MCP server for the Hostkit API.
API documentation: https://hostkit.pt/api/
The server talks to the public Hostkit API through:
https://app.hostkit.pt/api/{endpoint}?APIKEY=...
For enhanced security, API keys are property based, therefore must be generated and maintained in the Hostkit App -> Properties -> API key tab of each property.
A rate limiting is enforced, please check the API documentation for the current limit.
- Node.js 20+
- Hostkit API key
npm run checkHOSTKIT_API_KEY="your-api-key" npm startOr without npm:
HOSTKIT_API_KEY="your-api-key" node src/server.mjsThe MCP exposes both read and write endpoints. Use API keys with the same care as direct Hostkit API access.
Example stdio configuration:
{
"mcpServers": {
"hostkit": {
"command": "npx",
"args": ["-y", "github:hostkitpt/mcp"],
"env": {
"HOSTKIT_API_KEY": "your-api-key"
}
}
}
}For local development before publishing:
{
"mcpServers": {
"hostkit": {
"command": "node",
"args": ["/path/to/api/mcp/src/server.mjs"],
"env": {
"HOSTKIT_API_KEY": "your-api-key"
}
}
}
}git remote add origin https://github.com/hostkitpt/mcp.git
git push -u origin mainhostkit_get_licensehostkit_get_propertieshostkit_get_propertyhostkit_get_reservationshostkit_get_reservationhostkit_get_reservation_by_cm_idhostkit_get_paymentshostkit_get_online_checkinhostkit_get_keycodehostkit_get_invoiceshostkit_get_reservation_invoiceshostkit_get_receiptshostkit_get_credit_noteshostkit_get_safthostkit_get_expenseshostkit_get_last_siba_datehostkit_validate_sibahostkit_add_propertyhostkit_update_propertyhostkit_add_reservationhostkit_update_reservationhostkit_cancel_reservationhostkit_delete_reservationhostkit_add_guesthostkit_remove_guesthostkit_remove_all_guestshostkit_add_reservation_extrahostkit_delete_reservation_extrashostkit_add_invoicehostkit_add_invoice_linehostkit_close_invoicehostkit_delete_invoicehostkit_add_receipthostkit_add_credit_notehostkit_generate_safthostkit_send_siba
https://hostkit.pt/api/- official Hostkit API documentation
- Hostkit errors are returned as structured text content with
error,endpoint,status, andpayload. - The API key is never logged by this server.
- The server intentionally does not expose a generic unrestricted endpoint caller.