Stay Perks
REMOTE · STAYSPERKS.COM
Virtuoso luxury hotels with perks included: search 2,000+, get a quote, book. Pay hotels directly.
Available components
Last scanned (9 hours ago)
Scores higher than 55% of remote servers
Reachable. Last reached 5 Nov 2026.
Category E-commerce
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (complete_booking_session). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability65
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1816 tokens (~129/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management47
- Stability observed for 14 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage87
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 60% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 14 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (13)
- TLS certificate
- Authorization
- HTTPS
- HSTS header
- DNSSEC
- Transport
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this hosted endpoint (2)
- Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
- Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +1
- Schema quality: pass → fail ▼ functional
- Tool coverage: 47% → 60% ▲ functional
- New tool “request_itinerary” functional
- 27 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 25 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 23 Oct 26 +1
- Stability: unverified → 0.03 ▲ functional
- 22 Oct 26 64
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://staysperks.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=staysperks.com | CN=YR2,O=Let's Encrypt,C=US | 19 Oct 2026 | 17 Jan 2027 | RSA 2048 | SHA256-RSA | 690b0f0bf8159b1d3bfc04b9b7a71272eaf |
| SANs: staysperks.com, www.staysperks.com | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of staysperks.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | Trust anchor | 20326, 38696 | 8, 8 | Verified |
| com. | DS published | 19718 | 13 | Verified |
| staysperks.com. | No DS | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://staysperks.com/mcp | Verified | 200 | |
| http (plaintext) | http://staysperks.com/mcp | HTTPS enforced | 308 | https://staysperks.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cancel_booking ~55
Cancel a booking request. A confirmed hotel reservation is cancelled with the hotel under its own cancellation policy, which comes with the quote and the confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_id | string | yes | – |
| reason | string | – | Reason for cancellation |
No output schema declared.
No examples provided.
cancel_booking_session Cancel a booking before hotel confirmation ~53
SENSITIVE WRITE. Withdraws a booking before the hotel confirms it (the advisor is told). Confirmed reservations are cancelled with the hotel under its cancellation policy, through the advisor.
| Name | Type | Req | Description |
|---|---|---|---|
| session_id | string | yes | – |
No output schema declared.
No examples provided.
check_complexity ~61
Check whether a request goes straight to Geisel Power, the Virtuoso advisor, for a quote (hotel stays always do).
| Name | Type | Req | Description |
|---|---|---|---|
| num_nights | number | – | – |
| num_travelers | number | – | – |
| trip_id | string | yes | – |
No output schema declared.
No examples provided.
complete_booking_session Book it (requires the traveler's approval) ~111
SENSITIVE WRITE — get the traveler's explicit approval of the full total and the hotel's cancellation policy first. Asks Geisel Power to place the reservation. No payment is taken: the traveler pays the hotel directly under its own terms, and hotel bookings carry no fee. Returns complete_in_progress with a confirmation deadline (within 24 hours); poll get_booking_session for the hotel's confirmation number, which is also emailed to the traveler.
| Name | Type | Req | Description |
|---|---|---|---|
| booker | object | yes | – |
| session_id | string | yes | – |
No output schema declared.
No examples provided.
create_booking ~120
Get the steps to book a hotel, cruise or experience found with search_trips. Geisel Power, the Virtuoso advisor, quotes it in writing within 24 hours (rate, taxes, the hotel's cancellation policy and the perks) and books only after the traveler approves. This tool sends nothing itself (request_sent: false). Hotel bookings carry no fee and nothing is charged by Stay Perks: the traveler pays the hotel directly.
| Name | Type | Req | Description |
|---|---|---|---|
| num_nights | number | – | – |
| traveler_info | object | yes | – |
| trip_id | string | yes | – |
No output schema declared.
No examples provided.
create_booking_session Start a booking (UCP lodging) ~136
WRITE. Opens a UCP lodging booking session from a quoted offer (stay_id from get_availability_quote). Returns the authoritative total, the cancellation policy (show it to the traveler), the Virtuoso amenities, the payment term (pay at the hotel) and evidence. Nothing is charged; the session is held until the quote expires.
| Name | Type | Req | Description |
|---|---|---|---|
| adults | integer | – | – |
| booker | object | – | Lead traveler (legal name + email). Without it the session stays "incomplete". |
| children | integer | – | – |
| property_id | string | yes | – |
| stay_id | string | yes | stay_id of a quoted offer |
No output schema declared.
No examples provided.
get_availability_quote Check a stay quote ~80
READ. Returns the status of a quote from search_availability: "pending" (try again later), "quoted" (offers with stay_id, full total, cancellation terms), "unavailable", or "expired". Use an offer's stay_id with create_booking_session.
| Name | Type | Req | Description |
|---|---|---|---|
| quote_id | string | yes | Quote id returned by search_availability |
No output schema declared.
No examples provided.
get_booking_session Check a booking ~66
READ. Current state of a booking session: ready_for_complete (awaiting the traveler's approval), complete_in_progress (the advisor is placing the reservation), completed (includes the hotel's own confirmation number; the traveler is also emailed), or canceled.
| Name | Type | Req | Description |
|---|---|---|---|
| session_id | string | yes | – |
No output schema declared.
No examples provided.
get_booking_status ~25
Check the status of an existing booking
| Name | Type | Req | Description |
|---|---|---|---|
| booking_id | string | yes | – |
No output schema declared.
No examples provided.
get_trip_details ~77
Get the details of a hotel, package, cruise or private experience from search_trips, with a hotel's Virtuoso perks. Virtuoso records carry no published rate or availability; the advisor quotes those in writing within 24 hours.
| Name | Type | Req | Description |
|---|---|---|---|
| trip_id | string | yes | trip_id from search_trips, or a hotel's virtuoso_property_id |
No output schema declared.
