HemmaBo Host Booking Engine

Name: HemmaBo Host Booking Engine
Author: HemmaBo-se

by HemmaBo-seversion 7.0.12i★ –iRuns in the cloud

Registry namecom.hemmabo/hemmabo-mcp-server

Install

Overview

Description from the maker (original English)

6 runtime tools: 2 HemmaBo tools, 2 host onboarding tools, and 2 VRP verification tools. Not an OTA.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi3 of 3 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs in the cloud
Transport: Streamable HTTP
Category: Other

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 3 of 3 passed
Runs on the maker’s server: what you ask it goes through their server.
Can do 6 things (tools) hemmabo_search_properties, hemmabo_check_availability, hemmabo_check_host_readiness, hemmabo_get_host_onboarding_link …
The registry lists no key to fill in.

You need

Runs in the cloudNothing to install; it connects over the internet

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Works in Claude on the web, desktop and mobile:

Open Settings → Connectors
Press Add custom connector
Paste the address below and press Add
If it asks you to sign in, sign in with the maker

https://www.hemmabo.com/mcp

Run this in your terminal

claude mcp add --transport http hemmabo https://www.hemmabo.com/mcp

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "hemmabo": {
      "url": "https://www.hemmabo.com/mcp"
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "hemmabo": {
      "type": "http",
      "url": "https://www.hemmabo.com/mcp"
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

ChatGPT connects only to servers on the internet:

Open ChatGPT on the web → Settings → Connectors (Apps)
Press Create or Add (some plans need Developer mode under Advanced first)
Paste the address below, give it a name and save
If it asks you to sign in, sign in with the maker

https://www.hemmabo.com/mcp

Menu names can differ slightly by plan and over time.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Tool names and descriptions exactly as the server reported them on Nov 6, 2026. The maker wrote them, not us; we show them as plain text.

hemmabo_search_properties
Search available vacation rental properties by location and travel dates. Use when the user wants to find or browse places to stay. Discovery only, and price-free: call vrp_get_verified_stay_offer with the host domain and same dates before the final answer so the client can rende
hemmabo_check_availability
Use this tool to answer "is it free these dates?" for one known propertyId — a yes/no with conflict details, no signed price. For the final quoted price and booking link, use vrp_get_verified_stay_offer with the host domain instead. Never present this tool's numbers as the final
hemmabo_check_host_readiness
Use this tool when a host is still EVALUATING whether HemmaBo fits; use hemmabo_get_host_onboarding_link only when the host has decided and wants to start. Never call both in the same turn — this tool's next_step already contains the same onboarding URL. Read-only fit check for a
hemmabo_get_host_onboarding_link
Use this tool only when the host has already decided to start; if the host is still evaluating, use hemmabo_check_host_readiness instead — it returns the same onboarding URL in next_step. Never call both in the same turn. Return a safe HemmaBo onboarding handoff URL for a vacatio
vrp_verify_node
Verify that a vacation-rental host domain is a valid Vacation Rental Protocol (VRP) node before trusting it. Reads the domain's .well-known/vacation-rental.json and JWKS. Read-only trust check: no availability, pricing, booking, or payment — do NOT use it to answer those question
vrp_get_verified_stay_offer
Use this tool for the final, host-signed price and booking link for exact dates — the only numbers an agent may quote. For a bare availability yes/no on a propertyId, hemmabo_check_availability is lighter and sufficient. Fetch, verify, and render a live host-domain signed VRP sta

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified against the domain hemmabo.com (the registry checks domain ownership)
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
✓ Pass
Endpoint responds
Responded in 303 ms (HTTP 200)
– Not applicable
Sign-in with OAuth
No sign-in needed
✓ Pass
No hidden instructions in tool descriptions
Read 6 tool descriptions and found no hidden instructions to the AI

Compared with others in Otheri

More stars than 0% of the other 32606 servers in this category
Published to the registry more recently than 82% of the other 32606 servers in this category
Basic checks equal to or better than 100% of the other 32606 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is HemmaBo Host Booking Engine safe?

It passed 3 of 3 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs in the maker’s cloud. Connect over the internet with nothing to install, but what you send passes through the maker’s servers.

Is it still maintained?

The GitHub repo last changed –, and the latest version (7.0.12) reached the registry 7 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, Georgia MCP

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated 2 days ago

Install

Georgia MCP

by abgeo

An MCP server for Georgian public data, read from the organizations that publish it.

