Protocol and architecture

MCP is an open protocol for connecting AI applications to external capabilities and context. It normally complements APIs rather than replacing them. The host owns user interaction and orchestration, a client maintains one server connection, and the server mediates bounded access to its domain.

  • MCP does not provide travel inventory or business rules.
  • Protocol conformance does not prove production suitability.
  • Optional capabilities must be negotiated and tested per client.
  • The current published baseline is 2025-11-25.

Travel transactions

Search, quotation, hold, booking, ticketing, payment, exchange and cancellation are distinct states and risk classes. An AI-generated summary cannot establish current price or availability; the authoritative backend must revalidate material state before commitment.

  • Offer is not confirmed inventory.
  • Order, PNR, ticket and itinerary are not interchangeable.
  • Approval is bound to exact price, traveller and conditions.
  • Writes require idempotency and recovery design.

Security and governance

OAuth alone is insufficient. A production path also enforces token audience, tenant and object rights, data minimization, user control, downstream business policy and auditability.

  • Discovery is not trust.
  • Tool output is untrusted content.
  • Token passthrough creates confused-deputy risk.
  • Registry presence is not a security certificate.

Evaluation and operations

A pilot should reduce a named uncertainty and compare results with a baseline. Production evidence includes negative authorization tests, stale-state handling, compatibility, observability, rollback and per-capability revocation.

  • Measure correctness and inappropriate calls, not only speed.
  • Separate model, client, server and backend failures.
  • Record source and retrieval time for travel facts.
  • Keep release candidates separate from current normative rules.

FAQ zu Frequently asked questions about Travel MCP

What is the Model Context Protocol?

MCP is an open protocol for connecting AI applications to external tools, resources and workflows through defined client-server interactions.

Does MCP replace travel APIs?

No. MCP normally exposes bounded capabilities over existing REST, GraphQL, SOAP, NDC, OpenTravel or proprietary supplier APIs.

Is an MCP server the system of record?

Usually not. Inventory, price, order state and business rules remain authoritative in the connected GDS, CRS, PMS, order or supplier system.

Are offers returned through MCP automatically bookable?

No. An offer may be indicative or expired. Price, inventory and material conditions must be revalidated before a binding action.

Does OAuth make an MCP deployment secure?

OAuth is only one layer. Production security also requires token audience validation, tenant and object authorization, data minimization, user control and downstream policy enforcement.

What is the difference between a host and a client?

The host is the AI application and policy boundary. It normally creates one MCP client for each server connection.

What is the difference between tools, resources and prompts?

Tools are model-invoked operations, resources are application-controlled context, and prompts are user-selected reusable templates.

Can a model confirm a travel booking by itself?

Only within an explicitly authorized architecture. The backend must revalidate state, the user must approve the exact material terms, and execution must be idempotent and auditable.

Is registry presence proof that a server is safe?

No. Registry metadata supports discovery but does not prove code security, publisher authority, commercial entitlement or operational maturity.

Which MCP version is current?

As of the editorial review on 23 July 2026, the current published protocol version is 2025-11-25. Release candidates are evaluated separately.

How should MCP pilots be measured?

Measure task correctness, inappropriate calls, user corrections, stale-state rejection, latency, cost and recovery rather than demonstration success alone.

Can Travel MCP be deployed on premises?

Yes. Deployment topology depends on data, identity, system access, latency and operational requirements; on-premises placement is not automatically safer.

Primary sources and academic context

This page follows the versioned MCP specification and separates normative requirements from architectural recommendations.