Skip to content
anlyon.devby Anlyon

TextKit

com.jointextkit/textkitjointextkit.comstreamable-httpv1.0.0Scanned

SMS for developers: send and receive texts, verify phones, and buy US and Canada numbers.

142 tools: 78 can delete or cancel things, 1 do something that can't be undone, 4 change things and 59 only read.

Tools: 78 delete, 1 irreversible, 4 write, 59 read.
  • Reads private data · 16
  • Reads text others write · 30
  • Can send data out · 6
  • 9 findings

Anlyon alternative

83 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

142 tools

Deletes or cancels 78Claude Code: deny
  • activate_automationTurn an automation on, so tracked events start runs.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Turn an automation on, so tracked events start runs. With a live number it texts real people.

    Annotations the server declares

    • title: Activate automation
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • add_to_listAdd contacts to a list by contact_ids and/or phone_numbers (up to 1,000; numbers must already be contacts).No findings

    Why it is in this group

    • The name "add_to_list" says "add": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Add contacts to a list by contact_ids and/or phone_numbers (up to 1,000; numbers must already be contacts).

    Annotations the server declares

    • title: Add to list
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • assign_number_to_customerPlatforms: attribute a number (and its messages and usage) to one of your customers, or clear it with customer_id null.No findings

    Why it is in this group

    • The name "assign_number_to_customer" says "assign": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Platforms: attribute a number (and its messages and usage) to one of your customers, or clear it with customer_id null.

    Annotations the server declares

    • title: Assign number to customer
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • bulk_purchase_numbersBuy several numbers in one area code at once (e.g.Reads text others writeNo findings

    Why it is in this group

    • The name "bulk_purchase_numbers" says "purchase": a word that usually means money moves, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Buy several numbers in one area code at once (e.g. for a sender pool). Live numbers are billed monthly each.

    Annotations the server declares

    • title: Bulk purchase numbers
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • bulk_update_contactsAdd tags to, remove tags from, or delete many contacts by id.No findings

    Why it is in this group

    • The name "bulk_update_contacts" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Add tags to, remove tags from, or delete many contacts by id.

    Annotations the server declares

    • title: Bulk update contacts
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • bulk_update_numbersAct on many numbers at once: tag, untag, assign to a customer, or release.Reads text others writeNo findings

    Why it is in this group

    • The name "bulk_update_numbers" says "update": a word for a change.
    • The description says "cannot be undone".
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Act on many numbers at once: tag, untag, assign to a customer, or release. Releasing cannot be undone.

    Annotations the server declares

    • title: Bulk update numbers
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • cancel_automation_runCancel a run in progress.No findings

    Why it is in this group

    • The name "cancel_automation_run" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Cancel a run in progress.

    Annotations the server declares

    • title: Cancel automation run
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • cancel_batchCancel a batch.No findings

    Why it is in this group

    • The name "cancel_batch" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Cancel a batch. Messages already sent stay sent.

    Annotations the server declares

    • title: Cancel batch
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • cancel_scheduled_messageCancel a scheduled message before it sends.No findings

    Why it is in this group

    • The name "cancel_scheduled_message" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Cancel a scheduled message before it sends.

    Annotations the server declares

    • title: Cancel scheduled message
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • check_verificationCheck a verification code submitted by a user, by the phone or email it went to.No findings

    Why it is in this group

    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Check a verification code submitted by a user, by the phone or email it went to. Returns {verified, status, channel, charged}. Billed only when verified is true.

    Annotations the server declares

    • title: Check verification
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • clone_number_poolCopy a sender pool under a new name.No findings

    Why it is in this group

    • The description's first verb is "copy": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Copy a sender pool under a new name.

    Annotations the server declares

    • title: Clone number pool
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • connect_integrationConnect a tool so its people sync in as contacts, in a list of their own, every 6 hours: Mixpanel (projectId, username, secret = a service account; sourceId = cohort id), Amplitude…2 findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...rty holds their phone (phoneField). Use credentials the person gives you or keeps in their..."

      What this check looks for
    • Info

      The input schema at properties.mode.description mentions "credentials".

      Matched text

      inputSchema.properties.mode.description: "Mixpanel / Amplitude: pull with credentials every 6 hours (default when credentials..."

