com.stayker/1stay
REMOTE · MCP.STAYKER.COM · SCANNED SEP 21
Hotel booking MCP server. Search, book, and manage reservations across 250K+ properties worldwide.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security74
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability70
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1620 tokens (~202/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management86
- Stability check failed: schema churn in the 30 days we've observed: 0 tool removals, 2 breaking changes, 0 auth/transport breaks, 0 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 8 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the com.stayker/1stay MCP server?
com.stayker/1stay is a hosted endpoint at https://mcp.stayker.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.stayker.com
claude mcp add --transport http com-stayker-1stay 'https://mcp.stayker.com/mcp'
{
"mcpServers": {
"com-stayker-1stay": {
"url": "https://mcp.stayker.com/mcp"
}
}
} {
"servers": {
"com-stayker-1stay": {
"type": "http",
"url": "https://mcp.stayker.com/mcp"
}
}
} [mcp_servers.com-stayker-1stay] url = "https://mcp.stayker.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-stayker-1stay": {
"type": "remote",
"url": "https://mcp.stayker.com/mcp",
"enabled": true
}
}
} openclaw mcp add com-stayker-1stay --url 'https://mcp.stayker.com/mcp' --transport streamable-http
mcp_servers:
com-stayker-1stay:
url: "https://mcp.stayker.com/mcp" {
"McpServers": {
"com-stayker-1stay": {
"Transport": "http",
"Url": "https://mcp.stayker.com/mcp"
}
}
} assistant mcp add com-stayker-1stay -t streamable-http -u 'https://mcp.stayker.com/mcp'
{
"mcpServers": {
"com-stayker-1stay": {
"type": "http",
"url": "https://mcp.stayker.com/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 −2
- Stability: pass → fail ▼ security
- A breaking change shipped without a version bump: still 1.0.0 ▼ security
- Tool “cancel_booking” rewrote its description, which is the text the model reads security
- Tool “get_hotel_details” rewrote its description, which is the text the model reads security
- Tool “lookup_booking” rewrote its description, which is the text the model reads security
- Tool “search_hotels” rewrote its description, which is the text the model reads security
- “get_hotel_details” changed the type of “rooms”: number → integer ▼ functional
- “search_hotels” changed the type of “rooms”: number → integer ▼ functional
- The server now declares the “resources” capability functional
- MCP protocol: Implements a current MCP spec version (2026-07-28). functional
- MCP protocol version: 2025-11-25 → 2026-07-28 functional
- “book_hotel” reworded the description of “check_in” cosmetic
- “get_hotel_details” reworded the description of “check_in” cosmetic
- “lookup_booking” reworded the description of “check_in_date” cosmetic
- “search_hotels” reworded the description of “max_results” cosmetic
- 18 Sept 26 +3
- Stability: fail → pass ▲ security
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 73 to 80.
- 26 Aug 26 −3
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 +4
- Schema quality: 208 → 119 ▲ functional
- The server now declares the “resources” capability functional
- First check of Capabilities: pass functional
- First check of Schema quality: 100 functional
- MCP protocol: Implements a current MCP spec version (2026-07-28). functional
- MCP protocol version: 2025-11-25 → 2026-07-28 functional
- New resource “1Stay hotel details” functional
- New resource “1Stay hotel details compatibility 1” functional
- New resource “1Stay hotel results” functional
- New resource “1Stay hotel results compatibility 1” functional
- New resource “1Stay hotel results compatibility 2” functional
- New resource “1Stay hotel results compatibility 3” functional
- New resource “1Stay hotel results compatibility 4” functional
- “search_hotels” reworded the description of “max_results” cosmetic
- 24 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 67 to 70.
