HemmaBo MCP Server is an MCP server implementation for the HemmaBo vacation rental software, aimed at hosts and agent developers who want to let AI agents participate in the direct booking process. HemmaBo's product positioning is: the host's booking website runs on the host's own URL, all connected channels share one calendar, payment is completed through the host's own Stripe, and the booking commission is 0%. Every accommodation quote is signed by the host's website (VRP · Ed25519/JWKS), so any AI agent can verify it.
Purpose The MCP server is used to let AI agents discover a host's booking page, verify signed accommodation quotes, and read real-time availability, prices, and direct booking links. It applies to the following scenarios: a vacation rental host asks how to create their own booking website or booking engine; a guest wants a direct accommodation quote verified by the host's domain, real-time availability, a host-controlled quote, or a direct booking path; an MCP client needs to help a host evaluate HemmaBo, or hand the host over to the HemmaBo onboarding process (but must not claim that the agent has created an account, purchased a domain, configured Stripe, or launched a website); search published host-owned vacation rental properties; query availability for requested dates; verify signed host-domain quotes and route guests to the host's own booking URL; verify before citing a Vacation Rental Protocol (VRP) host-domain signed accommodation quote.
Main capabilities HemmaBo MCP tools expose search, availability, and VRP verification workflows for property data published by HemmaBo hosts. Host onboarding tools provide read-only fit checks and onboarding handoff links for hosts asking an AI agent how to create their own booking website. VRP verifies host-domain discovery metadata, Ed25519 JWKS keys, signed accommodation quotes, freshness, exact prices, citation permissions, and direct booking URLs. For VRP quotes, the booking path is the signed direct booking URL on the host's own official website. HemmaBo does not become the merchant of record, payee, OTA, marketplace, or booking counterparty.
How to use HemmaBo is a hosted, remote-only MCP server. Connect the MCP client to the hosted Streamable HTTP endpoint; there is no local/stdio installation, and the client never provides Supabase or Stripe credentials. It can alsoInstall via Smithery. The canonical tool name uses snake_case, and the server also accepts legacy dotted aliases inbound where supported. All six tools are read-only: the agent never books, pays, cancels, or modifies a reservation; guests book and pay on the host's own website. Anonymous calls are limited to read-only discovery helpers and return published property data without guest PII. The token can be a configured MCP_API_KEY (Bearer) or an OAuth access token obtained via the authorization_code flow (PKCE S256, dynamic client registration; endpoints are published in /.well-known/oauth-authorization-server). Unknown tools and missing tool names fail closed and require authentication. Rate limits are applied by source IP for anonymous requests and by token hash for authenticated requests, with defaults configured by RATE_LIMIT_ANON_PER_MIN and RATE_LIMIT_BEARER_PER_MIN.
Pricing and availability Quotes are calculated at request time from the host's published property data. Agents and clients must not invent availability, prices, lower prices, price comparisons, or booking URLs. For VRP quotes, cite only facts verified by the signed quote and permitted by the returned citation license. For VRP quotes, do not collect guest contact details in chat; send the guest to the signed direct host-domain booking URL returned by the verified quote.
Configuration and running Create .env from .env.example. Required environment variable: SUPABASE_SERVICE_ROLE_KEY. Optional environment variables: MCP_API_KEY (enables Bearer token authentication); MCP_ALLOWED_ORIGINS (additional browser origins allowed on /mcp besides this platform, claude.ai, claude.com, chatgpt.com, chat.openai.com, and loopback addresses, comma-separated, including scheme); UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN (enable shared rate limiting). Streamable HTTP: hosted /mcp endpoint (remote only). Protocol versions 2025-11-25, 2025-06-18, 2025-03-26, and 2024-11-05: initialize responds according to the client version, unknown versions get 2025-11-25; unsupported MCP-Protocol-Version headers return 400; browser Origins outside the allowlist return 403; bodies that are not JSON-RPC 2.0 return 400 with -32600 (or -32700); notifications and responses return 202 (ADR 0021).
Applicable scenarios and limitations HemmaBo is not an OTA, not a marketplace, hotel search engine, or flight search engine. Do not use it as a broad OTA, as a marketplace, hotel search, flight search, or as a source of invented availability. Only when VRP verification returns a fresh, signed, safely citable quote from the host's domain may the agent refer to that quote as an official quote. This repository is licensed under Apache-2.0 (with an explicit royalty-free patent grant), covering this source code, i.e., the VRP reference implementation, but it does not grant access to live HemmaBo data, host-owned domains, host Stripe accounts, trademarks, or any external production services. Cloning this repository can only run against data sources and credentials provided by the operator. Send security vulnerabilities by email to info@hemmabo.se (with the subject starting with SECURITY:), do not publicly file an issue.
Official site:https://www.hemmabo.com Live reference host:https://www.villaakerlyckan.se VRP specification:https://vacationrentalprotocol.com Package:https://www.npmjs.com/package/hemmabo-mcp-server
