"Ghost" matching MCP tools:

• hemmabo_search_availabilityA

  HemmaBo Host Booking EngineA

  Check whether a specific property is available for the requested dates. Use this tool after the user has selected a property from hemmabo_search_properties and wants to confirm availability before getting a quote. Do NOT use for general browsing — use hemmabo_search_properties instead. Read-only, open to anonymous callers (no Bearer token), and rate-limited: checking availability never places a hold or reserves dates. Returns available=true/false with conflict details and same-month alternative date windows when unavailable; a stale inbound calendar sync blocks an available answer (fails closed with calendar_freshness) instead of guessing. Omit guests to check dates only; pass it to price the alternative windows and to gate capacity — counts above the property's maximum return available=false (guests_exceed_max) with no alternatives. Stays shorter than the host's effective minimum nights return available=false with reasonCode min_nights_violation — extend the stay rather than shifting dates. The verdict always matches the host node's own availability API.

  ConnectorNo auth

• hemmabo_booking_statusA

  HemmaBo Host Booking EngineA

  Retrieve current status and full details of an existing booking by reservationId. Use to confirm checkout/create succeeded or before cancel/reschedule. Do NOT use for property discovery, availability, or pricing — use hemmabo_search_properties, hemmabo_search_availability, or hemmabo_booking_quote for those. Requires Authorization: Bearer token (MCP_API_KEY or OAuth); rate-limited per token. Read-only against the database — never writes, so it is safe to poll after a checkout timeout — but returns guest PII (name, email). reservationId is the booking UUID returned by hemmabo_booking_checkout or hemmabo_booking_create — never a propertyId — and guestToken is the secret issued with that same booking: a mismatched pair reveals nothing, not even that the booking exists. Without a reservationId there is no booking to look up yet.

  ConnectorNo auth

• hemmabo_host_onboarding_linkA

  HemmaBo Host Booking EngineA

  Return a safe HemmaBo onboarding handoff URL for a vacation-rental host who wants their own booking website or booking engine. Not for guests — guests should use hemmabo_search_properties instead. Use after explaining the fit or when the host asks to start; if the host is still evaluating whether HemmaBo fits, run hemmabo_host_readiness_check first — it already returns the same prefilled URL in its next_step. This tool is read-only and does not create a HemmaBo account, buy a domain, configure Stripe, write to Supabase, or provision a booking site. It returns the URL, what the host gets, and what the host should prepare. All parameters are optional prefill: they never change where the host lands — the URL always opens the same onboarding page with the passed details filled in; blank values are simply left out, and nothing is stored server-side.

  ConnectorNo auth

• hemmabo_search_propertiesA

  HemmaBo Host Booking EngineA

  Search available vacation rental properties by location and travel dates. Use when the user wants to find or browse places to stay. Discovery only — call get_verified_stay_offer with the host domain and same dates before the final answer so the client can render the verified stay offer widget; never quote a final price or booking link from search alone. Do NOT use when the user already has a propertyId or host domain. Returns propertyId, host domain, live availability, host-source pricing, and capacity. Parameters combine as one filter with guests and the checkIn/checkOut range (checkIn strictly before checkOut): region matches broadly against region, city, and country names, while country matches the country field alone — omit both and the search spans every published property. Capacity misses are excluded; date-unavailable matches return separately in unavailableMatches with up to three alternative windows.

  ConnectorNo auth

• hemmabo_booking_quoteA

  HemmaBo Host Booking EngineA

  Get a detailed pricing quote for a specific property, dates, and guest count. Use this tool after confirming availability to show the user exact pricing before booking. Do NOT use before checking availability — the quote may be invalid if dates are unavailable. Returns the final host-source total for the booking flow, per-night breakdown, and package pricing context. All prices are integers in the property's local currency (e.g. SEK). The quote is the propertyId priced for the exact checkIn/checkOut range and guests; the night count and party size together select the price tier, so changing any of them re-quotes.