- 20 Aug 26 0
- Authorization: fail → partial ▲ security
- Tool “cancel_booking” rewrote its description, which is the text the model reads security
- Tool “search_hotels” rewrote its description, which is the text the model reads security
- Tool “cancel_booking” no longer declares itself destructive security
- “book_hotel” reworded the description of “check_in” cosmetic
- “get_hotel_details” reworded the description of “check_in” cosmetic
- “search_hotels” reworded the description of “check_in” cosmetic
- “cancel_booking” dropped the optional parameter “cancellation_token” cosmetic
- 19 Aug 26 0
- A breaking change shipped without a version bump: still 1.0.0 ▼ security
- Tool “book_hotel” rewrote its description, which is the text the model reads security
- Tool “get_booking” rewrote its description, which is the text the model reads security
- Tool “get_hotel_details” rewrote its description, which is the text the model reads security
- Tool “resend_confirmation” rewrote its description, which is the text the model reads security
- Tool “search_hotels” rewrote its description, which is the text the model reads security
- Schema quality: 191 → 211 ▼ functional
- “get_booking” added a required parameter “confirmation_number”, so existing callers break ▼ functional
- “get_booking” dropped the required parameter “booking_id” ▼ functional
- “get_hotel_details” changed the type of “rooms”: integer → number ▼ functional
- “search_hotels” changed the type of “rooms”: integer → number ▼ functional
- “resend_confirmation” added an optional parameter “email” cosmetic
- “resend_confirmation” added an optional parameter “first_name” cosmetic
- “resend_confirmation” added an optional parameter “last_name” cosmetic
- “get_hotel_details” reworded the description of “rooms” cosmetic
- “resend_confirmation” reworded the description of “confirmation_number” cosmetic
- “search_hotels” reworded the description of “rooms” cosmetic
- “resend_confirmation” made “confirmation_number” optional cosmetic
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Probed https://mcp.stayker.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=mcp.stayker.com | CN=WE1,O=Google Trust Services,C=US | 14 Aug 2026 | 12 Nov 2026 | ECDSA 256 | ECDSA-SHA256 | 4b3732a8a44087680e97ab3e8d45e3c0 |
| SANs: mcp.stayker.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.stayker.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| stayker.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.stayker.com/mcp | Verified | 200 | |
| http (plaintext) | http://mcp.stayker.com/mcp | HTTPS enforced | 301 | https://mcp.stayker.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
book_hotel Book Hotel ~254
Book exactly one hotel room. The first 1Stay release does not support multi-room searches or reservations. Returns a secure checkout URL. This tool accepts no guest identity or payment fields. Name, email, phone, and payment details are collected on the secure checkout page. Guest pays the hotel directly. Their credit card statement shows the hotel name, not 1Stay. Hotel's own confirmation number. Loyalty points apply automatically. The displayed total includes taxes and any applicable, itemized 1Stay Booking Fee. Requires a rate_code from get_hotel_details, valid approximately 15 minutes. Expired codes are rejected.
| Name | Type | Req | Description |
|---|---|---|---|
| check_in | string | yes | Check-in date in YYYY-MM-DD format (e.g. 2026-05-06) |
| check_out | string | yes | Check-out date in YYYY-MM-DD format (e.g. 2026-05-07) |
| external_reference_id | string | – | Caller-defined unique reference ID for idempotency and retrieval |
| guests | integer | yes | Number of guests |
| hotel_id | string | yes | Hotel ID from search or details |
| rate_code | string | yes | Valid, unexpired rate code for the selected hotel, dates, and room |
| Name | Type | Req | Description |
|---|---|---|---|
| avg_nightly_rate | number | – | – |
| booking_fee | number | – | – |
| booking_fee_currency | string | – | – |
| booking_type | string | – | – |
| cancellation_policy | string | – | – |
| check_in | string | – | – |
| check_out | string | – | – |
| checkout_url | string | – | – |
| confirmation_number | string | – | – |
| currency | string | – | – |
| expires_in_minutes | integer | – | – |
| external_reference_id | – | – | – |
| hotel_name | string | – | – |
| idempotency_hit | boolean | – | – |
| message | string | yes | – |
| nights | integer | – | – |
| rate_plan | string | – | – |
| reward_points_eligible | boolean | – | – |
| room_type | string | – | – |
| status | string | yes | – |
| subtotal | number | – | – |
| taxes | number | – | – |
| total_with_taxes | number | – | – |
No examples provided.
cancel_booking Cancel Booking ~158
Prepare a hotel cancellation for completion on a secure 1Stay page. Verifies the guest's first name, last name, and hotel confirmation number, then returns the hotel policy classification and any cancellation deadline recorded with the reservation, plus a short-lived cancellation_url. 1Stay does not estimate a refund, credit, penalty, or hotel charge. Calling this tool never cancels the reservation. The guest must review the terms and select Cancel reservation on the secure page. Do not say the reservation was cancelled unless a later verified booking-status lookup reports status cancelled.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmation_number | string | yes | Hotel confirmation number |
| first_name | string | yes | Guest first name on the reservation |
| last_name | string | yes | Guest last name on the reservation |
| Name | Type | Req | Description |
|---|---|---|---|
| booking | object | – | – |
| cancellation | – | – | – |
| cancellation_url | string | – | – |
| cancellation_url_expires_at | string | – | – |
| message | string | yes | – |
| status | string | yes | – |
No examples provided.
