[{"slug":"ZV-2026-0047","server_name":"hemmabo-mcp-server.vercel.app","severity":"breaking","title":"hemmabo-mcp-server.vercel.app: New required field guestToken on hemmabo_booking_cancel; requests without it will fail.","summary":"[breaking] New required field guestToken on hemmabo_booking_cancel; requests without it will fail. [risky] Field guestToken was added to hemmabo_booking_checkout output. [risky] Field guestToken was added to hemmabo_booking_create output. [breaking] New required field guestToken on hemmabo_booking_reschedule; requests without it will fail. [breaking] New required field guestToken on hemmabo_booking_status; requests without it will fail.","changes":[{"kind":"input_required_added","path":"inputSchema.properties.guestToken","tool":"hemmabo_booking_cancel","after":{"type":"string","description":"Per-booking secret returned by hemmabo_booking_create / hemmabo_booking_checkout (the booking's guest_token, a UUID). Required to view or modify this specific booking — a valid Bearer token alone is NOT sufficient, because it authenticates the caller but grants no authority over any particular booking. Present the exact guestToken you received when the booking was created; without the matching value the call is refused. Never a propertyId or reservationId."},"detail":"New required field `guestToken` on `hemmabo_booking_cancel`; requests without it will fail.","severity":"breaking"},{"kind":"output_property_added","path":"outputSchema.properties.guestToken","tool":"hemmabo_booking_checkout","after":{"type":"string","description":"Per-booking secret (guest_token) for this booking. Present it back as guestToken on hemmabo_booking_status / hemmabo_booking_cancel / hemmabo_booking_reschedule to view or modify this booking; a Bearer token alone is not sufficient. Store it securely and do not show it to the guest."},"detail":"Field `guestToken` was added to `hemmabo_booking_checkout` output.","severity":"risky"},{"kind":"output_property_added","path":"outputSchema.properties.guestToken","tool":"hemmabo_booking_create","after":{"type":"string","description":"Per-booking secret (guest_token) for this booking. Present it back as guestToken on hemmabo_booking_status / hemmabo_booking_cancel / hemmabo_booking_reschedule to view or modify this booking; a Bearer token alone is not sufficient. Store it securely and do not show it to the guest."},"detail":"Field `guestToken` was added to `hemmabo_booking_create` output.","severity":"risky"},{"kind":"input_required_added","path":"inputSchema.properties.guestToken","tool":"hemmabo_booking_reschedule","after":{"type":"string","description":"Per-booking secret returned by hemmabo_booking_create / hemmabo_booking_checkout (the booking's guest_token, a UUID). Required to view or modify this specific booking — a valid Bearer token alone is NOT sufficient, because it authenticates the caller but grants no authority over any particular booking. Present the exact guestToken you received when the booking was created; without the matching value the call is refused. Never a propertyId or reservationId."},"detail":"New required field `guestToken` on `hemmabo_booking_reschedule`; requests without it will fail.","severity":"breaking"},{"kind":"input_required_added","path":"inputSchema.properties.guestToken","tool":"hemmabo_booking_status","after":{"type":"string","description":"Per-booking secret returned by hemmabo_booking_create / hemmabo_booking_checkout (the booking's guest_token, a UUID). Required to view or modify this specific booking — a valid Bearer token alone is NOT sufficient, because it authenticates the caller but grants no authority over any particular booking. Present the exact guestToken you received when the booking was created; without the matching value the call is refused. Never a propertyId or reservationId."},"detail":"New required field `guestToken` on `hemmabo_booking_status`; requests without it will fail.","severity":"breaking"}],"published_at":"2026-08-15T19:02:18.427Z"}]