An agent can read our state rules, price list and public guide without an account. Everything below is a public read. Tenant data, billing and writes sit behind a signed-in host account and are not exposed here.
curl https://api.cohostbnb.xyz/v1/cohost/state-rules
The reply lists every state we can serve, each with a status of GREEN, YELLOW, RED or UNKNOWN. A lookup is not a verification. RED and UNKNOWN block managed service, and a managed order needs a verified state first.
/openapi.json is OpenAPI 3.1. It covers the public read routes only: state rules, pricing tiers, channels, templates and the API guide. Prices come from /v1/pricing-tiers, the same source the pricing page uses.
Endpoint: https://cohostbnb.xyz/mcp (streamable HTTP; the same server answers at https://api.cohostbnb.xyz/mcp). Server card: /.well-known/mcp.json.
check_state_availability(state, city) returns the policy gate for a place.get_public_guide() returns the API guide.Both tools are read-only. Auth is OAuth authorization code with S256 PKCE, client ID claude-connector, no client secret, scope public:read. Tokens last 15 minutes. That scope can never act on a tenant account. A request with no token gets a 401 and a WWW-Authenticate header.
{
"mcpServers": {
"cohostbnb": { "type": "http", "url": "https://cohostbnb.xyz/mcp" }
}
}
For stdio clients, bridge the remote URL with npx mcp-remote https://cohostbnb.xyz/mcp.
Public reads need no key. Account routes use a bearer token tied to one host account; some tokens are limited to a single job, such as cleaner-only or automation-only. Tokens are never accepted by the public MCP server, and the MCP scope cannot reach account data.
CoHostBnB has a free plan with no card. Paid plans, per-property pricing and managed co-hosting are listed on /pricing and in /v1/pricing-tiers. We do not copy figures onto this page so they cannot drift from the price list.