Strider Hilton

Book Hilton hotels via Strider Labs MCP connector. Search properties worldwide, manage reservations, earn Hilton Honors points. Complete autonomous hotel boo...

Security Scan

The skill is internally consistent with its stated purpose (a Hilton booking MCP connector that runs an npm package via npx), but it relies on executing a remote npm package (npx) and omits details about the OAuth client configuration—so exercise normal supply-chain caution.

Purpose & Capability

Name/description (Hilton booking via a Strider Labs MCP connector) aligns with the manifest and SKILL.md. The skill only requires the npx binary and instructs use of an @striderlabs npm package, which is a reasonable implementation choice for an MCP connector.

Instruction Scope

SKILL.md limits instructions to installing/using @striderlabs/mcp-hilton, configuring the MCP client, available tool schemas, and expected OAuth authentication. It does not instruct the agent to read unrelated files, system secrets, or send data to unexpected endpoints in the doc.

Install Mechanism

Although there is no registry install spec, the skill instructs usage of npm install and npx to run @striderlabs/mcp-hilton. npx will fetch and execute code from the npm registry at runtime—this is expected for this type of connector but carries moderate supply-chain risk if the npm package or maintainer is untrusted.

Credentials

The skill declares no required env vars, which is coherent for a connector that triggers an OAuth flow for end users. However, SKILL.md does not describe whether the connector needs a Strider/third‑party client_id/secret or where tokens are stored; lack of these details is noteworthy but not necessarily malicious.

Persistence & Privilege

The skill is not marked always:true and does not request system-wide config access. It is an instruction-only skill that instructs the agent to run an external MCP binary; no elevated or persistent system privileges are requested in the manifest.

Assessment

This skill appears to do what it says (a Hilton booking connector) and asks only for npx to run an @striderlabs npm package. Before installing or enabling it: (1) verify the npm package and its publisher (review the package page, source repo, and recent releases/maintainers); (2) be aware that npx will download and execute code from npm at runtime—consider pinning to a known-safe version or installing the package yourself rather than relying on npx; (3) confirm how OAuth tokens are handled (where they are stored, who controls the client credentials); (4) avoid providing unrelated credentials. If you need higher assurance, request the package source or a reproducible release artifact and review it before use.

Strider Hilton Connector

MCP connector for booking Hilton hotels — search properties across all Hilton brands, manage reservations, and earn Hilton Honors points. Part of the Strider Labs action execution layer for AI agents.

Installation

npm install @striderlabs/mcp-hilton

MCP Configuration

Add to your MCP client configuration (Claude Desktop, Cursor, etc.):

{
  "mcpServers": {
    "hilton": {
      "command": "npx",
      "args": ["-y", "@striderlabs/mcp-hilton"]
    }
  }
}

Available Tools

hilton.search_hotels

Search Hilton properties by location.

Input Schema:

{
  "location": "string (city or address)",
  "check_in": "string (YYYY-MM-DD)",
  "check_out": "string (YYYY-MM-DD)",
  "rooms": "number",
  "guests": "number",
  "brand": "string (optional: hilton, doubletree, hampton, etc.)",
  "points_only": "boolean (optional)"
}

Output:

{
  "hotels": [{
    "id": "string",
    "name": "string",
    "brand": "string",
    "rating": "number",
    "price_per_night": "number",
    "points_per_night": "number",
    "distance": "string",
    "amenities": ["string"]
  }]
}

hilton.get_hotel_details

Get full hotel details including rooms and rates.

hilton.book_room

Book a room with guest details.

Input Schema:

{
  "hotel_id": "string",
  "room_id": "string",
  "guest": {
    "first_name": "string",
    "last_name": "string",
    "email": "string",
    "honors_number": "string (optional)"
  },
  "payment": "string (card or points)",
  "special_requests": "string (optional)"
}

hilton.get_reservations

Get upcoming reservations.

hilton.cancel_reservation

Cancel a booking.

hilton.get_honors_status

Check Hilton Honors points and status.

Output:

{
  "points": "number",
  "status": "string (member, silver, gold, diamond)",
  "nights_this_year": "number"
}

hilton.request_upgrade

Request room upgrade at check-in.

Authentication

First use triggers OAuth. Hilton Honors linked automatically. Tokens stored encrypted per-user.

Usage Examples

Find hotel:

Search for Hilton hotels in Chicago near downtown for this weekend

Book with points:

Book a Hilton using points for my New York trip

Check status:

What's my Hilton Honors status and point balance?

Business trip:

Book a Hampton Inn near the San Jose airport for Monday night

Error Handling

Code	Meaning	Action
AUTH_EXPIRED	Session expired	Re-authenticate
SOLD_OUT	No availability	Try nearby hotels
INSUFFICIENT_POINTS	Not enough points	Pay with card
CANCELLATION_FEE	Penalty applies	Warn before canceling

Hilton Brands

Works with all Hilton brands:

• Waldorf Astoria, Conrad, LXR
• Hilton Hotels & Resorts, Curio, Signia
• DoubleTree, Tapestry, Embassy Suites
• Hilton Garden Inn, Hampton, Tru
• Homewood Suites, Home2 Suites

Links

• npm: https://npmjs.com/package/@striderlabs/mcp-hilton
• Strider Labs: https://striderlabs.ai