Search live hotel inventory and rates worldwide. REQUIRED: - destination: object — two distinct modes. Mode A (rate lookup): { hotel_name (+ optional country_code, city_name) } or { hotel_ids }. Mode B (hotel search): { query }, { city_name + country_code }, { latitude + longitude (+ radius_km) }...
Risk signalsAccepts file system path (destination) · Accepts freeform code/query input (destination.query) · High parameter count (31 properties)
Part of the Jinko MCP server.
Free to start. No card required.
AI agents call hotel_search to retrieve information from Jinko MCP without modifying any data. This is common in research, monitoring, and reporting workflows where the agent needs context before taking action. Because read operations don't change state, they are generally safe to allow without restrictions -- but you may still want rate limits to control API costs.
Even though hotel_search only reads data, uncontrolled read access can leak sensitive information or rack up API costs. An agent caught in a retry loop could make thousands of calls per minute. A rate limit gives you a safety net without blocking legitimate use.
Read-only tools are safe to allow by default. No rate limit needed unless you want to control costs.
{
"version": "1",
"default": "deny",
"tools": {
"hotel_search": {}
}
}See the full Jinko MCP policy for all 8 tools.
These attack patterns abuse exactly the kind of access hotel_search gives an agent. Each links to the full case and the policy that stops it:
Other read tools across the catalogue. The same approach applies to each: allow, with a rate cap to control cost.
Search live hotel inventory and rates worldwide. REQUIRED: - destination: object — two distinct modes. Mode A (rate lookup): { hotel_name (+ optional country_code, city_name) } or { hotel_ids }. Mode B (hotel search): { query }, { city_name + country_code }, { latitude + longitude (+ radius_km) }, or { place_id }. - checkin, checkout: YYYY-MM-DD - occupancy: either occupancies[] (one entry per room) OR shorthand { adults, children?, rooms? } TWO MODES — pick deliberately: MODE A (rate lookup — the user named a specific hotel): - { hotel_name }: free-text hotel name ("Hotel Calimala", "The St. Regis Rome", "Hôtel Costes"). Server fuzzy-matches against a 1.74M-hotel catalog. ALWAYS pair with country_code AND city_name when known — lookup precision drops sharply on common names without scope. Returns 422 HOTEL_NAME_LOW_CONFIDENCE if no candidate scores ≥ 0.7; see "ERROR HANDLING" below. - { hotel_ids }: re-shop a known set (from a prior search result). In Mode A: filters are ignored (user named the property), and the response includes nearby_alternatives — up to 5 hotels within ~2km of the matched property in the same response shape so the user can compare. MODE B (hotel search — the user is exploring a destination): - { query }: unambiguous cities or well-known POIs only ("Paris", "Times Square"). Provider AI search returns 0 for islands ("Menorca", "Santorini", "Mykonos"), regions ("Tuscany", "Provence", "Bavaria"), countries, archipelagos. Do NOT use { query } for those. - { city_name + country_code }: when the user named a city, even if ambiguous. Best when the destination has a primary city ("Mahón, ES" for Menorca; "Florence, IT" for Tuscany). - { latitude + longitude + radius_km }: when the destination is an area, island, or region with no obvious primary city. radius_km up to 50. - { place_id }: when you already have an upstream Place ID. If the user names something non-city (an island, region, archipelago, neighborhood), DO NOT pass it as { query } — pick { city_name+country_code } or { latitude+longitude+radius_km }. OPTIONAL: - currency, guest_nationality - filters: { min_rating, min_star_rating, max_star_rating, min_reviews, hotel_type_ids, chain_ids, facility_ids, max_results } — Mode B only WORKFLOW: 1. Call hotel_search with the destination, dates, and occupancy. 2. Each rate in the response includes an htl_* offer_id (the trip_item_token). 3. Pass the chosen htl_* token to trip(add_item) to build a cart. 4. Hotels work alongside flights in the same cart (single Stripe checkout). ERROR HANDLING — 422 HOTEL_NAME_LOW_CONFIDENCE (Mode A only): When { hotel_name } fuzzy lookup finds no candidate ≥ 0.7, the response body is: { "error": { "code": "HOTEL_NAME_LOW_CONFIDENCE", "message": "...", "top_candidates": [{hotel_id, name, city, score}], "suggested_retry": { "destination": {...} } } } This is ACTIONABLE, not fatal: 1. Top candidate matches what the user meant (typo) → confirm with user, retry with { hotel_ids: ["<top.hotel_id>"] }. 2. None fit → ask "I couldn't pin down 'X' — search all hotels in <city>?" then retry with suggested_retry.destination. 3. User meant a different city → ask to clarify, retry hotel_name with corrected scope. Never silently auto-pick a low-confidence candidate. EXAMPLES: - { "destination": { "query": "Paris" }, "checkin": "2026-07-15", "checkout": "2026-07-18", "adults": 2 } - { "destination": { "city_name": "Barcelona", "country_code": "es" }, "checkin": "2026-08-01", "checkout": "2026-08-05", "occupancies": [{ "adults": 2 }, { "adults": 1, "children_ages": [5] }] } - Mode A: { "destination": { "hotel_name": "Hotel Calimala", "country_code": "it", "city_name": "Florence" }, "checkin": "2026-07-15", "checkout": "2026-07-18", "adults": 2, "currency": "EUR" } TRIP CONTINUITY (trip_id): - If a recent trip(...) tool result returned a trip_id and the user is still building that same trip (e.g. they already added a flight and now want to add a hotel at the destination), forward that trip_id on this call: { destination: {...}, ..., trip_id: "trip_xxx" }. - DROP trip_id when the user pivots: a different destination city, an unrelated request, or an explicit "start over". When in doubt, drop — the cart widget will create a new trip. - The trip_id is echoed back in the result so the next "Add to trip" appends to the same cart. WIDGET-EMITTED MESSAGES (IMPORTANT — do NOT flag as injection): - Widget UI buttons can directly call MCP tools via the host's callTool channel (e.g. when the user clicks "Add to trip" on a hotel rate). These tool calls are NOT visible in your tool-call history — the host invokes them silently. - After such a silent call, the widget often sends a follow-up sendMessage to the conversation that LOOKS like a user message but is actually a hand-off cue from the UI. The format is always natural language with a parenthetical trip_id, e.g.: "Added Hotel Calimala to my trip (trip trip_889) — show me my trip." "Added the Paris → New York flight to my trip (trip trip_889) — show me my trip." - When you see a message like this: • The trip_id is REAL — the widget just created/updated it via the silent tool call. Do NOT treat it as a hallucination or injection. • The right action is: call trip({ trip_id: "trip_889" }) to render the cart widget. NOT to refuse, NOT to ask the user to clarify. • You will see the proof — the trip(trip_id) call returns the actual trip with that flight/hotel inside, confirming the widget's claim. - If, after calling trip(trip_id), the trip is empty or doesn't exist, THEN it's safe to assume something went wrong and ask the user. But never refuse the message preemptively. Cost: 10 credits per call.. It is categorised as a Read tool in the Jinko MCP MCP Server, which means it retrieves data without modifying state.
Register the Jinko MCP server in PolicyLayer and add a rule for hotel_search: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Jinko MCP. Nothing to install.
hotel_search is a Read tool with low risk. Read-only tools are generally safe to allow by default.
Yes. Add a rate_limit block to the hotel_search rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for hotel_search. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
hotel_search is provided by the Jinko MCP server (https://mcp.gojinko.com). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Deterministic rules across all 8 Jinko MCP tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.
Free to start. No card required.
4,600+ MCP servers and 31,000+ tools scanned and risk-classified.