Blooio
com.blooio/mcpblooio.comstreamable-httpv4.1.0Scanned
Send and receive iMessage, SMS, RCS, and WhatsApp, and manage contacts, chats, and numbers.
120 tools: 11 can delete or cancel things, 13 do something that can't be undone, 41 change things and 55 only read.
Tools: 11 delete, 13 irreversible, 41 write, 55 read.
- Reads private data · 17
- Reads text others write · 120
- Can send data out · 30
- 1 finding
Anlyon alternative
65 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
120 tools
Deletes or cancels 11Claude Code: deny
delete_contactDelete a contact Soft-deletes a contact and its identities.Reads text others writeNo findings
Why it is in this group
- The name "delete_contact" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Delete a contact Soft-deletes a contact and its identities.
Annotations the server declares
- title: Delete a contact
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
delete_groupDelete a groupReads text others writeNo findings
Why it is in this group
- The name "delete_group" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Delete a group
Annotations the server declares
- title: Delete a group
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
delete_priorityDelete a priorityReads text others writeNo findings
Why it is in this group
- The name "delete_priority" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Delete a priority
Annotations the server declares
- title: Delete a priority
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
delete_webhookDelete a webhookReads text others writeNo findings
Why it is in this group
- The name "delete_webhook" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Delete a webhook
Annotations the server declares
- title: Delete a webhook
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
release_numberRelease a number Give a number up.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Release a number Give a number up. A Blooio SMS or Blooio Voice number is released to the carrier at once and its channels retired; `number.removed` fires for each channel. An iMessage line is removed the same way as `DELETE /channels/{channel}`. OAuth apps need `numbers:manage`.
Annotations the server declares
- title: Release a number
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
remove_blooio_numberRemove (unsubscribe) a Blooio number Removes/unsubscribes an owned Blooio line, cancelling its subscription — the same flow as the dashboard unsubscribe button.Reads text others writeNo findings
Why it is in this group
- The name "remove_blooio_number" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Remove (unsubscribe) a Blooio number Removes/unsubscribes an owned Blooio line, cancelling its subscription — the same flow as the dashboard unsubscribe button. Accepts either the E.164 number or the `ch_` channel id as `{channel}`. A `reasons` array (why the customer is unsubscribing) is required; the same reason handling updates the CRM, posts to Slack, and emits a `number.removed` webhook. Requires the `numbers:manage` scope for OAuth apps.
Annotations the server declares
- title: Remove (unsubscribe) a Blooio number
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
remove_chat_backgroundRemove chat backgroundReads text others writeNo findings
Why it is in this group
- The name "remove_chat_background" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Remove chat background
Annotations the server declares
- title: Remove chat background
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
remove_contact_identityDetach an identityReads text others writeNo findings
Why it is in this group
- The name "remove_contact_identity" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Detach an identity
Annotations the server declares
- title: Detach an identity
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
remove_contact_tagRemove a contact tagReads text others writeNo findings
Why it is in this group
- The name "remove_contact_tag" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Remove a contact tag
Annotations the server declares
- title: Remove a contact tag
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
remove_group_iconRemove group iconReads text others writeNo findings
Why it is in this group
- The name "remove_group_icon" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Remove group icon
Annotations the server declares
- title: Remove group icon
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
stop_typingStop typing indicator Clears the business-to-customer typing indicator.Reads text others writeNo findings
Why it is in this group
- The name "stop_typing" says "stop": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Stop typing indicator Clears the business-to-customer typing indicator. Supported on Blooio channels and Apple Messages for Business.
Annotations the server declares
- title: Stop typing indicator
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
Can't be undone 13Claude Code: ask
add_ticket_commentReply to a ticket Adds a reply.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "add_ticket_comment" says "add": a word for a change.
- The description's first verb is "reply": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "add_ticket_comment" says "add" and "comment": it writes something other people read.
Description, as the server wrote it Reply to a ticket Adds a reply. A ticket waiting on you moves back to `in_progress`. Closed tickets and tickets whose `can_comment` is false return `403`. OAuth apps need `tickets:write`.
Annotations the server declares
- title: Reply to a ticket
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
create_chatFind or create a chat Finds or creates a 1:1 chat with a recipient on a channel.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "create_chat" says "create": a word for a change.
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.channel_id): what the tool writes goes there.
Description, as the server wrote it Find or create a chat Finds or creates a 1:1 chat with a recipient on a channel. Returns the chat (with `created` indicating whether it was newly created).
Annotations the server declares
- title: Find or create a chat
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
merge_contactMerge a contact Collapses two auto-created contacts for the same person into one.Reads text others writeNo findings
Why it is in this group
- The name "merge_contact" says "merge": a word for a change that another call does not undo.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Merge a contact Collapses two auto-created contacts for the same person into one. The survivor is the `{contactId}` in the path; the `source_contact_id` in the body is absorbed into it. Every identity on the source is re-parented onto the survivor, tags are unioned, the survivor keeps its own name (falling back to the source's), and the source becomes a deprecated tombstone stamped with `merged_into`. Because chats and messages reference identities (not contacts), all conversations and timeline entries follow the moved identities automatically — nothing is rewritten or lost, and reads such as the survivor's timeline immediately reflect the merge. Idempotent: re-merging the same source into the same survivor returns 200; a source already merged into a different contact returns 409. Emits a `contact.merged` webhook event.
Annotations the server declares
- title: Merge a contact
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
notify_messageNotify Anyway Breaks through the recipient's Focus for a message you sent, the same as tapping Notify Anyway in Messages.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "notify_message" says "notify": a word for sending, and what is sent cannot be taken back.
- The description says "cannot be undone".
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "notify_message" says "notify": it sends or publishes something to other people.
- outboundThe input takes a destination (input.chat_id): what the tool writes goes there.
Description, as the server wrote it Notify Anyway Breaks through the recipient's Focus for a message you sent, the same as tapping Notify Anyway in Messages. Use it when Read Focus status reports `silenced`. Calling it again for a message that was already notified succeeds. It cannot be undone. Returns 404 if the message isn't in the chat. Returns 409 for an inbound message, an SMS or RCS message, a message that hasn't been dispatched to the device yet, a group chat, or a non-Blooio channel.
Annotations the server declares
- title: Notify Anyway
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
place_callPlace a call Call `to` from one of the organization's Blooio Voice numbers.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "place_call" says "call": a word for a change.
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
- outboundThe input takes a URL (input.handler.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Place a call Call `to` from one of the organization's Blooio Voice numbers. The call starts `ringing`; when the callee answers, `handler` takes its audio and `call.answered` fires. With an `agent` handler, the Blooio agent that owns `from` talks to the callee. OAuth apps need `calls:write`.
Annotations the server declares
- title: Place a call
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
purchase_blooio_numbersPurchase Blooio numbers Purchase one or more Blooio lines.Reads text others writeNo findings
Why it is in this group
- The name "purchase_blooio_numbers" says "purchase": a word that usually means money moves, which cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Purchase Blooio numbers Purchase one or more Blooio lines. Purchases are asynchronous and billable: the call charges the organization's default payment method and returns a `purchase_id`; the lines are provisioned when Stripe confirms the invoice, at which point a `number.purchase.completed` webhook fires (or `number.purchase.failed`). A card requiring 3DS/SCA returns `status: action_required` with an `action_url`, and also emits `number.purchase.action_required`.
Annotations the server declares
- title: Purchase Blooio numbers
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
send_call_dtmfSend DTMF Play keypad tones into a connected call, to navigate a phone menu for example.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "send_call_dtmf" says "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "send_call_dtmf" says "send": it sends or publishes something to other people.
Description, as the server wrote it Send DTMF Play keypad tones into a connected call, to navigate a phone menu for example. OAuth apps need `calls:write`.
Annotations the server declares
- title: Send DTMF
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
send_chat_messageSend a message to a chat Sends a message into an existing chat.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "send_chat_message" says "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "send_chat_message" says "send": it sends or publishes something to other people.
- outboundThe input takes a destination (input.chat_id): what the tool writes goes there.