No examples provided.
request_itinerary ~539
WRITE. Send Geisel Power, the Virtuoso advisor, the traveler's request for a Journey (Journeys by Geisel Power: a whole trip she plans, books and confirms, usually from about $15,000 to $20,000) or a hotel stay (Stay Perks Reserve, no minimum). Call it only after the traveler has agreed to share their name, email and trip details with Geisel Power, and set traveler_consented to true. Returns a reference and what happens next: Geisel replies to a Journeys request the same day, with the full proposal after a discovery call, and to a hotel request in writing within 24 hours; some requests also get a link to book a 30-minute call with her (call_url). Nothing is booked or charged. Hotel bookings carry no fee and the traveler pays the hotel directly; a Journey carries a planning fee, which depends on the trip's length and complexity and which Geisel explains on the discovery call.
| Name | Type | Req | Description |
|---|---|---|---|
| destinations | string | – | Where: places, regions or hotels ("Amalfi Coast, Lake Como") |
| string | yes | The traveler's email: Geisel replies there | |
| flexibility | string | – | How flexible the dates are: exact (Exact dates), few-days (A few days either way), month (Any time in a month), open (Open, advise me) |
| kind | string | – | journey (the default): a whole trip Geisel designs; hotel: a hotel stay only |
| name | string | yes | The traveler's full name |
| notes | string | – | Anything else the traveler wants Geisel to know |
| occasion | string | – | What the trip is for: anniversary (Anniversary or honeymoon), birthday (A milestone birthday), family (Family or multigenerational trip), celebration (Another celebration), business (Business with so… |
| travel_dates | string | – | When ("10 to 20 May 2027", "late spring") |
| traveler_consented | boolean | yes | true, and only once the traveler has agreed to share these details with Geisel Power |
| travelers | string | – | Who is traveling ("2 adults, 1 child") |
| trip_budget | string | – | The whole trip's budget in USD, for a Journey: under-15k (Under $15,000), 15k-20k ($15,000 to $20,000), 20k-50k ($20,000 to $50,000), 50k-plus ($50,000 or more). No budget is needed for a hotel stay |
No output schema declared.
No examples provided.
search_availability Request a stay quote (Virtuoso perks) ~209
WRITE. Ask Geisel Power, the Virtuoso advisor, to price a stay at a Virtuoso hotel (property_id from search_trips). Virtuoso data carries no live rates, so pricing is asynchronous: this returns a quote id with status "pending" and a quote_due_by time (within 24 hours); poll get_availability_quote. A firm offer includes the full total, taxes and fees, the hotel's cancellation policy, and the Virtuoso amenities (e.g. breakfast for two, a hotel credit, an upgrade, subject to availability). Nothing is reserved or charged by this call, and hotel bookings carry no fee.
| Name | Type | Req | Description |
|---|---|---|---|
| adults | integer | yes | Number of adults |
| children | integer | – | Number of children |
| end_date | string | yes | Check-out date, YYYY-MM-DD |
| property_id | string | yes | Virtuoso property id (virtuoso_property_id) from search_trips |
| start_date | string | yes | Check-in date, YYYY-MM-DD |
No output schema declared.
No examples provided.
search_trips ~223
Search 2,000+ Virtuoso hotels, plus packages, cruises and private experiences, by place, brand or kind of stay. Results show whether Virtuoso perks apply, a trip_id for get_trip_details, and how to book. No live rates: the advisor quotes them.
| Name | Type | Req | Description |
|---|---|---|---|
| budget_usd | number | – | Max budget in USD |
| check_in | string | – | Check-in date (ISO 8601) |
| check_out | string | – | Check-out date (ISO 8601) |
| destination | string | – | A city, region or country ("Paris", "Tuscany", "Caribbean"), a hotel or brand ("Four Seasons"), both ("Four Seasons Paris"), or a kind of stay ("beach", "safari") |
| limit | integer | – | Results per page, up to 50 (default 10) |
| offset | integer | – | Results to skip, for the next page |
| trip_type | string | – | hotel_only (the default), fixed_package, cruise, service (private experiences) or custom_itinerary |
No output schema declared.
No examples provided.
update_booking_session Update a booking before payment ~61
WRITE. Change occupancy (within the quote) or set the booker before completing. Not allowed after completion.
| Name | Type | Req | Description |
|---|---|---|---|
| adults | integer | – | – |
| booker | object | – | – |
| children | integer | – | – |
| session_id | string | yes | – |
No output schema declared.
No examples provided.
How do I install the Stay Perks MCP server?
Stay Perks is a hosted endpoint at https://staysperks.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · staysperks.com
claude mcp add --transport http com-staysperks-stay-perks 'https://staysperks.com/mcp'
What is the Stay Perks MCP server?
Stay Perks is an MCP server listed in the public MCP registry as com.staysperks/stay-perks. Virtuoso luxury hotels with perks included: search 2,000+, get a quote, book. Pay hotels directly. This page covers its hosted endpoint (https://staysperks.com/mcp).
Is the Stay Perks MCP server safe to use?
Stay Perks scores 70 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Stay Perks MCP server expose?
Stay Perks exposes 14 tools: search_trips, get_trip_details, check_complexity, create_booking, get_booking_status, and 9 more. Their descriptions and schemas cost roughly 1,816 tokens of context every time the server is loaded.
Does the Stay Perks MCP server require authentication?
No. We connected to Stay Perks without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Stay Perks MCP server still maintained?
Stay Perks is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What did VerifyMCP test on the Stay Perks MCP server?
VerifyMCP ran 13 checks on Stay Perks, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.