ChatGPT App Integration Guide

TheBayStayHomes — AI-assisted vacation-rental operations for property owners and hosts. The application exposes a Model Context Protocol (MCP) server so a host can connect an AI assistant such as ChatGPT and ask operational questions about their own properties. This page is the reference for anyone wiring an OpenAI Apps SDK layer on top of that backend. It contains no secrets.

• Endpoint: https://thebaystayhomes.com/mcp
• Transport: MCP Streamable HTTP (POST, JSON-RPC)
• Protected-resource metadata: https://thebaystayhomes.com/.well-known/oauth-protected-resource
• Requests without a valid bearer token receive HTTP 401.

OAuth 2.1 with PKCE. The application is the resource server; the authorization server is the project's managed authentication service, discovered from the protected-resource metadata above. Dynamic client registration is supported, so a compatible client can register itself.

1. Client fetches protected-resource metadata and discovers the authorization server.
2. Client registers dynamically (or uses a pre-registered client id).
3. Client starts an authorization request with PKCE.
4. The host signs in (email or Google) and lands on the consent screen at https://thebaystayhomes.com/.lovable/oauth/consent, which names the client and states what it can read and change.
5. On approval the client exchanges the code for an access token and refresh token.
6. Every MCP call sends Authorization: Bearer <access token>.

There are no granular OAuth scopes. Approval grants the fixed permission set below, and the server re-checks it on every single call:

• The token must be an OAuth client token issued by this authorization server.
• The account must be an authorised host of this application.
• Read access is limited to the seven read tools listed below.
• Write access is limited to the status field of a direct booking request.
• No SQL, no arbitrary queries, no deletes, no financial edits, no message sending.

Property values are slugs: whale-away, bay-watch, beautiful-home-wakefield, stylish-condo-wakefield. Dates are YYYY-MM-DD.

• Read (safe, idempotent): get_today_operations, list_calendar, list_cleanings, list_unconfirmed_cleanings, list_stay_requests, get_availability, list_booking_requests, list_bookings.
• Write (requires host confirmation in the conversation): update_booking_status.

Today's operations:

{ "name": "get_today_operations", "arguments": {} }

{
  "date": "2026-09-14",
  "arrivals_today": [
    { "property": "Bay Watch", "guest_first_name": "Seth",
      "booking_source": "Vrbo", "nights": 6, "check_out": "2026-09-20" }
  ],
  "departures_today": [],
  "same_day_turnovers": [],
  "cleanings_today": [],
  "open_stay_requests": [],
  "booking_requests_awaiting_decision": []
}

Calendar for a range:

{ "name": "list_calendar",
  "arguments": { "start_date": "2026-10-01", "end_date": "2026-10-31",
                 "property": "whale-away" } }

{
  "range": { "start_date": "2026-10-01", "end_date": "2026-10-31" },
  "reservations": [
    { "property": "Whale Away", "check_in": "2026-10-03", "check_out": "2026-10-07",
      "nights": 4, "booking_source": "Airbnb", "status": "booked",
      "guest_first_name": "Kathleen", "same_day_turnover": false }
  ]
}

Availability:

{ "name": "get_availability",
  "arguments": { "property": "bay-watch",
                 "start_date": "2026-11-01", "end_date": "2026-11-30" } }

{
  "property": "bay-watch",
  "available": [ { "from": "2026-11-01", "to": "2026-11-12" } ],
  "booked": [ { "from": "2026-11-12", "to": "2026-11-16", "booking_source": "Vrbo" } ],
  "first_available_night": "2026-11-01"
}

Write action:

{ "name": "update_booking_status",
  "arguments": { "id": "6f1c...-uuid", "status": "confirmed",
                 "host_notes": "Called guest, dates agreed." } }

{ "booking_request": { "id": "6f1c...-uuid", "property_slug": "bay-watch",
    "check_in": "2026-08-01", "check_out": "2026-08-07", "status": "confirmed" } }

• Bearer token on every request; unauthenticated calls return 401.
• Copied browser session tokens are rejected — the token must carry an OAuth client claim from the authorization server.
• Every tool resolves the signed-in host server-side and re-checks host authorisation before touching any data. Ids supplied by the client are never trusted for authorisation; they are only used to locate a record the host is already allowed to reach.
• Output filtering is applied server-side: guest email addresses, phone numbers, payouts, reservation codes and payment details are not returned to any tool caller.
• Internal errors are logged server-side; clients receive short, generic messages.

• Privacy policy: https://thebaystayhomes.com/privacy
• Terms of service: https://thebaystayhomes.com/terms
• Support: https://thebaystayhomes.com/support

• Start broad questions with get_today_operations; fall back to the narrow tools when the host names a date range or one property.
• Treat update_booking_status as a confirmation-gated action: restate the property, guest and dates before calling it.
• The backend is currently provisioned for a single host account. A per-host data scope is applied in one shared server-side guard, which is where multi-tenant filtering will be enforced before a second host is onboarded.