win.price/pricewin

Est-ce que win.price/pricewin est sûr ?

Au dernier audit MCP Hub, le serveur MCP « win.price/pricewin » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 12 outils

• cancel_booking≈ 380 tokens

  Second of two steps to cancel a booking: cancels it and starts any refund due. Irreversible. Requires the confirmation code and the single-use token that request_cancel_token emailed to the guest; a missing, expired or already-used token is rejected. get_cancellation_policy shows the refund terms that apply.

  Paramètres, retour & exemple (3)

  Paramètres

  • reason · string · requis
    Guest-provided cancellation reason (at least 3 characters)
  • cancelToken · string · requis
    Single-use cancellation token from the email request_cancel_token sent to the guest.
  • confirmationCode · string · requis
    8-char booking confirmation code, e.g. K7X9M2P4

  Exemple d'appel

  {"name": "cancel_booking", "arguments": {"reason": "texte", "cancelToken": "texte", "confirmationCode": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"status": "texte", "refundAmount": 1, "refundStatus": "texte", "gatewaySettlementEta": "texte"}}

• check_booking_status≈ 406 tokens

  Returns the current status of a booking request (waiting for the hotel, confirmed or cancelled) by the confirmation code request_booking returned.

  Paramètres, retour & exemple (2)

  Paramètres

  • language · string · optionnel · en | vi
    Response language
  • confirmationCode · string · requis
    confirmationCode from request_booking structuredContent (e.g. 'K7X9M2P4')

  Exemple d'appel

  {"name": "check_booking_status", "arguments": {"confirmationCode": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"paidAt": "texte", "status": "texte", "checkIn": "texte", "checkOut": "texte", "bookingId": "texte", "guestName": "texte", "guestEmail": "texte", "roomNumber": "texte", "propertyName": "texte", "paymentMethod": "texte", "paymentStatus": "texte", "paymentLinkUrl": "texte"}}

• get_cancellation_policy≈ 485 tokens

  Returns the cancellation terms for one rate plan at an OpenTravel partner hotel: whether it is refundable, the free-cancellation window, the refund percentage, a plain-language summary and, given the check-in date, the exact free-cancellation deadline. Takes the propertyId and the ratePlanId from get_hotel_detail.

  Paramètres, retour & exemple (5)

  Paramètres

  • language · string · optionnel · en | vi
    Reply language. Falls back to queryText, then English.
  • queryText · string · optionnel
    Short excerpt of the guest's request, used only to pick the reply language.
  • propertyId · string · requis
    OpenTravel propertyId UUID from search results
  • ratePlanId · string · requis
    ratePlanId from get_hotel_detail roomTypes[].ratePlanId
  • checkInDate · string · requis
    Check-in date YYYY-MM-DD — required to compute the exact free-cancel deadline

  Exemple d'appel

  {"name": "get_cancellation_policy", "arguments": {"propertyId": "texte", "ratePlanId": "texte", "checkInDate": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"policyText": "texte", "ratePlanId": "texte", "nonRefundable": true, "computedDeadline": "texte", "freeCancelUntilHours": 1, "refundPercentAfterWindow": 1}}

• get_hotel_detail≈ 1050 tokens

  Prices and availability for one OpenTravel direct-listed hotel over a date range, with its photos, amenities and room types, each room with its rate plan and total price. Takes the propertyId from search results (source 'OPENTRAVEL_DIRECT'), or a hotel name plus city for a known direct listing. get_hotel_info returns the same hotel's static facts without dates.

  Paramètres, retour & exemple (9)

  Paramètres

  • city · string · optionnel
    City of the hotel — required when resolving by hotelName.
  • adults · integer · optionnel
    Number of adults (default 2)
  • checkIn · string · requis
    Check-in date YYYY-MM-DD. Must be today or later.
  • checkOut · string · requis
    Check-out date YYYY-MM-DD. Must be after checkIn.
  • children · integer · optionnel
    Number of children (default 0)
  • language · string · optionnel · en | vi | de | ja | ko | zh | fr | es
    Preferred UI language (en/vi/de/ja/ko/zh/fr/es/ru/th/id).
  • hotelName · string · optionnel
    Fallback name for a confirmed OpenTravel direct listing when propertyId is unavailable
  • queryText · string · optionnel
    Optional short excerpt of the current request, used only to detect the UI language; it is not stored or forwarded.
  • propertyId · string · optionnel
    OpenTravel propertyId UUID from search results (opentravelResults[].propertyId).

