Reported issues for HemmaBo Host Booking Engine

Pod holds 18 of 20 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to HemmaBo Host Booking Engine.

Most discussed

ops(adr-0004): Phase 4 registry reindex + NPM metadata rollout after PR #102

Context: ADR 0004 lockstep-rollout. PR #102 merged & deployad; follow-ups (#106 m.fl.) merged.

Status (verifierat på main, version 3.2.15):

• Kanonisk verktygsyta är nu 15 tools: 11 HemmaBo federation-tools + 2 host onboarding-tools (hemmabo_host_readiness_check, hemmabo_host_onboarding_link) + 2 VRP-tools (verify_vacation_rental_node, get_verified_stay_offer). Källa: README.md, llms.txt, /.well-known/mcp.json, contract-test manifest-auth (asserterar 15).
• NPM: nu `hemmabo-

Read the thread · 2026-05-18 · open · 3 comments

feat: search.properties — multi-host fan-out across federation registry

Why

hemmabo_search_properties frågar i nuläget bara den lokala Supabase. (Logiken ligger i lib/tool-definitions-base.ts + api/mcp.ts; den gamla referensen src/index.ts finns inte längre — filen är borttagen.) Med ett registry (#55) ska en sökning "stuga i Sverige 10–14 juli" kunna returnera träffar från alla federationsnoder.

Scope

• Läs värdlistan från registryt (#55).
• Fan-out:a frågan till varje värds MCP-endpoint parallellt.
• Per-host timeout (~1.5s), fail-soft — blockera al

Read the thread · 2026-05-11 · open · 2 comments

feat: host registry — central directory of federation nodes

Why

Varje MCP-serverinstans känner bara till sin egen Supabase. hemmabo_search_properties (i lib/tool-definitions-base.ts + api/mcp.ts) returnerar bara lokala träffar eftersom det inte finns någon delad katalog över federationsmedlemmar.

⚠️ Bestäm gränsen först (blockerar detta issue)

En "central katalog som alla sökningar går igenom" riskerar att göra HemmaBo till en OTA/aggregator/grindvakt — vilket krockar med både VRP (agenten hittar värden på öppna webben, ingen central index)

Read the thread · 2026-05-11 · open · 2 comments

Hard-coded production hostname in manifest, ACP links, and OAuth register

Problem

Multiple endpoints embed the production hostname https://hemmabo-mcp-server.vercel.app as a string literal:

• api/mcp-manifest.ts:42 — mcp_endpoint
• api/mcp-manifest.ts:48 — tokenUrl
• api/mcp-manifest.ts:55 — registration endpoint
• api/mcp-manifest.ts:61 — icon
• api/acp.ts:155 — booking_status link
• api/oauth-register.ts:37 — TOKEN_ENDPOINT

On preview deployments (*-git-branch-hemmabo.vercel.app) or local dev, these still point at prod. The manifest

Read the thread · 2026-05-12 · closed · 1 comment

bug (DX): process.env.X! non-null assertions at module load — cryptic crashes when env unset

Problem

api/oauth.ts:27-28, api/oauth-register.ts:32-33, and src/auth.ts:25-26 all use TypeScript non-null assertions (process.env.SUPABASE_URL!) at module-load time inside createClient(...) calls. If the env var is unset (typical on first-time self-hosted setup or a misconfigured Vercel preview), the user gets:

TypeError: Cannot read properties of undefined (reading "replace")
  at SupabaseClient...

instead of a clear message saying which env var is missing.

Propos

Read the thread · 2026-05-12 · closed · 1 comment

bug (correctness): tool inputSchemas missing additionalProperties:false — typo'd args silently accepted by Ajv

Problem

Every TOOL_SPECS.inputSchema in lib/tool-definitions.ts omits additionalProperties. The JSON-Schema draft-07 default is true, so Ajv (configured in lib/validate-args.ts with strict: false, coerceTypes: false, removeAdditional: false) silently accepts unknown properties.