      What this check looks for
    Description, as the server wrote it
    Connect a tool so its people sync in as contacts, in a list of their own, every 6 hours: Mixpanel (projectId, username, secret = a service account; sourceId = cohort id), Amplitude (apiKey, secretKey, sourceId), HubSpot (accessToken), Shopify (shopDomain, accessToken), Salesforce, or a webhook. Before calling, ask which event or property shows people agreed to texts (consentEvent / consentField) and which property holds their phone (phoneField). Use credentials the person gives you or keeps in their environment; they are proved with one read, sealed, and never returned.

    Annotations the server declares

    • title: Connect integration
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • create_api_keyCreate an API key for an app you are building, to store as a secret in its environment (for example TEXTKIT_API_KEY) so the app can send texts itself.No findings

    Why it is in this group

    • The name "create_api_key" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Create an API key for an app you are building, to store as a secret in its environment (for example TEXTKIT_API_KEY) so the app can send texts itself. Same mode (test or live) as this connection; optional scopes limit it. The secret is returned once; the account owner is emailed.

    Annotations the server declares

    • title: Create api key
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • create_automationCreate a triggered text flow (as a draft): when trigger.event is tracked, run steps such as send_sms, wait, wait_for_event, and condition branches.No findings

    Why it is in this group

    • The name "create_automation" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Create a triggered text flow (as a draft): when trigger.event is tracked, run steps such as send_sms, wait, wait_for_event, and condition branches. Example: on cart_abandoned, wait 3600s, then if checkout_completed was not received send a reminder. Drafts send nothing until activated.

    Annotations the server declares

    • title: Create automation
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • create_customerPlatforms sending for other businesses: create a customer to attribute numbers, messages and usage to.No findings

    Why it is in this group

    • The name "create_customer" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Platforms sending for other businesses: create a customer to attribute numbers, messages and usage to.

    Annotations the server declares

    • title: Create customer
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • create_listCreate a list: a fixed group of contacts (Audience → Lists).No findings

    Why it is in this group

    • The name "create_list" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Create a list: a fixed group of contacts (Audience → Lists). Use a list when the user names exactly who belongs ("add these people to VIPs"); use a segment when membership follows rules.

    Annotations the server declares

    • title: Create list
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • create_number_poolCreate a sender pool from numbers you own.No findings

    Why it is in this group

    • The name "create_number_pool" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Create a sender pool from numbers you own.

    Annotations the server declares

    • title: Create number pool
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • create_scheduleSend the same text to one number every day, week or month at a local time (e.g.Reads text others writeNo findings

    Why it is in this group

    • The name "create_schedule" says "create": a word for a change.
    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Send the same text to one number every day, week or month at a local time (e.g. a weekly reminder). Every occurrence runs the usual send checks.

    Annotations the server declares

    • title: Create schedule
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • create_segmentSave an audience (a segment, a cohort): it appears in the console under Audience → Segments, and broadcasts can be sent to it.No findings

    Why it is in this group

    • The name "create_segment" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Save an audience (a segment, a cohort): it appears in the console under Audience → Segments, and broadcasts can be sent to it. Use this whenever the user asks to create, make or save an audience or list. Everyone who can be texted: one rule, status is subscribed. Contacts matching all (or any) of up to 10 rules. Attributes: tags, contact fields, custom fields (field = "field", key = the name), opt-in status, topic, import, created_at. Behaviour: last_message_at, last_reply_at, batch (key = batch id; value included, sent, failed, skipped or replied) and event (key = a tracked event name). Times take an ISO date or a window like 7d. It is evaluated live each time it is used, so a batch or list sent to it reaches whoever matches then.

    Annotations the server declares

    • title: Create segment
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • create_templateSave a message template.No findings

    Why it is in this group

    • The name "create_template" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Save a message template. Merge tags: {{first_name}}, {{name}}, {{phone}}, {{field:<custom>}}, and per-recipient variables.

    Annotations the server declares

    • title: Create template
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • create_topicCreate a subscription topic, so people can opt out of one kind of message (e.g.No findings

    Why it is in this group

    • The name "create_topic" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Create a subscription topic, so people can opt out of one kind of message (e.g. promotions) and keep others.

