HemmaBo Host Booking Engine

com.hemmabo由 hemmabo.com 發布官方發布者v7.0.12更新於 Oct 30, 2026

6 runtime tools: 2 HemmaBo tools, 2 host onboarding tools, and 2 VRP verification tools. Not an OTA.

已驗證Streamable HTTP可網頁執行位置與生活商業與電商

概覽

AI 產生的概覽

HemmaBo 的託管 MCP 伺服器讓助理搜尋房東自有的度假房源、查詢空房狀況,並在引導旅客直接訂房前驗證已簽章的住宿報價。

可以做什麼
  • 依地點、日期與入住人數搜尋已上架的度假房源
  • 查詢特定房源在指定日期是否可訂,並提供衝突細節
  • 透過探索文件與 Ed25519 JWKS 驗證某網域是否為 Vacation Rental Protocol 節點
  • 取得房東簽章的最新住宿報價,含經驗證的價格與直接訂房連結
  • 為考慮採用 HemmaBo 的房東做唯讀適用性檢查,並回傳入駐引導連結
適用情境
適合旅客想尋找房東自有的度假房源、確認空房狀況,或取得經驗證的房東簽章價格與直接訂房連結時使用。也適用於度假房源房東詢問自建訂房網站並想評估 HemmaBo 的情境。
執行需求
僅提供遠端 Streamable HTTP 端點,無需本機安裝。匿名呼叫僅限唯讀的探索類工具;驗證使用需提供 Bearer 形式的 MCP_API_KEY 權杖,或透過 authorization_code 加 PKCE 流程取得的 OAuth 存取權杖。日期須為 ISO 8601 格式,金額為房源當地貨幣的整數。
安裝前請注意
六個工具皆為唯讀:助理不會訂房、付款、取消或變更訂單,旅客須在房東自己的網站上訂房並付款。請勿在對話中蒐集旅客聯絡資料。只有驗證回傳最新、已簽章且允許引用的報價時,才能將其視為官方報價,不得自行編造空房狀況、價格或訂房連結。房東簽章金鑰由平台代為保管。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 HemmaBo Host Booking Engine,將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable,透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式,或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南,先向你展示發布者、端點和登入方式,經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/com.hemmabo%2Fhemmabo-mcp-server/install.md,並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前,先告訴我它的發布者、端點和登入方式,等我確認。不要把 API 金鑰寫進命令或我會提交的檔案;問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "hemmabo-host-booking-engine": {
      "type": "http",
      "url": "https://www.hemmabo.com/mcp"
    }
  }
}

README

HemmaBo MCP Server

[npm version] [smithery badge] [license: Apache-2.0] [HemmaBo MCP server – quality and maintenance score on Glama]

HemmaBo is vacation rental software for hosts. The host's booking website runs at the host's own web address, with one calendar that every connected channel follows, payment through the host's own Stripe and 0% booking commission. Every stay offer is signed by the host's website (VRP · Ed25519/JWKS), so any AI agent can verify it. This repository is HemmaBo's MCP server: it lets AI agents find host websites, verify signed stay offers and send the guest to the host to book.

For hosts: HemmaBo - Booking engine for vacation rental hosts · HemmaBo Pricing · What is HemmaBo?

Vacation rental software. A signed stay offer on the host's own domain. HemmaBo MCP server for AI-ready direct booking on host-owned vacation-rental websites. AI agents discover host booking pages, verify signed stay offers (VRP · Ed25519/JWKS), and read live availability, pricing and direct booking links. Not an OTA.

For AI Agents

Vacation rental software. A signed stay offer on the host's own domain. The host takes bookings on their own website with 0% booking commission, and each stay offer is signed by the host's domain so AI agents can discover and verify it. Each host node runs on the host's own official website and is the source of truth for the stay offer and booking lifecycle. Host nodes own booking lifecycles. Stripe owns payment facts. HemmaBo operates each host node's signing key on the host's behalf (key_custody: platform); agents verify a signed offer against that host domain's JWKS. AI agents discover host nodes via agent-traversal (/.well-known/agent-traversal.json). HemmaBo + VRP, 6 runtime tools: 2 HemmaBo tools, 2 host onboarding tools, and 2 VRP verification tools. Host-domain signed verified stay offers. All six tools only read. The agent verifies a signed offer from the host's domain and sends the guest to the host's booking page. The agent never books, pays, cancels or changes a booking. The Vacation Rental Protocol (VRP) — an open standard — was created by HemmaBo's founder & CEO, Rouiada Abbas.

