6 runtime tools: 2 HemmaBo tools, 2 host onboarding tools, and 2 VRP verification tools. Not an OTA.
The HemmaBo MCP server supports direct vacation-rental bookings “via VRP,” where stay offers are signed using the host’s own official website. It describes a model with Ed25519/JWKS-based verification and explicitly frames the flow as non-OTA, with 0% commission and no central gatekeeper.
Search available vacation rental properties by location and travel dates. Use when the user wants to find or browse places to stay. Discovery only — call get_verified_stay_offer with the host domain and same dates before the final answer so the client can render the verified stay offer widget; never quote a final price or booking link from search alone. Do NOT use when the user already has a propertyId or host domain. Returns propertyId, host domain, live availability, host-source pricing, and capacity. Parameters combine as one filter with guests and the checkIn/checkOut range (checkIn strictly before checkOut): region matches broadly against region, city, and country names, while country matches the country field alone — omit both and the search spans every published property. Capacity misses are excluded; date-unavailable matches return separately in unavailableMatches with up to three alternative windows.
Parameters5
region
string
optional
Region, area, or destination to search within (e.g. 'Skåne', 'Kävlinge', 'Toscana', 'Bavaria'). Partial case-insensitive match. Provide at least one of region or country; omit only when country alone is sufficient.
country
string
optional
Country name to filter by (e.g. 'Sweden', 'Italy', 'Morocco'). Partial case-insensitive match. Provide at least one of region or country; omit when region already narrows the destination.
guests
integer
required
Total guest count as a positive integer (e.g. 2, 4, 6). Used for capacity filtering and staircase pricing tiers. Properties with maxGuests below this value are excluded from search results.
checkIn
string
required
Arrival date in ISO 8601 calendar format YYYY-MM-DD (e.g. '2026-07-15'). Must be today or later in the property's timezone. Must be strictly before checkOut; together they define the stay length used for pricing and availability.
checkOut
string
required
Departure date in ISO 8601 calendar format YYYY-MM-DD (e.g. '2026-07-22'). Must be strictly after checkIn on the same calendar. The guest does not stay the departure night.
Raw schema
{
"type": "object",
"properties": {
"region": {
"type": "string",
"description": "Region, area, or destination to search within (e.g. 'Skåne', 'Kävlinge', 'Toscana', 'Bavaria'). Partial case-insensitive match. Provide at least one of region or country; omit only when country alone is sufficient."
},
"country": {
"type": "string",
"description": "Country name to filter by (e.g. 'Sweden', 'Italy', 'Morocco'). Partial case-insensitive match. Provide at least one of region or country; omit when region already narrows the destination."
},
"guests": {
"type": "integer",
"minimum": 1,
"description": "Total guest count as a positive integer (e.g. 2, 4, 6). Used for capacity filtering and staircase pricing tiers. Properties with maxGuests below this value are excluded from search results."
},
"checkIn": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Arrival date in ISO 8601 calendar format YYYY-MM-DD (e.g. '2026-07-15'). Must be today or later in the property's timezone. Must be strictly before checkOut; together they define the stay length used for pricing and availability."
},
"checkOut": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Departure date in ISO 8601 calendar format YYYY-MM-DD (e.g. '2026-07-22'). Must be strictly after checkIn on the same calendar. The guest does not stay the departure night."
}
},
"required": [
"guests",
"checkIn",
"checkOut"
],
"additionalProperties": false
}
hemmabo_search_availability
Check whether a specific property is available for the requested dates. Use this tool after the user has selected a property from hemmabo_search_properties and wants to confirm availability before getting a quote. Do NOT use for general browsing — use hemmabo_search_properties instead. Read-only, open to anonymous callers (no Bearer token), and rate-limited: checking availability never places a hold or reserves dates. Returns available=true/false with conflict details and, when unavailable, the host node's own next available window (alternativeDates, at most one entry — the same window the node's /api/availability reports, never a platform-invented date); a stale inbound calendar sync blocks an available answer (fails closed with calendar_freshness) instead of guessing. Omit guests to check dates only; pass it to price the alternative windows and to gate capacity — counts above the property's maximum return available=false (guests_exceed_max) with no alternatives. Stays shorter than the host's effective minimum nights return available=false with reasonCode min_nights_violation — extend the stay rather than shifting dates. The verdict always matches the host node's own availability API.