  ConnectorNo auth

• hemmabo_booking_createA

  HemmaBo Host Booking EngineA

  Create a pending direct booking without online payment for configured non-VRP fallback deployments. Use only after explicit user confirmation, with a propertyId from search, and only when no signed VRP direct_booking_url is available. For signed VRP offers, route to the signed host-domain URL instead. Requires Authorization: Bearer token (MCP_API_KEY or OAuth); rate-limited per token. Writes exactly one pending booking awaiting the host's decision; availability is checked first — conflicts or a stale calendar fail the call before anything is written. Not idempotent — check hemmabo_booking_status before retrying on timeout. There is no price or quoteId parameter — the node prices the stay itself at creation (gap-night pricing applies automatically). The booking is identified by propertyId + the checkIn/checkOut range + guests; guestName and guestEmail are required for host confirmation, guestPhone is optional. Returns bookingId and a one-time guestToken for later status/cancel/reschedule.

  ConnectorNo auth

• hemmabo_booking_negotiateA

  HemmaBo Host Booking EngineA

  PRICE LOCK, not negotiation: the host's price is fixed — this tool never bargains, discounts, or alters it; it only freezes the current host-source price for 15 minutes so it cannot change during checkout. It refuses to lock dates the property's calendar cannot deliver and returns alternative bookable windows instead. Use it only in the non-VRP fallback checkout flow, when no signed direct_booking_url is available and the user explicitly asks to lock a price. Never use this for search, availability, VRP offers, rendering a stay-offer widget, or verified-offer display — use get_verified_stay_offer instead. Requires Authorization: Bearer token (MCP_API_KEY or OAuth); rate-limited per token. Not idempotent: each call writes a new snapshot; validUntil is fixed at creation and never extended — re-locking returns a new quoteId. The lock freezes both the public and the direct host-source total; hemmabo_booking_checkout's channel picks which one is redeemed. Redeem the quoteId only for the identical propertyId + checkIn/checkOut + guests, and only until validUntil — changing any of them requires a new quote. Night count and guest count together select the locked price tier.

  ConnectorNo auth

• verify_vacation_rental_nodeA

  HemmaBo Host Booking EngineA

  Verify that a vacation-rental host domain is a valid Vacation Rental Protocol (VRP) node before trusting it. Reads the domain's .well-known/vacation-rental.json and JWKS. Read-only trust check: no availability, pricing, booking, or payment — do NOT use it to answer those questions. Use when a host domain arrives from outside search (user-typed or third-party); domains returned by hemmabo_search_properties can go straight to get_verified_stay_offer. On success, call get_verified_stay_offer with the same domain and stay dates. The single input is the host domain as a bare hostname (no scheme or path); public domains only — IPs, ports, and local/private hostnames are refused. Pass the node's canonical domain exactly — www and apex are distinct identities, and verification fails when the domain's declared canonical_domain differs from the one you passed. Verification reads that domain's own .well-known and JWKS, so the result is only as trustworthy as the exact domain you pass.

  ConnectorNo auth

• get_verified_stay_offerA

  HemmaBo Host Booking EngineA

  Fetch, verify, and render a live host-domain signed VRP stay offer for exact dates and guest count. Verifies Ed25519 JWS against domain JWKS. Call after hemmabo_search_properties returns a host domain, or after verify_vacation_rental_node confirms a domain from outside search, always before quoting final price or a booking link. Read-only: must not lock a quote, create a booking, collect guest details, or start checkout. Route booking only to the signed direct_booking_url; fall back to hemmabo_booking_negotiate/hemmabo_booking_checkout only when this call returns no signed offer, for a configured non-VRP deployment, after explicit user confirmation. The parameters work as a set: pass the same domain, checkIn, checkOut and guests the guest used at search; checkIn must be strictly before checkOut, and the resulting night count — not the dates themselves — drives the signed price and the host capacity check, so changing either date re-prices the offer. Always pass language as the guest's actual conversation language so the rendered widget matches the guest; it never affects the signed price or availability, only formatting.