    Annotations the server declares

    • title: Create topic
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • create_webhookSend events (message.received, message.delivered, message.opted_out, ...) to a URL: your app, a CRM, an automation tool.Reads text others writeNo findings

    Why it is in this group

    • The name "create_webhook" says "create": a word for a change.
    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Send events (message.received, message.delivered, message.opted_out, ...) to a URL: your app, a CRM, an automation tool. Returns the signing secret once.

    Annotations the server declares

    • title: Create webhook
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • delete_automationDelete an automation.No findings

    Why it is in this group

    • The name "delete_automation" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete an automation.

    Annotations the server declares

    • title: Delete automation
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_contactDelete a contact.No findings

    Why it is in this group

    • The name "delete_contact" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a contact. Messages, consent records, and topic preferences for the number are kept.

    Annotations the server declares

    • title: Delete contact
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_customerDelete a customer.No findings

    Why it is in this group

    • The name "delete_customer" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a customer.

    Annotations the server declares

    • title: Delete customer
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_listDelete a list (its contacts stay).No findings

    Why it is in this group

    • The name "delete_list" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a list (its contacts stay).

    Annotations the server declares

    • title: Delete list
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_messageDelete a finished message (delivered, failed or received) and every copy of its text, for a privacy request.No findings

    Why it is in this group

    • The name "delete_message" says "delete": a word for removing or ending something.
    • The description says "Cannot be undone".
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a finished message (delivered, failed or received) and every copy of its text, for a privacy request. Opt-out records and billing are kept. Cannot be undone.

    Annotations the server declares

    • title: Delete message
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_number_poolDelete a sender pool.No findings

    Why it is in this group

    • The name "delete_number_pool" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a sender pool. Its numbers are kept.

    Annotations the server declares

    • title: Delete number pool
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_scheduleDelete a recurring schedule.No findings

    Why it is in this group

    • The name "delete_schedule" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a recurring schedule.

    Annotations the server declares

    • title: Delete schedule
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_segmentDelete a segment.No findings

    Why it is in this group

    • The name "delete_segment" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a segment. Contacts are not touched.

    Annotations the server declares

    • title: Delete segment
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_templateDelete a template.No findings

    Why it is in this group

    • The name "delete_template" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a template.

    Annotations the server declares

    • title: Delete template
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_topicDelete a topic you created (built-in topics stay).No findings

    Why it is in this group

    • The name "delete_topic" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a topic you created (built-in topics stay).

    Annotations the server declares

    • title: Delete topic
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_webhookDelete a webhook endpoint.No findings

    Why it is in this group

    • The name "delete_webhook" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a webhook endpoint.

    Annotations the server declares

    • title: Delete webhook
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • disconnect_integrationDisconnect a tool: its credentials and its list are deleted; the contacts stay with their consent.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "Disconnect a tool: its credentials and its list are deleted; the contacts..."

      What this check looks for
    Description, as the server wrote it
    Disconnect a tool: its credentials and its list are deleted; the contacts stay with their consent.

    Annotations the server declares

    • title: Disconnect integration
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • fallback_verificationThe text did not arrive: email a new code for the same pending verification (one id, one charge).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The text did not arrive: email a new code for the same pending verification (one id, one charge). The emailed code replaces the texted one and is checked by the email address, which it proves (not the phone). Once per verification.

    Annotations the server declares

    • title: Fallback verification
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • forget_identityPrivacy erasure: forget the phone number linked to a user_id, so its tracked events stop reaching automations.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Privacy erasure: forget the phone number linked to a user_id, so its tracked events stop reaching automations.

    Annotations the server declares

    • title: Forget identity
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • import_contactsCreate or update up to 500 contacts per call, matched by phone_number.No findings

    Why it is in this group

    • The name "import_contacts" says "import": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Create or update up to 500 contacts per call, matched by phone_number. Attributes go in fields (up to 20 strings, e.g. plan) for segments and {{field:name}} merge tags; tags group contacts. opt_in carries consent evidence (status: false records an opt-out). import_id from the first response groups several calls; dry_run: true returns what would change and writes nothing.

    Annotations the server declares

    • title: Import contacts
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • import_opt_outsBring a suppression list over from another provider or tool (up to 500 numbers per call), so people who opted out there are never texted here.No findings

    Why it is in this group

    • The name "import_opt_outs" says "import": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Bring a suppression list over from another provider or tool (up to 500 numbers per call), so people who opted out there are never texted here.