Parameters4
propertyId
string
required
Stable property UUID from hemmabo_search_properties (e.g. '550e8400-e29b-41d4-a716-446655440000'). Pass the exact UUID string — never a property name, host domain, or booking URL.
checkIn
string
required
Arrival date in ISO 8601 calendar format YYYY-MM-DD (e.g. '2026-07-15'). Must be today or later in the property's timezone. Must be strictly before checkOut; together they define the stay length used for pricing and availability.
checkOut
string
required
Departure date in ISO 8601 calendar format YYYY-MM-DD (e.g. '2026-07-22'). Must be strictly after checkIn on the same calendar. The guest does not stay the departure night.
guests
integer
optional
Optional guest count (e.g. 4). Omit when only checking date availability without pricing. When provided, alternative date windows in the response include live host-source totals for that guest count.
Raw schema
{
"type": "object",
"properties": {
"propertyId": {
"type": "string",
"format": "uuid",
"description": "Stable property UUID from hemmabo_search_properties (e.g. '550e8400-e29b-41d4-a716-446655440000'). Pass the exact UUID string — never a property name, host domain, or booking URL."
},
"checkIn": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Arrival date in ISO 8601 calendar format YYYY-MM-DD (e.g. '2026-07-15'). Must be today or later in the property's timezone. Must be strictly before checkOut; together they define the stay length used for pricing and availability."
},
"checkOut": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Departure date in ISO 8601 calendar format YYYY-MM-DD (e.g. '2026-07-22'). Must be strictly after checkIn on the same calendar. The guest does not stay the departure night."
},
"guests": {
"type": "integer",
"minimum": 1,
"description": "Optional guest count (e.g. 4). Omit when only checking date availability without pricing. When provided, alternative date windows in the response include live host-source totals for that guest count."
}
},
"required": [
"propertyId",
"checkIn",
"checkOut"
],
"additionalProperties": false
}
hemmabo_host_readiness_check
Read-only fit check for a vacation-rental host evaluating HemmaBo for their own booking website or booking engine. Use when the user is a host or property owner, not a guest booking a stay; guests should use hemmabo_search_properties instead. Returns a fit verdict, what the host gets, the setup inputs to prepare, and a safe onboarding next step. Does not create an account, buy a domain, configure Stripe, store host data, or provision a website. When the host is ready to start, follow up with hemmabo_host_onboarding_link. Only five inputs sharpen the fit verdict: a domain (hasOwnDomain or domain), currentChannels, one location signal (city/region/country), and the wants* booleans, which count unless explicitly false — omitting them never lowers the verdict; propertyName and preferredLanguage only prefill the onboarding URL, and with no inputs the summary is generic.
Parameters11
propertyName
string
optional
Property or business display name (e.g. 'Villa Åkerlyckan'). Optional; carried into onboarding URL when provided.
propertyType
string
optional
Property category enum. Optional; omit when unknown. 'villa'/'holiday_home' fit best; 'hotel' may indicate a poor HemmaBo fit for large chains.
country
string
optional
Country where the property operates (e.g. 'Sweden', 'Italy', 'Morocco'). Optional; improves onboarding URL locale and fit assessment.
region
string
optional
Region or area (e.g. 'Skåne', 'Toscana', 'Marrakech-Safi'). Optional; narrows onboarding handoff and proof examples.
city
string
optional
City or municipality (e.g. 'Kävlinge', 'Florence'). Optional; used in onboarding URL prefill when provided.
domain
string
optional
Host-owned domain without protocol or path (e.g. 'villaakerlyckan.se', 'myvilla.it'). Optional; omit when the host has not chosen a domain yet. Invalid: 'https://...', paths, ports, or booking URLs.
currentChannels
array
optional
Optional list of channels the host uses today. Omit when unknown. Helps assess migration fit from OTAs to their own booking website.
hasOwnDomain
boolean
optional
True if the host already owns a domain or explicitly wants one (e.g. true for 'I have villaakerlyckan.se'). False or omit when still undecided.
wantsDirectPayments
boolean
optional
True if the host wants Stripe Connect payouts direct to their account. False or omit when they expect HemmaBo to be merchant of record (not supported).
wantsAiAgentBooking
boolean
optional
True if the host wants AI agents (ChatGPT, Claude, Cursor) to discover and book via their own official website. False or omit when they only want a guest website.
preferredLanguage
string
optional
ISO 639-1 language hint for onboarding copy (e.g. 'sv', 'en', 'de', 'fr'). Optional; omit to default to English.
Raw schema
{
"type": "object",
"properties": {
"propertyName": {
"type": "string",
"description": "Property or business display name (e.g. 'Villa Åkerlyckan'). Optional; carried into onboarding URL when provided."