  ConnectorNo auth

• pscale_genusA

  bsp-mcpA

  Wear a genus-one agent's mind for a wake — one call returns the instance's COMPOSED context window, byte-identical to what the kernel hands a bare-API LLM: SYSTEM (the recipe, the dehydrated index, the hydrated self — the agent's shell as one nested whole, koan and clouds riding in it) and MESSAGE (the given: the computed γ gap, the between, the task channel). Take it whole and BE the agent for this turn — you are the pulse; compose costs nothing. Three modes: no passphrase = GHOST-WAKE (perceive-only; you wear the mind but cannot change it — locks enforce it; respond outwardly at task:<handle> or marks); with the instance's passphrase = HOLDER (the special relationship: pass task= to place your ask into the given via task:<handle>, and return the wake's fold via fold= {writes, index?, heartbeat?, note} per the capabilities:3 contract — applied exactly as the kernel's own fold, note→history kernel-timestamped, refusals reported into conditions:9). Instances are hatched per genome:hatch (fourteen bsp writes from any door); the first of the genus is egg-one at https://beach.happyseaurchin.com. Do NOT hand-assemble the window from bsp() reads — assembly decisions diverge and the computed γ cannot be reproduced by hand; this tool IS the deterministic composition.

  Connector

  Destructive

  No auth

• ghostroute_ct_proofsA

  TunnelMind Data APIB

  Returns GhostRoute's per-cert inclusion proofs: each is a cryptographic demonstration that the exact certificate a host serves is included in an append-only CT log whose root TunnelMind signature-verified — upgrading "a monitor said this cert exists" to "proven in a log we witness". Failed attempts are included with a `reason`; a cert that suddenly cannot be proven is itself a signal. Use this tool when: - You want to know whether a specific AI host's live cert is provably logged (pass `domain`), or - You want the corpus-wide proof rollup across watched hosts (omit `domain`). Inputs: - `domain` (query, optional): a hostname to filter to; omit for corpus-wide. - `limit` (query, optional): max recent rows, 1–200, default 50. Returns: - `domain` (echo, null when corpus-wide). - `summary`: `total_attempts`, `proven`, `unproven`, `domains`, `last_observed_at`. - `recent[]`: recent attempts (`log_operator`, `leaf_index`, `tree_size`, `sth_root_hash`, `inclusion_proven`, `reason`, ...). - `by_domain[]`: per-host `attempts` / `proven` rollup. Latency: - Typical <300ms (KV-cached 5m).

  ConnectorNo auth

• search_verified_jobsA

  pirchA

  Search pirch's pool of verified-live job listings. Every job returned was opened and confirmed real and accepting applicants by pirch within the last 72 hours — dead and ghost listings are removed automatically, so results can be trusted as live right now. Free, public data. When showing a job to a user, link its `url` (the pirch page, which shows the verification and links to the original posting).

  ConnectorNo auth

• hemmabo_booking_checkoutA

  HemmaBo Host Booking EngineA

  Create a fallback non-VRP booking and return a host-configured Stripe checkout URL. Use only after explicit user confirmation when no signed VRP direct_booking_url is available; when get_verified_stay_offer returns one, route the guest there instead. Use hemmabo_booking_create to record a pending booking without collecting payment yet. Behavior: existing bookings are never modified — availability is checked and dates briefly locked first; conflicts fail before anything is created or charged. Success creates exactly one pending booking and one Stripe Checkout Session on the host's connected account, returning paymentUrl, reservationId, and a one-time guestToken (required for status/cancel/reschedule). Only the Stripe webhook confirms the booking; unpaid pending bookings expire automatically. Not idempotent — check hemmabo_booking_status before retrying. Params: pass quoteId only for the exact propertyId/dates/guests locked by hemmabo_booking_negotiate (valid 15 min); omit to price fresh. channel selects which locked total is used; paymentMode changes only the handoff form, never the price. Requires Authorization: Bearer token (MCP_API_KEY or OAuth); rate-limited per token.