    Annotations the server declares

    • title: Import opt outs
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • pause_automationPause an automation: no new runs start, and runs in progress wait where they are until it is activated again.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Pause an automation: no new runs start, and runs in progress wait where they are until it is activated again.

    Annotations the server declares

    • title: Pause automation
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • pause_batchPause a sending or scheduled batch.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Pause a sending or scheduled batch.

    Annotations the server declares

    • title: Pause batch
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • purchase_numberBuy a phone number for your account (free sandbox numbers with test keys).Reads text others writeNo findings

    Why it is in this group

    • The name "purchase_number" says "purchase": a word that usually means money moves, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Buy a phone number for your account (free sandbox numbers with test keys). Live numbers are billed monthly.

    Annotations the server declares

    • title: Purchase number
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • query_audienceCount a cohort without saving anything (nothing appears in the console): run up to 10 segment rules now and get the counts (matched, opted out, eligible to text) and the first cont…Reads private data1 finding

    Why it is in this group

    • The name "query_audience" says "query": a word for reading.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • private-dataThe description's first sentence says "count" and "contact": it reads contacts.

    Findings

    • Warn

      The server marks "query_audience" destructive (destructiveHint: true), and its name says "query", a word for reading.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":false}; The name "query_audience" says "query": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Count a cohort without saving anything (nothing appears in the console): run up to 10 segment rules now and get the counts (matched, opted out, eligible to text) and the first contacts. Examples: replied in the last 7 days (last_reply_at after 7d); got a batch and did not reply (batch sent, and batch replied with is_not); started checkout but never purchased (event exists, event not_exists); VIPs not texted in 30 days. Same rule fields as a saved segment. Everyone eligible to text: one rule, status is subscribed.

    Annotations the server declares

    • title: Query audience
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • redact_messageEmpty a finished message's text and media everywhere it is kept, keeping its status, price and timeline (redacted_at is set).No findings

    Why it is in this group

    • The description says "Cannot be undone".
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Empty a finished message's text and media everywhere it is kept, keeping its status, price and timeline (redacted_at is set). Cannot be undone.

    Annotations the server declares

    • title: Redact message
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • release_numberRelease a number you own.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Release a number you own. It cannot be got back.

    Annotations the server declares

    • title: Release number
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • remove_from_listRemove contacts from a list (they stay contacts).No findings

    Why it is in this group

    • The name "remove_from_list" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Remove contacts from a list (they stay contacts).

    Annotations the server declares

    • title: Remove from list
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • replay_eventSend an event again to one webhook endpoint (after fixing the receiver).Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe description's first verb is "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Send an event again to one webhook endpoint (after fixing the receiver).

    Annotations the server declares

    • title: Replay event
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • replay_failed_webhooksRe-send every event that failed to reach a webhook endpoint in a window (default the last 24 hours, up to 7 days), after fixing the receiver.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Re-send every event that failed to reach a webhook endpoint in a window (default the last 24 hours, up to 7 days), after fixing the receiver.

    Annotations the server declares

    • title: Replay failed webhooks
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • request_short_codeAsk our team for a short code (or a toll-free number they set up).No findings

    Why it is in this group

    • The name "request_short_code" says "request": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Ask our team for a short code (or a toll-free number they set up). Provisions nothing by itself; carriers take 8-12 weeks to approve a short code.

    Annotations the server declares

    • title: Request short code
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • resume_batchResume a paused batch.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Resume a paused batch.

    Annotations the server declares

    • title: Resume batch
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • retry_batchRetry a batch's failed recipients.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Retry a batch's failed recipients.

    Annotations the server declares

    • title: Retry batch
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • revoke_api_keyRevoke an API key of this mode.No findings

    Why it is in this group

    • The name "revoke_api_key" says "revoke": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Revoke an API key of this mode. Immediate and permanent: anything using it stops working.

    Annotations the server declares

    • title: Revoke api key
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • rotate_webhook_secretReplace a webhook endpoint's signing secret (returned once).No findings

    Why it is in this group

    • The description's first verb is "replace": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Replace a webhook endpoint's signing secret (returned once). expire_previous_in keeps the old one signing for that many seconds so the receiver can switch without dropping events.

