lilo Vacation Rentals
REMOTE · MCP.LILO.PROPERTY · SCANNED SEP 27
Vacation rental discovery, direct booking, and property protection for AI agents.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: this server exposes a tool marked destructive (verify_guest_identity_for_check_in) and its handshake is open, but we could not confirm whether a tool call is gated, so we do not assert it is callable unauthenticated. View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability51
- 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Fail
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 6766 tokens (~95/item across 71 items; 67 tools + 4 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 67 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 68 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities20
- Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail
How do I install the lilo Vacation Rentals MCP server?
lilo Vacation Rentals is a hosted endpoint at https://mcp.lilo.property/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.lilo.property
claude mcp add --transport http lilo-property-mcp-server 'https://mcp.lilo.property/mcp'
{
"mcpServers": {
"lilo-property-mcp-server": {
"url": "https://mcp.lilo.property/mcp"
}
}
} {
"servers": {
"lilo-property-mcp-server": {
"type": "http",
"url": "https://mcp.lilo.property/mcp"
}
}
} [mcp_servers.lilo-property-mcp-server] url = "https://mcp.lilo.property/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"lilo-property-mcp-server": {
"type": "remote",
"url": "https://mcp.lilo.property/mcp",
"enabled": true
}
}
} openclaw mcp add lilo-property-mcp-server --url 'https://mcp.lilo.property/mcp' --transport streamable-http
mcp_servers:
lilo-property-mcp-server:
url: "https://mcp.lilo.property/mcp" {
"McpServers": {
"lilo-property-mcp-server": {
"Transport": "http",
"Url": "https://mcp.lilo.property/mcp"
}
}
} assistant mcp add lilo-property-mcp-server -t streamable-http -u 'https://mcp.lilo.property/mcp'
{
"mcpServers": {
"lilo-property-mcp-server": {
"type": "http",
"url": "https://mcp.lilo.property/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 0
- Stability: 0.97 → pass security
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 0
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 27 Sept 2026 · Probed https://mcp.lilo.property/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=mcp.lilo.property | CN=YR1,O=Let's Encrypt,C=US | 29 Aug 2026 | 27 Nov 2026 | RSA 2048 | SHA256-RSA | 624dacdf32ece6dd70a9e1e0871da34d2e7 |
| SANs: mcp.lilo.property | ||||||
| CN=YR1,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | a20253f15f2691c05dc1ce13b9bcca4e |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.lilo.property. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| property. | present | 33049 | 13 | Verified |
| lilo.property. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| content-security-policy | default-src 'none' |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | no-referrer |
| permissions-policy | interest-cohort=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.lilo.property/mcp | Verified | 200 | |
| http (plaintext) | http://mcp.lilo.property/mcp | HTTPS enforced | 301 | https://mcp.lilo.property/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
query_vacation_rental_evidence_chain ~101
Query the evidence chain for a vacation rental property or specific booking. Returns independently verified evidence records filtered by property_id, booking_id, or event_type. Use this to audit the complete evidence trail.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_id | string | – | Booking UUID (optional) |
| event_type | string | – | Filter by event type |
| limit | number | – | Max results (default 50) |
| property_id | string | – | Property UUID |
No output schema declared.
No examples provided.
record_guest_interaction_to_evidence ~137
Record a guest interaction to the vacation rental's evidence chain. Creates a verified evidence record of the interaction. Pass property_id, interaction_type (inquiry, complaint, request, confirmation), content text, and channel (mcp, voice, sms, email). Optional: booking_id.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_id | string | – | Booking UUID (optional) |
| channel | string | – | Channel: mcp, voice, sms, email |
| content | string | yes | Interaction content/summary |
| interaction_type | string | yes | Type: inquiry, complaint, request, confirmation |
| property_id | string | yes | Property UUID |
No output schema declared.
No examples provided.
report_rental_inventory_issue ~153
Report a missing, damaged, or low-stock inventory item at a vacation rental property. Creates an issue record with optional photo evidence. Pass property_id, item_name, and issue_type (missing, damaged, low_stock, needs_replacement). Optional: description, booking_id, photo_url.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_id | string | – | Associated booking UUID (optional) |
| description | string | – | Description of the issue |
| issue_type | string | yes | Type: missing, damaged, low_stock, needs_replacement |
| item_name | string | yes | Name of the inventory item |
| photo_url | string | – | URL to photo evidence (optional) |
| property_id | string | yes | Property UUID or lilo_code |
No output schema declared.
