HotelUse - Hotel Metasearch
io.github.leo9/hoteluseleo9streamable-httpv1.0.1Scanned
Compare hotel prices, room options and booking providers with live HotelUse searches.
3 tools: 3 only read.
- Reads private data · 0
- Reads text others write · 3
- Can send data out · 0
- 2 findings
Anlyon alternative
Run the operations that matter as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
3 tools
Only reads 3Show 3 read-only tools
get_hotelGet undated facts for one identified or named hotel: address, photos, descriptions, star classification, sourced guest ratings, consecutive positive review count, facilities, pet/p…Reads text others writeNo findings
Why it is in this group
- The name "get_hotel" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "get" and "review": it reads comments, which other people can write.
Description, as the server wrote it Get undated facts for one identified or named hotel: address, photos, descriptions, star classification, sourced guest ratings, consecutive positive review count, facilities, pet/parking policies and timezone. Optional fee amounts may be absent in the catalog. Accepts the exact HotelUse hotel_id from a previous result, or hotel_name and destination. A unique, confident match is required. A full hotel name may be used without a destination; add the destination when ambiguous. No stay dates, availability, live prices or room-level offers are included. Supply exactly one hotel_id or hotel_name. Omit unknown optional values; do not send null. Resolve a hotel follow-up by name or position against the most recent relevant ordered search list. Copy its hotel_id exactly; if unavailable, use hotel_name and destination. Ask only if the hotel is ambiguous. For room options or current room prices call get_room_rates directly, passing search_quote_session_id from that search to preserve its stay and preferences. The first get_room_rates response includes all returned room groups and every provider minimum in room_groups. For all room options and prices, use that complete list after one call; do not paginate raw supplier offers or re-query the same stay. The raw_offer_page count describes supplier rate plans, not additional room types. Users can expand room cards locally without another price query. For undated amenities, policies or other hotel facts call get_hotel directly. Do not repeat a destination search before either hotel-specific tool. Existing returned prices may be explained without refreshing when no new search or current quote is requested.
Annotations the server declares
- title: Hotel information
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
get_room_ratesGet one identified or named hotel’s room options and provider prices for explicit hotel-local dates (including today), or date_intent: tonight, and occupancy.Reads text others write1 finding
Why it is in this group
- The name "get_room_rates" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Info
The description is 2,113 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...be explained without refreshing when no new search or current quote is requested."
Description, as the server wrote it Get one identified or named hotel’s room options and provider prices for explicit hotel-local dates (including today), or date_intent: tonight, and occupancy. Tonight is resolved server-side in the hotel time zone. Accepts the exact HotelUse hotel_id from search_hotels, or hotel_name and destination when the ID is unavailable; destination is optional but helps disambiguation. A unique hotel match is required. Returns server-grouped room types, rate terms and full-stay provider prices in a separate Room options view. Provider price links open external booking pages; no reservation is made. Providing search_quote_session_id inherits omitted dates, occupancy, currency, language, residency and rate filters from that exact search. Explicit itinerary changes create a new quote; the search device is preserved. Supply exactly one hotel_id or hotel_name. Supply check_in/check_out, date_intent, or an existing search_quote_session_id for room quotes. All returned room groups are included in the first response; no room pagination is needed. Omit unknown optional values; do not send null. Resolve a hotel follow-up by name or position against the most recent relevant ordered search list. Copy its hotel_id exactly; if unavailable, use hotel_name and destination. Ask only if the hotel is ambiguous. For room options or current room prices call get_room_rates directly, passing search_quote_session_id from that search to preserve its stay and preferences. The first get_room_rates response includes all returned room groups and every provider minimum in room_groups. For all room options and prices, use that complete list after one call; do not paginate raw supplier offers or re-query the same stay. The raw_offer_page count describes supplier rate plans, not additional room types. Users can expand room cards locally without another price query. For undated amenities, policies or other hotel facts call get_hotel directly. Do not repeat a destination search before either hotel-specific tool. Existing returned prices may be explained without refreshing when no new search or current quote is requested.
