MCP server

HemmaBo Host Booking Engine

mcp:hemmabo-se/hemmabo-mcp-server

6 runtime tools: 2 HemmaBo tools, 2 host onboarding tools, and 2 VRP verification tools. Not an OTA.

awesome-mcp-servers Glama MCP Registry

Verdict

Not analyzed

Indexed from the registries, but not analyzed yet. Lineage and listings below are current.

Package advisories 12

Known vulnerabilities and malicious-package reports (OSV) that reach the versions of the packages it installs or runs.

highGHSA-22jm-h49p-29qwnpm/@modelcontextprotocol/sdk

MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

No version pinned, and the newest release may be affected · fixed in 1.32.0 · package.json

highGHSA-345p-7cg4-v4c7npm/@modelcontextprotocol/sdk

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

No version pinned, and the newest release may be affected · fixed in 1.26.0 · package.json

highGHSA-46jr-4wx8-v453npm/@modelcontextprotocol/sdk

MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

No version pinned, and the newest release may be affected · fixed in 1.32.0 · package.json

highGHSA-6qxp-vccf-f47hnpm/@modelcontextprotocol/sdk

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

No version pinned, and the newest release may be affected · fixed in 1.31.0 · package.json

highGHSA-8r9q-7v3j-jr4gnpm/@modelcontextprotocol/sdk

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

No version pinned, and the newest release may be affected · fixed in 1.25.2 · package.json

highGHSA-w48q-cv73-mx4wnpm/@modelcontextprotocol/sdk

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

No version pinned, and the newest release may be affected · fixed in 1.24.0 · package.json

highGHSA-mrhx-c7xc-m3w5npm/zod

Zod can exhaust memory while validating oversized constrained collections

No version pinned, and the newest release may be affected · fixed in 4.6.6 · package.json

mediumGHSA-6prh-2h8m-c8cwnpm/@modelcontextprotocol/sdk

MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

No version pinned, and the newest release may be affected · fixed in 1.32.0 · package.json

mediumGHSA-rvq5-wwqv-78pqnpm/@modelcontextprotocol/sdk

MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service

No version pinned, and the newest release may be affected · fixed in 1.32.0 · package.json

mediumGHSA-2g4f-4pwh-qvx6npm/ajv

ajv has ReDoS when using `$data` option

No version pinned, and the newest release may be affected · fixed in 8.18.0, 6.14.0 · package.json

mediumGHSA-v88g-cgmw-v5xwnpm/ajv

Prototype Pollution in Ajv

No version pinned, and the newest release may be affected · fixed in 6.12.3 · package.json

mediumGHSA-m95q-7qp3-xv42npm/zod

Zod denial of service vulnerability

No version pinned, and the newest release may be affected · fixed in 3.22.3 · package.json

Execution chain 330

What it calls, runs, installs, reads and writes, with the line that does it.