- outboundThe input takes a URL (input.rich_link.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Send a message to a chat Sends a message into an existing chat. Both the sender channel and recipient are inferred from the chat, so `from` and `to` must not be supplied. Returns the message object at the top level (not wrapped in `data`).
Annotations the server declares
- title: Send a message to a chat
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
send_messageSend a message The primary endpoint for starting a message.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "send_message" says "send": a word for sending, and what is sent cannot be taken back.
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "send_message" says "send": it sends or publishes something to other people.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
- outboundThe input takes a URL (input.rich_link.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Send a message The primary endpoint for starting a message. The common send is entirely scalar: `{ "from": "+15551230001", "to": "+15551234567", "text": "Hello" }`.
Annotations the server declares
- title: Send a message
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
send_message_to_channelSend a message on a specific channel Channel-scoped equivalent of `POST /messages` with an explicit `from`: `:channel` accepts the same phone number (URL-encode `+` as `%2B`), alia…Reads text others writeCan send data outNo findings
Why it is in this group
- The name "send_message_to_channel" says "send": a word for sending, and what is sent cannot be taken back.
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "send_message_to_channel" says "send": it sends or publishes something to other people.
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
- outboundThe input takes a URL (input.rich_link.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Send a message on a specific channel Channel-scoped equivalent of `POST /messages` with an explicit `from`: `:channel` accepts the same phone number (URL-encode `+` as `%2B`), alias, or `ch_...` value `from` accepts, and the body omits `from`. Multiple recipients on a group-capable channel (blooio/whatsapp) form a single group thread; on other channels they fan out to individual sends (max 100).
Annotations the server declares
- title: Send a message on a specific channel
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
send_pollSend a poll Sends a native iMessage poll to a chat.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "send_poll" says "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "send_poll" says "send": it sends or publishes something to other people.
- outboundThe input takes a destination (input.chat_id): what the tool writes goes there.
Description, as the server wrote it Send a poll Sends a native iMessage poll to a chat. Requires a title and 2+ options. Blooio channels only.
Annotations the server declares
- title: Send a poll
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
send_ten_dlc_brand_otpSend the brand verification PIN Text a verification PIN to a `SOLE_PROPRIETOR` brand's `mobile_phone`.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "send_ten_dlc_brand_otp" says "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "send_ten_dlc_brand_otp" says "send": it sends or publishes something to other people.
Description, as the server wrote it Send the brand verification PIN Text a verification PIN to a `SOLE_PROPRIETOR` brand's `mobile_phone`. OAuth apps need `numbers:manage`.
Annotations the server declares
- title: Send the brand verification PIN
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
transfer_callTransfer a call Move a connected call to another handler, or to the phone number `to`, which takes it off Blooio once that number answers.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "transfer_call" says "transfer": a word for a change that another call does not undo.
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
- outboundThe input takes a URL (input.handler.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Transfer a call Move a connected call to another handler, or to the phone number `to`, which takes it off Blooio once that number answers. A call a Blooio agent handed off can be transferred too. A transfer that fails partway, or a number that doesn't answer, leaves the call waiting for a teammate, as a handed-off call does. OAuth apps need `calls:write`.
Annotations the server declares
- title: Transfer a call
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
Changes things 41Claude Code: ask
add_contact_identityAttach an identity Attaches a phone/email identity (on a channel type) to a contact.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "add_contact_identity" says "add": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.channel_id): what the tool writes goes there.
Description, as the server wrote it Attach an identity Attaches a phone/email identity (on a channel type) to a contact.
Annotations the server declares
- title: Attach an identity
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
add_contact_tagsAdd contact tagsReads text others writeNo findings
Why it is in this group
- The name "add_contact_tags" says "add": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Add contact tags
Annotations the server declares
- title: Add contact tags
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
add_reactionReact to a message Adds or removes a tapback reaction on any message in the chat — inbound (received) or outbound — addressed by the message `id` from the List messages endpoint.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "add_reaction" says "add": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.chat_id): what the tool writes goes there.
Description, as the server wrote it React to a message Adds or removes a tapback reaction on any message in the chat — inbound (received) or outbound — addressed by the message `id` from the List messages endpoint. Use a `+` prefix to add and `-` to remove (e.g. `+love`, `-love`). Returns 404 if the message isn't in the chat and 409 if it hasn't been dispatched to the device yet. Blooio channels only.
Annotations the server declares
- title: React to a message
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
answer_callAnswer a call Answer an inbound call that's ringing, or take a call a Blooio agent handed off, with `handler`.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "answer_call" says "call": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.handler.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Answer a call Answer an inbound call that's ringing, or take a call a Blooio agent handed off, with `handler`. The first answer wins; any later one gets `409 call_not_ringing`. OAuth apps need `calls:write`.
Annotations the server declares
- title: Answer a call
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
appeal_ten_dlc_campaignAppeal a campaign Ask for a rejected campaign (`review_failed` or `mno_rejected`) to be reviewed again, saying what you fixed.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Appeal a campaign Ask for a rejected campaign (`review_failed` or `mno_rejected`) to be reviewed again, saying what you fixed. OAuth apps need `numbers:manage`.
Annotations the server declares
- title: Appeal a campaign
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
batch_lookup_phone_numbersBatch phone number lookup Looks up up to 100 phone numbers.Reads text others write1 finding
Why it is in this group
- The name "batch_lookup_phone_numbers" says "lookup": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
The server marks "batch_lookup_phone_numbers" as not read-only (readOnlyHint: false), and its words say it reads.
What this check looks forMatched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":true}; The name "batch_lookup_phone_numbers" says "lookup": a word for reading.
Description, as the server wrote it Batch phone number lookup Looks up up to 100 phone numbers. Requires an enterprise plan.
Annotations the server declares
- title: Batch phone number lookup
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
buy_numbersBuy numbers Buy 1 to 10 US local numbers found with `GET /numbers/available`, with `products` turned on.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.phone_numbers): what the tool writes goes there.
Description, as the server wrote it Buy numbers Buy 1 to 10 US local numbers found with `GET /numbers/available`, with `products` turned on. The purchase finishes asynchronously: the response is a `provisioning` purchase, and `number.purchase.completed` or `number.purchase.failed` fires when it settles (or poll `GET /numbers/purchases/{purchaseId}`). Retrying with the same `Idempotency-Key` and body returns the same purchase. An SMS number sends texts once it's assigned to a provisioned 10DLC campaign, which Blooio does automatically when the organization has one. OAuth apps need `numbers:manage`.
Annotations the server declares
- title: Buy numbers
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
contact_capabilitiesCheck if a phone number or email is reachable via iMessage / SMS / RCS.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Check if a phone number or email is reachable via iMessage / SMS / RCS. Resolves (or creates) the contact for that identifier, then returns its capabilities. Creating the contact is a side effect.
Annotations the server declares
- title: Check capabilities for a phone number or email
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
create_contactCreate a contact Creates a contact, optionally with one identity (phone/email on a channel type).Reads text others writeCan send data outNo findings
Why it is in this group
- The name "create_contact" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.channel_id): what the tool writes goes there.
Description, as the server wrote it Create a contact Creates a contact, optionally with one identity (phone/email on a channel type).
Annotations the server declares
- title: Create a contact
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
create_groupCreate a group Creates a group chat on a group-capable channel (blooio/whatsapp) with one or more members.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "create_group" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.channel_id): what the tool writes goes there.
Description, as the server wrote it Create a group Creates a group chat on a group-capable channel (blooio/whatsapp) with one or more members. No iMessage conversation exists yet: the first message sent to the group opens it, and `chat_linked` becomes `true` once it does. There is no separate linking step.
Annotations the server declares
- title: Create a group
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
create_priorityCreate a priority Creates a channel priority.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "create_priority" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.channels): what the tool writes goes there.
Description, as the server wrote it Create a priority Creates a channel priority. Channels sharing a `priority` (and type) form a pool; ascending priority is the send-time waterfall. The first priority created for a key becomes its default unless `is_default: false` is set.
