MBD Travel
REMOTE · MBDTRAVEL.COM
Read-only MBD Travel catalogue: tours, hotel prices, private transfers and the Dubai visa.
Available components
Last scanned (13 hours ago)
Scores higher than 64% of remote servers
Reachable. Last reached 23 Oct 2026.
Category E-commerce
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security80
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability56
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2668 tokens (~222/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management37
- Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage96
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 85% of tool parameters carry a description.Partial
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "quote_transfer" implies "transfer" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Fail
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 22 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
- 20 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Oct 26 +11
- Transport: fail → pass ▲ security
- Stability: unverified → 0.03 ▲ functional
- 12 Oct 26 58
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 23 Oct 2026 · Probed https://mbdtravel.com/api/v1/mcp/public
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=mbdtravel.com | CN=WE1,O=Google Trust Services,C=US | 27 Sept 2026 | 26 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | 93b3174ff1bf020e0e2882838a224f9d |
| SANs: mbdtravel.com, blog.mbdtravel.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mbdtravel.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| mbdtravel.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=604800; includeSubDomains |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mbdtravel.com/api/v1/mcp/public | Verified | 200 | |
| http (plaintext) | http://mbdtravel.com/api/v1/mcp/public | HTTPS enforced | 301 | https://mbdtravel.com/api/v1/mcp/public |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
browse_destinations Destinations ~115
Lists catalogue countries and cities with their published tour counts. scope: countries, cities (of one country) or featured (default: the cities MBD Travel highlights). There is no continent, region or theme grouping. Returns destinations only, not tours.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Country (slug, Turkish or English name, or ISO code); returns that country’s cities. |
| currency | string | yes | Price currency. |
| language | string | yes | Catalogue language. |
| scope | string | – | featured = highlighted cities (default). |
| Name | Type | Req | Description |
|---|---|---|---|
| catalogueRefreshedAt | string|null | – | – |
| cities | array | yes | – |
| countries | array | yes | – |
| deepLink | string | yes | – |
| disclaimer | string | – | – |
| generatedAt | string | – | – |
No examples provided.
compare_tours Compare tours ~71
Puts two to four tours side by side with the same fields. It returns every field of each tour. It gives no winner, score or verdict; null fields stay null.
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | yes | Price currency. |
| language | string | yes | Catalogue language. |
| slugs | array | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| catalogueRefreshedAt | string|null | – | – |
| deepLink | string | yes | – |
| disclaimer | string | – | – |
| generatedAt | string | – | – |
| tours | array | yes | – |
No examples provided.
fetch Record detail ~113
Returns the full text, price and site link for a record id. Id format: <tur|deneyim|otel|vize>:<tr|en>:<EUR|USD|AED>:<key> (tour, experience, hotel, visa); change only the currency part to switch currency. A tour record carries itinerary, inclusions, exclusions, hotels and departures, and names what it lacks. An unpublished record returns NOT_FOUND.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Record id, format as in the tool description. |
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
| metadata | object | – | – |
| text | string | yes | – |
| title | string | yes | – |
| url | string | yes | – |
No examples provided.
find_last_minute_tours Last-minute tours ~106
Returns tours departing soon, soonest first, with dates. Covers last minute, near-term, urgent, right away, this week and tour at airfare price requests. Selection is by departure date only; it is not a discount. windowDays states the length of the window in days. It has no date range or destination filter.
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | yes | Price currency. |
| language | string | yes | Catalogue language. |
| limit | integer | – | Default 10. |
| Name | Type | Req | Description |
|---|---|---|---|
| catalogueRefreshedAt | string|null | – | – |
| deepLink | string | yes | – |
| disclaimer | string | – | – |
| emptyReason | string|null | yes | – |
| generatedAt | string | – | – |
| total | integer | yes | – |
| tours | array | yes | – |
| windowDays | integer | yes | – |
No examples provided.
get_departures Tour departures ~173
Returns a tour's departures with the price of every occupancy slot for each (adult, single, extra bed, children, infant). Prices are not trimmed; every occupancy slot is listed. Past departures are excluded. Paged by date: default 12 per page; nextCursor is the cursor of the next page. The dates returned are the only departure dates the catalogue holds.