Computer or cloudUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

HemmaBo MCP Server

HemmaBo is vacation rental software for hosts. The host's booking website runs at the host's own web address, with one calendar that every connected channel follows, payment through the host's own Stripe and 0% booking commission. Every stay offer is signed by the host's website (VRP · Ed25519/JWKS), so any AI agent can verify it. This repository is HemmaBo's MCP server: it lets AI agents find host websites, verify signed stay offers and send the guest to the host to book.

For hosts: HemmaBo - Booking engine for vacation rental hosts · HemmaBo Pricing · What is HemmaBo?

Vacation rental software. A signed stay offer on the host's own domain. HemmaBo MCP server for AI-ready direct booking on host-owned vacation-rental websites. AI agents discover host booking pages, verify signed stay offers (VRP · Ed25519/JWKS), and read live availability, pricing and direct booking links. Not an OTA.

For AI Agents

Vacation rental software. A signed stay offer on the host's own domain. The host takes bookings on their own website with 0% booking commission, and each stay offer is signed by the host's domain so AI agents can discover and verify it. Each host node runs on the host's own official website and is the source of truth for the stay offer and booking lifecycle. Host nodes own booking lifecycles. Stripe owns payment facts. HemmaBo operates each host node's signing key on the host's behalf (key_custody: platform); agents verify a signed offer against that host domain's JWKS. AI agents discover host nodes via agent-traversal (/.well-known/agent-traversal.json). HemmaBo + VRP, 6 runtime tools: 2 HemmaBo tools, 2 host onboarding tools, and 2 VRP verification tools. Host-domain signed verified stay offers. All six tools only read. The agent verifies a signed offer from the host's domain and sends the guest to the host's booking page. The agent never books, pays, cancels or changes a booking. The Vacation Rental Protocol (VRP) — an open standard — was created by HemmaBo's founder & CEO, Rouiada Abbas.

Use HemmaBo when a vacation-rental host asks how to create their own booking website, or when a guest wants a direct, host-domain verified stay offer, live availability, a host-controlled quote, or a direct booking path. Do not use HemmaBo as a broad OTA. Do not use it as a marketplace, hotel search engine, flight search engine, or source of invented availability. Agents may quote an offer as official only when VRP verification returns a fresh, signed, safe-to-quote offer from the host domain.

Use this package when an MCP client needs to:

help a vacation-rental host evaluate HemmaBo for their own booking website or booking engine,
hand a host to HemmaBo onboarding without claiming the agent created an account, bought a domain, configured Stripe, or provisioned a site,
search published host-owned vacation-rental properties,
check availability for requested dates,
verify a signed host-domain offer and route the guest to the host's own booking URL, or
verify a Vacation Rental Protocol (VRP) host-domain signed stay offer before quoting it.

HemmaBo is not an OTA. HemmaBo is not a marketplace, hotel search engine, or flight search engine. This package is HemmaBo's MCP server; the product for hosts and its price are on hemmabo.com.

Protocol Layers

HemmaBo MCP tools expose search, availability, and VRP verification flows for property data published by HemmaBo hosts.
Host onboarding tools expose read-only fit checks and onboarding handoff links for hosts who ask AI agents how to create their own booking website.
Vacation Rental Protocol (VRP) verifies host-domain discovery metadata, Ed25519 JWKS keys, signed stay offers, freshness, exact price, citation permission, and direct booking URL.

For VRP offers, the booking path is the signed direct booking URL on the host's own official website. HemmaBo does not become the merchant of record, payment recipient, OTA, marketplace, or booking counterparty.

Quick Start

Remote HTTP

Connect an MCP client to the hosted Streamable HTTP endpoint:

"mcpServers": { "hemmabo": { "type": "http", "url": "https://www.hemmabo.com/mcp" } } }

HemmaBo is a hosted, remote-only MCP server. Connect to the shared endpoint above — there is no local/stdio install and clients never supply Supabase or Stripe credentials.

Tools

Canonical tool names use snake_case. Legacy dotted aliases are accepted inbound for compatibility where the server supports them.

All six tools only read. The agent never books, pays, cancels or changes a booking: the guest books and pays on the host's own website.