Annotations the server declares
- title: Create a priority
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
create_ten_dlc_campaignCreate a campaign Register a campaign under the organization's registered brand.Reads text others writeNo findings
Why it is in this group
- The name "create_ten_dlc_campaign" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Create a campaign Register a campaign under the organization's registered brand. The registry and carriers review it asynchronously; `registration.campaign.updated` fires as its `status` changes. Once a campaign reaches `mno_provisioned`, Blooio assigns the organization's unassigned SMS numbers to its oldest provisioned campaign. OAuth apps need `numbers:manage`.
Annotations the server declares
- title: Create a campaign
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
create_ticketOpen a ticket Opens a support ticket for the Blooio team.Reads text others writeNo findings
Why it is in this group
- The name "create_ticket" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Open a ticket Opens a support ticket for the Blooio team. Every ticket opens at `medium` priority; only Blooio support changes it, so sending `priority` returns `422 priority_not_allowed`. To request call forwarding, prefer `POST /me/numbers/{number}/call-forwarding`, which takes the destination as a field. OAuth apps need `tickets:write`.
Annotations the server declares
- title: Open a ticket
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
create_webhookCreate a webhook Subscribes an HTTPS endpoint to events.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "create_webhook" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.channel_id): what the tool writes goes there.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Create a webhook Subscribes an HTTPS endpoint to events. Returns the signing secret once, on creation.
Annotations the server declares
- title: Create a webhook
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
decide_bloobability_v2Decide policies against a conversation Decides every policy you send against one conversation with Bloobability v2.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Decide policies against a conversation Decides every policy you send against one conversation with Bloobability v2. Each result carries two calibrated numbers in [0, 1]: `probability` (the policy holds) and `answerable` (the conversation contains enough to judge it). There is no verdict and no threshold: choose your own. A low `answerable` never changes `probability`.
Annotations the server declares
- title: Decide policies against a conversation
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
hangup_callHang up a call End a call.Reads text others writeNo findings
Why it is in this group
- The name "hangup_call" says "call": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Hang up a call End a call. It ends once the carrier confirms, and `call.ended` fires. OAuth apps need `calls:write`.
Annotations the server declares
- title: Hang up a call
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
mark_chat_readMark chat as read Sends a read receipt.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "mark_chat_read" says "mark": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.chat_id): what the tool writes goes there.
Description, as the server wrote it Mark chat as read Sends a read receipt. Blooio channels only.
Annotations the server declares
- title: Mark chat as read
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
put_ten_dlc_brandRegister the brand Register the organization's brand, or resubmit it with corrected details.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "put_ten_dlc_brand" says "put": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.phone): what the tool writes goes there.
Description, as the server wrote it Register the brand Register the organization's brand, or resubmit it with corrected details. The registry reviews it asynchronously; `registration.brand.updated` fires as its `status` changes. A `SOLE_PROPRIETOR` brand must then verify its mobile number (`requires_otp`). OAuth apps need `numbers:manage`.
Annotations the server declares
- title: Register the brand
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
refresh_location_contactsRefresh Find My locations Forces a refresh of Find My location data from the device.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Refresh Find My locations Forces a refresh of Find My location data from the device.
Annotations the server declares
- title: Refresh Find My locations
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
replay_webhook_deliveryReplay a webhook delivery Re-sends a past delivery.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Replay a webhook delivery Re-sends a past delivery. Also available at `/webhooks/{webhookId}/logs/{deliveryId}/replay`.
Annotations the server declares
- title: Replay a webhook delivery
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
request_call_forwardingRequest call forwarding Opens a support ticket to forward calls from an owned dedicated or inbound Blooio number.Reads text others writeNo findings
Why it is in this group
- The name "request_call_forwarding" says "request": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Request call forwarding Opens a support ticket to forward calls from an owned dedicated or inbound Blooio number. The destination must be a US E.164 number. Shared or foreign source numbers are rejected. Forwarding isn't instant: check its progress with `GET /tickets/{ticket_id}` using the returned `ticket_id`, whose `forwarding.state` reaches `completed` when calls forward. OAuth apps need `numbers:manage` to open the request and `tickets:read` to check it.
Annotations the server declares
- title: Request call forwarding
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
rotate_webhook_secretRotate webhook signing secret Rotates and returns a new signing secret (once).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Rotate webhook signing secret Rotates and returns a new signing secret (once).
Annotations the server declares
- title: Rotate webhook signing secret
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
set_chat_backgroundSet chat background Uploads a chat background image.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "set_chat_background" says "set": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.chat_id): what the tool writes goes there.
Description, as the server wrote it Set chat background Uploads a chat background image. Max 10MB; image/jpeg|png|gif|webp|heic|heif. Blooio channels only.
Annotations the server declares
- title: Set chat background
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
set_group_iconSet group icon Uploads a group icon.Reads text others writeNo findings
Why it is in this group
- The name "set_group_icon" says "set": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Set group icon Uploads a group icon. Max 10MB; image/jpeg|png|gif|webp|heic|heif. Requires the group chat to be linked on a device.
Annotations the server declares
- title: Set group icon
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
set_typingStart/stop typing indicator Shows or clears a business-to-customer typing indicator.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "set_typing" says "set": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.chat_id): what the tool writes goes there.
Description, as the server wrote it Start/stop typing indicator Shows or clears a business-to-customer typing indicator. Supported on Blooio channels and Apple Messages for Business.
Annotations the server declares
- title: Start/stop typing indicator
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
update_channel_profileUpdate channel profile Partial update of the channel profile (`display_name`, `about`, `email`, `avatar`).Reads text others writeCan send data outNo findings
Why it is in this group
- The name "update_channel_profile" says "update": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it Update channel profile Partial update of the channel profile (`display_name`, `about`, `email`, `avatar`). Stored under `metadata.profile` and returned on `GET /channels/{channel}`. Null or empty string clears a field. Unknown keys are rejected. This writes Blooio metadata only; it does not push a display name to the device.
Annotations the server declares
- title: Update channel profile
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
update_channel_settingsUpdate channel settings Partial update of a channel's settings (send only the keys you want to change).Reads text others writeCan send data outNo findings
Why it is in this group
- The name "update_channel_settings" says "update": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it Update channel settings Partial update of a channel's settings (send only the keys you want to change). Keys are per channel type. Blooio (P2P numbers): `auto_mark_read` is available on dedicated and inbound lines; `auto_share_contact` is dedicated-only AND the line must have a contact card (name or photo) set up; `imessage_only` is available on every line. Apple Messages for Business and WhatsApp Business: `opener`, a partial update of the channel's opener (send only the fields you want to change). Blooio Voice: `inbound`, with `handler` (`softphone`, `agent`, or `api`) and `ring_timeout_seconds` (5 to 120); `agent` needs a live Blooio agent that owns the number. Turning a setting OFF is always allowed. Errors return a machine-readable `code`: `settings_unsupported_for_channel_type` (403, a channel type without settings), `auto_mark_read_not_allowed` / `auto_share_contact_not_allowed` (403, line type can't enable it), `contact_card_not_set_up` (403, enable auto_share_contact with no contact card), `agent_unavailable` (409, the `agent` handler on a number no live Blooio agent owns), `no_settings_provided` (422, empty update), `invalid_settings` (422, unknown key or field, a value of the wrong type, or an…
Annotations the server declares
- title: Update channel settings
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
update_chatUpdate a chat Sets chat state (`open`/`closed`) on an Apple Messages for Business chat.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "update_chat" says "update": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.chat_id): what the tool writes goes there.
Description, as the server wrote it Update a chat Sets chat state (`open`/`closed`) on an Apple Messages for Business chat. Chats on every other channel return 422 `state_not_writable`: `closed` reflects the customer ending an Apple Messages for Business conversation, and no other protocol has an equivalent.
Annotations the server declares
- title: Update a chat
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
update_contactUpdate a contactReads text others writeNo findings
Why it is in this group
- The name "update_contact" says "update": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Update a contact
Annotations the server declares
- title: Update a contact
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
update_contact_cardUpdate a number's contact card Updates the contact card (name, avatar, sharing settings) shared from this number.Reads text others writeNo findings
Why it is in this group
- The name "update_contact_card" says "update": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Update a number's contact card Updates the contact card (name, avatar, sharing settings) shared from this number. At least one field is required.
