
  • Can send data out · 0
  • 2 findings

Anlyon alternative

Run the operations that matter as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

3 tools

Only reads 3Show 3 read-only tools
  • get_hotelGet undated facts for one identified or named hotel: address, photos, descriptions, star classification, sourced guest ratings, consecutive positive review count, facilities, pet/p…Reads text others writeNo findings

    Why it is in this group

    • The name "get_hotel" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "get" and "review": it reads comments, which other people can write.
    Description, as the server wrote it
    Get undated facts for one identified or named hotel: address, photos, descriptions, star classification, sourced guest ratings, consecutive positive review count, facilities, pet/parking policies and timezone. Optional fee amounts may be absent in the catalog. Accepts the exact HotelUse hotel_id from a previous result, or hotel_name and destination. A unique, confident match is required. A full hotel name may be used without a destination; add the destination when ambiguous. No stay dates, availability, live prices or room-level offers are included. Supply exactly one hotel_id or hotel_name. Omit unknown optional values; do not send null. Resolve a hotel follow-up by name or position against the most recent relevant ordered search list. Copy its hotel_id exactly; if unavailable, use hotel_name and destination. Ask only if the hotel is ambiguous. For room options or current room prices call get_room_rates directly, passing search_quote_session_id from that search to preserve its stay and preferences. The first get_room_rates response includes all returned room groups and every provider minimum in room_groups. For all room options and prices, use that complete list after one call; do not paginate raw supplier offers or re-query the same stay. The raw_offer_page count describes supplier rate plans, not additional room types. Users can expand room cards locally without another price query. For undated amenities, policies or other hotel facts call get_hotel directly. Do not repeat a destination search before either hotel-specific tool. Existing returned prices may be explained without refreshing when no new search or current quote is requested.

    Annotations the server declares

    • title: Hotel information
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_room_ratesGet one identified or named hotel’s room options and provider prices for explicit hotel-local dates (including today), or date_intent: tonight, and occupancy.Reads text others write1 finding

    Why it is in this group

    • The name "get_room_rates" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Info

      The description is 2,113 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...be explained without refreshing when no new search or current quote is requested."

      What this check looks for
    Description, as the server wrote it
    Get one identified or named hotel’s room options and provider prices for explicit hotel-local dates (including today), or date_intent: tonight, and occupancy. Tonight is resolved server-side in the hotel time zone. Accepts the exact HotelUse hotel_id from search_hotels, or hotel_name and destination when the ID is unavailable; destination is optional but helps disambiguation. A unique hotel match is required. Returns server-grouped room types, rate terms and full-stay provider prices in a separate Room options view. Provider price links open external booking pages; no reservation is made. Providing search_quote_session_id inherits omitted dates, occupancy, currency, language, residency and rate filters from that exact search. Explicit itinerary changes create a new quote; the search device is preserved. Supply exactly one hotel_id or hotel_name. Supply check_in/check_out, date_intent, or an existing search_quote_session_id for room quotes. All returned room groups are included in the first response; no room pagination is needed. Omit unknown optional values; do not send null. Resolve a hotel follow-up by name or position against the most recent relevant ordered search list. Copy its hotel_id exactly; if unavailable, use hotel_name and destination. Ask only if the hotel is ambiguous. For room options or current room prices call get_room_rates directly, passing search_quote_session_id from that search to preserve its stay and preferences. The first get_room_rates response includes all returned room groups and every provider minimum in room_groups. For all room options and prices, use that complete list after one call; do not paginate raw supplier offers or re-query the same stay. The raw_offer_page count describes supplier rate plans, not additional room types. Users can expand room cards locally without another price query. For undated amenities, policies or other hotel facts call get_hotel directly. Do not repeat a destination search before either hotel-specific tool. Existing returned prices may be explained without refreshing when no new search or current quote is requested.

    Annotations the server declares

    • title: Room options
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • search_hotelsSearch a destination or latitude/longitude (with country) for explicit hotel-local dates (including today), or date_intent: tonight.Reads text others write1 finding

    Why it is in this group

    • The name "search_hotels" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Info

      The description is 2,903 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...ol again. Pagination with quote_session_id/cursor is only for unchanged criteria."