    Annotations the server declares

    • title: Rotate webhook secret
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • send_batchSend one message to many people (a broadcast or campaign): pick recipients by segment_id, tags, contact_ids, or an explicit recipients list.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "send_batch" says "send": a word for sending, and what is sent cannot be taken back.
    • The input addresses people (input.recipients): what it sends cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "send_batch" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Send one message to many people (a broadcast or campaign): pick recipients by segment_id, tags, contact_ids, or an explicit recipients list. Opted-out numbers, numbers without marketing consent, and people unsubscribed from topic_id are removed before sending. dry_run: true sends nothing and returns the count, cost, rejected rows and consent.no_opt_in (recipients the send will skip for having no opt-in). scheduled_at sends later (up to 30 days). With a live key it texts real people.

    Annotations the server declares

    • title: Send batch
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • send_messageSend one SMS from one of your numbers.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "send_message" says "send": a word for sending, and what is sent cannot be taken back.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "send_message" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Send one SMS from one of your numbers. Set category "marketing" for promotions (the opt-in check applies) and scheduled_at to send later. Quiet hours apply to every message: outside 8am-9pm (8pm in Florida, Maryland and Oklahoma) in the recipient's local time a marketing message is refused and anything else is held until 8am, except one-time codes and replies within 4 hours of their text. In sandbox (test keys), delivery is simulated: +15005550006 delivers, +15005550002 fails, +15005550007 is filtered as spam, +15005550013 delivers after a delay, +15005550016 has no opt-in (see /docs/sandbox).

    Annotations the server declares

    • title: Send message
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • send_verificationSend a one-time verification code (OTP) to a phone number by text, or to an email address with channel "email".Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "send_verification" says "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "send_verification" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Send a one-time verification code (OTP) to a phone number by text, or to an email address with channel "email". TextKit generates the code, handles expiry (10 min) and attempt limits (5), and blocks SMS-pumping and email-bombing abuse.

    Annotations the server declares

    • title: Send verification
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • set_contact_topicSubscribe a contact to a topic, or unsubscribe them (e.g.No findings

    Why it is in this group

    • The name "set_contact_topic" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Subscribe a contact to a topic, or unsubscribe them (e.g. "promotions" vs "order updates").

    Annotations the server declares

    • title: Set contact topic
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • set_spend_limitSet or remove the monthly spend cap and its alert thresholds.No findings

    Why it is in this group

    • The name "set_spend_limit" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Set or remove the monthly spend cap and its alert thresholds. Live sends over the cap are refused.

    Annotations the server declares

    • title: Set spend limit
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • simulate_inboundSandbox only: simulate an inbound SMS to one of your test numbers (emits message.received; STOP, START and HELP act as for real).No findings

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Sandbox only: simulate an inbound SMS to one of your test numbers (emits message.received; STOP, START and HELP act as for real).

    Annotations the server declares

    • title: Simulate inbound
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • sync_integrationSync a connected tool now (up to 6 times an hour) and get what changed.No findings

    Why it is in this group

    • The name "sync_integration" says "sync": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Sync a connected tool now (up to 6 times an hour) and get what changed.

    Annotations the server declares

    • title: Sync integration
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • test_webhookSend a signed test.ping to a webhook endpoint and see what it answered.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe description's first verb is "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Send a signed test.ping to a webhook endpoint and see what it answered.

    Annotations the server declares

    • title: Test webhook
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • track_eventRecord something a customer did (e.g.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Record something a customer did (e.g. signed_up, cart_abandoned, trial_ending), by user_id and/or phone. It starts or advances any active automation listening for that event.

    Annotations the server declares

    • title: Track event
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • update_automationEdit an automation (name, sender, trigger, or steps).No findings

    Why it is in this group

    • The name "update_automation" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Edit an automation (name, sender, trigger, or steps).

    Annotations the server declares

    • title: Update automation
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • update_contactUpdate a contact.No findings

    Why it is in this group

    • The name "update_contact" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Update a contact. Only the inputs you pass change; tags and fields replace the whole list or map.

    Annotations the server declares

    • title: Update contact
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • update_customerRename a customer or change its external_id or metadata.No findings

    Why it is in this group

    • The name "update_customer" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Rename a customer or change its external_id or metadata.