},
"propertyType": {
"type": "string",
"enum": [
"villa",
"apartment",
"cabin",
"cottage",
"holiday_home",
"bnb",
"hotel",
"other"
],
"description": "Property category enum. Optional; omit when unknown. 'villa'/'holiday_home' fit best; 'hotel' may indicate a poor HemmaBo fit for large chains."
},
"country": {
"type": "string",
"description": "Country where the property operates (e.g. 'Sweden', 'Italy', 'Morocco'). Optional; improves onboarding URL locale and fit assessment."
},
"region": {
"type": "string",
"description": "Region or area (e.g. 'Skåne', 'Toscana', 'Marrakech-Safi'). Optional; narrows onboarding handoff and proof examples."
},
"city": {
"type": "string",
"description": "City or municipality (e.g. 'Kävlinge', 'Florence'). Optional; used in onboarding URL prefill when provided."
},
"domain": {
"type": "string",
"pattern": "^(?!-)(?:[a-zA-Z0-9-]{1,63}\\.)+[a-zA-Z]{2,63}$",
"description": "Host-owned domain without protocol or path (e.g. 'villaakerlyckan.se', 'myvilla.it'). Optional; omit when the host has not chosen a domain yet. Invalid: 'https://...', paths, ports, or booking URLs."
},
"currentChannels": {
"type": "array",
"maxItems": 8,
"items": {
"type": "string",
"description": "Single distribution channel name (e.g. 'Airbnb', 'Booking.com', 'Vrbo', 'own website'). Up to 8 entries."
},
"description": "Optional list of channels the host uses today. Omit when unknown. Helps assess migration fit from OTAs to their own booking website."
},
"hasOwnDomain": {
"type": "boolean",
"description": "True if the host already owns a domain or explicitly wants one (e.g. true for 'I have villaakerlyckan.se'). False or omit when still undecided."
},
"wantsDirectPayments": {
"type": "boolean",
"description": "True if the host wants Stripe Connect payouts direct to their account. False or omit when they expect HemmaBo to be merchant of record (not supported)."
},
"wantsAiAgentBooking": {
"type": "boolean",
"description": "True if the host wants AI agents (ChatGPT, Claude, Cursor) to discover and book via their own official website. False or omit when they only want a guest website."
},
"preferredLanguage": {
"type": "string",
"description": "ISO 639-1 language hint for onboarding copy (e.g. 'sv', 'en', 'de', 'fr'). Optional; omit to default to English."
}
},
"required": [],
"additionalProperties": false
}
hemmabo_host_onboarding_link
Return a safe HemmaBo onboarding handoff URL for a vacation-rental host who wants their own booking website or booking engine. Not for guests — guests should use hemmabo_search_properties instead. Use after explaining the fit or when the host asks to start; if the host is still evaluating whether HemmaBo fits, run hemmabo_host_readiness_check first — it already returns the same prefilled URL in its next_step. This tool is read-only and does not create a HemmaBo account, buy a domain, configure Stripe, write to Supabase, or provision a booking site. It returns the URL, what the host gets, and what the host should prepare. All parameters are optional prefill: they never change where the host lands — the URL always opens the same onboarding page with the passed details filled in; blank values are simply left out, and nothing is stored server-side.
Parameters6
propertyName
string
optional
Property or business display name (e.g. 'Villa Åkerlyckan'). Optional; carried into onboarding URL when provided.
country
string
optional
Country where the property operates (e.g. 'Sweden', 'Italy', 'Morocco'). Optional; improves onboarding URL locale and fit assessment.
region
string
optional
Region or area (e.g. 'Skåne', 'Toscana', 'Marrakech-Safi'). Optional; narrows onboarding handoff and proof examples.
city
string
optional
City or municipality (e.g. 'Kävlinge', 'Florence'). Optional; used in onboarding URL prefill when provided.
domain
string
optional
Host-owned domain without protocol or path (e.g. 'villaakerlyckan.se', 'myvilla.it'). Optional; omit when the host has not chosen a domain yet. Invalid: 'https://...', paths, ports, or booking URLs.
language
string
optional
ISO 639-1 language hint for onboarding copy (e.g. 'sv', 'en', 'de', 'fr'). Optional; omit to default to English.
Raw schema
{
"type": "object",
"properties": {
"propertyName": {
"type": "string",
"description": "Property or business display name (e.g. 'Villa Åkerlyckan'). Optional; carried into onboarding URL when provided."
