A Model Context Protocol server for LumbreTravel travel management system
LumbreTravel MCP has clear tool naming with action verbs (get_, create_, update_, delete_, list_) following conventions. All 19 tools are explicitly registered with names, descriptions, and input schemas visible in src/handlers/tools.handler.ts. However, the implementation has moderate gaps: descriptions average 120 characters (below the 194-char baseline), many parameter descriptions are generic ('ID del programa' rather than actionable format guidance), output schemas are entirely undocumented (no visibility into what these tools return), and error handling is not visible in the provided code. The server attempts composition well, separate tools for create/update/delete on programs, distinct lookup tools (by name, by date range), and filter-capable discovery tools (list_agencies, list_services, etc.). However, critical production patterns are missing: no pagination visible in tools that return lists (daily_activities, season_summary, search queries), no documented constraints on numeric ranges, no enum declarations for date format specifications despite explicit format requirements (DD-MM-YYYY), and no evidence of error recovery guidance or actionable error messages. Parameter naming is inconsistent, some filters use suffixes (hotelIdToFilter, leaderIdToFilter) while core fields use shorthand (id, name). Write operations (create_program, update_program, delete_program) lack confirmation mechanisms or dry-run patterns.
Crea un nuevo programa de viajes. Antes de crear un nuevo programa se debe preguntar al si quiere que primero se busque el programa a ver si existe. Si no se especifica la fecha de inicio o fin del programa, no la asumas, pide al usuario que la especifique. Si no se especifica el ID de la agencia, pide al usuario que la especifique.
Obtiene las actividades diarias
Elimina un programa de viajes
Obtiene pasajeros por email
Obtiene pasajeros por nombre completo
Obtiene un programa de viajes por ID
Output schemas completely undocumented. No visibility into what any tool returns, field names, types, structure. This forces LLMs to guess what data is available for downstream tool calls and risks chaining failures.
No pagination support visible in list tools or search results (daily_activities, get_programs_by_name, season_summary). Tools returning multiple items lack limit, offset/cursor, and total_count fields. Will fail with large result sets.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 51 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 0 | - | v1 |
Obtiene programas de viajes por rango de fechas
Busca programas de viajes por nombre
Obtiene todas las agencias disponibles para asociar a un programa de viajes
Obtiene todos los hoteles disponibles para asociar a una actividad en un programa de viajes
Obtiene todos los incluye o extras disponibles para asociar a una actividad en un programa de viajes
Obtiene todos los guías disponibles para asociar a una actividad en un programa de viajes
Obtiene todos los proveedores disponibles
Obtiene todos los idiomas para asociar a una actividad en un programa de viajes. Estos idiomas solo se pueden usar para asociar a un servicio.
Obtiene todos los servicios disponibles para asociar a una actividad en un programa de viajes
Obtiene todos los vehículos disponibles para asociar a una actividad en un programa de viajes
Reactiva un programa de viajes
Obtiene un resumen de pasajeros a lo largo de una temporada. Esta tool es muy útil para obtener el total de pasajeros de una temporada y ver como se distribuye por agencias.
Actualiza un programa de viajes en LumbreTravel
Date format constraints (DD-MM-YYYY, YYYY) mentioned in descriptions but NOT enforced via JSON Schema format or pattern fields. Parameters accept 'string' type with no regex validation. LLMs cannot parse informal constraints and will pass malformed dates.
Destructive operations (delete_program) lack confirmation or dry-run capability. No evidence of permission gates or audit logging. An agent can invoke delete_program with no safeguards against data loss.
Discovery tools (list_*) have minimal descriptions (30-50 chars). No guidance on WHEN to call them or what structure they reveal. Agents cannot infer discovery dependencies. E.g., list_agencies description is 'Obtiene todas las agencias...' with no mention that create_program requires agencyId from this tool.
Parameter naming inconsistency. Filter parameters use suffix notation (hotelIdToFilter, leaderIdToFilter, serviceIdToFilter) while core lookup params use shorthand (id, name). No type suffixes to disambiguate (e.g., hotel_id vs hotelId). Forces LLMs to reason about naming conventions.
No error handling guidance visible in provided code. No indication how tools report failures, what recovery steps LLM should take, or whether errors are retryable. Stack traces or bare error codes will render tools useless to agents.
Credentials (CLIENT_ID, CLIENT_SECRET, EMAIL, PASSWORD) exposed in Dockerfile as ENV variables with placeholder values. No evidence of server-side secret injection or vault integration. If this container is deployed, credentials may leak into image history or logs.