Read-only Hostaway MCP: listings, calendar, inbox, reports. Fixtures, no key. By STYLABS.
Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
HOSTAWAY_CLIENT_SECRETOAuth appoptionalHostaway API client secret. Optional: omit both credentials to run fixtures.
Declared by the author in the official MCP registry. Forge does not store, broker, or ever see these values — the config below is scaffolded with placeholders you fill in locally.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
list_listingsList Hostaway listings. Defaults to GET /v1/listings?specialStatus[]=active. Optional availabilityDateStart/End + availabilityGuestNumber filter the list the same way Hostaway does. Amenities are amenityId values, not free-text names. Check-in/out hours are 0–23. Denylisted access and invoicing fie…List Hostaway listings. Defaults to GET /v1/listings?specialStatus[]=active. Optional availabilityDateStart/End + availabilityGuestNumber filter the list the same way Hostaway does. Amenities are amenityId values, not free-text names. Check-in/out hours are 0–23. Denylisted access and invoicing fie…
No input schema was published for this tool.
get_listingRetrieve one listing via GET /v1/listings/{id}?includeResources=1. House rules, check-in hours (0–23), amenityId values, and photos are included. wifiPassword, door codes, and invoicing contacts are stripped.Retrieve one listing via GET /v1/listings/{id}?includeResources=1. House rules, check-in hours (0–23), amenityId values, and photos are included. wifiPassword, door codes, and invoicing contacts are stripped.
No input schema was published for this tool.
get_calendarRetrieve listing calendar via GET /v1/listings/{id}/calendar?includeResources=1. Each day has status (available/blocked/reserved/pending), isAvailable, and price (null means unknown — do not invent a rate). Nested reservations are denylist-stripped.Retrieve listing calendar via GET /v1/listings/{id}/calendar?includeResources=1. Each day has status (available/blocked/reserved/pending), isAvailable, and price (null means unknown — do not invent a rate). Nested reservations are denylist-stripped.
No input schema was published for this tool.
list_reservationsList reservations via GET /v1/reservations. Read-only. doorCode / doorCodeVendor / doorCodeInstruction are stripped. Create reservation is not implemented.List reservations via GET /v1/reservations. Read-only. doorCode / doorCodeVendor / doorCodeInstruction are stripped. Create reservation is not implemented.
No input schema was published for this tool.
list_conversationsList inbox threads via GET /v1/conversations?includeResources=1. Nested Reservation objects are denylist-stripped.List inbox threads via GET /v1/conversations?includeResources=1. Nested Reservation objects are denylist-stripped.
No input schema was published for this tool.
list_messagesList messages in a thread via GET /v1/conversations/{id}/messages. Read-only. There is no send tool.List messages in a thread via GET /v1/conversations/{id}/messages. Read-only. There is no send tool.
No input schema was published for this tool.
inbox_triageUnanswered / SLA view Hostaway's inbox does not compute. A thread is unanswered when the latest message is incoming (or hasUnreadMessages with no later host reply). Default SLA is 2 hours. Does not send replies.Unanswered / SLA view Hostaway's inbox does not compute. A thread is unanswered when the latest message is incoming (or hasUnreadMessages with no later host reply). Default SLA is 2 hours. Does not send replies.
No input schema was published for this tool.
draft_replySuggested reply grounded in THAT listing's fields, house rules, amenityId values, and calendar prices. Never invent rates (use calendar or say unknown). Never include wifi or door codes. Never POSTs a message — send is always false and there is no send endpoint.Suggested reply grounded in THAT listing's fields, house rules, amenityId values, and calendar prices. Never invent rates (use calendar or say unknown). Never include wifi or door codes. Never POSTs a message — send is always false and there is no send endpoint.
No input schema was published for this tool.
report_occupancyOccupancy and blocked holes computed from calendar reads. Occupancy = reserved nights / (reserved + available). Blocked holes are consecutive blocked/hardBlock days. Not an owner statement. No financials.Occupancy and blocked holes computed from calendar reads. Occupancy = reserved nights / (reserved + available). Blocked holes are consecutive blocked/hardBlock days. Not an owner statement. No financials.
No input schema was published for this tool.
report_inboxUnanswered thread counts by listing, computed from conversation reads. Not a Hostaway owner statement.Unanswered thread counts by listing, computed from conversation reads. Not a Hostaway owner statement.
No input schema was published for this tool.
report_completenessListing completeness from reads: missing photos, missing house rules, missing amenities (empty listingAmenities). Not a financial report.Listing completeness from reads: missing photos, missing house rules, missing amenities (empty listingAmenities). Not a financial report.
No input schema was published for this tool.
11 of 11 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Read-only Hostaway MCP: listings, calendar, inbox, reports. Fixtures, no key. By STYLABS.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
The crawl stopped at the depth-4 limit. Anything below that level was never resolved.
The crawl stopped at the 60-package limit. The rest of the tree was never resolved.
36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)
54 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.
+42 more not listed. The counts by reason above cover all of them.
Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.