HotelRunner MCP by usefulapi
io.usefulapi/hotelrunnerusefulapi.iostreamable-httpv1.0.0Scanned
Read HotelRunner reservations, rooms, channels; update availability and prices; confirm or cancel.
8 tools: 2 can delete or cancel things and 6 only read.
- Reads private data · 2
- Reads text others write · 8
- Can send data out · 0
- No findings
Anlyon alternative
2 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
8 tools
Deletes or cancels 2Claude Code: deny
hotelrunner_update_reservation_stateWRITE: move ONE reservation to the next state: event 'confirm' (hotelier accepts it) or 'cancel' (cancels it; cancel_reason is required: customer, no_room, no_show or invalid_price…Reads text others writeNo findings
Why it is in this group
- The name "hotelrunner_update_reservation_state" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE: move ONE reservation to the next state: event 'confirm' (hotelier accepts it) or 'cancel' (cancels it; cancel_reason is required: customer, no_room, no_show or invalid_price). Cancel is not reversible through this API and releases the room; HotelRunner may notify the guest or the sales channel (Booking.com, Expedia, ...), so only cancel when the user clearly asked for it, and pass confirm=true for a cancel. Only possible when the reservation's requires_response is true and the event is in its next_states (see hotelrunner_get_reservation); otherwise HotelRunner answers state_change_is_not_available. Counts as one of the property's 250 requests per day (5 per minute). PUT /api/v2/apps/reservations/fire.
Annotations the server declares
- title: Confirm or cancel a reservation
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
hotelrunner_update_room_calendarWRITE: change availability, price, minimum/maximum stay, stop-sale, closed-to-arrival (cta) or closed-to-departure (ctd) for ONE room type (inv_code) over a date range of at most 9…Reads text others writeNo findings
Why it is in this group
- The name "hotelrunner_update_room_calendar" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE: change availability, price, minimum/maximum stay, stop-sale, closed-to-arrival (cta) or closed-to-departure (ctd) for ONE room type (inv_code) over a date range of at most 90 days, optionally only on some weekdays and only on some channels. Only the fields you pass are changed. This is LIVE inventory: HotelRunner pushes it to every connected channel (Booking.com, Expedia, your own booking engine, ...) and it changes what guests can book and pay. The price is the base-rate price in the property's sales currency; guest-based prices derive from it. Only rooms whose availability_update / restrictions_update / price_update flag is true (hotelrunner_list_rooms) accept that kind of change. HotelRunner answers asynchronously: the reply has a transaction_id; check per-channel results with hotelrunner_get_transaction_details. Send one change per call, not a full refresh. Counts as one of the property's 250 requests per day (5 per minute). PUT /api/v2/apps/rooms/daily.
Annotations the server declares
- title: Update room availability, prices and restrictions
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
Only reads 6Show 6 read-only tools
hotelrunner_get_reservationOne reservation by its HotelRunner code (hr_number, e.g.Reads text others writeNo findings
Why it is in this group
- The name "hotelrunner_get_reservation" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it One reservation by its HotelRunner code (hr_number, e.g. R377873409) or the sales channel's own reservation code, with the full vendor record (rooms, daily prices, extras, payments, guest and billing details, next_states). If the reservation is older than HotelRunner's lookup window, pass from_date. Counts as one of the property's 250 requests per day (5 per minute). GET /api/v2/apps/reservations?reservation_number=.
Annotations the server declares
- title: Get reservation
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
hotelrunner_get_transaction_detailsPer-channel status of a calendar update: pass the transaction_id returned by hotelrunner_update_room_calendar.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "hotelrunner_get_transaction_details" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "calendar": it reads calendars.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Per-channel status of a calendar update: pass the transaction_id returned by hotelrunner_update_room_calendar. Shows succeeded / failed / in-progress counts and each channel's state and error message. Counts as one of the property's 250 requests per day (5 per minute). GET /api/v2/apps/infos/transaction_details.
Annotations the server declares
- title: Get calendar update status
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
hotelrunner_list_channelsAll sales channels HotelRunner supports (name and code, e.g.Reads text others writeNo findings
Why it is in this group
- The name "hotelrunner_list_channels" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it All sales channels HotelRunner supports (name and code, e.g. bookingcom, expedia, hrs, online). The code is what hotelrunner_update_room_calendar takes in channel_codes. Counts as one of the property's 250 requests per day (5 per minute). GET /api/v2/apps/infos/channels.