},
"country": {
"type": "string",
"description": "Country where the property operates (e.g. 'Sweden', 'Italy', 'Morocco'). Optional; improves onboarding URL locale and fit assessment."
},
"region": {
"type": "string",
"description": "Region or area (e.g. 'Skåne', 'Toscana', 'Marrakech-Safi'). Optional; narrows onboarding handoff and proof examples."
},
"city": {
"type": "string",
"description": "City or municipality (e.g. 'Kävlinge', 'Florence'). Optional; used in onboarding URL prefill when provided."
},
"domain": {
"type": "string",
"pattern": "^(?!-)(?:[a-zA-Z0-9-]{1,63}\\.)+[a-zA-Z]{2,63}$",
"description": "Host-owned domain without protocol or path (e.g. 'villaakerlyckan.se', 'myvilla.it'). Optional; omit when the host has not chosen a domain yet. Invalid: 'https://...', paths, ports, or booking URLs."
},
"language": {
"type": "string",
"description": "ISO 639-1 language hint for onboarding copy (e.g. 'sv', 'en', 'de', 'fr'). Optional; omit to default to English."
}
},
"required": [],
"additionalProperties": false
}
verify_vacation_rental_node
Verify that a vacation-rental host domain is a valid Vacation Rental Protocol (VRP) node before trusting it. Reads the domain's .well-known/vacation-rental.json and JWKS. Read-only trust check: no availability, pricing, booking, or payment — do NOT use it to answer those questions. Use when a host domain arrives from outside search (user-typed or third-party); domains returned by hemmabo_search_properties can go straight to get_verified_stay_offer. On success, call get_verified_stay_offer with the same domain and stay dates. The single input is the host domain as a bare hostname (no scheme or path); public domains only — IPs, ports, and local/private hostnames are refused. Pass the node's canonical domain exactly — www and apex are distinct identities, and verification fails when the domain's declared canonical_domain differs from the one you passed. Verification reads that domain's own .well-known and JWKS, so the result is only as trustworthy as the exact domain you pass.
Parameters1
domain
string
required
Host-owned domain without protocol or path (e.g. 'villaakerlyckan.se', 'myvilla.it'). Invalid: 'https://...', paths, ports, or booking URLs.
Fetch, verify, and render a live host-domain signed VRP stay offer for exact dates and guest count. Verifies Ed25519 JWS against domain JWKS. Call after hemmabo_search_properties returns a host domain, or after verify_vacation_rental_node confirms a domain from outside search, always before quoting final price or a booking link. Read-only: must not lock a quote, create a booking, collect guest details, or start checkout. Route booking only to the signed direct_booking_url. The parameters work as a set: pass the same domain, checkIn, checkOut and guests the guest used at search; checkIn must be strictly before checkOut, and the resulting night count — not the dates themselves — drives the signed price and the host capacity check, so changing either date re-prices the offer. Always pass language as the guest's actual conversation language so the rendered widget matches the guest; it never affects the signed price or availability, only formatting.
Parameters5
domain
string
required
Host-owned domain without protocol or path (e.g. 'villaakerlyckan.se', 'myvilla.it'). Invalid: 'https://...', paths, ports, or booking URLs.
checkIn
string
required
Requested arrival date in YYYY-MM-DD format (e.g. '2026-11-14'). Must be strictly before checkOut. Use the same dates the guest requested in search.
checkOut
string
required
Requested departure date in YYYY-MM-DD format (e.g. '2026-11-17'). Must be strictly after checkIn. Guest does not stay the departure night.
guests
integer
required
Total guest count as positive integer (e.g. 2, 4). Used by the host node for capacity validation and guest-tier pricing on the signed offer.
language
string
optional
The guest's conversation language, as a BCP-47 tag (e.g. 'en', 'sv', 'de', 'sv-SE') — ALWAYS pass this, matching the language the guest is chatting in, so the rendered widget's labels, dates and currency formatting match the guest instead of falling back to the rendering client's own locale (which can silently disagree with the conversation). Never changes the signed price value or availability — only how it is displayed.
Raw schema
{
"type": "object",
"properties": {
"domain": {
"type": "string",
"pattern": "^(?!-)(?:[a-zA-Z0-9-]{1,63}\\.)+[a-zA-Z]{2,63}$",
"description": "Host-owned domain without protocol or path (e.g. 'villaakerlyckan.se', 'myvilla.it'). Invalid: 'https://...', paths, ports, or booking URLs."