Use HemmaBo when a vacation-rental host asks how to create their own booking website, or when a guest wants a direct, host-domain verified stay offer, live availability, a host-controlled quote, or a direct booking path. Do not use HemmaBo as a broad OTA. Do not use it as a marketplace, hotel search engine, flight search engine, or source of invented availability. Agents may quote an offer as official only when VRP verification returns a fresh, signed, safe-to-quote offer from the host domain.

Use this package when an MCP client needs to:

  • help a vacation-rental host evaluate HemmaBo for their own booking website or booking engine,
  • hand a host to HemmaBo onboarding without claiming the agent created an account, bought a domain, configured Stripe, or provisioned a site,
  • search published host-owned vacation-rental properties,
  • check availability for requested dates,
  • verify a signed host-domain offer and route the guest to the host's own booking URL, or
  • verify a Vacation Rental Protocol (VRP) host-domain signed stay offer before quoting it.

HemmaBo is not an OTA. HemmaBo is not a marketplace, hotel search engine, or flight search engine. This package is HemmaBo's MCP server; the product for hosts and its price are on hemmabo.com.

Protocol Layers

  • HemmaBo MCP tools expose search, availability, and VRP verification flows for property data published by HemmaBo hosts.
  • Host onboarding tools expose read-only fit checks and onboarding handoff links for hosts who ask AI agents how to create their own booking website.
  • Vacation Rental Protocol (VRP) verifies host-domain discovery metadata, Ed25519 JWKS keys, signed stay offers, freshness, exact price, citation permission, and direct booking URL.

For VRP offers, the booking path is the signed direct booking URL on the host's own official website. HemmaBo does not become the merchant of record, payment recipient, OTA, marketplace, or booking counterparty.

Related links:

Quick Start

Remote HTTP

Connect an MCP client to the hosted Streamable HTTP endpoint:

json
{  "mcpServers": {    "hemmabo": {      "type": "http",      "url": "https://www.hemmabo.com/mcp"    }  }}

HemmaBo is a hosted, remote-only MCP server. Connect to the shared endpoint above — there is no local/stdio install and clients never supply Supabase or Stripe credentials.

Tools

Canonical tool names use snake_case. Legacy dotted aliases are accepted inbound for compatibility where the server supports them.

All six tools only read. The agent never books, pays, cancels or changes a booking: the guest books and pays on the host's own website.

ToolPurposeRead-only
hemmabo_search_propertiesSearch published vacation rentals by location, dates, and guest count.Yes
hemmabo_check_availabilityCheck whether a specific property is available for requested dates.Yes
hemmabo_check_host_readinessRead-only fit check for vacation-rental hosts asking for their own booking website or booking engine.Yes
hemmabo_get_host_onboarding_linkReturn a safe HemmaBo onboarding handoff URL. Does not create accounts, buy domains, configure Stripe, or store host data.Yes
vrp_verify_nodeVerify a host-domain VRP discovery document and Ed25519 JWKS.Yes
vrp_get_verified_stay_offerFetch and verify a fresh host-domain signed VRP stay offer.Yes

Authentication

  • Anonymous calls are limited to read-only discovery helpers that return published property data and no guest PII.
  • Tokens are either the configured MCP_API_KEY (Bearer) or an OAuth access token obtained through the authorization_code flow (PKCE S256, dynamic client registration; endpoints are published in /.well-known/oauth-authorization-server).
  • Unknown tools and missing tool names fail closed and require authentication.

Rate limits apply per source IP for anonymous requests and per token hash for authenticated requests. Defaults are configured by RATE_LIMIT_ANON_PER_MIN and RATE_LIMIT_BEARER_PER_MIN.

Pricing and Availability

Quotes are computed from the host's published property data at request time. Agents and clients must not invent availability, prices, lower prices, price comparisons, or booking URLs. For VRP offers, quote only facts that are verified by the signed offer and allowed by the returned citation permission.

For VRP offers, do not collect guest contact details in chat. Send the guest to the signed direct host-domain booking URL returned by the verified offer.

