Trust boundaries and authorization path
A complete architecture distinguishes host, MCP client, MCP server, authorization server, gateway and downstream travel system. Authentication at the MCP endpoint is only one control: object-level authorization, tenant isolation and business rules must still be enforced at the system of record.
Threat modelling must cover prompt injection, tool poisoning, confused-deputy flows, token theft, SSRF, session hijacking and excessive result disclosure. Controls are mapped to the boundary that can enforce them, rather than delegated to the language model.
Transactional safeguards
Search, quotation, hold, booking, ticketing, payment, exchange and cancellation are different risk classes. Binding operations require fresh state validation, an explicit presentation of price and conditions, idempotency and a durable audit record.
A production design also needs per-tool kill switches, negative authorization tests, recovery procedures and correlation identifiers spanning the host, MCP server and downstream supplier.