  Exemple d'appel

  {"name": "get_hotel_detail", "arguments": {"checkIn": "texte", "checkOut": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"adults": 1, "nights": 1, "checkIn": "texte", "checkOut": "texte", "language": "en", "property": {}, "discovery": true, "roomTypes": [], "bookingUrl": "texte"}}

• get_hotel_info≈ 767 tokens

  Static facts about an OpenTravel direct-listed hotel, with no check-in or check-out date required: photo gallery, property description, address, facilities (parking, pool, pets and so on), check-in and check-out times, the house cancellation policy, and each room type's description, floor area, capacity, photos and in-room facilities. Carries no prices and no availability — get_hotel_detail covers those for a specific date range. Takes the propertyId UUID from search results.

  Paramètres, retour & exemple (3)

  Paramètres

  • language · string · optionnel · en | vi | de | ja | ko | zh | fr | es
    Preferred reply language (en/vi/de/ja/ko/zh).
  • queryText · string · optionnel
    Optional short excerpt of the current request, used only to detect the reply language; it is not stored or forwarded.
  • propertyId · string · requis
    OpenTravel propertyId UUID from search results (opentravelResults[].propertyId).

  Exemple d'appel

  {"name": "get_hotel_info", "arguments": {"propertyId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"property": {}, "roomTypes": [], "cancellationPolicy": {}}}

• get_ota_hotel_detail≈ 604 tokens

  Full detail (rooms, live prices, facilities, photos, reviews) from Booking.com for one named hotel over a date range, for requests about a single hotel rather than a whole city (search_hotels_live lists a city). The name is resolved through the city's listings, so it takes the hotel name together with its city; a Booking.com URL from an earlier result skips that lookup. OpenTravel direct listings are covered by get_hotel_detail. The fetch is live and takes up to about two minutes; under heavy load it can return not-found.

  Paramètres, retour & exemple (9)

  Paramètres

  • city · string · optionnel
    City of the hotel, used to resolve the name, e.g. 'Da Nang'. Required with hotelName.
  • rooms · integer · optionnel
    Number of rooms (default 1)
  • adults · integer · optionnel
    Number of adults (default 2)
  • checkIn · string · requis
    Check-in date YYYY-MM-DD. Must be today or later.
  • checkOut · string · requis
    Check-out date YYYY-MM-DD. Must be after checkIn.
  • language · string · optionnel · en | vi | de | ja | ko | zh | fr | es
    Optional UI language. Indonesian (id) cannot be detected from text, so for Indonesian this is how the language is set.
  • hotelName · string · optionnel
    Name of the hotel, e.g. 'Mercure Danang French Village Bana Hills'. Required unless propertyUrl is given.
  • queryText · string · optionnel
    Short excerpt (one sentence at most) of the guest's latest message in their own words, used only to detect the reply language; it is not stored or forwarded. It carries no names, contact details or other parts of the conversation.
  • propertyUrl · string · optionnel
    Booking.com property URL from an earlier result (hotel.prices.booking.url); skips the name lookup.

  Exemple d'appel

  {"name": "get_ota_hotel_detail", "arguments": {"checkIn": "texte", "checkOut": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• poll_flight_results≈ 837 tokens

  Returns the current results of a flight search session started by search_flights_live: outbound and return options with airline, flight number, times, stops, fare and booking link. Results can be partial while the search runs; status reads 'completed' or 'failed' when it ends.

  Paramètres, retour & exemple (1)

  Paramètres

  • sessionId · string · requis
    Session ID from search_flights_live

  Exemple d'appel

  {"name": "poll_flight_results", "arguments": {"sessionId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"cabin": "texte", "adults": 1, "cached": true, "origin": "texte", "status": "texte", "language": "en", "tripType": "texte", "sessionId": "texte", "returnDate": "texte", "destination": "texte", "totalReturn": 1, "departureDate": "texte"}}

• poll_search_results≈ 1412 tokens

  Returns the current results of a hotel search session started by search_hotels_live: hotels with their price from each source, and OpenTravel direct listings with the propertyId that get_hotel_detail and get_hotel_info take. Results can be partial while the search runs; status reads 'completed' once every source has answered.

