Visa Data in AI Booking Assistants: MCP or Visa API?

Third-party pages and our own pages checked on 27 October 2026.

An AI booking assistant can answer visa questions and start an application if it can call a visa provider's tools. There are two ways to give it that: a visa API your engineers wrap as tools, or an MCP server the assistant connects to directly. Either way, the traveler still consents, pays and checks the application on a page they control, and a named company files it with the government.

This guide is for product, digital and partnerships teams at OTAs, airlines and TMCs who are building or buying an assistant. Governments decide visas. No assistant and no provider can promise an approval.

What MCP is, in plain words

MCP, the Model Context Protocol, is an open standard for connecting AI applications to outside systems. The official MCP site calls it "an open-source standard for connecting AI applications to external systems" and puts it this way: "Think of MCP like a USB-C port for AI applications."

In travel terms, three parts matter.

The assistant is the host. It is your own chat, or an AI application like Claude or ChatGPT.
The MCP server is the visa provider's plug. The assistant connects to it and reads what it offers.
The tools are the actions the server offers. For example, "look up requirements for this passport and route" or "prepare an application".

MCP is not a new data source. It is not a government channel, and it does not make answers more accurate. The data behind a provider's MCP server is the same data behind its API. What changes is which assistants can reach it.

One published example shows the split between read tools and application tools. Visamundi's MCP tools page, checked on 27 October 2026, lists public tools that include get_visa_requirements and list_visas, which return reference data. It also lists get_application_form, save_application and get_payment_link, which prepare an application and return a payment link.

Three jobs an assistant can do with visa data

An assistant can do three jobs with visa data. It can answer the entry question, prepare an application, and hand the traveler off to pay and submit. Each job needs something different from the provider and fails in a different way.

Job	What the assistant does	What it needs from the provider	Risk if done badly
1. Answer	Says whether the traveler needs a visa for their passport, route and travel date, transit included	A requirements lookup that returns a verification date	A confident wrong answer in chat
2. Prepare	Collects the application fields and shows what is still missing	An application schema and a "missing fields" response	The assistant handles passport data your stack was never meant to hold
3. Hand off	Gives the traveler a link or a checkout step to pay and submit	A payment page or your own checkout, plus status sent back to you	The traveler pays and nobody tells your support team what happened

Most teams should start with job 1, add job 3 next, and treat job 2 carefully. The partner questions below explain why.

MCP server or visa API: which one does your assistant need?

If you build your own assistant, a visa API you call from your backend gives you the most control. If you want assistants you do not own, such as ChatGPT, Claude or Copilot-style tools used by your agents, to reach visa data, you need an MCP server.

Question	Visa API wrapped as tools (your backend)	Provider's MCP server
Who decides which calls the assistant may make	You, in code	The provider's server and the key's scope
Works in third-party assistants (Claude, ChatGPT, IDEs)	No, only in your own app	Yes, any MCP client
Where passport data flows	Through your backend unless you hand off	Through the AI application to the provider's server
Writes (applications, payments)	Your rules, your idempotency keys	Whatever the provider's tools allow
Best for	Your own chat in the booking flow	Agent copilots, partner tools, fast trials

Wrapping an API as tools means your engineers define each tool, its inputs and what it returns. Your backend makes the call and holds the provider's key. The assistant only sees what your code passes back.

With an MCP server, the provider defines the tools. What the assistant can do depends on the server and on the key you connect with. Visamundi's MCP overview says each partner key "exposes only the tools you enable for it in the partner portal". YourVisa.ai's MCP product page lists "Dedicated keys with scoped permissions, usage tracking and instant revocation." Both checked 27 October 2026.

Visamundi's overview page, checked on 27 October 2026, draws the same line between the two: "The API remains the right choice when you are building deterministic application code. MCP is the right choice when you want an AI client to discover and call Visamundi tools conversationally."

The two are not exclusive. Your own chat can run on your API integration while your agents use a provider's MCP server in a copilot. If you are still choosing between an integration and a hosted checkout, read eVisa API vs white label first. For the read and write path of the API itself, see how eVisa APIs work.

What the traveler must do themselves

The traveler confirms what is shared, checks the application, accepts the terms and pays. The assistant can prepare the work. It should not accept terms or pay on the traveler's behalf.

The MCP specification, version 2026-07-28, lists "User Consent and Control" as a key principle. Users "must explicitly consent to and understand all data access and operations", and hosts "must obtain explicit user consent before invoking any tool". The same section says MCP "cannot enforce these security principles at the protocol level", and asks implementors to build "robust consent and authorization flows into their applications".

For a travel seller, that reads as three steps.

The traveler confirms before the assistant sends their details anywhere.
The traveler sees and checks the application before it is paid.
The traveler accepts the provider's terms and pays on a page, not inside an assistant message.