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | yes | Price currency. |
| cursor | string | – | nextCursor from the previous response. |
| from | string | – | Departures on or after this date (YYYY-MM-DD) |
| language | string | yes | Catalogue language. |
| limit | integer | – | Departures per page. Default 12. |
| slug | string | yes | – |
| to | string | – | Departures on or before this date (YYYY-MM-DD) |
| Name | Type | Req | Description |
|---|---|---|---|
| catalogueRefreshedAt | string|null | – | – |
| deepLink | string | yes | – |
| departures | array | yes | – |
| disclaimer | string | – | – |
| emptyReason | string|null | yes | – |
| generatedAt | string | – | – |
| nextCursor | string|null | yes | Cursor of the next page; null on the last page. |
| total | integer | yes | – |
No examples provided.
get_tour Tour record ~108
Returns one tour: description, airline, nights, day-by-day itinerary, included and excluded items, hotels, upcoming departure dates and the first departure's price per slot (adult, child). cancellation holds the fixed tour cancellation and refund policy. Fields without data are listed in missing. An unpublished tour returns PRODUCT_NOT_FOUND. Only the first departure is priced here.
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | yes | Price currency. |
| language | string | yes | Catalogue language. |
| slug | string | yes | product.slug |
| Name | Type | Req | Description |
|---|---|---|---|
| catalogueRefreshedAt | string|null | – | – |
| deepLink | string | yes | – |
| disclaimer | string | – | – |
| generatedAt | string | – | – |
| tour | object | yes | – |
No examples provided.
list_hotels List hotels ~181
Lists the curated hotel pool by country, area and stars, with facility tags. No supplier call and no price (a price needs dates and guests). city matches area words ("Antalya", "Business Bay"); the free-text argument matches name words. Each hotel carries a hotelId. When nothing matches, the reply lists nearby MBD hotels and a contact link.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | City name in Turkish or English. |
| country | string | – | Country: name in English or Turkish, or ISO 3166-1 alpha-2 code (example: "Turkey", "AE"). |
| currency | string | yes | – |
| cursor | string | – | cursor from the previous response. |
| language | string | yes | – |
| limit | integer | – | – |
| search | string | – | Words in the hotel name. |
| stars | integer | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| alternatives | array | – | – |
| alternativesBasis | string | – | – |
| catalogueRefreshedAt | string|null | – | – |
| contact | object | – | – |
| cursor | string|null | yes | – |
| deepLink | string | yes | – |
| deepLinkNote | string | – | – |
| disclaimer | string | – | – |
| emptyReason | string|null | – | – |
| generatedAt | string | – | – |
| hotels | array | yes | – |
| total | integer|null | – | – |
No examples provided.
quote_hotel_stay Price a hotel stay ~247
Gets a live supplier offer or MBD contract price (pricingSource) for hotels and dates. Books nothing and holds no room. An unverified price is not returned. PRICE_ON_REQUEST means no price is on file; the reply then carries pageUrl and contact. Supplier calls are limited daily. Needs check-in, check-out and guests. When nationality is omitted the price is for TR and the reply states nationalityUsed.
| Name | Type | Req | Description |
|---|---|---|---|
| adults | integer | yes | Adults; at most 6 people per room, 4 children. |
| checkIn | string | yes | Check-in date; at most 365 days from today (YYYY-MM-DD) |
| checkOut | string | yes | Check-out date; the stay must be 1-30 nights (YYYY-MM-DD) |
| childrenAges | array | – | Age of each child, one entry per child. No birth dates. |
| currency | string | yes | – |
| hotelIds | array | yes | hotelId values (ids, not names). |
| language | string | yes | – |
| nationality | string | – | ISO 3166-1 alpha-2 code (TR, AE, DE); optional, default TR. Changes the price. |
| Name | Type | Req | Description |
|---|---|---|---|
| catalogueRefreshedAt | string|null | – | – |
| deepLink | string | yes | – |
| deepLinkNote | string | – | – |
| disclaimer | string | – | – |
| generatedAt | string | – | – |
| handoff | object | – | – |
| liveQuoteLimit | object | – | – |
| nationalityDefaulted | boolean | – | – |
| nationalityNote | string | – | – |
| nationalityUsed | string | – | – |
| quotedAt | string | yes | – |
| quotes | array | yes | – |
No examples provided.
quote_transfer Quote a transfer ~130
Prices one transfer for a party from the stored list price: vehicles needed (a 7th passenger needs a second), price per vehicle, total, cheapest option. Reads only: no basket, hold or order. Needs slug, direction and party size (Istanbul also needs district).