      What this check looks for
    Description, as the server wrote it
    Search a destination or latitude/longitude (with country) for explicit hotel-local dates (including today), or date_intent: tonight. Tonight is resolved server-side in the destination time zone, never UTC. Returns hotel summaries and the lowest eligible full-stay total from Expedia, Booking, Agoda and Brek, with direct provider booking links. Search starts at a 20 km core radius, expanding to 40 km then 60 km while fewer than 50 matching static candidates exist, within the same tool call and deadline. Explicit max_distance_km disables expansion. Providers are queried once after the final candidate scope is chosen. Default order is nearest 5 km distance bands first, then greatest Brek price advantage over the cheapest other provider in each band. The advantage uses comparable full-stay totals in the same currency; missing comparisons go last within their band. Preserve the returned hotel order unless the user requests another sort. Supports star ranges or exact stars, guest-review minimum and review count, facilities, property types, distance and full-stay price budgets. Hotel and rate filters can be combined; budgets cover all nights and requested rooms, including mandatory taxes and fees. Guest scores and hotel star classifications have separate filters. no_matching_offer means prices/terms failed the requested filters, not sold out. Room types and room-level rate plans are not included. No HotelUse account or API credits required. Device detection is automatic with a desktop fallback. For a fresh search supply destination or latitude/longitude with country, and either check_in/check_out or date_intent. Search pagination accepts only quote_session_id and cursor. Omit unknown optional values; do not send null. On follow-ups that change destination, dates, guests, hotel/rate filters or sort, call search_hotels again once with the updated criteria and preserve unchanged itinerary/preferences from the latest relevant search. Do not filter or reorder an earlier result page and present it as a new destination search: that page may omit matching hotels. For nearest, closest, or distance order use sort: distance_asc. The geographic_scope.radius_km value is the search radius, never any hotel’s distance. Per-hotel distance_meters is measured from the destination center. For cheapest hotels use sort: stay_total_asc. For "4-star only" use hotel_filters.star_ratings: [4]; for "4- and 5-star only" use [4,5], not star_rating_min: 4 (which includes 4.5). Never broaden explicit criteria silently. Omit providers unless the user requests specific providers; the server handles occupancy support. A successful partial response is the result of this search: show the returned prices and do not automatically repeat the search to fill missing provider quotes. An explicit user refresh calls the tool again. Pagination with quote_session_id/cursor is only for unchanged criteria.

    Annotations the server declares

    • title: Search hotels
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write3
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

2 info
  • The description is 2,903 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...ol again. Pagination with quote_session_id/cursor is only for unchanged criteria."

    What this check looks for
  • The description is 2,113 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...be explained without refreshing when no new search or current quote is requested."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 1.0.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http hoteluse https://www.hoteluse.dev/mcp/search
claude mcp add --transport http hoteluse https://www.hoteluse.dev/mcp/search

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__hoteluse__search_hotels",
      "mcp__hoteluse__get_room_rates",
      "mcp__hoteluse__get_hotel"
    ],
    "ask": [],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as hoteluse. Review it before you use it.

Capability tags behind 3 rules
  • mcp__hoteluse__search_hotels untrusted-input
  • mcp__hoteluse__get_room_rates untrusted-input
  • mcp__hoteluse__get_hotel untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.leo9/hoteluse/verify?hash=61d1a3cb25ca513261065d8c2f0a202c6fa4db1d5c70cbf86af0955c1206c4ed" | jq -e '.changed == false'

Pinned hash 61d1a3cb25ca, from Oct 29, 2026, 00:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.leo9/hoteluse/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.github.leo9/hoteluse
[![anlyon.dev](https://anlyon.dev/badge/io.github.leo9/hoteluse.svg)](https://anlyon.dev/servers/io.github.leo9/hoteluse)

Source: MCP Registry. Synced Oct 29, 2026, 00:17 UTC.