  ConnectorNo auth

• hemmabo_booking_cancelA

  HemmaBo Host Booking EngineA

  Cancel a confirmed booking and process the Stripe refund per host cancellation policy. Use when the guest explicitly requests cancellation — if the guest wants new dates instead of ending the stay, use hemmabo_booking_reschedule instead. Do not use for pending/unpaid bookings — those expire automatically. To preview the applicable policy first, read cancellationPolicy from hemmabo_booking_status. Requires Authorization: Bearer token (MCP_API_KEY or OAuth); rate-limited per token. Destructive and idempotent in effect: a repeat cancel is refused as already cancelled and never triggers a second refund. reservationId is the booking UUID from hemmabo_booking_checkout or hemmabo_booking_create — never a propertyId — and must be paired with the guestToken issued for that same booking. reason is optional free text shown to the host; when omitted the host sees 'Cancelled via MCP'.

  Connector

  Destructive

  No auth

• hemmabo_booking_rescheduleA

  HemmaBo Host Booking EngineA

  Reschedule a confirmed or pending booking to new dates with automatic repricing and Stripe charge/refund. Use when the guest wants to change dates on an existing booking — if the guest wants to end the stay entirely rather than move it, use hemmabo_booking_cancel instead. Do not use if cancelled or if a protocol compatibility client reports completed — check hemmabo_booking_status first. Requires Authorization: Bearer token (MCP_API_KEY or OAuth). Destructive write: the original dates are released back to the host calendar and the original price no longer applies — the booking keeps the same reservationId (updated in place, never recreated), and the price difference is charged or refunded via Stripe. Rate-limited per token. Identify the existing booking by reservationId, then give the new stay as newCheckIn/newCheckOut (newCheckIn strictly before newCheckOut); the new night count re-prices the stay exactly like a fresh quote.

  Connector

  Destructive

  No auth

• hemmabo_host_readiness_checkA

  HemmaBo Host Booking EngineA

  Read-only fit check for a vacation-rental host evaluating HemmaBo for their own booking website or booking engine. Use when the user is a host or property owner, not a guest booking a stay; guests should use hemmabo_search_properties instead. Returns a fit verdict, what the host gets, the setup inputs to prepare, and a safe onboarding next step. Does not create an account, buy a domain, configure Stripe, store host data, or provision a website. When the host is ready to start, follow up with hemmabo_host_onboarding_link. Only five inputs sharpen the fit verdict: a domain (hasOwnDomain or domain), currentChannels, one location signal (city/region/country), and the wants* booleans, which count unless explicitly false — omitting them never lowers the verdict; propertyName and preferredLanguage only prefill the onboarding URL, and with no inputs the summary is generic.

  ConnectorNo auth

• ghost_pre_spend_gateA

  ghost-x402-market-intel-vet-schemaA

  THE PRE-SPEND GATE. Call this immediately before your agent pays an x402/API provider, with the task's own economics. Returns ALLOW / FALLBACK / DECLINE / INSUFFICIENT_EVIDENCE — not advice: a decision your payment path should enforce. It joins the provider's measured record (independent payers, concentration, price drift, reachability, funding links, on-chain verdict) to YOUR numbers (customer_revenue, value_of_success, max_budget, required_margin, failure_cost, switching_cost) and answers the question ranking cannot: is paying for THIS task profitable, and at which provider. Where the task's value is known it maximises expected net value; where it is not, it minimises cost per verified success — which is why it will refuse the cheapest call when a cheaper provider succeeds less often. Unknown economics stay UNKNOWN and are never invented. Report the result afterwards to /v1/gate/outcome (free) — that is the only source of the success rates it uses. Paid per decision via x402, or drawn from prepaid credit; a cached decision inside valid_until and an INSUFFICIENT_EVIDENCE answer are free.