    Annotations the server declares

    • title: Update customer
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • update_integrationRename, pause or resume (status), or change an integration's settings or credentials (left-out credentials keep the stored ones).1 finding

    Why it is in this group

    • The name "update_integration" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...or change an integration's settings or credentials (left-out credentials keep the stored o..."

      What this check looks for
    Description, as the server wrote it
    Rename, pause or resume (status), or change an integration's settings or credentials (left-out credentials keep the stored ones).

    Annotations the server declares

    • title: Update integration
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • update_listRename a list or change its description.No findings

    Why it is in this group

    • The name "update_list" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Rename a list or change its description.

    Annotations the server declares

    • title: Update list
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • update_number_poolRename a sender pool or change its numbers.No findings

    Why it is in this group

    • The name "update_number_pool" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Rename a sender pool or change its numbers.

    Annotations the server declares

    • title: Update number pool
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • update_schedulePause (active: false) or resume (active: true) a recurring schedule.Reads text others writeNo findings

    Why it is in this group

    • The name "update_schedule" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Pause (active: false) or resume (active: true) a recurring schedule.

    Annotations the server declares

    • title: Update schedule
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • update_segmentRename a segment or replace its rules.No findings

    Why it is in this group

    • The name "update_segment" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Rename a segment or replace its rules.

    Annotations the server declares

    • title: Update segment
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • update_templateRename or edit a template.No findings

    Why it is in this group

    • The name "update_template" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Rename or edit a template.

    Annotations the server declares

    • title: Update template
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • update_topicRename or describe a topic.No findings

    Why it is in this group

    • The name "update_topic" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Rename or describe a topic.

    Annotations the server declares

    • title: Update topic
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • update_webhookChange a webhook endpoint: URL, events, or turn it off (active: false).Reads text others writeNo findings

    Why it is in this group

    • The name "update_webhook" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Change a webhook endpoint: URL, events, or turn it off (active: false).

    Annotations the server declares

    • title: Update webhook
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • upsert_contactCreate a contact, or update the existing one with the same phone_number.No findings

    Why it is in this group

    • The name "upsert_contact" says "upsert": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Create a contact, or update the existing one with the same phone_number.

    Annotations the server declares

    • title: Upsert contact
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
Can't be undone 1Claude Code: ask
  • export_csvExport as CSV text for analysis: messages, deliveries, events, opt_outs, webhook_deliveries, usage, usage_monthly, audit_log or credit_history.Can send data out1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "export_csv" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Export as CSV text for analysis: messages, deliveries, events, opt_outs, webhook_deliveries, usage, usage_monthly, audit_log or credit_history. At most 50,000 rows; narrow the date range with from and to.

    Annotations the server declares

    • title: Export csv
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Changes things 4Claude Code: ask
  • export_numbersYour numbers as CSV text.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Your numbers as CSV text.

    Annotations the server declares

    • title: Export numbers
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_number_requestsOpen short-code and toll-free requests.1 finding

    Why it is in this group

    • The name "list_number_requests" says "list": a word for reading.
    • The description's first verb is "open": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "list_number_requests" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "list_number_requests" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Open short-code and toll-free requests.

    Annotations the server declares

    • title: List number requests
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • plan_importFind out where an audience is and the ways to bring it in.1 finding

    Why it is in this group

    • The name "plan_import" says "import": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "plan_import" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "plan_import" says "import": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Find out where an audience is and the ways to bring it in. Without source: questions to ask the person (where their people are, which group, what they can sign in to, whether consent was recorded, once or kept in sync) and the kinds of source known. With source (their words, e.g. "Mixpanel", "Shopify", "our Postgres users table", "a Google Sheet"): the ways in, best first, each with steps and a console link: an integration already syncing it, tools already in this chat for it, a 6-hourly sync connected with their key here or in the console, a push to an ingest URL, a script with a key from their environment, an export, or a CSV upload. Changes nothing.

    Annotations the server declares

    • title: Plan import
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 59Show 59 read-only tools
  • get_automationRetrieve an automation with its trigger and steps.No findings

    Why it is in this group

    • The name "get_automation" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve an automation with its trigger and steps.