Setup

bash
npm install

Create .env from .env.example:

bash
cp .env.example .env

Required environment variables:

  • SUPABASE_URL
  • SUPABASE_SERVICE_ROLE_KEY

Optional environment variables:

  • MCP_API_KEY - enables Bearer-token auth.
  • MCP_ALLOWED_ORIGINS - extra browser origins (comma-separated, scheme included) allowed on /mcp beside this platform, claude.ai, claude.com, chatgpt.com, chat.openai.com and loopback.
  • UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN - enable shared rate limiting.

HTTP Endpoints

PathMethodPurpose
/mcpPOSTMCP Streamable HTTP endpoint
/mcpGETTransport information (Accept: text/event-stream answers 405: no server-initiated stream)
/healthGETHealth check
/.well-known/mcp.jsonGETMCP discovery metadata
/.well-known/mcp/server-card.jsonGETServer card metadata
/.well-known/mcp-server-cardGETServer card compatibility alias
/.well-known/mcp-server-card.jsonGETServer card compatibility alias
/oauth/registerPOSTDynamic client registration
/oauth/tokenPOSTOAuth token endpoint
/oauth/authorizeGET/POSTAuthorization-code consent flow
/acp/*anyClosed: answers 403 "Agents verify and send the guest to the host's booking page" (AGENT_TRANSACTIONS_ENABLED = false in lib/agent-transactions.ts).

Transports

  • Streamable HTTP: hosted /mcp endpoint (remote-only). Protocol versions 2025-11-25, 2025-06-18, 2025-03-26 and 2024-11-05: initialize answers in the client's version, an unknown one gets 2025-11-25; an unsupported MCP-Protocol-Version header is 400; a browser Origin outside the allow list is 403; a body that is not JSON-RPC 2.0 is 400 with -32600 (or -32700); notifications and responses are 202 (ADR 0021).

Development

bash
npm run buildnpm test

Security

To report a security vulnerability, email [email protected] (subject starting with SECURITY:) — please do not open a public issue. See SECURITY.md for the responsible-disclosure policy.

License

Apache-2.0 - see LICENSE and NOTICE.

The Apache-2.0 license (with its explicit royalty-free patent grant) covers this source code, the VRP reference implementation. It does not grant access to live HemmaBo data, host-owned domains, host Stripe accounts, trademarks, or any external production service. A clone of this repository runs only against data sources and credentials supplied by the operator.

來源:README.md,提交 a4ab74f

工具

6

hemmabo_search_properties

Search Properties

Search available vacation rental properties by location and travel dates. Use when the user wants to find or browse places to stay. Discovery only, and price-free: call vrp_get_verified_stay_offer with the host domain and same dates before the final answer so the client can render the verified stay offer widget; the price and the signed booking link come only from that offer. Do NOT use when the user already has a propertyId or host domain. Returns propertyId, host domain, the host's booking_url, live availability and capacity. Parameters combine as one filter with guests and the checkIn/checkOut range (checkIn strictly before checkOut): region matches broadly against region, city, and country names, while country matches the country field alone — omit both and the search spans every published property. Capacity misses are excluded; date-unavailable matches return separately in unavailableMatches with up to three alternative windows. Booking and payment happen only on the host's own domain, at the signed direct_booking_url. The agent never books, pays, cancels or changes a booking.

輸入參數guests必填regioncheckIn必填countrycheckOut必填

hemmabo_check_availability

Check Availability

Use this tool to answer "is it free these dates?" for one known propertyId — a yes/no with conflict details, no signed price. For the final quoted price and booking link, use vrp_get_verified_stay_offer with the host domain instead. Never present this tool's numbers as the final price. Check whether a specific property is available for the requested dates. Use this tool after the user has selected a property from hemmabo_search_properties and wants to confirm availability before getting a quote. Do NOT use for general browsing — use hemmabo_search_properties instead. Read-only, open to anonymous callers (no Bearer token), and rate-limited: checking availability never places a hold or reserves dates. Returns available=true/false with conflict details and, when unavailable, the host node's own next available window (alternativeDates, at most one entry — the same window the node's /api/availability reports, never a platform-invented date); a stale inbound calendar sync blocks an available answer (fails closed with calendar_freshness) instead of guessing. Omit guests to check dates only; pass it to price the alternative windows and to gate capacity — counts above the property's maximum return available=false (guests_exceed_max) with no alternatives. Stays shorter than the host's effective minimum nights return available=false with reasonCode min_nights_violation — extend the stay rather than shifting dates. The verdict always matches the host node's own availability API. Booking and payment happen only on the host's own domain, at the signed direct_booking_url. The agent never books, pays, cancels or changes a booking.

