Loading ToolBench
MCP server for Marriott Hotels — let AI agents search hotels, manage reservations, check in, and redeem Bonvoy points via browser automation
This server has clear, actionable tool descriptions (all 16 tools have 50-180+ character descriptions) and properly structured input schemas with required field declarations. However, it falls short on critical production-grade patterns: (1) multiple tools lack parameter descriptions entirely (login, logout, status, add_extras lack any param context); (2) no output schemas are documented for any tool, LLMs cannot anticipate response structure; (3) error handling lacks recovery guidance and actionable messages; (4) destructive operations (checkout, cancel_reservation, redeem_points) use a bare 'confirm' boolean without multi-step confirmation workflow; (5) no tool annotations (readOnlyHint/destructiveHint/idempotentHint) despite clear risk patterns; (6) parameter relationships undocumented (e.g., select_room depends on prior get_room_options, checkout depends on select_room or explicit hotelId+roomCode, but this choreography is only hinted in descriptions, not formalized); (7) several tools conflate multiple concerns, e.g., redeem_points searches AND redeems, violating single-responsibility; (8) secrets in environment variables are correctly not exposed as params (good), but no audit logging or rate-limiting is visible. Tool naming is strong (verb_noun pattern, clear intent), but parameter descriptions are sparse.
Add optional extras to your booking — parking, breakfast, late checkout, early check-in, airport transfer, or spa credit.
Cancel a Marriott reservation. IMPORTANT: Set confirm=true only after explicit user confirmation.
Check in to your Marriott hotel reservation using your confirmation number.
Complete a Marriott hotel booking. IMPORTANT: Set confirm=true only after getting explicit user confirmation. Without confirm=true, returns a booking preview instead of charging.
Retrieve your Marriott Bonvoy loyalty status — member tier, points balance, progress to next tier, and recent activity.
Get detailed information about a specific Marriott hotel — description, amenities, policies, check-in/out times, parking, and pet policy.
No output schemas documented for any of 16 tools. LLMs cannot predict response structure, forcing them to guess field names and types for downstream tool chains. Breaks the composition pattern.
Parameters with no descriptions: login, logout, status, and add_extras (extras param) lack context. LLMs cannot determine parameter purpose or constraints from names alone. Violates parameter documentation requirement.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | 2026-07-28+ | v2 |
Retrieve existing Marriott reservation details. Requires being logged in. Returns upcoming reservations or a specific booking by confirmation number.
View available room types and rates for a specific hotel and date range. Returns room names, bed types, prices, cancellation policies, and Bonvoy point rates.
Get your Marriott stay history — past and upcoming reservations, nights stayed, points earned, and status.
Log in to Marriott Bonvoy. Reads MARRIOTT_EMAIL and MARRIOTT_PASSWORD from environment variables, or returns a URL for manual login.
Clear saved Marriott session and cookies. Use this to log out or reset authentication state.
Change dates or room type for an existing reservation. IMPORTANT: Set confirm=true only after getting explicit user confirmation.
Redeem Bonvoy points for a Marriott hotel stay. IMPORTANT: Set confirm=true only after explicit user confirmation.
Search for Marriott hotels by destination and dates. Returns hotel names, brands, ratings, locations, and nightly rates.
Choose a room type to book. Call this after get_room_options to select a room before checkout.
Check Marriott login status and Bonvoy session info. Use this to verify authentication before performing other actions.
Irreversible operations (checkout, redeem_points) and destructive ops (cancel_reservation) rely on a bare 'confirm' boolean. No multi-round-trip confirmation workflow (input_required), no preview → review → execute pattern. A single LLM error confirmation bypasses all safety gates.
Tool annotations missing. No readOnlyHint for safe tools (status, get_*) or destructiveHint for dangerous ones (checkout, cancel_reservation, redeem_points). LLMs cannot distinguish cost/safety profile.
Tool composition assumes implicit state machine (search → get_details → get_room_options → select_room → add_extras → checkout). No input_required handshake between steps; no formalized dependency documentation. If LLM skips steps, tools fail silently or return confusing errors.
redeem_points conflates search + redeem. If hotel not specified, tool searches first, then redeems automatically. Breaks single-responsibility. Should split: search_hotels_for_points (read) + redeem_points_for_hotel (write).
No error recovery guidance. Descriptions do not include 'what to do if this fails' hints. E.g., search_hotels could fail if destination is ambiguous, should mention to_try or fallback tools.
Response filtering not visible in code. checkout, search_hotels, get_room_options likely return verbose API payloads (pagination metadata, internal IDs, audit fields). No evidence of stripping irrelevant data before returning to LLM.