tabiori Editor MCP

tabiori Editor MCP lets signed-in tabiori users create and edit travel plans (itineraries, schedules, checklists, notes) through MCP-compatible clients such as ChatGPT and Claude.

Endpoints

Authentication

The MCP server requires OAuth 2.1 with PKCE. Users sign in with their tabiori account on the consent screen and grant scopes:

  • editor:read — read plans the user belongs to
  • editor:write — create and update plans, schedules, and related content

Access tokens are short-lived JWTs that expire after 1 day by default. Refresh tokens rotate on use and expire after 90 days by default. Authorization codes expire after 10 minutes. Only the authenticated user's own plans are accessible.

What the connector does

  • Read and list travel plans, schedules, checklists, notes, and chat messages
  • Create new plans and append or update schedules
  • Upload or generate cover and schedule images on tabiori servers
  • Delete plans or individual items when the user confirms

Changes are written directly to the user's tabiori account and appear in the tabiori mobile app and web client.

Data sent to tabiori

Tool calls may include account identifiers, OAuth client and grant metadata, plan IDs, plan titles, descriptions, dates, destinations, schedule titles, times, notes, spot names, addresses, coordinates, phone numbers, URLs, costs, checklist categories and items, completion states, notes, scraps, in-plan chat messages, image files or image URLs, upload tokens, sharing links, invite data, hotel search inputs such as check-in date, adults, budget, and search coordinates, and hotel result data such as name, location, price, rating, image URLs, provider, and booking/detail links. The MCP server does not request full chat transcripts or local file lists, but it processes content that the user intentionally sends to a tool call. See our Privacy Policy for details on third-party MCP client integration.

Purposes, recipients, and retention

tabiori uses MCP data to authenticate the connected account, enforce scopes, create, read, update, delete, and preview travel plans, manage schedules, checklists, notes, scraps, chat, images, and sharing links, search and add hotel candidates, rate-limit requests, prevent abuse, investigate errors, provide support, and improve service quality.

Data is processed on Firebase / Google Cloud services used by tabiori, including Firestore, Cloud Storage, Cloud Functions, and Cloud Logging. Tool results needed for the user's request are returned to the MCP client, such as ChatGPT, Claude, Cursor, or another client chosen by the user. Hotel search may send search coordinates, dates, adults, and budget to external accommodation data providers such as Rakuten Travel, Expedia, and Booking.com. tabiori does not sell personal data.

User content is retained until the user deletes it, deletes the account, or it is no longer needed to provide the service. Temporary image upload URLs expire after 15 minutes. Hotel suggestion caches expire after 1 hour. OAuth authorization codes expire after 10 minutes. Access tokens expire after 1 day by default, and refresh tokens expire after 90 days by default. MCP audit logs are retained for up to 365 days for security, abuse prevention, and troubleshooting, then deleted or anonymized. Temporary rate-limit counters expire shortly after their window, generally within 2 minutes for minute windows and within 2 hours for hourly heavy-tool windows.

User controls

Users can disconnect the MCP integration from their MCP client settings or through tabiori support. Users can view, edit, and delete plans, schedules, checklists, notes, scraps, chat messages, images, and sharing links in tabiori. Access, correction, deletion, and suspension requests can be sent to the support address below.

Rate limits

Requests are rate-limited per IP and per authenticated user. Heavy media tools have additional hourly limits. Clients receive HTTP 429 with Retry-After when limits are exceeded.

Support

Questions about this connector: info@tabiori.com

Last updated: 2026-09-04