Annotations the server declares
- title: Update a number's contact card
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
update_contact_identityUpdate an identity Renames a contact identity in place.Reads text others writeNo findings
Why it is in this group
- The name "update_contact_identity" says "update": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Update an identity Renames a contact identity in place. An optional name updates the parent contact in the same request.
Annotations the server declares
- title: Update an identity
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
update_groupUpdate a groupReads text others writeNo findings
Why it is in this group
- The name "update_group" says "update": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Update a group
Annotations the server declares
- title: Update a group
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
update_numberUpdate a number Turn a Blooio SMS or Blooio Voice number's products on and off, or assign its SMS channel to a 10DLC campaign.Reads text others writeNo findings
Why it is in this group
- The name "update_number" says "update": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Update a number Turn a Blooio SMS or Blooio Voice number's products on and off, or assign its SMS channel to a 10DLC campaign. Turning `sms` off takes the number off its campaign. iMessage lines can't be changed here. OAuth apps need `numbers:manage`.
Annotations the server declares
- title: Update a number
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
update_priorityUpdate a priority Updates a priority's name, default flag, and/or channel set.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "update_priority" says "update": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.channels): what the tool writes goes there.
Description, as the server wrote it Update a priority Updates a priority's name, default flag, and/or channel set. When `channels` is supplied it replaces the priority's channels wholesale.
Annotations the server declares
- title: Update a priority
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
update_ten_dlc_campaignUpdate campaign samples Replace a campaign's sample messages, the field carriers most often ask to change.Reads text others writeNo findings
Why it is in this group
- The name "update_ten_dlc_campaign" says "update": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Update campaign samples Replace a campaign's sample messages, the field carriers most often ask to change. OAuth apps need `numbers:manage`.
Annotations the server declares
- title: Update campaign samples
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
update_ticketUpdate a ticket's status Changes a ticket's status, for example to close a request you no longer need.Reads text others writeNo findings
Why it is in this group
- The name "update_ticket" says "update": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Update a ticket's status Changes a ticket's status, for example to close a request you no longer need. Only `status` can change: `priority` is set by Blooio support and returns `422 priority_not_allowed`. Purchase, system, and billing tickets are managed by Blooio and return `403`. OAuth apps need `tickets:write`.
Annotations the server declares
- title: Update a ticket's status
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
update_webhookUpdate a webhook Updates url, status (`active`/`disabled`), or the payload `api_version`.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "update_webhook" says "update": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Update a webhook Updates url, status (`active`/`disabled`), or the payload `api_version`. A version change applies to the next event delivered; deliveries already made, and replays of them, keep the version they were sent with.
Annotations the server declares
- title: Update a webhook
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
upload_contact_card_avatarUpload a contact card avatar Uploads an avatar image for the number's contact card.Reads text others writeNo findings
Why it is in this group
- The name "upload_contact_card_avatar" says "upload": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Upload a contact card avatar Uploads an avatar image for the number's contact card. Max 10MB.
Annotations the server declares
- title: Upload a contact card avatar
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
verify_ten_dlc_brand_otpVerify the brand PIN Submit the PIN texted by `POST /10dlc/brand/otp`.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Verify the brand PIN Submit the PIN texted by `POST /10dlc/brand/otp`. OAuth apps need `numbers:manage`.
Annotations the server declares
- title: Verify the brand PIN
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
vote_pollVote on a poll Casts or toggles a vote by `option_index` (0-based) or `option` text.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.chat_id): what the tool writes goes there.
Description, as the server wrote it Vote on a poll Casts or toggles a vote by `option_index` (0-based) or `option` text. Blooio channels only.
Annotations the server declares
- title: Vote on a poll
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
Only reads 55Show 55 read-only tools
get_blooio_purchaseGet purchase status Poll the status of an asynchronous number purchase by its `purchase_id`.Reads text others writeNo findings
Why it is in this group
- The name "get_blooio_purchase" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get purchase status Poll the status of an asynchronous number purchase by its `purchase_id`. Returns `pending`/`provisioning`, `completed` (with the provisioned allocations), or `failed`. Requires the `numbers:read` scope for OAuth apps.
Annotations the server declares
- title: Get purchase status
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_callGet a call One of the organization's calls.Reads text others writeNo findings
Why it is in this group
- The name "get_call" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get a call One of the organization's calls. OAuth apps need `calls:read`.
Annotations the server declares
- title: Get a call
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_call_transcriptGet a call transcript What was said on a call while a Blooio agent had it, in order.Reads text others writeNo findings
Why it is in this group
- The name "get_call_transcript" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get a call transcript What was said on a call while a Blooio agent had it, in order. Empty for calls no agent took. Lines are added while the call is up. OAuth apps need `calls:read`.
Annotations the server declares
- title: Get a call transcript
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_channelGet a channelReads text others writeNo findings
Why it is in this group
- The name "get_channel" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get a channel
Annotations the server declares
- title: Get a channel
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_channel_capabilitiesGet channel capabilities Returns supported protocols, content types, actions, and interactive features for a channel.Reads text others writeNo findings
Why it is in this group
- The name "get_channel_capabilities" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get channel capabilities Returns supported protocols, content types, actions, and interactive features for a channel.
Annotations the server declares
- title: Get channel capabilities
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_channel_healthGet line health Messaging health for one dedicated or inbound Blooio line: its live safety state plus reply, delivery, and risk metrics over the trailing `days`.Reads text others writeNo findings
Why it is in this group
- The name "get_channel_health" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get line health Messaging health for one dedicated or inbound Blooio line: its live safety state plus reply, delivery, and risk metrics over the trailing `days`. Built for polling.
Annotations the server declares
- title: Get line health
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_channel_settingsGet channel settings Per-channel settings for channel types that support them.Reads text others writeNo findings
Why it is in this group
- The name "get_channel_settings" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get channel settings Per-channel settings for channel types that support them. `settings` and `available` are per channel type: Blooio (P2P numbers) exposes `auto_mark_read`, `auto_share_contact`, and `imessage_only`; Apple Messages for Business and WhatsApp Business expose `opener`; Blooio Voice exposes `inbound`, who answers the number's calls and how long they ring. `available[key]` says whether THIS channel may turn `key` on (type-gated). A channel whose type has no settings yet returns `403 settings_unsupported_for_channel_type`.
Annotations the server declares
- title: Get channel settings
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_chatGet a chat The chat of a group that was merged into another group on its first send returns the surviving group's chat on the same number.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_chat" says "get": a word for reading.
What it can reach
- private-dataThe name "get_chat" says "get" and "chat": it reads messages.
- private-dataThe description's first sentence says "get" and "chat": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "get_chat" says "get" and "chat": it reads messages, which other people can write.
- untrusted-inputThe description's first sentence says "get" and "chat": it reads messages, which other people can write.
Description, as the server wrote it Get a chat The chat of a group that was merged into another group on its first send returns the surviving group's chat on the same number.
Annotations the server declares
- title: Get a chat
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_chat_backgroundGet chat background Reads the chat's background image (Blooio channels).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_chat_background" says "get": a word for reading.
What it can reach
- private-dataThe name "get_chat_background" says "get" and "chat": it reads messages.
- private-dataThe description's first sentence says "get" and "chat": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "get_chat_background" says "get" and "chat": it reads messages, which other people can write.
- untrusted-inputThe description's first sentence says "get" and "chat": it reads messages, which other people can write.
Description, as the server wrote it Get chat background Reads the chat's background image (Blooio channels). Reads live from the device.
Annotations the server declares
- title: Get chat background
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_chat_focusRead Focus status Reads whether the other person in the chat has notifications silenced by a Focus, as their device shares it over iMessage.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_chat_focus" says "get": a word for reading.
What it can reach
- private-dataThe name "get_chat_focus" says "get" and "chat": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "get_chat_focus" says "get" and "chat": it reads messages, which other people can write.