Providers that publish MCP servers describe the same split. Visamundi says: "The agent never pays and never accepts terms, consents or disclaimers: the traveller does it on the page opened by the link." YourVisa.ai says its "server is read-only and never triggers charges" and that the assistant "generates a dedicated application link". Both are quoted from their own pages on 27 October 2026.

Passport data is personal data, so check with your own privacy team who is the data controller at each step.

Questions to ask a visa partner before you plug it into an assistant

Ask these eight before you connect any visa partner to an assistant. Each one covers a failure that shows up in chat, not on a booking page.

Consent. Where exactly does the traveler confirm, and does the tool refuse to act without it? If the tool does not check, only the assistant's instructions prevent an action the traveler did not approve.
Who pays, and to whom. Does the traveler pay the partner on a hosted page, or do you take payment in your own checkout? Who is merchant of record? That decides whose name is on the card statement and who handles refunds.
Who submits. Does the partner file with the government, or only prepare a form the traveler files? Who answers when the authority asks for more documents? The assistant cannot do that for the traveler.
What the agent may write. Read-only tools, draft applications, or anything that charges money? Can you switch write tools off per key? Start read-only and add writes on purpose.
Attribution. How is an application started in your assistant credited to you: a key, a partner code or a link? How is revenue shared? Without attribution, chat sales do not show up in your numbers.
Data path. Does passport data pass through your systems, the AI provider's, or go straight to the partner? Where is it stored and for how long? Your security review will ask.
Freshness. Does every answer carry a verification date and a government source the assistant can quote? An answer with no date cannot be checked.
Status back. How do you and your support team learn the outcome: webhooks or a partner console? A chat link with no status is a support ticket later.

Ask every partner the same eight questions, ours included. For the checklist outside the assistant case, see the six questions to ask any visa partner. For everything a production integration needs, see the full API checklist.

How SimpleVisa fits today

SimpleVisa is going to build its own MCP server as well.

Here is what exists today, from our own live pages.

API. The SimpleVisa API and sandbox keys page lists GET /v1/requirements, which returns the documents for a passport, route and date, then POST /v1/applications, document upload with POST /v1/applications/:id/documents, status with GET /v1/applications/:id, and webhooks with POST /v1/webhooks. Sandbox keys come without a sales call. These are the calls a team can wrap as tools in its own assistant.
Coverage. Requirements data covers 190+ destinations. Which destinations we file applications for, live or in beta, is on the coverage page. To see a live answer, try the requirements checker.
Data path. Our trust page says: "The traveler uploads to us, pays us, and we submit to the government. Your integration carries a route and an email address". We store passport images in the EU and delete them after the decision. See where passport data lives.
Who pays. On revenue share, SimpleVisa is merchant of record. On the platform licence, you are. See pricing.

Book a demo Get a test key

FAQ

What is MCP, in travel terms?

MCP (Model Context Protocol) is an open standard that lets an AI assistant connect to outside tools. For a travel seller, a visa provider's MCP server is the plug that lets an assistant look up entry requirements or prepare a visa application.

Do we need an MCP server, or is a visa API enough?

If you run your own assistant, a visa API called from your backend is enough and gives you more control. An MCP server matters when assistants you do not own, such as Claude or ChatGPT, need to reach the visa data directly.

Can an AI assistant apply for a visa on a traveler's behalf?

It can collect the details and prepare the application with a provider's tools. The traveler should still check it, accept the terms and pay on a page they control, and the government decides.

Who pays when a visa is sold through an AI chat?

It depends on the partner model: either the traveler pays the visa partner on its hosted page, or you take payment in your own checkout. Ask who is merchant of record before you connect anything.

Who submits the application to the government?

The visa partner or your own team, never the assistant on its own. Ask your partner whether it files with the authority and who handles requests for more documents.

What consent does the traveler need to give?

The MCP specification says users must explicitly consent to data access and that hosts must get explicit consent before invoking any tool. In practice, the traveler confirms before details are shared and approves the application before paying; check the rest with your privacy team.

Is SimpleVisa building an MCP server?

SimpleVisa is going to build its own MCP server as well. Today, the SimpleVisa REST API and sandbox keys are available on the developers page.

Sources

All checked on 27 October 2026.

Model Context Protocol, What is the Model Context Protocol (MCP)?
Model Context Protocol, Specification, version 2026-07-28, Key Principles and Implementation Guidelines
Visamundi, MCP overview
Visamundi, MCP tools
YourVisa.ai, Travel Visa API & MCP Integration
SimpleVisa, Developers, Coverage, Trust, Pricing

Product and integration guidance only. Not legal or immigration advice. Governments issue visas. Third-party product descriptions are quoted from their public pages on 27 October 2026 and may change.