get_booking Get Booking ~152
Look up a reservation exclusively by the hotel confirmation number shown in the guest's confirmation email. Internal Stayker booking IDs are never accepted or disclosed by MCP. Returns full booking details including hotel, dates, guest info, rate, and status. Anonymous access requires a verification_token issued by lookup_booking and scoped to a single booking. Without a valid token, no booking data is returned. Developers authenticated with their own API key do not need a token; their access is scoped to their own bookings.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmation_number | string | yes | Hotel confirmation number shown in the guest's confirmation email |
| verification_token | string | – | Booking-scoped verification token required for anonymous access. Developer API key-authenticated access does not require it. |
| Name | Type | Req | Description |
|---|---|---|---|
| action_handoff | string | yes | – |
| available_actions | object | yes | – |
| booking_type | string | yes | – |
| cancellation | – | – | – |
| check_in | – | – | – |
| check_out | – | – | – |
| confirmation_number | – | – | – |
| created_at | – | – | – |
| guests | array | – | – |
| hotel | – | – | – |
| nights | integer | – | – |
| pricing | object | – | – |
| reward_points_eligible | boolean | yes | – |
| room | – | – | – |
| status | string | – | – |
No examples provided.
get_hotel_details Hotel Details ~267
Get rates and room details for exactly one room at a specific hotel. Returns room types, live rates, amenities, cancellation policies, and rate_codes required by book_hotel. Guest pays the hotel directly. Displayed totals include taxes and any applicable, itemized 1Stay Booking Fee. Loyalty points eligible. Room type notes: "Run of house" means the hotel assigns the room at check-in. "Suite" at select-service brands usually means a larger room with a sofa, not a separate bedroom.
| Name | Type | Req | Description |
|---|---|---|---|
| accessible | boolean | – | When true, returns accessible (ADA) room types instead of standard ones. Default false because hotels list many near-identical accessible variants. The response always reports accessible_rooms_availa… |
| check_in | string | yes | Check-in date in YYYY-MM-DD format (e.g. 2026-05-06) |
| check_out | string | yes | Check-out date in YYYY-MM-DD format (e.g. 2026-05-07) |
| guests | integer | – | Number of guests (default 2) |
| hotel_id | string | yes | Hotel ID from search results |
| rooms | integer | – | Number of rooms. 1Stay currently supports exactly one room per search and reservation; omit this field or set it to 1. |
| Name | Type | Req | Description |
|---|---|---|---|
| accessible_rooms_available | integer | yes | – |
| accessible_rooms_note | – | – | – |
| availability_status | string | – | – |
| hotel | object | yes | – |
| message | string | – | – |
| next_step | string | – | – |
| rate_quote_expires_at | – | – | – |
| rate_quote_ttl_seconds | – | – | – |
| rooms | array | yes | – |
| stay | object | – | – |
No examples provided.
lookup_booking Lookup Booking ~170
Look up a reservation by verifying the guest's identity. Returns the confirmation number and booking summary in conversation. Requires the guest's full name plus either the hotel confirmation number, or the booking email together with the last 4 digits of the card used to book. An email address alone is not enough. An optional check-in date can narrow repeat stays.
| Name | Type | Req | Description |
|---|---|---|---|
| check_in_date | string | – | Optional check-in date (YYYY-MM-DD) to narrow repeat stays |
| confirmation_number | string | – | Hotel confirmation number |
| string | – | Email address used when booking | |
| first_name | string | yes | Guest first name on the reservation |
| last_four_card | string | – | Last 4 digits of the card used to book |
| last_name | string | yes | Guest last name on the reservation |
| Name | Type | Req | Description |
|---|---|---|---|
| action_handoff | string | yes | – |
| available_actions | object | – | – |
| booking_status | string | – | – |
| check_in | string | – | – |
| check_out | string | – | – |
| confirmation_number | – | yes | – |
| confirmation_number_status | string | – | – |
| guest_name | string | – | – |
| hotel | string | – | – |
| status | string | yes | – |
| verification_token | string | yes | – |
| verification_token_expires_at | string | yes | – |
| verification_token_note | string | – | – |
No examples provided.