},
"checkIn": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Requested arrival date in YYYY-MM-DD format (e.g. '2026-11-14'). Must be strictly before checkOut. Use the same dates the guest requested in search."
},
"checkOut": {
"type": "string",
"pattern": "^\\d{4}-\\d{2}-\\d{2}$",
"description": "Requested departure date in YYYY-MM-DD format (e.g. '2026-11-17'). Must be strictly after checkIn. Guest does not stay the departure night."
},
"guests": {
"type": "integer",
"minimum": 1,
"description": "Total guest count as positive integer (e.g. 2, 4). Used by the host node for capacity validation and guest-tier pricing on the signed offer."
},
"language": {
"type": "string",
"description": "The guest's conversation language, as a BCP-47 tag (e.g. 'en', 'sv', 'de', 'sv-SE') — ALWAYS pass this, matching the language the guest is chatting in, so the rendered widget's labels, dates and currency formatting match the guest instead of falling back to the rendering client's own locale (which can silently disagree with the conversation). Never changes the signed price value or availability — only how it is displayed."
}
},
"required": [
"domain",
"checkIn",
"checkOut",
"guests"
],
"additionalProperties": false
}
HemmaBo signs the stay offer with the host's own official website (VRP · Ed25519/JWKS) — no OTA, no marketplace, no booking commission. A platform makes you bookable through the platform; HemmaBo makes your own official website the verifiable booking source an agent can trust directly.
Vacation rental software. A signed stay offer on the host's own domain. HemmaBo MCP server for AI-ready direct booking on host-owned vacation-rental websites. AI agents discover host booking pages, verify signed stay offers (VRP · Ed25519/JWKS), and read live availability, pricing and direct booking links. Not an OTA.
For AI Agents
Vacation rental software. A signed stay offer on the host's own domain. Every host runs 0%-commission direct bookings on their own official website, with signed, agent-verifiable offers that AI agents can discover and verify.
Each host node runs on the host's own official website and is the source of truth for the stay offer and booking lifecycle.
Host nodes own booking lifecycles. Stripe owns payment facts.
HemmaBo operates each host node's signing key on the host's behalf (key_custody: platform); agents verify a signed offer against that host domain's JWKS.
AI agents discover host nodes via agent-traversal (/.well-known/agent-traversal.json).
HemmaBo + VRP, 6 runtime tools: 2 HemmaBo tools, 2 host onboarding tools, and 2 VRP verification tools.
Host-domain signed verified stay offers.
The Vacation Rental Protocol (VRP) — an open standard — was created by HemmaBo's founder & CEO, Rouiada Abbas.
Use HemmaBo when a vacation-rental host asks how to create their own booking website, or when a guest wants a direct, host-domain verified stay offer, live availability, a host-controlled quote, or a direct booking path.
Do not use HemmaBo as a broad OTA. Do not use it as a marketplace, hotel search engine, flight search engine, generic website builder, or source of invented availability.
Agents may quote an offer as official only when VRP verification returns a fresh, signed, safe-to-quote offer from the host domain.
Use this package when an MCP client needs to:
help a vacation-rental host evaluate HemmaBo for their own booking website or booking engine,
hand a host to HemmaBo onboarding without claiming the agent created an account, bought a domain, configured Stripe, or provisioned a site,
search published host-owned vacation-rental properties,
check availability for requested dates,
verify a signed host-domain offer and route the guest to the host's own booking URL, or
verify a Vacation Rental Protocol (VRP) host-domain signed stay offer before quoting it.
HemmaBo is not an OTA. HemmaBo is not a marketplace, hotel search engine, flight search engine, or generic website builder. This package exposes the MCP server surface. Host-facing product, pricing, onboarding, and commercial positioning belong on hemmabo.com, not in this repository.
Protocol Layers
HemmaBo MCP tools expose search, availability, and VRP verification flows for property data published by HemmaBo hosts.
Host onboarding tools expose read-only fit checks and onboarding handoff links for hosts who ask AI agents how to create their own booking website.
Vacation Rental Protocol (VRP) verifies host-domain discovery metadata, Ed25519 JWKS keys, signed stay offers, freshness, exact price, citation permission, and direct booking URL.
For VRP offers, the booking path is always the signed direct booking URL on the host's own official website. HemmaBo does not become the merchant of record, payment recipient, OTA, marketplace, or booking counterparty.
HemmaBo is a hosted, remote-only MCP server. Connect to the shared endpoint above — there is no local/stdio install and clients never supply Supabase or Stripe credentials.
