hostaway-kit MCP server

by stylabs·io.github.stylabs/hostaway-kit·v1.0.2

No reviews yet

Read-only Hostaway MCP: listings, calendar, inbox, reports. Fixtures, no key. By STYLABS.

A85/100grade A

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

A85/100

full report

Adoption

Growing

0 stars57 downloads/wk

Reviews

Write one

Nobody has reviewed hostaway-kit yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

hostaway-kit tools (11)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

draft_reply
Suggested reply grounded in THAT listing's fields, house rules, amenityId values, and calendar prices. Never invent rates (use calendar or say unknown). Never include wifi or door codes. Never POSTs a message — send is always false and there is no send endpoint.
get_calendar
Retrieve listing calendar via GET /v1/listings/{id}/calendar?includeResources=1. Each day has status (available/blocked/reserved/pending), isAvailable, and price (null means unknown — do not invent a rate). Nested reservations are denylist-stripped.
get_listing
Retrieve one listing via GET /v1/listings/{id}?includeResources=1. House rules, check-in hours (0–23), amenityId values, and photos are included. wifiPassword, door codes, and invoicing contacts are stripped.
inbox_triage
Unanswered / SLA view Hostaway's inbox does not compute. A thread is unanswered when the latest message is incoming (or hasUnreadMessages with no later host reply). Default SLA is 2 hours. Does not send replies.
list_conversations
List inbox threads via GET /v1/conversations?includeResources=1. Nested Reservation objects are denylist-stripped.
list_listings
List Hostaway listings. Defaults to GET /v1/listings?specialStatus[]=active. Optional availabilityDateStart/End + availabilityGuestNumber filter the list the same way Hostaway does. Amenities are amenityId values, not free-text names. Check-in/out hours are 0–23. Denylisted access and invoicing fields are stripped.
list_messages
List messages in a thread via GET /v1/conversations/{id}/messages. Read-only. There is no send tool.
list_reservations
List reservations via GET /v1/reservations. Read-only. doorCode / doorCodeVendor / doorCodeInstruction are stripped. Create reservation is not implemented.
report_completeness
Listing completeness from reads: missing photos, missing house rules, missing amenities (empty listingAmenities). Not a financial report.
report_inbox
Unanswered thread counts by listing, computed from conversation reads. Not a Hostaway owner statement.
report_occupancy
Occupancy and blocked holes computed from calendar reads. Occupancy = reserved nights / (reserved + available). Blocked holes are consecutive blocked/hardBlock days. Not an owner statement. No financials.

Public scan report

scanner v0.1.10 · 2026-10-29 · same rubric, same numbers if you re-run it

no findings

Code scan21 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitystatic API keys via environment variables6/15
Maintenancelast push 18 days ago15/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10

Overall 85/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How hostaway-kit compares

Against every graded Email MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 85/100; higher than 78% of 916 Email servers
Tools: 11; the typical Email server has 7
Tools that change things: 0%; typical: 25%. Fewer write tools means less an agent can break
Downloads a week: 57; more than 40% of 235 Email servers with a package

What its tools let an agent do: 11 read

Release history: 2 versions in the registry since 2026-08-31, latest 2026-10-12, typically one every 42 days.

Install hostaway-kit in Claude Code, Cursor or VS Code

Runs npx -y hostaway-kit on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add hostaway-kit -- npx -y hostaway-kit

Add to Cursor

What the publisher says

From the hostaway-kit repository's README, as published. We do not edit it. Read it on GitHub

hostaway-kit

Read-only MCP server plus Cursor / Claude Code / Codex skills for operators who already run Hostaway as their PMS.

Ask an assistant about listings, calendar, inbox, and simple reports. Hostaway stays the system of record. This kit never writes — no messages, no calendar blocks, no reservations.

Shipped by STYLABS, an AI-native venture studio that builds custom Hostaway booking sites and operator dashboards. STYLABS is not an official Hostaway partner.

What you get

Read-only MCP (stdio) — listlistings, getlisting, getcalendar, listreservations, listconversations, listmessages, plus inbox triage, draft reply, and reports.
Denylist on every listing / reservation / message payload: wifiPassword, wifiUsername, doorSecurityCode, doorCode, doorCodeVendor, doorCodeInstruction, and all invoicing* contact fields.
Inbox intelligence Hostaway does not compute — unanswered / SLA triage and a suggested reply grounded in that listing's fields, house rules, and calendar. Rates come from the calendar or are reported as unknown. Nothing is sent.
Reports Hostaway does not ship as owner statements — occupancy and blocked holes from the calendar, unanswered thread counts, listing completeness (photos / house rules / amenities). No financials.
Skills in this repo (not on npm) that tell the model to use the MCP tools and never invent numbers.