resend_confirmation Resend Confirmation ~211
Resend a hotel reservation confirmation email. Use either the confirmation number from a successful lookup_booking call, or the guest's full name and email address when they do not know their confirmation number, card last four, or check-in date. The email contains the hotel confirmation number the guest can then use with lookup_booking or cancel_booking. Recovery requests never reveal whether a reservation matched. The confirmation is sent only to the email address already on the booking record; there is no recipient override. Email changes are handled at https://stayker.com/service.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmation_number | string | – | Hotel confirmation number. Use this after a verified lookup. |
| string | – | Guest email address. Used only to find a match; confirmation is sent only to the email address already on file. | |
| first_name | string | – | Guest first name. Required with last_name and email when the confirmation number is unavailable. |
| last_name | string | – | Guest last name. Required with first_name and email when the confirmation number is unavailable. |
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | yes | – |
| status | string | yes | – |
No examples provided.
search_hotels Search Hotels ~347
Search hotels by location and dates for exactly one room. Returns available properties with nightly rates across major brands, boutique, and independent hotels. The first 1Stay release supports one room per search and reservation. Guest pays the hotel directly. Hotel's own confirmation number. Loyalty points apply.
| Name | Type | Req | Description |
|---|---|---|---|
| check_in | string | yes | Check-in date in YYYY-MM-DD format (e.g. 2026-05-06). Must be today through 340 days from today. |
| check_out | string | yes | Check-out date in YYYY-MM-DD format (e.g. 2026-05-07). Must be after check_in. |
| currency | string | – | Currency code (default USD) |
| cursor | string | – | Pagination cursor from previous search response |
| guests_per_room | integer | – | Guests per room (default 2) |
| latitude | number | – | Latitude — must be provided together with longitude |
| location | string | – | City, address, venue, or landmark (e.g. 'Nashville, TN' or 'Times Square, NYC'). Required unless latitude and longitude are both provided. |
| longitude | number | – | Longitude — must be provided together with latitude |
| max_results | integer | – | Max hotels to return, max 4 (default 4). Use the returned cursor to load more pages. |
| radius | integer | – | Search radius in miles (default 25, max 100) |
| rooms | integer | – | Number of rooms. 1Stay currently supports exactly one room per search and reservation; omit this field or set it to 1. |
| search_id | string | – | Search ID paired with a pagination cursor from previous results |
| Name | Type | Req | Description |
|---|---|---|---|
| check_in | string | yes | – |
| check_out | string | yes | – |
| conversion_applied | boolean | – | – |
| cursor | – | yes | – |
| guests_per_room | integer | – | – |
| has_more | boolean | yes | – |
| requested_currency | string | – | – |
| resolution_type | string | – | – |
| resolved_location | string | – | – |
| results | array | yes | – |
| returned_currencies | array | – | – |
| rooms | integer | – | – |
| search_id | string | – | – |
| total_results | integer | yes | – |
No examples provided.
search_tools Search Tools ~61
List available 1Stay hotel booking tools. An optional keyword filters by search, book, cancel, or details; absence of a keyword returns all tools.
| Name | Type | Req | Description |
|---|---|---|---|
| keyword | string | – | Optional tool filter keyword, such as book, search, cancel, or details |
| Name | Type | Req | Description |
|---|---|---|---|
| tools | array | yes | – |
| total | integer | yes | – |
No examples provided.
What is the com.stayker/1stay MCP server?
com.stayker/1stay is an MCP server listed in the public MCP registry as com.stayker/1stay. Hotel booking MCP server. Search, book, and manage reservations across 250K+ properties worldwide. This page covers its hosted endpoint (https://mcp.stayker.com/mcp).
Is the com.stayker/1stay MCP server safe to use?
com.stayker/1stay scores 82 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the com.stayker/1stay MCP server expose?
com.stayker/1stay exposes 8 tools: search_hotels, get_hotel_details, book_hotel, lookup_booking, resend_confirmation, and 3 more. Their descriptions and schemas cost roughly 1,620 tokens of context every time the server is loaded.
Does the com.stayker/1stay MCP server require authentication?
No. We connected to com.stayker/1stay without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the com.stayker/1stay MCP server still maintained?
com.stayker/1stay is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.