Description, as the server wrote it Read Focus status Reads whether the other person in the chat has notifications silenced by a Focus, as their device shares it over iMessage. `silenced` means new messages arrive quietly; to break through for a message you sent, use Notify Anyway. `unknown` means the device has no status for this person (for example, a handle Messages has not seen yet, or someone who does not share Focus status). Apple does not expose a way to turn another person's Focus on or off. Returns 409 for group chats and non-Blooio channels.
Annotations the server declares
- title: Read Focus status
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_contactGet a contactReads private dataReads text others writeNo findings
Why it is in this group
- The name "get_contact" says "get": a word for reading.
What it can reach
- private-dataThe name "get_contact" says "get" and "contact": it reads contacts.
- private-dataThe description's first sentence says "get" and "contact": it reads contacts.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get a contact
Annotations the server declares
- title: Get a contact
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_contact_capabilitiesGet contact capabilities Returns per-identity reachability/capabilities (iMessage/SMS/RCS, etc.) for a contact.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_contact_capabilities" says "get": a word for reading.
What it can reach
- private-dataThe name "get_contact_capabilities" says "get" and "contact": it reads contacts.
- private-dataThe description's first sentence says "get" and "contact": it reads contacts.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get contact capabilities Returns per-identity reachability/capabilities (iMessage/SMS/RCS, etc.) for a contact. For iMessage (blooio) identities this is a LIVE per-number lookup performed by an active iMessage channel — the request is rejected with 409 if the API key has no active iMessage (blooio) channel provisioned.
Annotations the server declares
- title: Get contact capabilities
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_contact_cardGet a number's contact cardReads private dataReads text others writeNo findings
Why it is in this group
- The name "get_contact_card" says "get": a word for reading.
What it can reach
- private-dataThe name "get_contact_card" says "get" and "contact": it reads contacts.
- private-dataThe description's first sentence says "get" and "contact": it reads contacts.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get a number's contact card
Annotations the server declares
- title: Get a number's contact card
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_contact_timelineGet contact timeline A single, chronological cross-channel activity feed for a contact, unifying every conversation the contact takes part in — both 1:1 chats keyed on the contact'…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_contact_timeline" says "get": a word for reading.
What it can reach
- private-dataThe name "get_contact_timeline" says "get" and "contact": it reads contacts.
- private-dataThe description's first sentence says "get" and "contact": it reads contacts.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get contact timeline A single, chronological cross-channel activity feed for a contact, unifying every conversation the contact takes part in — both 1:1 chats keyed on the contact's identities and group chats where the contact is a current member — across all channel types. After a merge, the survivor's timeline includes the absorbed contact's history automatically. Each entry is a polymorphic envelope tagged by `type`; ordered newest-first by `occurred_at`. By default only `message` entries are returned; pass `include_events=true` to interleave lifecycle and chat events.
Annotations the server declares
- title: Get contact timeline
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_eventGet an eventReads text others writeNo findings
Why it is in this group
- The name "get_event" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get an event
Annotations the server declares
- title: Get an event
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_groupGet a group A group id that was merged into another group on its first send (see Create a group) returns the surviving group.Reads text others writeNo findings
Why it is in this group
- The name "get_group" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get a group A group id that was merged into another group on its first send (see Create a group) returns the surviving group. Compare the returned `id` with the one you asked for to pick up the canonical id.
Annotations the server declares
- title: Get a group
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_location_contactGet one Find My contactReads private dataReads text others writeNo findings
Why it is in this group
- The name "get_location_contact" says "get": a word for reading.
What it can reach
- private-dataThe name "get_location_contact" says "get" and "contact": it reads contacts.
- private-dataThe description's first sentence says "get" and "contact": it reads contacts.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get one Find My contact
Annotations the server declares
- title: Get one Find My contact
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_messageGet a messageReads private dataReads text others writeNo findings
Why it is in this group
- The name "get_message" says "get": a word for reading.
What it can reach
- private-dataThe name "get_message" says "get" and "message": it reads messages.
- private-dataThe description's first sentence says "get" and "message": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "get_message" says "get" and "message": it reads messages, which other people can write.
- untrusted-inputThe description's first sentence says "get" and "message": it reads messages, which other people can write.
Description, as the server wrote it Get a message
Annotations the server declares
- title: Get a message
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_message_statusGet message status Lightweight delivery status of a message.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_message_status" says "get": a word for reading.
What it can reach
- private-dataThe name "get_message_status" says "get" and "message": it reads messages.
- private-dataThe description's first sentence says "get" and "message": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "get_message_status" says "get" and "message": it reads messages, which other people can write.
- untrusted-inputThe description's first sentence says "get" and "message": it reads messages, which other people can write.
Description, as the server wrote it Get message status Lightweight delivery status of a message.
Annotations the server declares
- title: Get message status
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_my_default_priorityGet the key's default priority Returns the calling API key's default channel priority, or `{ "data": null }` when none is configured (in which case the agnostic send falls back to …Reads text others writeNo findings
Why it is in this group
- The name "get_my_default_priority" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get the key's default priority Returns the calling API key's default channel priority, or `{ "data": null }` when none is configured (in which case the agnostic send falls back to the implicit Blooio pool of the key's own numbers).
Annotations the server declares
- title: Get the key's default priority
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_numberGet a number One of the organization's numbers, with its products and channels.Reads text others writeNo findings
Why it is in this group
- The name "get_number" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get a number One of the organization's numbers, with its products and channels. OAuth apps need `numbers:read`.
Annotations the server declares
- title: Get a number
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_number_purchaseGet a number purchase A purchase made with `POST /numbers`.Reads text others writeNo findings
Why it is in this group
- The name "get_number_purchase" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get a number purchase A purchase made with `POST /numbers`. Its numbers appear in `GET /numbers` once it's `completed`. OAuth apps need `numbers:read`.
Annotations the server declares
- title: Get a number purchase
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_poll_resultsGet poll resultsReads text others writeNo findings
Why it is in this group
- The name "get_poll_results" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get poll results
Annotations the server declares
- title: Get poll results
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_priorityGet a priorityReads text others writeNo findings
Why it is in this group
- The name "get_priority" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get a priority
Annotations the server declares
- title: Get a priority
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_ten_dlc_brandGet the brand The organization's 10DLC brand.Reads text others writeNo findings
Why it is in this group
- The name "get_ten_dlc_brand" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get the brand The organization's 10DLC brand. OAuth apps need `numbers:read`.
Annotations the server declares
- title: Get the brand
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_ten_dlc_campaignGet a campaign One of the organization's 10DLC campaigns.Reads text others writeNo findings
Why it is in this group
- The name "get_ten_dlc_campaign" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get a campaign One of the organization's 10DLC campaigns. OAuth apps need `numbers:read`.
Annotations the server declares
- title: Get a campaign
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_ten_dlc_optionsList registration options The entity types, verticals, and campaign use cases a brand and campaign can name.Reads text others writeNo findings
Why it is in this group
- The name "get_ten_dlc_options" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List registration options The entity types, verticals, and campaign use cases a brand and campaign can name. OAuth apps need `numbers:read`.
Annotations the server declares
- title: List registration options
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_ten_dlc_usecase_qualificationCheck a use case Whether the organization's brand qualifies for a campaign use case, and how many sub use cases it takes.Reads text others writeNo findings
Why it is in this group
- The name "get_ten_dlc_usecase_qualification" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Check a use case Whether the organization's brand qualifies for a campaign use case, and how many sub use cases it takes. OAuth apps need `numbers:read`.
Annotations the server declares
- title: Check a use case
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_ticketGet a ticket Returns one ticket.Reads text others writeNo findings
Why it is in this group
- The name "get_ticket" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "get_ticket" says "get" and "ticket": it reads issues, which other people can write.
- untrusted-inputThe description's first sentence says "get" and "ticket": it reads issues, which other people can write.
Description, as the server wrote it Get a ticket Returns one ticket. Poll this to check a call-forwarding request: its `forwarding.state` reads `pending`, `in_progress`, `completed`, or `failed`, and a closed ticket always reads `completed`. OAuth apps need `tickets:read`.