Concrete impact: an AI agent that sends {propertyID: "abc", checkIn: "..."} (wrong casing) passes Ajv validation. lib/tools.ts:validateRequiredArgs then trips on the missing propertyId and returns a

Read the thread · 2026-05-12 · closed · 1 comment

tracking: public documentation drift — update in lockstep with #59/#64/#65/#66/#67/#69/#70 fixes

Tracking issue — documentation must be updated in lockstep with bug fixes

Multiple public-facing documents make claims that are not currently true on origin/main. Each individual claim is rooted in a separately-tracked bug; this issue tracks the documentation update that needs to happen when each fix lands so that docs and code stay aligned.

Drift inventory

Read the thread · 2026-05-12 · closed · 1 comment

bug (financial): no Stripe webhook handler + silent refund failure — bookings can desync from real money state

Verified against origin/main

Two related defects in the ACP payment lifecycle that together let bookings drift out of sync with Stripe reality:

A. No webhook handler

grep -rn 'webhook' api/ returns nothing. completeCheckout (api/acp.ts L309-372) creates a PaymentIntent with confirm: true synchronously, then writes status: confirmed to the bookings table based purely on the HTTP response. Anything that happens to the PaymentIntent after that — 3DS step-up

Read the thread · 2026-05-12 · closed · 1 comment

Most recent

bug (privacy): GET /acp/checkouts/:id has no auth — exposes guest PII to anyone with a UUID

Verified against origin/main (api/acp.ts L497-511)

const isMutation = req.method === "POST" || req.method === "PUT";
if (isMutation) {
  const authErr = validateApiKey(req.headers["authorization"]);
  if (authErr) return res.status(401).json({...});
}

Auth runs only on POST/PUT. GET /acp/checkouts/:id is publicly accessible.

The response from buildACPState (api/acp.ts L88-167) returns:

buyer: { first_name, last_name, email, phone_number }
metadata: { property_id, p

[Read the thread](https://github.com/HemmaBo-se/hemmabo-mcp-server/issues/68) · 2026-05-12 · closed · 1 comment