  Paramètres, retour & exemple (9)

  Paramètres

  • area · string · optionnel
    Optional override for the area filter captured at search time
  • limit · integer · optionnel
    Max hotels to return; 0 = all (default 50)
  • nights · integer · requis
    Number of nights
  • offset · integer · optionnel
    Skip first N hotels for pagination (default 0)
  • priceMax · number · optionnel
    Optional override for the maximum-price filter
  • priceMin · number · optionnel
    Optional override for the minimum-price filter
  • hotelName · string · optionnel
    Optional override for the hotel-name filter captured at search time
  • sessionId · string · requis
    Session ID from search_hotels_live
  • priceCurrency · string · optionnel
    ISO 4217 code of priceMin/priceMax; defaults to the UI language's currency

  Exemple d'appel

  {"name": "poll_search_results", "arguments": {"nights": 1, "sessionId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"city": "texte", "tier": "texte", "limit": 1, "cached": true, "hotels": [], "nights": 1, "offset": 1, "status": "texte", "checkIn": "texte", "fxRates": {}, "hasMore": true, "checkOut": "texte"}}

• request_booking≈ 1055 tokens

  Sends a booking request for a room at an OpenTravel partner hotel. Nothing is charged and no room is held: the hotel confirms the request by email, and the guest pays at the property on arrival. There is no payment step, now or later. Takes the room and rate from get_hotel_detail and the guest's name, phone number and email; when any of these is missing, the result asks for it and, in clients that show widgets, opens a form for it. One request covers several rooms of the same room type (roomCount), with adults and children counted across all of them; each call is a separate request with its own code, so rooms of one type booked call by call reach the hotel as unrelated requests. Returns one confirmation code for the whole request.

  Paramètres, retour & exemple (14)

  Paramètres

  • adults · integer · requis
    Number of adults across ALL rooms of the request — at least one per room
  • checkIn · string · requis
    Check-in date YYYY-MM-DD. Must be today or later.
  • checkOut · string · requis
    Check-out date YYYY-MM-DD. Must be after checkIn.
  • children · integer · optionnel
    Number of children across ALL rooms of the request (default 0)
  • currency · string · requis · VND | USD | EUR
    Currency of totalAmount, as quoted by get_hotel_detail for the chosen room.
  • language · string · optionnel · en | vi | de | ja | ko | zh | fr | es
    Optional response language hint. Only used when queryText gives no signal.
  • guestName · string · optionnel
    Full name of the primary guest. When omitted, the result asks the user for it.
  • queryText · string · optionnel
    Short excerpt (one sentence at most) of the guest's latest message in their own words, used only to detect the reply language; it is not stored or forwarded. It carries no names, contact details or other parts of the conversation.
  • roomCount · integer · optionnel
    How many rooms of this room type the guest wants (default 1). All of them go in this one request, under one confirmation code.
  • guestEmail · string · optionnel
    Email address the confirmation is sent to, as the guest gave it; it cannot be changed after the request is sent. When omitted, the result asks the user for it.
  • guestPhone · string · optionnel
    Guest phone number; the hotel calls it to confirm the request. When omitted, the result asks the user for it.
  • propertyId · string · requis
    OpenTravel propertyId from get_hotel_detail
  • roomTypeId · string · requis
    roomTypeId from get_hotel_detail roomTypes array
  • totalAmount · number · requis
    Total amount for ALL rooms in the property's base currency: the room's price for the stay × roomCount

  Exemple d'appel

  {"name": "request_booking", "arguments": {"adults": 1, "checkIn": "texte", "checkOut": "texte", "currency": "VND", "propertyId": "texte", "roomTypeId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"status": "texte", "nextStep": "texte", "bookingId": "texte", "roomCount": 1, "quotedAmount": 1, "assignedRoomId": "texte", "quotedCurrency": "texte", "paymentRequired": true, "confirmationCode": "texte"}}

• request_cancel_token≈ 315 tokens

  First of two steps to cancel a booking. Emails a single-use cancellation token to the address on the booking, given its confirmation code and that same email address. Nothing is cancelled, charged or refunded by this step. The token expires after 24 hours and works once; cancel_booking completes the cancellation with it.

  Paramètres, retour & exemple (2)

  Paramètres

  • guestEmail · string · requis
    Guest email address — must match the booking primary guest email
  • confirmationCode · string · requis
    8-char booking confirmation code, e.g. K7X9M2P4

  Exemple d'appel

  {"name": "request_cancel_token", "arguments": {"guestEmail": "texte", "confirmationCode": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"message": "texte", "success": true}}

• search_flights_live≈ 1160 tokens

  Starts a live one-way flight search for a route and date. Fares come from Agoda and Google Flights. Origin and destination are 3-letter IATA airport codes (for example SGN, HAN, DAD). Returns a session ID; poll_flight_results returns the results. When the route or date is missing, the result is a question for the user instead of a search.