Annotations the server declares
- title: Room options
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
search_hotelsSearch a destination or latitude/longitude (with country) for explicit hotel-local dates (including today), or date_intent: tonight.Reads text others write1 finding
Why it is in this group
- The name "search_hotels" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Info
The description is 2,903 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...ol again. Pagination with quote_session_id/cursor is only for unchanged criteria."
Description, as the server wrote it Search a destination or latitude/longitude (with country) for explicit hotel-local dates (including today), or date_intent: tonight. Tonight is resolved server-side in the destination time zone, never UTC. Returns hotel summaries and the lowest eligible full-stay total from Expedia, Booking, Agoda and Brek, with direct provider booking links. Search starts at a 20 km core radius, expanding to 40 km then 60 km while fewer than 50 matching static candidates exist, within the same tool call and deadline. Explicit max_distance_km disables expansion. Providers are queried once after the final candidate scope is chosen. Default order is nearest 5 km distance bands first, then greatest Brek price advantage over the cheapest other provider in each band. The advantage uses comparable full-stay totals in the same currency; missing comparisons go last within their band. Preserve the returned hotel order unless the user requests another sort. Supports star ranges or exact stars, guest-review minimum and review count, facilities, property types, distance and full-stay price budgets. Hotel and rate filters can be combined; budgets cover all nights and requested rooms, including mandatory taxes and fees. Guest scores and hotel star classifications have separate filters. no_matching_offer means prices/terms failed the requested filters, not sold out. Room types and room-level rate plans are not included. No HotelUse account or API credits required. Device detection is automatic with a desktop fallback. For a fresh search supply destination or latitude/longitude with country, and either check_in/check_out or date_intent. Search pagination accepts only quote_session_id and cursor. Omit unknown optional values; do not send null. On follow-ups that change destination, dates, guests, hotel/rate filters or sort, call search_hotels again once with the updated criteria and preserve unchanged itinerary/preferences from the latest relevant search. Do not filter or reorder an earlier result page and present it as a new destination search: that page may omit matching hotels. For nearest, closest, or distance order use sort: distance_asc. The geographic_scope.radius_km value is the search radius, never any hotel’s distance. Per-hotel distance_meters is measured from the destination center. For cheapest hotels use sort: stay_total_asc. For "4-star only" use hotel_filters.star_ratings: [4]; for "4- and 5-star only" use [4,5], not star_rating_min: 4 (which includes 4.5). Never broaden explicit criteria silently. Omit providers unless the user requests specific providers; the server handles occupancy support. A successful partial response is the result of this search: show the returned prices and do not automatically repeat the search to fill missing provider quotes. An explicit user refresh calls the tool again. Pagination with quote_session_id/cursor is only for unchanged criteria.
Annotations the server declares
- title: Search hotels
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write3
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
- Infosearch_hotels
The description is 2,903 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...ol again. Pagination with quote_session_id/cursor is only for unchanged criteria."
- Infoget_room_rates
The description is 2,113 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...be explained without refreshing when no new search or current quote is requested."
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.0.1. Values in angle brackets are yours to fill in.
claude mcp add --transport http hoteluse https://www.hoteluse.dev/mcp/searchclaude mcp add --transport http hoteluse https://www.hoteluse.dev/mcp/searchRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__hoteluse__search_hotels",
"mcp__hoteluse__get_room_rates",
"mcp__hoteluse__get_hotel"
],
"ask": [],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as hoteluse. Review it before you use it.
Capability tags behind 3 rules
- mcp__hoteluse__search_hotels untrusted-input
- mcp__hoteluse__get_room_rates untrusted-input
- mcp__hoteluse__get_hotel untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/io.github.leo9/hoteluse/verify?hash=61d1a3cb25ca513261065d8c2f0a202c6fa4db1d5c70cbf86af0955c1206c4ed" | jq -e '.changed == false'Pinned hash 61d1a3cb25ca, from Oct 29, 2026, 00:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/io.github.leo9/hoteluse/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/io.github.leo9/hoteluse)Source: MCP Registry. Synced Oct 29, 2026, 00:17 UTC.