### bug (ACP spec): POST /acp/checkouts ignores Idempotency-Key — network retries create duplicate bookings

## Verified against origin/main ([api/acp.ts:179](api/acp.ts#L179))

```ts
async function createCheckout(body: Record<string, unknown>, res: VercelResponse) {
  const supabase = getSupabase();
  // ...
  const { data: booking, error: bookErr } = await supabase
    .from("bookings")
    .insert({ ... })

There is no Idempotency-Key handling anywhere in api/acp.ts. The Stripe ACP spec requires servers to honor Idempotency-Key on POST so agents can safely retry on network er

Read the thread · 2026-05-12 · closed · 1 comment

bug (security): rate limiting missing on /oauth/register, /oauth/token, and /acp endpoints — DoS + credential-stuffing surface

Verified against origin/main (ebc498a)

The rate-limit module lib/rate-limit.ts is imported and applied only in api/mcp.ts:16. Grep across api/:

$ grep -rn 'checkRateLimit\|rate-limit' api/
api/mcp.ts:16:import { anonIdentifier, bearerIdentifier, checkRateLimit } from "../lib/rate-limit.js";
api/mcp.ts:1031:    const rl = await checkRateLimit(kind, identifier);

That leaves three sensitive endpoints unprotected:

| Endpoint | Auth | Rate-limit | Risk | |---|

Read the thread · 2026-05-12 · closed · 1 comment

bug (CRITICAL/security): OAuth tokens issued by /oauth/token are rejected at runtime — entire OAuth flow non-functional

Severity

CRITICAL — the OAuth flow advertised in the public manifest does not work. Any AI platform (Anthropic, OpenAI, Google) that follows the documented flow obtains a token, then is rejected on every tools/call.

Verified against origin/main (commit ebc498a)

The auth surface has two validators defined in src/auth.ts:

Read the thread · 2026-05-12 · closed · 1 comment

bug: triple-SoT for tool definitions (src/index.ts, src/stdio.ts, api/mcp.ts) — only api/mcp.ts is contract-tested

Found during SoT audit for #59

The 11 federation tools are defined three independent times in this repo, with no contract test locking the other two against the canonical one.

Read the thread · 2026-05-12 · closed · 1 comment

bug (CI): src/pricing.test.ts (677 lines, 40 tests) is silently excluded from npm test — pricing & tool-parity untested in CI

Found during SoT audit for #59 / #60 / #61

The CI test script in package.json explicitly enumerates test files:

"test": "npx tsx --test src/stripe.test.ts src/mcp-manifest-singleton.test.ts src/mcp-tool-annotations.contract.test.ts"

src/pricing.test.ts is not in the list and is therefore never executed by CI (.github/workflows/ci.yml only runs npm test).

Verified locally

$ npx tsx --test src/pricing.test.ts
# tests

[Read the thread](https://github.com/HemmaBo-se/hemmabo-mcp-server/issues/62) · 2026-05-12 · closed · 1 comment

### bug (security): dual-SoT availability.ts — src/ lacks fail-closed DB error handling (double-booking risk)

## Severity

**High** — potential double-booking under intermittent Supabase failures if the wrong file is imported.

## Found while reading SoT for #59

Two copies of the availability checker exist with **divergent behaviour on database errors**:

| File | Lines | Behaviour on Supabase query error |
|---|---|---|
| [src/availability.ts](src/availability.ts) | 102 | ❌ Ignores `error` from `.from(...).select(...)` — proceeds as if query returned empty data → can report `available: true` for a pro

[Read the thread](https://github.com/HemmaBo-se/hemmabo-mcp-server/issues/61) · 2026-05-12 · closed · 1 comment

### bug: dead duplicate src/pricing.ts vs lib/pricing.ts — single-SoT drift risk

## Found while reading SoT for #59

Two copies of the pricing resolver exist:

| File | Last modified | Exports |
|---|---|---|
| [src/pricing.ts](src/pricing.ts) | 2026-04-25 | helpers `daysBetween`, `isWeekend`, `findPriceBlock` are **local** (not exported) |
| [lib/pricing.ts](lib/pricing.ts) | 2026-05-05 | same helpers are **exported** |

## Current live wiring (verified via grep)

- [lib/tools.ts L20](lib/tools.ts#L20) — `import { resolveQuote } from "./pricing.js";` → uses **lib/**
- [api/

[Read the thread](https://github.com/HemmaBo-se/hemmabo-mcp-server/issues/60) · 2026-05-12 · closed · 1 comment

### fix: MCP tool names contain '.' — blocks claude.ai web client (FrontendRemoteMcpToolDefinition validation)

## Problem

When adding this MCP server as a remote MCP in **claude.ai (web)**, Anthropic's frontend validator rejects the tool list with:

tools.0.FrontendRemoteMcpToolDefinition.name: String should match pattern '^[a-zA-Z0-9_-]{1,64}$'

Cause: tool names registered via `server.tool()` in [src/index.ts](src/index.ts) use `.` (dot), which is allowed by the MCP spec but rejected by Anthropic's stricter web-frontend regex.

Affected tool names:
- `search.properties`, `search.availability`,

[Read the thread](https://github.com/HemmaBo-se/hemmabo-mcp-server/issues/59) · 2026-05-12 · closed · 1 comment

### spec: federation trust model — network_id, signed responses, DNS verification

## Why
HemmaBo positionerar sig som "infrastructure and federation for host-owned vacation rental nodes" (`README.md`). För en riktig federation (host #2 och framåt, se #54) behöver vi en nedskriven tillitsmodell så att en klon inte bara kan *påstå* medlemskap.

Korrigering 2026-06: tidigare version av detta issue citerade ett README-påstående om `network_id: hemmabo_verified` + signerade federationssvar. Det påståendet är **borttaget** ur README, och `network_id` finns inte någonstans i koden. 

[Read the thread](https://github.com/HemmaBo-se/hemmabo-mcp-server/issues/58) · 2026-05-11 · open · 1 comment

The remaining reports are on [the project's issue tracker](https://github.com/HemmaBo-se/hemmabo-mcp-server/issues).