No examples provided.
screen_guest_before_booking ~131
Pre-booking guest risk assessment for vacation rental hosts. Evaluates guest profile, booking details, and communication patterns to provide a risk level (low/medium/high/critical) with specific recommendations. Helps hosts decide whether to accept a booking request. Pass guest_email, guest_phone, guest_name, message_text, and/or booking_details.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_details | object | – | Booking details |
| guest_email | string | – | Guest email address |
| guest_name | string | – | Guest name |
| guest_phone | string | – | Guest phone number |
| message_text | string | – | Initial message from guest |
No output schema declared.
No examples provided.
search_philadelphia_event_venues ~83
Search Philadelphia event and wedding venues. Returns venue details including capacity, type, availability, and booking information. Filter by venue_type (wedding, event, historic, all) and minimum capacity.
| Name | Type | Req | Description |
|---|---|---|---|
| capacity_min | number | – | Minimum capacity requirement |
| query | string | – | Search query |
| venue_type | string | – | Venue type filter |
No output schema declared.
No examples provided.
search_philadelphia_historic_properties ~100
Search Philadelphia historic properties and landmarks from public records. Useful for World Cup 2026 and America's 250th Anniversary (2026) planning. Filter by type: landmark, historic_religious, african_american, or all.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max results (default 20) |
| query | string | – | Search query (property name, address, etc.) |
| type | string | – | Property type filter |
No output schema declared.
No examples provided.
search_vacation_rental_market ~152
Search lilo's market discovery for vacation rental properties in any US location. Filter by price range, bedrooms, superhost status, and World Cup 2026 host cities. Returns property listings including non-activated properties for market research.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max results (default 20) |
| location | string | yes | City, state, or neighborhood to search |
| max_price | number | – | Maximum nightly price |
| min_bedrooms | number | – | Minimum bedrooms |
| min_price | number | – | Minimum nightly price |
| superhost_only | boolean | – | Only show superhosts |
| world_cup_city | boolean | – | Only World Cup 2026 host cities |
No output schema declared.
No examples provided.
search_vacation_rentals ~178
Search for vacation rental properties with structured filtering. Returns results optimized for AI deep research with id, title, url, snippet, pricing, and property attributes. Use this for broad property discovery. Supports filtering by city, state, bedrooms, price, and pet-friendliness.
| Name | Type | Req | Description |
|---|---|---|---|
| city | string | – | Filter by city name |
| limit | number | – | Max results to return (default 10, max 50) |
| max_price | number | – | Maximum nightly rate in USD |
| min_bedrooms | number | – | Minimum number of bedrooms |
| pet_friendly | boolean | – | Filter for pet-friendly properties only |
| query | string | yes | Search query (e.g. 'beach house in Delaware', 'family rental near Philadelphia') |
| state | string | – | Filter by state name or abbreviation |
No output schema declared.
No examples provided.
search_vacation_rentals_by_amenities ~95
Search for vacation rentals by amenity description using natural language. Examples: 'pool and hot tub', 'pet-friendly with fenced yard', 'EV charger and garage'. Pass the amenity query and optional location filter.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max results (default 10) |
| location | string | – | Location to search |
| query | string | yes | Natural language amenity query |
No output schema declared.
No examples provided.
search_vacation_rentals_by_description ~138
Search for vacation rentals using a natural language description. Examples: 'romantic beachfront getaway with hot tub', 'family-friendly house with pool near Disney', 'quiet cabin in the mountains for a writers retreat'. Finds matching properties by semantic meaning, not just keywords. Pass the description as 'query'. Optional: threshold (how strict result matching should be) and limit (max results, default 10).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max results (default 10) |
| query | string | yes | Natural language description of what you're looking for |
| threshold | number | – | Match strictness (higher = stricter) |
No output schema declared.
No examples provided.
search_vacation_rentals_by_location ~133
Search for vacation rentals, short-term rentals, and accommodation properties by location, guest count, and property type. Use this when a traveler wants to find a place to stay. Returns matching properties with names, locations, nightly rates, photos, and protection status.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max results to return (default 10) |
| location | string | yes | Location to search (city, state, or address) |
| property_type | string | – | Property type filter (entire_home, private_room, etc.) |
| verified_only | boolean | – | Only verified properties (default true) |
No output schema declared.
