PriceWin
by price.win · remote · no sign-in to list tools · v1.19.0 · published by win.price
Live hotel and flight prices compared across Booking.com, Agoda, Trip.com and Traveloka, in USD.
12 tools: 1 can delete or cancel things, 1 do something that can't be undone, 4 change things and 6 only read.
Scanned Oct 21, 2026
- Deletes or cancels1Claude Code: deny: see these tools
- Can't be undone1Claude Code: ask: see these tools
- Changes things4Claude Code: ask: see these tools
- Only reads6Claude Code: allow: see these tools
1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http pricewin https://mcp.price.win/mcpFindings
Matches of fixed checks, with the text they matched.
The server marks "get_ota_hotel_detail" as not read-only (readOnlyHint: false), and its words say it reads.
What this check looks forMatched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":true}; The name "get_ota_hotel_detail" says "get": a word for reading.
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
12 tools
Deletes or cancels 1Claude Code: deny
cancel_bookingSecond of two steps to cancel a booking: cancels it and starts any refund due.No findings
Why it is in this group
- The name "cancel_booking" says "cancel": a word for removing or ending something.
- The description says "Irreversible".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Second of two steps to cancel a booking: cancels it and starts any refund due. Irreversible. Requires the confirmation code and the single-use token that request_cancel_token emailed to the guest; a missing, expired or already-used token is rejected. get_cancellation_policy shows the refund terms that apply.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
- destructiveHint: true
- title: Cancel Booking (step 2 of 2)
Can't be undone 1Claude Code: ask
request_bookingSends a booking request for a room at an OpenTravel partner hotel.No findings
Why it is in this group
- The name "request_booking" says "request": a word for a change.
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
Description, as the server wrote it Sends a booking request for a room at an OpenTravel partner hotel. Nothing is charged and no room is held: the hotel confirms the request by email, and the guest pays at the property on arrival. There is no payment step, now or later. Takes the room and rate from get_hotel_detail and the guest's name, phone number and email; when any of these is missing, the result asks for it and, in clients that show widgets, opens a form for it. One request covers several rooms of the same room type (roomCount), with adults and children counted across all of them; each call is a separate request with its own code, so rooms of one type booked call by call reach the hotel as unrelated requests. Returns one confirmation code for the whole request.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
- destructiveHint: false
- title: Request a Booking (hotel confirms, pay at the hotel)
Changes things 4Claude Code: ask
get_ota_hotel_detailFull detail (rooms, live prices, facilities, photos, reviews) from Booking.com for one named hotel over a date range, for requests about a single hotel rather than a whole city (se…1 finding
Why it is in this group
- The name "get_ota_hotel_detail" says "get": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
Findings
- Warn
The server marks "get_ota_hotel_detail" as not read-only (readOnlyHint: false), and its words say it reads.
What this check looks forMatched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":true}; The name "get_ota_hotel_detail" says "get": a word for reading.
Description, as the server wrote it Full detail (rooms, live prices, facilities, photos, reviews) from Booking.com for one named hotel over a date range, for requests about a single hotel rather than a whole city (search_hotels_live lists a city). The name is resolved through the city's listings, so it takes the hotel name together with its city; a Booking.com URL from an earlier result skips that lookup. OpenTravel direct listings are covered by get_hotel_detail. The fetch is live and takes up to about two minutes; under heavy load it can return not-found.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
- destructiveHint: false
- title: Hotel Detail by Name (one specific hotel)
request_cancel_tokenFirst of two steps to cancel a booking.No findings
Why it is in this group
- The name "request_cancel_token" says "request": a word for a change.
Description, as the server wrote it First of two steps to cancel a booking. Emails a single-use cancellation token to the address on the booking, given its confirmation code and that same email address. Nothing is cancelled, charged or refunded by this step. The token expires after 24 hours and works once; cancel_booking completes the cancellation with it.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
- destructiveHint: false
- title: Request Cancellation Link (step 1 of 2)
search_flights_liveStarts a live one-way flight search for a route and date.No findings
Why it is in this group
- The name "search_flights_live" says "search": a word for reading.
- The description's first verb is "start": a word for a change.
Description, as the server wrote it Starts a live one-way flight search for a route and date. Fares come from Agoda and Google Flights. Origin and destination are 3-letter IATA airport codes (for example SGN, HAN, DAD). Returns a session ID; poll_flight_results returns the results. When the route or date is missing, the result is a question for the user instead of a search.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
- destructiveHint: false
- title: Search Flights Live
search_hotels_liveStarts a live hotel search for a city and date range.No findings
Why it is in this group
- The name "search_hotels_live" says "search": a word for reading.