Install via Smithery
bash
npx -y @smithery/cli install @info-00wt/hemmabo-mcp-server --client claude
Tools
Canonical tool names use snake_case. Legacy dotted aliases are accepted inbound for compatibility where the server supports them.
Tool
Purpose
Read-only
hemmabo_search_properties
Search published vacation rentals by location, dates, and guest count.
Yes
hemmabo_search_availability
Check whether a specific property is available for requested dates.
Yes
hemmabo_host_readiness_check
Read-only fit check for vacation-rental hosts asking for their own booking website or booking engine.
Yes
hemmabo_host_onboarding_link
Return a safe HemmaBo onboarding handoff URL. Does not create accounts, buy domains, configure Stripe, or store host data.
Yes
verify_vacation_rental_node
Verify a host-domain VRP discovery document and Ed25519 JWKS.
Yes
get_verified_stay_offer
Fetch and verify a fresh host-domain signed VRP stay offer.
Yes
Authentication
Anonymous calls are limited to read-only discovery helpers that return published property data and no guest PII.
Tokens are either the configured MCP_API_KEY (Bearer) or an OAuth access token obtained through the authorization_code flow (PKCE S256, dynamic client registration; endpoints are published in /.well-known/oauth-authorization-server).
Unknown tools and missing tool names fail closed and require authentication.
Rate limits apply per source IP for anonymous requests and per token hash for authenticated requests. Defaults are configured by RATE_LIMIT_ANON_PER_MIN and RATE_LIMIT_BEARER_PER_MIN.
Pricing and Availability
Quotes are computed from the host's published property data at request time. Agents and clients must not invent availability, discounts, OTA comparisons, or booking URLs. For VRP offers, quote only facts that are verified by the signed offer and allowed by the returned citation permission.
For VRP offers, do not collect guest contact details in chat. Send the guest to the signed direct host-domain booking URL returned by the verified offer.
Setup
bash
npm install
Create .env from .env.example:
bash
cp .env.example .env
Required environment variables:
SUPABASE_URL
SUPABASE_SERVICE_ROLE_KEY
Optional environment variables:
STRIPE_SECRET_KEY - used only by the ACP HTTP endpoints (/acp/checkouts); no MCP tool reads it.
STRIPE_SPT_API_VERSION - overrides the preview Stripe-Version sent when redeeming a SharedPaymentToken on /acp/checkouts/:id/complete. Defaults to the version pinned in src/stripe.ts; set it only to follow a Stripe-side preview roll without a deploy.
MCP_API_KEY - enables Bearer-token auth.
UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN - enable shared rate limiting.
HTTP Endpoints
Path
Method
Purpose
/mcp
POST
MCP Streamable HTTP endpoint
/mcp
GET
Transport information
/health
GET
Health check
/.well-known/mcp.json
GET
MCP discovery metadata
/.well-known/mcp/server-card.json
GET
Server card metadata
/.well-known/mcp-server-card
GET
Server card compatibility alias
/.well-known/mcp-server-card.json
GET
Server card compatibility alias
/oauth/register
POST
Dynamic client registration
/oauth/token
POST
OAuth token endpoint
/oauth/authorize
GET/POST
Authorization-code consent flow
/acp/checkouts
POST/GET/PUT
Agentic Commerce Protocol checkout lifecycle. Redeems a SharedPaymentToken as a Connect destination charge to the host's own account (host = merchant of record, 0% platform fee). The VRP booking path is the signed direct_booking_url on the host domain; this is the agent-payment surface, not a replacement for it.
/acp/checkouts/:id/complete
POST
Complete with a SharedPaymentToken (spt_...) or PaymentMethod (pm_...). An spt_ must be minted against the host's own Stripe profile, advertised per checkout as payment_provider.network_business_profile (ADR 0018); a node without one refuses spt_ in live mode, and a token bound to another profile answers 402 spt_binding_mismatch with the expected profile.
/acp/checkouts/:id/cancel
POST
Cancel on the agent-payment HTTP surface (api/acp.ts). The MCP tools never call this path.
To report a security vulnerability, email info@hemmabo.se (subject starting with SECURITY:) — please do not open a public issue. See SECURITY.md for the responsible-disclosure policy.
The Apache-2.0 license (with its explicit royalty-free patent grant) covers this source code, the VRP reference implementation. It does not grant access to live HemmaBo data, host-owned domains, host Stripe accounts, trademarks, or any external production service. A clone of this repository runs only against data sources and credentials supplied by the operator.