Annotations the server declares
- title: List sales channels
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
hotelrunner_list_connected_channelsThe channels this property is connected to, each with counts of calendar update processes in progress, succeeded and failed.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "hotelrunner_list_connected_channels" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "calendar": it reads calendars.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The channels this property is connected to, each with counts of calendar update processes in progress, succeeded and failed. Counts as one of the property's 250 requests per day (5 per minute). GET /api/v2/apps/infos/connected_channels.
Annotations the server declares
- title: List connected channels
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
hotelrunner_list_reservationsList reservations of the property (new, modified, canceled), newest data first as HotelRunner returns them, 1-50 per page.Reads text others writeNo findings
Why it is in this group
- The name "hotelrunner_list_reservations" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List reservations of the property (new, modified, canceled), newest data first as HotelRunner returns them, 1-50 per page. By default ALL reservations created in the window are returned (this tool sets undelivered=false, so reading does not depend on a PMS having fetched them). from_date is the creation date (HotelRunner keeps at most 30 days back; default 10 days); from_last_update_date finds reservations changed since a date. detail 'summary' (default) gives guest, dates, rooms, totals, payment state and contact; 'full' returns the whole vendor record including billing address, national id, daily prices and extras. Reply: items, count, page, pages, next_page. Counts as one of the property's 250 requests per day (5 per minute). GET /api/v2/apps/reservations.
Annotations the server declares
- title: List reservations
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
hotelrunner_list_roomsList the property's room types and rates with their inv_code and rate_code, capacity, pricing type, sales currency, connected channel codes and whether availability, restrictions a…Reads text others writeNo findings
Why it is in this group
- The name "hotelrunner_list_rooms" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List the property's room types and rates with their inv_code and rate_code, capacity, pricing type, sales currency, connected channel codes and whether availability, restrictions and prices can be updated through the API. Use the inv_code with hotelrunner_update_room_calendar. Counts as one of the property's 250 requests per day (5 per minute). GET /api/v2/apps/rooms.
Annotations the server declares
- title: List rooms and rates
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.
- Reads private data2
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write8
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
No check matched anything in these tool definitions. That is not a safety guarantee.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http hotelrunner https://hotelrunner.usefulapi.io/mcpclaude mcp add --transport http hotelrunner https://hotelrunner.usefulapi.io/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__hotelrunner__hotelrunner_list_rooms",
"mcp__hotelrunner__hotelrunner_list_reservations",
"mcp__hotelrunner__hotelrunner_get_reservation",
"mcp__hotelrunner__hotelrunner_list_channels",
"mcp__hotelrunner__hotelrunner_list_connected_channels",
"mcp__hotelrunner__hotelrunner_get_transaction_details"
],
"ask": [],
"deny": [
"mcp__hotelrunner__hotelrunner_update_room_calendar",
"mcp__hotelrunner__hotelrunner_update_reservation_state"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as hotelrunner. Review it before you use it.
Capability tags behind 8 rules
- mcp__hotelrunner__hotelrunner_list_rooms untrusted-input
- mcp__hotelrunner__hotelrunner_list_reservations untrusted-input
- mcp__hotelrunner__hotelrunner_get_reservation untrusted-input
- mcp__hotelrunner__hotelrunner_list_channels untrusted-input
- mcp__hotelrunner__hotelrunner_list_connected_channels private-data, untrusted-input
- mcp__hotelrunner__hotelrunner_get_transaction_details private-data, untrusted-input
- mcp__hotelrunner__hotelrunner_update_room_calendar untrusted-input
- mcp__hotelrunner__hotelrunner_update_reservation_state untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/hotelrunner/verify?hash=0ec273673fa59afbf4a6f6e669acc1108a775c776396650b656e1af5d405ca2d" | jq -e '.changed == false'Pinned hash 0ec273673fa5, from Oct 24, 2026, 16:20 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/io.usefulapi/hotelrunner/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/io.usefulapi/hotelrunner)Source: MCP Registry · repository. Synced Oct 24, 2026, 17:17 UTC.