- The description's first verb is "start": a word for a change.
Description, as the server wrote it Starts a live hotel search for a city and date range. Prices come from Agoda, Booking.com, Traveloka, Trip.com, Hotels.com and Airbnb, plus direct rates from OpenTravel partner hotels. Returns a session ID; poll_search_results returns the results as they arrive. Optional filters narrow the results by hotel name, area or total price for the stay. Prices depend on the party: it defaults to 2 adults in 1 room, and the result states the party searched and flags when it was defaulted. When the city or dates are missing, the result is a question for the user instead of a search; the stay dates searched are echoed back for confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
- destructiveHint: false
- title: Search Hotels Live
Only reads 6Claude Code: allow
check_booking_statusReturns the current status of a booking request (waiting for the hotel, confirmed or cancelled) by the confirmation code request_booking returned.No findings
Why it is in this group
- The name "check_booking_status" says "status": a word for reading.
Description, as the server wrote it Returns the current status of a booking request (waiting for the hotel, confirmed or cancelled) by the confirmation code request_booking returned.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Check Booking Status
get_cancellation_policyReturns the cancellation terms for one rate plan at an OpenTravel partner hotel: whether it is refundable, the free-cancellation window, the refund percentage, a plain-language sum…No findings
Why it is in this group
- The name "get_cancellation_policy" says "get": a word for reading.
Description, as the server wrote it Returns the cancellation terms for one rate plan at an OpenTravel partner hotel: whether it is refundable, the free-cancellation window, the refund percentage, a plain-language summary and, given the check-in date, the exact free-cancellation deadline. Takes the propertyId and the ratePlanId from get_hotel_detail.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Cancellation Policy
get_hotel_detailPrices and availability for one OpenTravel direct-listed hotel over a date range, with its photos, amenities and room types, each room with its rate plan and total price.No findings
Why it is in this group
- The name "get_hotel_detail" says "get": a word for reading.
Description, as the server wrote it Prices and availability for one OpenTravel direct-listed hotel over a date range, with its photos, amenities and room types, each room with its rate plan and total price. Takes the propertyId from search results (source 'OPENTRAVEL_DIRECT'), or a hotel name plus city for a known direct listing. get_hotel_info returns the same hotel's static facts without dates.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Hotel Detail (by propertyId / OpenTravel-direct)
get_hotel_infoStatic facts about an OpenTravel direct-listed hotel, with no check-in or check-out date required: photo gallery, property description, address, facilities (parking, pool, pets and…No findings
Why it is in this group
- The name "get_hotel_info" says "get": a word for reading.
Description, as the server wrote it Static facts about an OpenTravel direct-listed hotel, with no check-in or check-out date required: photo gallery, property description, address, facilities (parking, pool, pets and so on), check-in and check-out times, the house cancellation policy, and each room type's description, floor area, capacity, photos and in-room facilities. Carries no prices and no availability — get_hotel_detail covers those for a specific date range. Takes the propertyId UUID from search results.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Hotel Info (no dates needed)
poll_flight_resultsReturns the current results of a flight search session started by search_flights_live: outbound and return options with airline, flight number, times, stops, fare and booking link.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it Returns the current results of a flight search session started by search_flights_live: outbound and return options with airline, flight number, times, stops, fare and booking link. Results can be partial while the search runs; status reads 'completed' or 'failed' when it ends.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Poll Flight Results
poll_search_resultsReturns the current results of a hotel search session started by search_hotels_live: hotels with their price from each source, and OpenTravel direct listings with the propertyId th…No findings
Why it is in this group
- The name "poll_search_results" says "search": a word for reading.
Description, as the server wrote it Returns the current results of a hotel search session started by search_hotels_live: hotels with their price from each source, and OpenTravel direct listings with the propertyId that get_hotel_detail and get_hotel_info take. Results can be partial while the search runs; status reads 'completed' once every source has answered.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Poll Search Results
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 1.19.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http pricewin https://mcp.price.win/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__pricewin__poll_search_results",
"mcp__pricewin__poll_flight_results",
"mcp__pricewin__get_hotel_detail",
"mcp__pricewin__check_booking_status",
"mcp__pricewin__get_hotel_info",
"mcp__pricewin__get_cancellation_policy"
],
"ask": [
"mcp__pricewin__search_hotels_live",
"mcp__pricewin__search_flights_live",
"mcp__pricewin__get_ota_hotel_detail",
"mcp__pricewin__request_booking",
"mcp__pricewin__request_cancel_token"
],
"deny": [
"mcp__pricewin__cancel_booking"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as pricewin. Review it before you use it.