Mapped to the Hostaway Public API:

If HOSTAWAYACCOUNTID or HOSTAWAYCLIENTSECRET is unset, the server serves bundled fixtures so npx still demos.

Install / run

npx -y hostaway-kit

Or from this repo:

npm install
npm run build
node dist/index.js

stdio only. Logs go to stderr. Credentials are optional.

Environment

Get an API client secret from the Hostaway dashboard. This kit does not ship or use a Hostaway account.

Cursor

Add to ~/.cursor/mcp.json (or project .cursor/mcp.json):

{
  "mcpServers": {
    "hostaway": {
      "command": "npx",
      "args": ["-y", "hostaway-kit"],
      "env": {
        "HOSTAWAY_ACCOUNT_ID": "your-account-id",
        "HOSTAWAY_CLIENT_SECRET": "your-client-secret"
      }
    }
  }
}

Leave both env values empty, or omit env, to run the fixture demo.

Copy the skills from this repo into Cursor:

cp -R skills/* ~/.cursor/skills/

Claude Code

Add to ~/.claude.json (or project .mcp.json):

{
  "mcpServers": {
    "hostaway": {
      "command": "npx",
      "args": ["-y", "hostaway-kit"],
      "env": {
        "HOSTAWAY_ACCOUNT_ID": "your-account-id",
        "HOSTAWAY_CLIENT_SECRET": "your-client-secret"
      }
    }
  }
}

Skills:

mkdir -p .claude/skills
cp -R skills/* .claude/skills/

Codex

~/.codex/config.toml:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

hostaway-kit: common questions

Is hostaway-kit MCP server safe?: Yes, by our scan: it is graded A (85/100). Read the hostaway-kit safety report
How do I install hostaway-kit?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does hostaway-kit need an API key?: Yes. The registry entry asks for HOSTAWAY_CLIENT_SECRET.
Is hostaway-kit maintained?: The last commit was 24 days ago (2026-10-12). The latest release is v1.0.2.
What can I use instead of hostaway-kit?: Servers from other publishers that do the same job: Mailoo - Email MCP Server, Workspace MCP server and Inbox Zero MCP server.
How does hostaway-kit compare with other Email MCP servers?: safety score 85/100 (higher than 78% of 916 Email servers); tools 11 (the typical Email server has 7); tools that change things 0% (typical: 25%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to hostaway-kit

Same job from other publishers: the closest match first, then the best rated.

Mailoo - Email MCP Server
Email MCP server for AI agents: IMAP/SMTP, Gmail, Outlook, calendar, ManageSieve, AI triage, OAuth2.
5.0(1)
Growing
A
Workspace
Google Workspace MCP server for Gmail, Drive, Calendar, Docs, Sheets, Slides, Forms, Tasks, Chat.
not reviewed
Widely used
A
Inbox Zero
Search Gmail and Outlook, save drafts, manage email rules, and view email stats.
not reviewed
Established
A
Atomic Mail
Programmable email inbox for AI agents — JMAP, PoW auth, stdio MCP server.
not reviewed
Established
A
LMCP
Mac & Windows: let ChatGPT, Claude & Cursor use your email, calendar, iMessage, Teams, files.
not reviewed
Established
B

Run it through the gateway

Local package. It runs on your machine, not through the gateway.

Rating: —
Safety grade: A · 85/100
Stars: 0
Downloads/wk: 57
Price: Free
Licence: MIT
Transport: Local · npm
Version: 1.0.2
Category: Email
Last release: 2026-10-12

Credentials it needs

HOSTAWAY_ACCOUNT_IDHostaway account id. Optional: omit both credentials to run fixtures.
HOSTAWAY_CLIENT_SECRETsecretHostaway API client secret. Optional: omit both credentials to run fixtures.

Own this server?

Claim it to keep the listing current and reply to reviews. Claiming never changes the grade or hides a review.

Claim listing

Badge for your README

Shows the safety grade and links back to this page. It updates itself after every scan and review.

[![mcp.market](https://mcp.market/badge/stylabs-hostaway-kit.svg)](https://mcp.market/server/stylabs-hostaway-kit)

How the badge works