    Annotations the server declares

    • title: Get automation
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_automation_runRetrieve one run with its step-by-step timeline.No findings

    Why it is in this group

    • The name "get_automation_run" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve one run with its step-by-step timeline.

    Annotations the server declares

    • title: Get automation run
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_balancePrepaid credit balance and auto-recharge setting.No findings

    Why it is in this group

    • The name "get_balance" says "get": a word for reading.
    Description, as the server wrote it
    Prepaid credit balance and auto-recharge setting.

    Annotations the server declares

    • title: Get balance
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_batchRetrieve a batch with its progress counts.No findings

    Why it is in this group

    • The name "get_batch" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve a batch with its progress counts.

    Annotations the server declares

    • title: Get batch
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_batch_resultsResults of a batch: delivered, failed, pending, replies, opt-outs (stops), spend, and failures grouped by reason.Reads text others writeNo findings

    Why it is in this group

    • The name "get_batch_results" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "reply": it reads comments, which other people can write.
    Description, as the server wrote it
    Results of a batch: delivered, failed, pending, replies, opt-outs (stops), spend, and failures grouped by reason.

    Annotations the server declares

    • title: Get batch results
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_contactRetrieve a contact.Reads private dataNo findings

    Why it is in this group

    • The name "get_contact" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_contact" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "retrieve" and "contact": it reads contacts.
    Description, as the server wrote it
    Retrieve a contact.

    Annotations the server declares

    • title: Get contact
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_contact_topicsA contact's subscription to each topic.Reads private dataNo findings

    Why it is in this group

    • The name "get_contact_topics" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_contact_topics" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "contact": it reads contacts.
    Description, as the server wrote it
    A contact's subscription to each topic.

    Annotations the server declares

    • title: Get contact topics
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_customerRetrieve a customer.No findings

    Why it is in this group

    • The name "get_customer" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve a customer.

    Annotations the server declares

    • title: Get customer
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_customer_usageA customer's messages, verifications and spend for a period.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_customer_usage" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "message": it reads messages.
    • untrusted-inputThe description's first sentence says "message": it reads messages, which other people can write.
    Description, as the server wrote it
    A customer's messages, verifications and spend for a period.

    Annotations the server declares

    • title: Get customer usage
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_deliverabilityDelivery rates by day, destination carrier, or sending number.No findings

    Why it is in this group

    • The name "get_deliverability" says "get": a word for reading.
    Description, as the server wrote it
    Delivery rates by day, destination carrier, or sending number.

    Annotations the server declares

    • title: Get deliverability
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_integrationOne connected tool and its last sync.No findings

    Why it is in this group

    • The name "get_integration" says "get": a word for reading.
    Description, as the server wrote it
    One connected tool and its last sync.

    Annotations the server declares

    • title: Get integration
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_listRetrieve a list and its contact count.Reads private dataNo findings

    Why it is in this group

    • The name "get_list" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "retrieve" and "contact": it reads contacts.
    Description, as the server wrote it
    Retrieve a list and its contact count.

    Annotations the server declares

    • title: Get list
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_messageRetrieve a message by its msg_...Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_message" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_message" says "get" and "message": it reads messages.
    • private-dataThe description's first sentence says "retrieve" and "message": it reads messages.
    • untrusted-inputThe name "get_message" says "get" and "message": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "retrieve" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    Retrieve a message by its msg_... id, with its delivery timeline.

    Annotations the server declares

    • title: Get message
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_numberRetrieve one of your numbers: status, sender registration, tags, pools, customer.No findings

    Why it is in this group

    • The name "get_number" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve one of your numbers: status, sender registration, tags, pools, customer.

    Annotations the server declares

    • title: Get number
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_number_poolRetrieve a sender pool and its numbers.No findings

    Why it is in this group

    • The name "get_number_pool" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve a sender pool and its numbers.

    Annotations the server declares

    • title: Get number pool
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_registrationA registration with its checks, status, and linked numbers.No findings

    Why it is in this group

    • The name "get_registration" says "get": a word for reading.
    Description, as the server wrote it
    A registration with its checks, status, and linked numbers.

    Annotations the server declares

    • title: Get registration
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_scheduleRetrieve a recurring schedule with its recent occurrences.No findings

    Why it is in this group

    • The name "get_schedule" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve a recurring schedule with its recent occurrences.