No examples provided.
search_world_cup_rentals ~195
Search for vacation rentals in FIFA World Cup 2026 host cities. Returns properties with stadium proximity information, match schedules, and expected demand surge data. Use this when a traveler is looking for accommodation for World Cup 2026 matches. Supports 11 US host cities: Miami, New York, Los Angeles, Dallas, Philadelphia, Atlanta, Houston, Seattle, San Francisco, Boston, Kansas City.
| Name | Type | Req | Description |
|---|---|---|---|
| check_in | string | – | Check-in date (YYYY-MM-DD format, tournament runs Jun 11 - Jul 19, 2026) |
| check_out | string | – | Check-out date (YYYY-MM-DD format) |
| city | string | yes | World Cup 2026 host city (e.g. 'Miami', 'Philadelphia') |
| group_size | number | – | Number of guests in the group |
| limit | number | – | Max results to return (default 10, max 50) |
No output schema declared.
No examples provided.
verify_evidence_anchor_integrity ~72
Verify the integrity and authenticity of a specific evidence anchor record. Confirms the evidence is tamper-proof and independently verifiable. Pass evidence_id (UUID) or evidence_hash.
| Name | Type | Req | Description |
|---|---|---|---|
| evidence_hash | string | – | Evidence hash (alternative to evidence_id) |
| evidence_id | string | – | Evidence UUID |
No output schema declared.
No examples provided.
verify_guest_identity_for_check_in ~140
Create a secure guest verification and check-in link for a confirmed vacation rental booking. Verifies guest identity via phone, presents house rules for acknowledgment, records consent with verified evidence, and provides access codes upon agreement. Returns a unique handshake link.
| Name | Type | Req | Description |
|---|---|---|---|
| check_in_date | string | yes | Check-in date (YYYY-MM-DD) |
| check_out_date | string | yes | Check-out date (YYYY-MM-DD) |
| guest_email | string | – | Guest email address |
| guest_name | string | yes | Name of the guest |
| guest_phone | string | – | Guest phone for verification |
| property_id | string | yes | Property UUID or lilo_code |
No output schema declared.
No examples provided.
verify_rental_checkout_condition ~162
Record checkout verification for a vacation rental with checklist completion and photo evidence. Used by cleaners or hosts to document property condition after a guest departure. Pass property_id, booking_id, overall_condition (excellent/good/fair/poor/damaged), optional checklist_items, issues_found, photo_urls, and verified_by.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_id | string | yes | Booking UUID |
| checklist_items | array | – | Completed checklist items |
| issues_found | array | – | List of issues found |
| overall_condition | string | yes | Overall condition: excellent, good, fair, poor, damaged |
| photo_urls | array | – | Photo evidence URLs |
| property_id | string | yes | Property UUID or lilo_code |
| verified_by | string | – | Name of person verifying |
No output schema declared.
No examples provided.
verify_vacation_rental_evidence_record ~67
Verify the authenticity and integrity of a specific evidence record. Confirms the evidence has not been tampered with, existed at the claimed timestamp, and is independently verifiable. Pass the evidence_id (UUID).
| Name | Type | Req | Description |
|---|---|---|---|
| evidence_id | string | yes | Evidence record UUID |
No output schema declared.
No examples provided.
verify_vacation_rental_trust_chain ~100
Independently verify a specific evidence record in a vacation rental property's trust chain. Confirms the evidence has been independently verified and is tamper-proof. Pass lilo_code (e.g. PROP-6408) and envelope_hash of the evidence record to verify.
| Name | Type | Req | Description |
|---|---|---|---|
| envelope_hash | string | yes | Hash of the evidence envelope to verify |
| lilo_code | string | yes | Property lilo code (e.g. PROP-6408) |
No output schema declared.
No examples provided.
What is the lilo Vacation Rentals MCP server?
lilo Vacation Rentals is an MCP server listed in the public MCP registry as io.github.lilo-property/mcp-server. Vacation rental discovery, direct booking, and property protection for AI agents. This page covers its hosted endpoint (https://mcp.lilo.property/mcp).
Is the lilo Vacation Rentals MCP server safe to use?
lilo Vacation Rentals scores 73 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the lilo Vacation Rentals MCP server expose?
lilo Vacation Rentals exposes 67 tools: get_vacation_rental_details, search_vacation_rentals_by_location, search_vacation_rental_market, search_vacation_rentals_by_description, find_similar_vacation_rentals, and 62 more. Their descriptions and schemas cost roughly 6,747 tokens of context every time the server is loaded.
Does the lilo Vacation Rentals MCP server require authentication?
No. We connected to lilo Vacation Rentals without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the lilo Vacation Rentals MCP server still maintained?
lilo Vacation Rentals is still listed as active in the MCP registry. We last reached this channel on 27 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.