Annotations the server declares
- title: Get a ticket
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_webhookGet a webhookReads text others writeNo findings
Why it is in this group
- The name "get_webhook" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get a webhook
Annotations the server declares
- title: Get a webhook
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_available_blooio_numbersList available Blooio numbers Browse Blooio number inventory available to purchase.Reads text others writeNo findings
Why it is in this group
- The name "list_available_blooio_numbers" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List available Blooio numbers Browse Blooio number inventory available to purchase. `type=shared` returns available shared lines; `type=dedicated` returns unassigned dedicated inventory. When one or more `area_code` values are supplied with `type=dedicated` or `type=inbound`, the response is an area-code quote: each requested code is reported as either in stock (provisioned free) or requiring a custom order (a custom area-code fee applies and a provisioning ticket is opened at purchase). Requires the number purchase API feature to be enabled for the organization, and the `numbers:read` scope for OAuth apps.
Annotations the server declares
- title: List available Blooio numbers
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_callsList calls The organization's calls, newest first.Reads text others writeNo findings
Why it is in this group
- The name "list_calls" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List calls The organization's calls, newest first. OAuth apps need `calls:read`.
Annotations the server declares
- title: List calls
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_channelsList channels Lists messaging channels for the organization.Reads text others writeNo findings
Why it is in this group
- The name "list_channels" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List channels Lists messaging channels for the organization. Ordinary sends do not require a channel id; use this endpoint to inspect capabilities or obtain an exact channel id for advanced integrations.
Annotations the server declares
- title: List channels
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_chat_messagesList chat messages Lists messages in a chat, newest first by default.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_chat_messages" says "list": a word for reading.
What it can reach
- private-dataThe name "list_chat_messages" says "list" and "chat": it reads messages.
- private-dataThe description's first sentence says "list" and "chat": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "list_chat_messages" says "list" and "chat": it reads messages, which other people can write.
- untrusted-inputThe description's first sentence says "list" and "chat": it reads messages, which other people can write.
Description, as the server wrote it List chat messages Lists messages in a chat, newest first by default. Use `order=asc` for oldest first.
Annotations the server declares
- title: List chat messages
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_chatsList chats Lists conversations, most recent first.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_chats" says "list": a word for reading.
What it can reach
- private-dataThe name "list_chats" says "list" and "chat": it reads messages.
- private-dataThe description's first sentence says "list" and "chat": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "list_chats" says "list" and "chat": it reads messages, which other people can write.
- untrusted-inputThe description's first sentence says "list" and "chat": it reads messages, which other people can write.
Description, as the server wrote it List chats Lists conversations, most recent first. Filter by channel type, state, channel, or contact.
Annotations the server declares
- title: List chats
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_contact_identitiesList contact identitiesReads private dataReads text others writeNo findings
Why it is in this group
- The name "list_contact_identities" says "list": a word for reading.
What it can reach
- private-dataThe name "list_contact_identities" says "list" and "contact": it reads contacts.
- private-dataThe description's first sentence says "list" and "contact": it reads contacts.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List contact identities
Annotations the server declares
- title: List contact identities
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_contact_tagsList contact tagsReads private dataReads text others writeNo findings
Why it is in this group
- The name "list_contact_tags" says "list": a word for reading.
What it can reach
- private-dataThe name "list_contact_tags" says "list" and "contact": it reads contacts.
- private-dataThe description's first sentence says "list" and "contact": it reads contacts.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List contact tags
Annotations the server declares
- title: List contact tags
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_contactsList contacts Lists contacts.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_contacts" says "list": a word for reading.
What it can reach
- private-dataThe name "list_contacts" says "list" and "contact": it reads contacts.
- private-dataThe description's first sentence says "list" and "contact": it reads contacts.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List contacts Lists contacts. Cursor pagination is the default. Supplying `offset`, `q`, `tag`, `sort`, or `filter` switches to offset pagination and includes `pagination.total`.
Annotations the server declares
- title: List contacts
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_eventsList events Unified activity feed (message lifecycle, polls, groups, reactions, typing, payments, `safety.state_changed`, `safety.number_banned`).Reads text others writeNo findings
Why it is in this group
- The name "list_events" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List events Unified activity feed (message lifecycle, polls, groups, reactions, typing, payments, `safety.state_changed`, `safety.number_banned`). Filter by type, chat, or message.
Annotations the server declares
- title: List events
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_group_membersList group members For a merged group id, lists the members of the surviving group.Reads text others writeNo findings
Why it is in this group
- The name "list_group_members" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List group members For a merged group id, lists the members of the surviving group.
Annotations the server declares
- title: List group members
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_groupsList groupsReads text others writeNo findings
Why it is in this group
- The name "list_groups" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List groups
Annotations the server declares
- title: List groups
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_location_contactsList Find My contacts Lists Find My friends sharing their location with the linked Apple account.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_location_contacts" says "list": a word for reading.
What it can reach
- private-dataThe name "list_location_contacts" says "list" and "contact": it reads contacts.
- private-dataThe description's first sentence says "list" and "contact": it reads contacts.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List Find My contacts Lists Find My friends sharing their location with the linked Apple account.
Annotations the server declares
- title: List Find My contacts
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_message_eventsList message events Lifecycle events for a message (sent, delivered, read, reactions, ...).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_message_events" says "list": a word for reading.
What it can reach
- private-dataThe name "list_message_events" says "list" and "message": it reads messages.
- private-dataThe description's first sentence says "list" and "message": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "list_message_events" says "list" and "message": it reads messages, which other people can write.
- untrusted-inputThe description's first sentence says "list" and "message": it reads messages, which other people can write.
Description, as the server wrote it List message events Lifecycle events for a message (sent, delivered, read, reactions, ...).
Annotations the server declares
- title: List message events
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_numbersList sender numbers Lists the phone numbers / sender addresses available to this API key.Reads text others writeNo findings
Why it is in this group
- The name "list_numbers" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List sender numbers Lists the phone numbers / sender addresses available to this API key. Banned and suspended numbers stay in the list. `status` is `banned`, `suspended`, or `active`; a ban takes precedence when both apply. `is_active` is false when the line is banned, suspended, or the underlying account is blocked.
Annotations the server declares
- title: List sender numbers
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_org_numbersList numbers Every number the organization rents from Blooio, newest first: iMessage lines and Blooio SMS and Blooio Voice numbers alike, one entry per number.Reads text others writeNo findings
Why it is in this group
- The name "list_org_numbers" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List numbers Every number the organization rents from Blooio, newest first: iMessage lines and Blooio SMS and Blooio Voice numbers alike, one entry per number. `products` says what each does and `channels` lists the channel behind each product. OAuth apps need `numbers:read`.
Annotations the server declares
- title: List numbers
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_prioritiesList priorities Lists channel priorities owned by the calling API key.Reads text others writeNo findings
Why it is in this group
- The name "list_priorities" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List priorities Lists channel priorities owned by the calling API key.
Annotations the server declares
- title: List priorities
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_ten_dlc_campaignsList campaigns The organization's 10DLC campaigns, newest first.Reads text others writeNo findings
Why it is in this group
- The name "list_ten_dlc_campaigns" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List campaigns The organization's 10DLC campaigns, newest first. OAuth apps need `numbers:read`.
Annotations the server declares
- title: List campaigns
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_ticket_commentsList ticket comments Lists a ticket's public comments, oldest first: the request itself, replies from Blooio support, and your replies.Reads text others writeNo findings
Why it is in this group
- The name "list_ticket_comments" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "list_ticket_comments" says "list" and "ticket": it reads issues, which other people can write.
- untrusted-inputThe description's first sentence says "list" and "ticket": it reads issues, which other people can write.
Description, as the server wrote it List ticket comments Lists a ticket's public comments, oldest first: the request itself, replies from Blooio support, and your replies. OAuth apps need `tickets:read`.
Annotations the server declares
- title: List ticket comments
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_ticketsList tickets Lists the organization's support tickets, newest first.Reads text others writeNo findings
Why it is in this group
- The name "list_tickets" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "list_tickets" says "list" and "ticket": it reads issues, which other people can write.
- untrusted-inputThe description's first sentence says "list" and "ticket": it reads issues, which other people can write.
