Apaleo's MCP runs your hotel.
Plekify's MCP sells your rooms.
This page documents the five read-only tools, the sellable-view data they return — property, availability, rate, and offer records — and how an agent obtains an API key to call them. What follows is the reference for a distribution-side MCP for hotel direct booking.
Why agents use ours
1. A lower trust tier
Apaleo's MCP authenticates per hotel with OAuth2, effectively master-key access that can cancel bookings and move money. Plekify's MCP uses a scoped read-only Bearer key instead. A hotel can hand an agent programmatic read access without opening the operations surface at all.
2. Raw is not sellable
Apaleo's raw rate rows include unpriced, promo-gated and restricted entries: machine-true, but not shoppable. That gap between raw data and a bookable price is the rate gap. Plekify's get_rates returns the computed sellable view instead: a per-night price, a nightly breakdown, and a total in the property's currency, the same view the storefront widget serves.
3. A real checkout, not a promise
get_checkout_link returns a property page URL and a Shopify cart permalink for a human to complete. That checkout is Shopify's: three steps, Shop Pay for returning shoppers, PCI-DSS Level 1 attestation, a multi-property cart, and B2B trade codes on account terms. The agent starts the booking; the human finishes it. Plekify MCP v1 never writes holds, carts or bookings.
Apaleo MCP vs Plekify MCP
Two agent surfaces with different tenants. Apaleo's MCP is built for a hotelier's own operations agents; Plekify's is for shopping and travel agents on the public web, with the commerce stack behind it.
|
Apaleo MCP |
Plekify MCP |
| audience |
hotelier's own ops agents |
public shopping/travel agents |
| auth |
per-hotel OAuth2 = PMS master key (can cancel bookings, move money) |
scoped read-only Bearer key |
| shape |
~230 read/write ops tools |
5 read-only commerce tools + checkout handoff |
| data |
raw PMS truth |
the sellable offer + the Shopify commerce stack |
Transport & methods
POST https://app.plekify.com/mcp — JSON-RPC 2.0 over HTTPS, Bearer key required. protocolVersion 2025-06-18; serverInfo plekify-mcp 1.0.0. GET on /mcp is informational.
Methods: initialize · notifications/initialized · ping · tools/list · tools/call. Read-only in v1 — nothing an agent reads here creates a booking.
The five tools
All five tools run against the demo tenant (8 properties). Every tool reuses the same live stack that powers the storefront widget — no data is re-implemented for the agent surface.
Auth & rate limits
Send Authorization: Bearer <key> on every request. Keys are issued by Plekify — email hello@plekify.com. The server reads the key from the environment variable PLEKIFY_MCP_DEMO_KEY — that is the name only; the value is never printed or shipped.
The rate limit is honest: 60 requests per minute per key, counted in-memory with a sliding window, per server instance (v1). That is the ceiling — no inflation.
Error codes
| Code |
Meaning |
-32700 |
Parse error — body is not JSON (HTTP 400). |
-32600 |
Invalid request — missing jsonrpc: "2.0" or method, or a non-POST request (HTTP 400). |
-32601 |
Method not found — unknown method name. |
-32602 |
Invalid params — tools/call missing params.name or params.arguments; a tool-level argument error (for example missing required parameter: X); or an unknown tool. |
-32603 |
Internal error — a constant string; the server never echoes driver or stack text. |
-32001 |
Unauthorized — a valid Bearer key is required; also surfaces when the demo tenant cannot be resolved. |
-32005 |
Rate limit exceeded — more than 60 req/min per key. |
Example call
List the available tools (paste the example from llms.txt):
curl https://app.plekify.com/mcp \
-H 'content-type: application/json' \
-H 'authorization: Bearer PLEKIFY_MCP_DEMO_KEY' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Changelog
v1.0.0 — 2026-09: 5 read-only tools, Bearer auth, 60 rpm per key, demo tenant (8 properties).
Matthew Swart is building this
Plekify is built by the co-founder of SafariNow.com, which grew to roughly 22,000 establishments before its majority sale to Travelstart in 2017. Matthew reads key requests personally — pre-revenue, every implementation is set up by him.