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | yes | Price currency. |
| direction | string | yes | Listed round-trip price is used, not two one-ways. |
| district | string | – | Istanbul hotel district. |
| language | string | yes | Catalogue language. |
| passengers | integer | yes | Passengers. |
| slug | string | yes | Transfer slug. |
| Name | Type | Req | Description |
|---|---|---|---|
| cheapest | object | yes | – |
| deepLink | string | yes | – |
| direction | string | yes | – |
| name | string | yes | – |
| options | array | yes | – |
| passengers | integer | yes | – |
| slug | string | yes | – |
| validUntil | string|null | – | – |
No examples provided.
search Search the MBD Travel catalogue ~144
Free-text search over published MBD Travel tours, experiences, hotels and the Dubai visa (examples: "Japan tour", "Dubai desert safari", "Paris hotel", "Dubai visa"; Turkish works too). Each result carries an id. Currency comes from the currency argument or the query ("dollar", "AED"), else EUR. A hotel result carries a price note, not a price. Flights, transfers, booking and payment are not in the index.
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | – | Price currency. |
| language | string | – | Result language; default tr. |
| limit | integer | – | Maximum results per type; default 5. |
| query | string | yes | Text to search. |
| Name | Type | Req | Description |
|---|---|---|---|
| results | array | yes | – |
No examples provided.
search_tours Search tours ~264
Lists and filters published tours by free text, destination, maximum from-price, departure date range and sort. Prices are "from" prices with their basis, not fixed prices. Returns an empty list with emptyReason when nothing matches. Tours only: no hotels, experiences or visas.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | City: slug or name in Turkish or English. |
| country | string | – | Country: slug, name in Turkish or English, or ISO 3166-1 alpha-2 code (example: "japonya", "Japan", "JP"). |
| currency | string | yes | Price currency. |
| departureFrom | string | – | Tours with a departure on or after this date (YYYY-MM-DD) |
| departureTo | string | – | Tours with a departure on or before this date (YYYY-MM-DD) |
| language | string | yes | Catalogue language. |
| limit | integer | – | Default 10. |
| maxPrice | integer | – | Maximum from-price in the unit of priceFrom.amount (minor units: 15000 for EUR 150) and in the chosen currency. |
| offset | integer | – | – |
| query | string | – | Free text: country, city or tour name (example: "Japan"). |
| sort | string | – | Default newest. |
| Name | Type | Req | Description |
|---|---|---|---|
| catalogueRefreshedAt | string|null | – | – |
| deepLink | string | yes | – |
| disclaimer | string | – | – |
| emptyReason | string|null | yes | – |
| generatedAt | string | – | – |
| total | integer | yes | – |
| tours | array | yes | – |
No examples provided.
search_transfers Search transfers ~172
Private transfers, fixed price per vehicle. Dubai: DXB, SHJ, AUH to hotel, city transfer, full-day tour. Istanbul: IST, SAW to hotel, priced by hotel side (pass district or side). Filters: airport, serviceType, direction, side, district, passengers (a 7th passenger needs a second vehicle). Reads only: no booking.
| Name | Type | Req | Description |
|---|---|---|---|
| airport | string | – | Pick-up airport. |
| currency | string | yes | Price currency. |
| direction | string | – | Direction filter. |
| district | string | – | Istanbul hotel district, e.g. Kadikoy; sets the side. |
| language | string | yes | Catalogue language. |
| passengers | integer | – | Party size. |
| serviceType | string | – | – |
| side | string | – | Istanbul hotel side. |
| Name | Type | Req | Description |
|---|---|---|---|
| deepLink | string | yes | – |
| emptyReason | string|null | yes | – |
| total | integer | yes | – |
| transfers | array | yes | – |
No examples provided.
How do I install the MBD Travel MCP server?
MBD Travel is a hosted endpoint at https://mbdtravel.com/api/v1/mcp/public, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mbdtravel.com
claude mcp add --transport http com-mbdtravel-travel 'https://mbdtravel.com/api/v1/mcp/public'
What is the MBD Travel MCP server?
MBD Travel is an MCP server listed in the public MCP registry as com.mbdtravel/travel. Read-only MBD Travel catalogue: tours, hotel prices, private transfers and the Dubai visa. This page covers its hosted endpoint (https://mbdtravel.com/api/v1/mcp/public).
Is the MBD Travel MCP server safe to use?
MBD Travel scores 73 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the MBD Travel MCP server expose?
MBD Travel exposes 12 tools: search, fetch, search_tours, get_tour, get_departures, and 7 more. Their descriptions and schemas cost roughly 1,824 tokens of context every time the server is loaded.
Does the MBD Travel MCP server require authentication?
No. We connected to MBD Travel without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the MBD Travel MCP server still maintained?
MBD Travel is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.