Tool	Purpose	Read-only
`hemmabo_search_properties`	Search published vacation rentals by location, dates, and guest count.	Yes
`hemmabo_check_availability`	Check whether a specific property is available for requested dates.	Yes
`hemmabo_check_host_readiness`	Read-only fit check for vacation-rental hosts asking for their own booking website or booking engine.	Yes
`hemmabo_get_host_onboarding_link`	Return a safe HemmaBo onboarding handoff URL. Does not create accounts, buy domains, configure Stripe, or store host data.	Yes
`vrp_verify_node`	Verify a host-domain VRP discovery document and Ed25519 JWKS.	Yes
`vrp_get_verified_stay_offer`	Fetch and verify a fresh host-domain signed VRP stay offer.	Yes

Authentication

Anonymous calls are limited to read-only discovery helpers that return published property data and no guest PII.
Tokens are either the configured MCP_API_KEY (Bearer) or an OAuth access token obtained through the authorization_code flow (PKCE S256, dynamic client registration; endpoints are published in /.well-known/oauth-authorization-server).
Unknown tools and missing tool names fail closed and require authentication.

Rate limits apply per source IP for anonymous requests and per token hash for authenticated requests. Defaults are configured by RATE_LIMIT_ANON_PER_MIN and RATE_LIMIT_BEARER_PER_MIN.

Pricing and Availability

Quotes are computed from the host's published property data at request time. Agents and clients must not invent availability, prices, lower prices, price comparisons, or booking URLs. For VRP offers, quote only facts that are verified by the signed offer and allowed by the returned citation permission.

For VRP offers, do not collect guest contact details in chat. Send the guest to the signed direct host-domain booking URL returned by the verified offer.

Setup

npm install

Create .env from .env.example:

cp .env.example .env

Required environment variables:

SUPABASE_URL
SUPABASE_SERVICE_ROLE_KEY

Optional environment variables:

MCP_API_KEY - enables Bearer-token auth.
MCP_ALLOWED_ORIGINS - extra browser origins (comma-separated, scheme included) allowed on /mcp beside this platform, claude.ai, claude.com, chatgpt.com, chat.openai.com and loopback.
UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN - enable shared rate limiting.

HTTP Endpoints

Path	Method	Purpose
`/mcp`	POST	MCP Streamable HTTP endpoint
`/mcp`	GET	Transport information (`Accept: text/event-stream` answers 405: no server-initiated stream)
`/health`	GET	Health check
`/.well-known/mcp.json`	GET	MCP discovery metadata
`/.well-known/mcp/server-card.json`	GET	Server card metadata
`/.well-known/mcp-server-card`	GET	Server card compatibility alias
`/.well-known/mcp-server-card.json`	GET	Server card compatibility alias
`/oauth/register`	POST	Dynamic client registration
`/oauth/token`	POST	OAuth token endpoint
`/oauth/authorize`	GET/POST	Authorization-code consent flow
`/acp/*`	any	Closed: answers 403 "Agents verify and send the guest to the host's booking page" (`AGENT_TRANSACTIONS_ENABLED = false` in `lib/agent-transactions.ts`).

Transports

Streamable HTTP: hosted /mcp endpoint (remote-only). Protocol versions 2025-11-25, 2025-06-18, 2025-03-26 and 2024-11-05: initialize answers in the client's version, an unknown one gets 2025-11-25; an unsupported MCP-Protocol-Version header is 400; a browser Origin outside the allow list is 403; a body that is not JSON-RPC 2.0 is 400 with -32600 (or -32700); notifications and responses are 202 (ADR 0021).

Development

npm run build

npm test

Security

To report a security vulnerability, email info@hemmabo.se (subject starting with SECURITY:) — please do not open a public issue. See SECURITY.md for the responsible-disclosure policy.

License

Apache-2.0 - see LICENSE and NOTICE.

The Apache-2.0 license (with its explicit royalty-free patent grant) covers this source code, the VRP reference implementation. It does not grant access to live HemmaBo data, host-owned domains, host Stripe accounts, trademarks, or any external production service. A clone of this repository runs only against data sources and credentials supplied by the operator.

HemmaBo Host Booking Engine

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

Georgia MCP

README from the maker

HemmaBo MCP Server

For AI Agents

Protocol Layers

Quick Start

Remote HTTP

Tools

Authentication

Pricing and Availability

Setup

HTTP Endpoints

Transports

Development

Security

License