  ConnectorNo auth

• ghostroute_ct_witnessA

  TunnelMind Data APIB

  Returns GhostRoute's first-party Certificate-Transparency witness state: the latest signature-verified Signed Tree Head (STH) for every trusted, non-Google CT log TunnelMind independently witnesses, plus a regression scan over our own append-only history. Proof the platform holds its own signature-checked roots rather than reselling crt.sh/certspotter. Use this tool when: - You want corpus-wide CT witness health, not one cert. - You need to know whether any CT log misbehaved (rewound, forked, or served an STH whose signature did not verify) — a serious trust event. Inputs: - none. Returns: - `summary`: `logs_witnessed`, `verified_logs`, `unverified_logs`, `all_verified`, `total_snapshots`, `regressions`, `last_observed_at`. - `logs[]`: per-log latest STH (`log_url`, `log_operator`, `tree_size`, `sth_timestamp`, `root_hash`, `signature_verified`, `snapshots`). - `regressions[]`: detected violations — `kind` is `tree_size_rewind`, `root_fork`, or `sth_signature_invalid` (empty array = healthy). Latency: - Typical <300ms (KV-cached 5m; the witness worker updates twice a day).

  ConnectorNo auth

• ghostroute_verifyA

  TunnelMind Data APIB

  Retrieves a previously-issued, signed GhostRoute receipt by its GR-YYYY-NNNNNNN id, for independent audit of a past sovereignty verdict. Use this tool when: - You hold a GhostRoute receipt id and want to confirm its contents/signature. - You are reconciling an agent's action log against the attestation layer. Inputs: - `receipt_id` (path, required): GR-YYYY-NNNNNNN. Returns: - The full persisted receipt row (routing, cert, sovereignty fields + signature). Latency: - Typical <200ms (single indexed read).

  ConnectorNo auth

• ghostroute_ai_lookupA

  TunnelMind Data APIB

  Checks whether a domain or ASN belongs to a known AI company's infrastructure and what sovereignty it CLAIMS (program, zone, HQ), the baseline GhostRoute scores routing reality against. Use this tool when: - You want to know "whose AI infrastructure is this, and what does it claim?" - You are enriching an endpoint before deciding whether to send it inference. Inputs: - `entity` (path, required): a domain or ASN (AS####). Returns: - `matched`, `match_basis` (domain|asn), `ai_company`, `ai_product`, `sovereign_ai_program`, `claimed_sovereign_zone`, `hq_country`, `verified_sovereign`. Latency: - Typical <300ms (cached corpus read).

  ConnectorNo auth

• ghostroute_ct_alertsA

  TunnelMind Data APIB

  Returns the durable, deduplicated ledger of CT equivocation events the GhostRoute witness worker detects and pushes — a tree_size_rewind (an append-only log shrank), a root_fork (one tree_size witnessed with two different Merkle roots = a split-view log), or an sth_signature_invalid (a log's latest Signed Tree Head failed signature verification). Where `/v1/ghostroute/witness` shows live computed health, this is the immutable first-detection log: each entry's `detected_at` is when TunnelMind first raised the alarm. A healthy CT ecosystem returns an empty feed — any row here is a serious trust event. Use this tool when: - You want a chronological record of CT trust violations, not live state. - You're polling for new equivocation events (check `summary.last_detected_at`). Inputs: - `limit` (query, optional): max recent alerts, 1–200, default 50. Returns: - `summary`: `total`, `undelivered`, `rewinds`, `forks`, `bad_signatures`, `last_detected_at`. - `alerts[]`: each `kind`, `severity`, `log_url`, `log_operator`, `from_tree_size`, `to_tree_size`, `distinct_roots`, `event_observed_at`, `detected_at`, `delivered`. Latency: - Typical <200ms (KV-cached 1m).

  ConnectorNo auth