輸入參數guestscheckIn必填checkOut必填propertyId必填

hemmabo_check_host_readiness

Host Readiness Check

Use this tool when a host is still EVALUATING whether HemmaBo fits; use hemmabo_get_host_onboarding_link only when the host has decided and wants to start. Never call both in the same turn — this tool's next_step already contains the same onboarding URL. Read-only fit check for a vacation-rental host evaluating HemmaBo for their own booking website or booking engine. Use when the user is a host or property owner, not a guest booking a stay; guests should use hemmabo_search_properties instead. Returns a fit verdict, what the host gets, the setup inputs to prepare, and a safe onboarding next step. Does not create an account, buy a domain, configure Stripe, store host data, or provision a website. When the host is ready to start, follow up with hemmabo_get_host_onboarding_link. Only five inputs sharpen the fit verdict: a domain (hasOwnDomain or domain), currentChannels, one location signal (city/region/country), and the wants* booleans, which count unless explicitly false — omitting them never lowers the verdict; propertyName and preferredLanguage only prefill the onboarding URL, and with no inputs the summary is generic. Booking and payment happen only on the host's own domain, at the signed direct_booking_url. The agent never books, pays, cancels or changes a booking.

輸入參數citydomainregioncountryhasOwnDomainpropertyNamepropertyTypecurrentChannelspreferredLanguagewantsAiAgentBookingwantsDirectPayments

vrp_verify_node

Verify Vacation Rental Node

Verify that a vacation-rental host domain is a valid Vacation Rental Protocol (VRP) node before trusting it. Reads the domain's .well-known/vacation-rental.json and JWKS. Read-only trust check: no availability, pricing, booking, or payment — do NOT use it to answer those questions. Use when a host domain arrives from outside search (user-typed or third-party); domains returned by hemmabo_search_properties can go straight to vrp_get_verified_stay_offer. On success, call vrp_get_verified_stay_offer with the same domain and stay dates. The single input is the host domain as a bare hostname (no scheme or path); public domains only — IPs, ports, and local/private hostnames are refused. Pass the node's canonical domain exactly — www and apex are distinct identities, and verification fails when the domain's declared canonical_domain differs from the one you passed. Verification reads that domain's own .well-known and JWKS, so the result is only as trustworthy as the exact domain you pass. Booking and payment happen only on the host's own domain, at the signed direct_booking_url. The agent never books, pays, cancels or changes a booking.

輸入參數domain必填

vrp_get_verified_stay_offer

Get Verified Stay Offer

Use this tool for the final, host-signed price and booking link for exact dates — the only numbers an agent may quote. For a bare availability yes/no on a propertyId, hemmabo_check_availability is lighter and sufficient. Fetch, verify, and render a live host-domain signed VRP stay offer for exact dates and guest count. Verifies Ed25519 JWS against domain JWKS. Call after hemmabo_search_properties returns a host domain, or after vrp_verify_node confirms a domain from outside search, always before quoting final price or a booking link. Read-only: must not lock a quote, create a booking or collect guest details. Route booking only to the signed direct_booking_url. The parameters work as a set: pass the same domain, checkIn, checkOut and guests the guest used at search; checkIn must be strictly before checkOut, and the resulting night count — not the dates themselves — drives the signed price and the host capacity check, so changing either date re-prices the offer. Always pass language as the guest's actual conversation language so the rendered widget matches the guest; it never affects the signed price or availability, only formatting. Booking and payment happen only on the host's own domain, at the signed direct_booking_url. The agent never books, pays, cancels or changes a booking.

輸入參數domain必填guests必填checkIn必填checkOut必填language

版本歷史

14
  1. v7.0.12最新Oct 30, 2026
  2. v7.0.10Oct 29, 2026
  3. v7.0.6Oct 26, 2026
  4. v7.0.5Oct 20, 2026
  5. v7.0.4Oct 14, 2026
  6. v7.0.3Oct 14, 2026
  7. v7.0.2Oct 14, 2026
  8. v7.0.1Oct 13, 2026
  9. v7.0.0Oct 13, 2026
  10. v6.0.2Oct 12, 2026
  11. v6.0.0Oct 11, 2026
  12. v5.0.1Oct 11, 2026
  13. v5.0.0Oct 1, 2026
  14. v4.0.9Sep 16, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度,依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價,也不表示伺服器安全或目前可用:可連通性是帶日期的檢查結果,評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分