Description, as the server wrote it List tickets Lists the organization's support tickets, newest first. Includes call-forwarding requests opened with `POST /me/numbers/{number}/call-forwarding`. OAuth apps need `tickets:read`.
Annotations the server declares
- title: List tickets
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_webhook_deliveriesList webhook deliveries Recent delivery attempts for a webhook.Reads text others writeNo findings
Why it is in this group
- The name "list_webhook_deliveries" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List webhook deliveries Recent delivery attempts for a webhook. Also available at `/webhooks/{webhookId}/logs`.
Annotations the server declares
- title: List webhook deliveries
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_webhook_versionsList webhook payload versions Every payload version a subscription can be set to, newest first, with what each one changed.Reads text others writeNo findings
Why it is in this group
- The name "list_webhook_versions" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List webhook payload versions Every payload version a subscription can be set to, newest first, with what each one changed. New subscriptions default to the version marked `latest`. Set a subscription's version with `api_version` on create or update.
Annotations the server declares
- title: List webhook payload versions
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
list_webhooksList webhooksReads text others writeNo findings
Why it is in this group
- The name "list_webhooks" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List webhooks
Annotations the server declares
- title: List webhooks
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
lookup_phone_numberLook up a phone number Returns parsed info / geocoding for a phone number.Reads text others writeNo findings
Why it is in this group
- The name "lookup_phone_number" says "lookup": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Look up a phone number Returns parsed info / geocoding for a phone number. Requires an enterprise plan.
Annotations the server declares
- title: Look up a phone number
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
meGet the authenticated account Returns the authenticated organization, linked devices/numbers, usage, and API key validity.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get the authenticated account Returns the authenticated organization, linked devices/numbers, usage, and API key validity.
Annotations the server declares
- title: Get the authenticated account
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
search_available_numbersSearch available numbers US local numbers you can buy that support every product in `products`.Reads text others writeNo findings
Why it is in this group
- The name "search_available_numbers" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Search available numbers US local numbers you can buy that support every product in `products`. Results are live inventory: a number can be taken between the search and the purchase. OAuth apps need `numbers:read`.
Annotations the server declares
- title: Search available numbers
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
61200 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 17 private-data tools breaks every one.
- Reads private data17
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write120
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out30
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__blooio__get_chat",
"mcp__blooio__get_chat_background",
"mcp__blooio__get_chat_focus",
"mcp__blooio__get_contact",
"mcp__blooio__get_contact_capabilities",
"mcp__blooio__get_contact_card",
"mcp__blooio__get_contact_timeline",
"mcp__blooio__get_location_contact",
"mcp__blooio__get_message",
"mcp__blooio__get_message_status",
"mcp__blooio__list_chat_messages",
"mcp__blooio__list_chats",
"mcp__blooio__list_contact_identities",
"mcp__blooio__list_contact_tags",
"mcp__blooio__list_contacts",
"mcp__blooio__list_location_contacts",
"mcp__blooio__list_message_events"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
1 warn
The server marks "batch_lookup_phone_numbers" as not read-only (readOnlyHint: false), and its words say it reads.
What this check looks forMatched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":true}; The name "batch_lookup_phone_numbers" says "lookup": a word for reading.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 4.1.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http blooio https://mcp.blooio.com/v4claude mcp add --transport http blooio https://mcp.blooio.com/v4Run in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__blooio__me",
"mcp__blooio__get_my_default_priority",
"mcp__blooio__list_numbers",
"mcp__blooio__get_contact_card",
"mcp__blooio__list_location_contacts",
"mcp__blooio__get_location_contact",
"mcp__blooio__list_channels",
"mcp__blooio__list_available_blooio_numbers",
"mcp__blooio__get_blooio_purchase",
"mcp__blooio__get_channel",
"mcp__blooio__get_channel_capabilities",
"mcp__blooio__get_channel_health",
"mcp__blooio__get_channel_settings",
"mcp__blooio__list_priorities",
"mcp__blooio__get_priority",
"mcp__blooio__list_contacts",
"mcp__blooio__get_contact",
"mcp__blooio__list_contact_identities",
"mcp__blooio__get_contact_capabilities",
"mcp__blooio__get_contact_timeline",
"mcp__blooio__list_contact_tags",
"mcp__blooio__list_groups",
"mcp__blooio__get_group",
"mcp__blooio__list_group_members",
"mcp__blooio__list_chats",
"mcp__blooio__get_chat",
"mcp__blooio__get_chat_focus",
"mcp__blooio__get_poll_results",
"mcp__blooio__get_chat_background",
"mcp__blooio__list_chat_messages",
"mcp__blooio__get_message",
"mcp__blooio__get_message_status",
"mcp__blooio__list_message_events",
"mcp__blooio__list_webhooks",
"mcp__blooio__list_webhook_versions",
"mcp__blooio__get_webhook",
"mcp__blooio__list_webhook_deliveries",
"mcp__blooio__list_events",
"mcp__blooio__get_event",
"mcp__blooio__list_tickets",
"mcp__blooio__get_ticket",
"mcp__blooio__list_ticket_comments",
"mcp__blooio__lookup_phone_number",
"mcp__blooio__list_org_numbers",
"mcp__blooio__search_available_numbers",
"mcp__blooio__get_number_purchase",
"mcp__blooio__get_number",
"mcp__blooio__get_ten_dlc_options",
"mcp__blooio__get_ten_dlc_brand",
"mcp__blooio__get_ten_dlc_usecase_qualification",
"mcp__blooio__list_ten_dlc_campaigns",
"mcp__blooio__get_ten_dlc_campaign",
"mcp__blooio__list_calls",
"mcp__blooio__get_call",
"mcp__blooio__get_call_transcript"
],
"ask": [
"mcp__blooio__update_contact_card",
"mcp__blooio__upload_contact_card_avatar",
"mcp__blooio__request_call_forwarding",
"mcp__blooio__refresh_location_contacts",
"mcp__blooio__purchase_blooio_numbers",
"mcp__blooio__update_channel_settings",
"mcp__blooio__update_channel_profile",
"mcp__blooio__send_message_to_channel",
"mcp__blooio__create_priority",
"mcp__blooio__update_priority",
"mcp__blooio__create_contact",
"mcp__blooio__update_contact",
"mcp__blooio__merge_contact",
"mcp__blooio__add_contact_identity",
"mcp__blooio__update_contact_identity",
"mcp__blooio__add_contact_tags",
"mcp__blooio__create_group",
"mcp__blooio__update_group",
"mcp__blooio__set_group_icon",
"mcp__blooio__create_chat",
"mcp__blooio__update_chat",
"mcp__blooio__set_typing",
"mcp__blooio__mark_chat_read",
"mcp__blooio__share_contact_card",
"mcp__blooio__send_poll",
"mcp__blooio__vote_poll",
"mcp__blooio__set_chat_background",
"mcp__blooio__send_chat_message",
"mcp__blooio__send_message",
"mcp__blooio__add_reaction",
"mcp__blooio__notify_message",
"mcp__blooio__create_webhook",
"mcp__blooio__update_webhook",
"mcp__blooio__rotate_webhook_secret",
"mcp__blooio__replay_webhook_delivery",
"mcp__blooio__create_ticket",
"mcp__blooio__update_ticket",
"mcp__blooio__add_ticket_comment",
"mcp__blooio__batch_lookup_phone_numbers",
"mcp__blooio__decide_bloobability_v2",
"mcp__blooio__buy_numbers",
"mcp__blooio__update_number",
"mcp__blooio__put_ten_dlc_brand",
"mcp__blooio__send_ten_dlc_brand_otp",
"mcp__blooio__verify_ten_dlc_brand_otp",
"mcp__blooio__create_ten_dlc_campaign",
"mcp__blooio__update_ten_dlc_campaign",
"mcp__blooio__appeal_ten_dlc_campaign",
"mcp__blooio__place_call",
"mcp__blooio__answer_call",
"mcp__blooio__hangup_call",
"mcp__blooio__transfer_call",
"mcp__blooio__send_call_dtmf",
"mcp__blooio__contact_capabilities"
],
"deny": [
"mcp__blooio__remove_blooio_number",
"mcp__blooio__delete_priority",
"mcp__blooio__delete_contact",
"mcp__blooio__remove_contact_identity",
"mcp__blooio__remove_contact_tag",
"mcp__blooio__delete_group",
"mcp__blooio__remove_group_icon",
"mcp__blooio__stop_typing",
"mcp__blooio__remove_chat_background",
"mcp__blooio__delete_webhook",
"mcp__blooio__release_number"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as blooio. Review it before you use it.