  Paramètres, retour & exemple (8)

  Paramètres

  • cabin · string · optionnel · economy | premium_economy | business | first
    Cabin class (default economy)
  • adults · integer · optionnel
    Number of adults (default 1)
  • origin · string · optionnel
    Departure airport IATA code, e.g. 'SGN'. When omitted, the result asks the user for it.
  • language · string · optionnel · en | vi | de | ja | ko | zh | fr | es
    Preferred UI language (en/vi/de/ja/ko/zh/fr/es/ru/th/id).
  • queryText · string · optionnel
    Optional short excerpt of the current request, used only to detect the UI language; it is not stored or forwarded.
  • returnDate · string · optionnel
    Return date YYYY-MM-DD. Return flights are not searched at the moment: the result lists outbound flights only.
  • destination · string · optionnel
    Arrival airport IATA code, e.g. 'HAN'. When omitted, the result asks the user for it.
  • departureDate · string · optionnel
    Departure date YYYY-MM-DD, today or later. When omitted, the result asks the user for it.

  Exemple d'appel

  {"name": "search_flights_live", "arguments": {"cabin": "economy", "adults": 1, "origin": "texte", "language": "en", "queryText": "texte", "returnDate": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"cabin": "texte", "adults": 1, "cached": true, "origin": "texte", "status": "texte", "language": "en", "tripType": "texte", "sessionId": "texte", "returnDate": "texte", "destination": "texte", "totalReturn": 1, "departureDate": "texte"}}

• search_hotels_live≈ 1718 tokens

  Starts a live hotel search for a city and date range. Prices come from Agoda, Booking.com, Traveloka, Trip.com, Hotels.com and Airbnb, plus direct rates from OpenTravel partner hotels. Returns a session ID; poll_search_results returns the results as they arrive. Optional filters narrow the results by hotel name, area or total price for the stay. Prices depend on the party: it defaults to 2 adults in 1 room, and the result states the party searched and flags when it was defaulted. When the city or dates are missing, the result is a question for the user instead of a search; the stay dates searched are echoed back for confirmation.

  Paramètres, retour & exemple (13)

  Paramètres

  • area · string · optionnel
    Optional district, ward, or neighborhood filter within the city
  • city · string · optionnel
    City or broad destination, e.g. 'Da Nang'. When omitted, the result asks the user for it.
  • rooms · integer · optionnel
    Number of rooms (default 1).
  • adults · integer · optionnel
    Number of adults (default 2). Prices depend on it.
  • checkIn · string · optionnel
    Check-in date (YYYY-MM-DD), today or later. When omitted, the result asks the user for it.
  • checkOut · string · optionnel
    Check-out date (YYYY-MM-DD), after checkIn. When omitted, the result asks the user for it.
  • children · integer · optionnel
    Number of children sharing the room (default 0). OTA prices cannot include children; the result says so when children are given.
  • language · string · optionnel · en | vi | de | ja | ko | zh | fr | es
    Preferred UI language (en/vi/de/ja/ko/zh/fr/es/ru/th/id).
  • priceMax · number · optionnel
    Maximum total price for the whole stay (not per night), in priceCurrency.
  • priceMin · number · optionnel
    Minimum total price for the whole stay (not per night), in priceCurrency.
  • hotelName · string · optionnel
    Optional hotel-name filter when the user names a specific property
  • queryText · string · optionnel
    Optional short excerpt of the current request, used only to detect the UI language; it is not stored or forwarded.
  • priceCurrency · string · optionnel
    ISO 4217 code of priceMin/priceMax (USD, EUR, VND, …); defaults to the currency of the UI language.

  Exemple d'appel

  {"name": "search_hotels_live", "arguments": {"area": "texte", "city": "texte", "rooms": 1, "adults": 1, "checkIn": "texte", "checkOut": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"city": "texte", "tier": "texte", "limit": 1, "cached": true, "hotels": [], "nights": 1, "offset": 1, "status": "texte", "checkIn": "texte", "fxRates": {}, "hasMore": true, "checkOut": "texte"}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://mcp.price.win/mcp