Environment variables 26

lib/idempotency.ts:39 · all

lib/idempotency.ts:119 · all

lib/idempotency.ts:165 · all

lib/rate-limit.ts:35 · all

lib/rate-limit.ts:98 · all

lib/env.ts:12 · read

MCP_ALLOWED_ORIGINS

lib/mcp-transport.ts:92 · read

MCP_API_KEY

src/auth.ts:67 · read

MCP_API_KEY

src/auth.ts:126 · read

PUBLIC_BASE_URL

lib/base-url.ts:21 · read

STRIPE_SECRET_KEY

api/acp.ts:66 · read

STRIPE_SECRET_KEY

src/stripe.ts:182 · read

STRIPE_SPT_API_VERSION

src/stripe.ts:39 · read

STRIPE_WEBHOOK_SECRET

api/stripe-webhook.ts:327 · read

SUPABASE_ANON_KEY

api/acp.ts:60 · read

SUPABASE_ANON_KEY

api/mcp.ts:281 · read

SUPABASE_SERVICE_ROLE_KEY

api/acp.ts:52 · read

SUPABASE_SERVICE_ROLE_KEY

api/mcp.ts:273 · read

SUPABASE_SERVICE_ROLE_KEY

api/stripe-webhook.ts:44 · read

SUPABASE_SERVICE_ROLE_KEY

src/auth.ts:87 · read

SUPABASE_URL

api/acp.ts:51 · read

SUPABASE_URL

api/acp.ts:59 · read

SUPABASE_URL

api/mcp.ts:272 · read

SUPABASE_URL

api/mcp.ts:280 · read

SUPABASE_URL

api/stripe-webhook.ts:43 · read

SUPABASE_URL

src/auth.ts:87 · read

GitHub repositories 8

hemmabo-se/hemmabo-mcp-server

.plugin/plugin.json:14 · url

hemmabo-se/hemmabo-mcp-server

api/oauth-authorization-server.ts:83 · url

hemmabo-se/hemmabo-mcp-server

api/oauth-protected-resource.ts:56 · url

hemmabo-se/hemmabo-mcp-server

glama.json:12 · url

hemmabo-se/hemmabo-mcp-server

package.json:53 · url

hemmabo-se/hemmabo-mcp-server

project.faf:8 · url

hemmabo-se/hemmabo-mcp-server

server.json:16 · url

hemmabo-se/hemmabo-mcp-server

smithery.yaml:28 · url

Network calls 17

{…}

lib/tools-base.ts:656 · call

{…}

lib/vrp.ts:194 · via:fetchJson

api/acp.ts:525 · via:readPaymentIntentOutcome

api/acp.ts:920 · via:readPaymentIntentOutcome

lib/ap2.ts:283 · call

lib/fx-display.ts:137 · call

lib/vrp.ts:165 · call

lib/vrp.ts:229 · via:fetchJson

lib/vrp.ts:916 · via:fetchJson

api.stripe.com

api/acp.ts:264 · call

api.stripe.com

api/acp.ts:702 · call

api.stripe.com

api/acp.ts:957 · call

api.stripe.com

src/stripe.ts:236 · call

api.stripe.com

src/stripe.ts:260 · call

api.stripe.com

src/stripe.ts:299 · call

api.stripe.com

src/stripe.ts:350 · call

www.hemmabo.com

api/acp.ts:197 · url_literal

Packages 5

npm:@modelcontextprotocol/sdk

package.json · delegated

npm:@supabase/supabase-js

package.json · delegated

npm:ajv

package.json · delegated

npm:ajv-formats

package.json · delegated

npm:zod

package.json · delegated

URLs 274

http://127.0.0.1

api/oauth-register.ts:67

http://json-schema.org/draft-07/schema#

lib/vrp-receipt.ts:40

http://www.w3.org/2000/svg

icon.svg:1

https://

lib/tool-definitions.ts:22

https://

lib/tool-definitions.ts:31

https://$

api/acp.ts:197

https://$

api/acp.ts:865

https://$

api/acp.ts:1026

https://$

api/oauth-authorize.ts:75

https://$

lib/tools-base.ts:652

https://$

lib/tools-base.ts:877

https://$

https://$

https://$

https://$

https://api.frankfurter.app/latest?from=$

lib/fx-core.ts:101

https://api.stripe.com/v1/checkout/sessions

src/stripe.ts:236

https://api.stripe.com/v1/payment_intents

api/acp.ts:702

https://api.stripe.com/v1/payment_intents

src/stripe.ts:350

https://api.stripe.com/v1/payment_intents/$

api/acp.ts:265

https://api.stripe.com/v1/payment_intents/$

api/acp.ts:958

https://api.stripe.com/v1/payment_intents/$

src/stripe.ts:260

https://api.stripe.com/v1/refunds

src/stripe.ts:299

https://claude.ai/api/mcp/auth_callback

api/oauth-register.ts:13

https://claude.com/docs/connectors/building/mcp-apps/cross-compatibility

lib/apps-widget.ts:23

https://datatracker.ietf.org/doc/html/rfc7636

lib/pkce.ts:11

https://datatracker.ietf.org/doc/html/rfc8414

api/oauth-authorization-server.ts:9

https://datatracker.ietf.org/doc/html/rfc9728

api/oauth-protected-resource.ts:9

https://developers.openai.com/apps-sdk/schemas/chatgpt-app-submission.v1.json

submission/chatgpt-app-submission.json:2

https://docs.stripe.com/agentic-commerce/protocol/specification

api/acp.ts:3

https://docs.stripe.com/api/shared-payment/granted-token?api-version=2026-07-08.preview

src/stripe.ts:21

https://github.com/HemmaBo-se/hemmabo-mcp-server

.plugin/plugin.json:14

https://github.com/HemmaBo-se/hemmabo-mcp-server

api/oauth-authorization-server.ts:83

https://github.com/HemmaBo-se/hemmabo-mcp-server

api/oauth-protected-resource.ts:56

https://github.com/HemmaBo-se/hemmabo-mcp-server

glama.json:12

https://github.com/HemmaBo-se/hemmabo-mcp-server

project.faf:8

https://github.com/HemmaBo-se/hemmabo-mcp-server

server.json:16

https://github.com/HemmaBo-se/hemmabo-mcp-server

smithery.yaml:28

https://github.com/HemmaBo-se/hemmabo-mcp-server.git

package.json:53

https://github.com/sponsors/colinhacks

package-lock.json:1852

https://github.com/sponsors/epoberezkin

package-lock.json:651

https://github.com/sponsors/express-rate-limit

package-lock.json:1036

https://github.com/sponsors/fastify

package-lock.json:1055

https://github.com/sponsors/ljharb

package-lock.json:743

https://github.com/sponsors/ljharb

package-lock.json:1124

https://github.com/sponsors/ljharb

package-lock.json:1148

https://github.com/sponsors/ljharb

package-lock.json:1173

https://github.com/sponsors/ljharb

package-lock.json:1185

https://github.com/sponsors/ljharb

package-lock.json:1399

https://github.com/sponsors/ljharb

package-lock.json:1490

https://github.com/sponsors/ljharb

package-lock.json:1636

https://github.com/sponsors/ljharb

package-lock.json:1652

https://github.com/sponsors/ljharb

package-lock.json:1670

https://github.com/sponsors/ljharb

package-lock.json:1689

https://github.com/sponsors/panva

package-lock.json:1296

https://github.com/sponsors/sindresorhus

package-lock.json:1338

https://glama.ai/mcp/schemas/connector.json

glama-connector.json:2

https://glama.ai/mcp/schemas/server.json

glama.json:2

https://glama.ai/mcp/servers/HemmaBo-se/hemmabo-mcp-server

api/mcp-manifest.ts:150

https://glama.ai/mcp/servers/HemmaBo-se/hemmabo-mcp-server

project.faf:48

https://hemmabo-mcp-server.vercel.app

lib/base-url.ts:16

https://hemmabo-mcp-server.vercel.app

lib/base-url.ts:30

https://hemmabo-mcp-server.vercel.app/health

project.faf:39

https://hemmabo.com

lib/apps-widget.ts:84

https://inspector.example

.env.example:27

https://inspector.example

.env.example:30

https://modelcontextprotocol.io/specification/2025-11-25/basic/transports

lib/mcp-transport.ts:11

https://open-plugins.com/schema/plugin.json

.plugin/plugin.json:2