Capability tags behind 120 rules
- mcp__blooio__me untrusted-input
- mcp__blooio__get_my_default_priority untrusted-input
- mcp__blooio__list_numbers untrusted-input
- mcp__blooio__get_contact_card private-data, untrusted-input
- mcp__blooio__update_contact_card untrusted-input
- mcp__blooio__upload_contact_card_avatar untrusted-input
- mcp__blooio__request_call_forwarding untrusted-input
- mcp__blooio__list_location_contacts private-data, untrusted-input
- mcp__blooio__refresh_location_contacts untrusted-input
- mcp__blooio__get_location_contact private-data, untrusted-input
- mcp__blooio__list_channels untrusted-input
- mcp__blooio__list_available_blooio_numbers untrusted-input
- mcp__blooio__purchase_blooio_numbers untrusted-input
- mcp__blooio__get_blooio_purchase untrusted-input
- mcp__blooio__get_channel untrusted-input
- mcp__blooio__remove_blooio_number untrusted-input
- mcp__blooio__get_channel_capabilities untrusted-input
- mcp__blooio__get_channel_health untrusted-input
- mcp__blooio__get_channel_settings untrusted-input
- mcp__blooio__update_channel_settings untrusted-input, outbound
- mcp__blooio__update_channel_profile untrusted-input, outbound
- mcp__blooio__send_message_to_channel untrusted-input, outbound
- mcp__blooio__list_priorities untrusted-input
- mcp__blooio__create_priority untrusted-input, outbound
- mcp__blooio__get_priority untrusted-input
- mcp__blooio__update_priority untrusted-input, outbound
- mcp__blooio__delete_priority untrusted-input
- mcp__blooio__list_contacts private-data, untrusted-input
- mcp__blooio__create_contact untrusted-input, outbound
- mcp__blooio__get_contact private-data, untrusted-input
- mcp__blooio__update_contact untrusted-input
- mcp__blooio__delete_contact untrusted-input
- mcp__blooio__merge_contact untrusted-input
- mcp__blooio__list_contact_identities private-data, untrusted-input
- mcp__blooio__add_contact_identity untrusted-input, outbound
- mcp__blooio__update_contact_identity untrusted-input
- mcp__blooio__remove_contact_identity untrusted-input
- mcp__blooio__get_contact_capabilities private-data, untrusted-input
- mcp__blooio__get_contact_timeline private-data, untrusted-input
- mcp__blooio__list_contact_tags private-data, untrusted-input
- mcp__blooio__add_contact_tags untrusted-input
- mcp__blooio__remove_contact_tag untrusted-input
- mcp__blooio__list_groups untrusted-input
- mcp__blooio__create_group untrusted-input, outbound
- mcp__blooio__get_group untrusted-input
- mcp__blooio__update_group untrusted-input
- mcp__blooio__delete_group untrusted-input
- mcp__blooio__list_group_members untrusted-input
- mcp__blooio__set_group_icon untrusted-input
- mcp__blooio__remove_group_icon untrusted-input
- mcp__blooio__list_chats private-data, untrusted-input
- mcp__blooio__create_chat untrusted-input, outbound
- mcp__blooio__get_chat private-data, untrusted-input
- mcp__blooio__update_chat untrusted-input, outbound
- mcp__blooio__set_typing untrusted-input, outbound
- mcp__blooio__stop_typing untrusted-input
- mcp__blooio__mark_chat_read untrusted-input, outbound
- mcp__blooio__share_contact_card untrusted-input, outbound
- mcp__blooio__get_chat_focus private-data, untrusted-input
- mcp__blooio__send_poll untrusted-input, outbound
- mcp__blooio__vote_poll untrusted-input, outbound
- mcp__blooio__get_poll_results untrusted-input
- mcp__blooio__get_chat_background private-data, untrusted-input
- mcp__blooio__set_chat_background untrusted-input, outbound
- mcp__blooio__remove_chat_background untrusted-input
- mcp__blooio__list_chat_messages private-data, untrusted-input
- mcp__blooio__send_chat_message untrusted-input, outbound
- mcp__blooio__send_message untrusted-input, outbound
- mcp__blooio__get_message private-data, untrusted-input
- mcp__blooio__get_message_status private-data, untrusted-input
- mcp__blooio__list_message_events private-data, untrusted-input
- mcp__blooio__add_reaction untrusted-input, outbound
- mcp__blooio__notify_message untrusted-input, outbound
- mcp__blooio__list_webhooks untrusted-input
- mcp__blooio__create_webhook untrusted-input, outbound
- mcp__blooio__list_webhook_versions untrusted-input
- mcp__blooio__get_webhook untrusted-input
- mcp__blooio__update_webhook untrusted-input, outbound
- mcp__blooio__delete_webhook untrusted-input
- mcp__blooio__rotate_webhook_secret untrusted-input
- mcp__blooio__list_webhook_deliveries untrusted-input
- mcp__blooio__replay_webhook_delivery untrusted-input
- mcp__blooio__list_events untrusted-input
- mcp__blooio__get_event untrusted-input
- mcp__blooio__list_tickets untrusted-input
- mcp__blooio__create_ticket untrusted-input
- mcp__blooio__get_ticket untrusted-input
- mcp__blooio__update_ticket untrusted-input
- mcp__blooio__list_ticket_comments untrusted-input
- mcp__blooio__add_ticket_comment untrusted-input, outbound
- mcp__blooio__lookup_phone_number untrusted-input
- mcp__blooio__batch_lookup_phone_numbers untrusted-input
- mcp__blooio__decide_bloobability_v2 untrusted-input
- mcp__blooio__list_org_numbers untrusted-input
- mcp__blooio__buy_numbers untrusted-input, outbound
- mcp__blooio__search_available_numbers untrusted-input
- mcp__blooio__get_number_purchase untrusted-input
- mcp__blooio__get_number untrusted-input
- mcp__blooio__update_number untrusted-input
- mcp__blooio__release_number untrusted-input
- mcp__blooio__get_ten_dlc_options untrusted-input
- mcp__blooio__get_ten_dlc_brand untrusted-input
- mcp__blooio__put_ten_dlc_brand untrusted-input, outbound
- mcp__blooio__send_ten_dlc_brand_otp untrusted-input, outbound
- mcp__blooio__verify_ten_dlc_brand_otp untrusted-input
- mcp__blooio__get_ten_dlc_usecase_qualification untrusted-input
- mcp__blooio__list_ten_dlc_campaigns untrusted-input
- mcp__blooio__create_ten_dlc_campaign untrusted-input
- mcp__blooio__get_ten_dlc_campaign untrusted-input
- mcp__blooio__update_ten_dlc_campaign untrusted-input
- mcp__blooio__appeal_ten_dlc_campaign untrusted-input
- mcp__blooio__list_calls untrusted-input
- mcp__blooio__place_call untrusted-input, outbound
- mcp__blooio__get_call untrusted-input
- mcp__blooio__get_call_transcript untrusted-input
- mcp__blooio__answer_call untrusted-input, outbound
- mcp__blooio__hangup_call untrusted-input
- mcp__blooio__transfer_call untrusted-input, outbound
- mcp__blooio__send_call_dtmf untrusted-input, outbound
- mcp__blooio__contact_capabilities untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/com.blooio/mcp/verify?hash=e4eff6790bae6b5e519f04dca72bb33df5073d77fc3f9f11ec70169bbcccca91" | jq -e '.changed == false'Pinned hash e4eff6790bae, from Oct 31, 2026, 00:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/com.blooio/mcp/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/com.blooio/mcp)Source: MCP Registry · repository. Synced Oct 31, 2026, 00:18 UTC.