    Annotations the server declares

    • title: Get schedule
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_scheduled_messageRetrieve a pending scheduled message.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_scheduled_message" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_scheduled_message" says "get" and "message": it reads messages.
    • private-dataThe description's first sentence says "retrieve" and "message": it reads messages.
    • untrusted-inputThe name "get_scheduled_message" says "get" and "message": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "retrieve" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    Retrieve a pending scheduled message.

    Annotations the server declares

    • title: Get scheduled message
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_segmentRetrieve a segment and its rules.No findings

    Why it is in this group

    • The name "get_segment" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve a segment and its rules.

    Annotations the server declares

    • title: Get segment
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_spend_limitThe monthly spend limit and this month's estimated spend.No findings

    Why it is in this group

    • The name "get_spend_limit" says "get": a word for reading.
    Description, as the server wrote it
    The monthly spend limit and this month's estimated spend.

    Annotations the server declares

    • title: Get spend limit
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_templateRetrieve a template.No findings

    Why it is in this group

    • The name "get_template" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve a template.

    Annotations the server declares

    • title: Get template
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_toll_free_verificationA toll-free verification: status, numbers, the form, what is missing (problems), and the carriers' reason when it was rejected.No findings

    Why it is in this group

    • The name "get_toll_free_verification" says "get": a word for reading.
    Description, as the server wrote it
    A toll-free verification: status, numbers, the form, what is missing (problems), and the carriers' reason when it was rejected.

    Annotations the server declares

    • title: Get toll free verification
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_topicRetrieve a topic.No findings

    Why it is in this group

    • The name "get_topic" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve a topic.

    Annotations the server declares

    • title: Get topic
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_usageUsage by month, today's counters, and plan limits.No findings

    Why it is in this group

    • The name "get_usage" says "get": a word for reading.
    Description, as the server wrote it
    Usage by month, today's counters, and plan limits.

    Annotations the server declares

    • title: Get usage
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_verificationRetrieve a verification by id: its status and attempts (never the code).No findings

    Why it is in this group

    • The name "get_verification" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve a verification by id: its status and attempts (never the code).

    Annotations the server declares

    • title: Get verification
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_webhookRetrieve a webhook endpoint.No findings

    Why it is in this group

    • The name "get_webhook" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve a webhook endpoint.

    Annotations the server declares

    • title: Get webhook
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_api_keysList the active API keys of this mode (never the secrets).Reads private dataNo findings

    Why it is in this group

    • The name "list_api_keys" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "secret": it reads secrets.
    Description, as the server wrote it
    List the active API keys of this mode (never the secrets).

    Annotations the server declares

    • title: List api keys
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_audit_logsWho changed what on the account (keys, team, webhooks, spend limit, numbers, consent, settings), newest first.No findings

    Why it is in this group

    • The name "list_audit_logs" says "list": a word for reading.
    Description, as the server wrote it
    Who changed what on the account (keys, team, webhooks, spend limit, numbers, consent, settings), newest first.

    Annotations the server declares

    • title: List audit logs
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_automation_runsList an automation's runs, newest first.No findings

    Why it is in this group

    • The name "list_automation_runs" says "list": a word for reading.
    Description, as the server wrote it
    List an automation's runs, newest first.

    Annotations the server declares

    • title: List automation runs
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_automationsList automations.No findings

    Why it is in this group

    • The name "list_automations" says "list": a word for reading.
    Description, as the server wrote it
    List automations.

    Annotations the server declares

    • title: List automations
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_batch_recipientsList a batch's recipients with each one's status.No findings

    Why it is in this group

    • The name "list_batch_recipients" says "list": a word for reading.
    Description, as the server wrote it
    List a batch's recipients with each one's status.

    Annotations the server declares

    • title: List batch recipients
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_batchesList batches (broadcasts), newest first.No findings

    Why it is in this group

    • The name "list_batches" says "list": a word for reading.
    Description, as the server wrote it
    List batches (broadcasts), newest first.

    Annotations the server declares

    • title: List batches
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_contactsList contacts, newest first.Reads private dataNo findings

    Why it is in this group

    • The name "list_contacts" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_contacts" says "list" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    Description, as the server wrote it
    List contacts, newest first. Filter by tag, segment_id, list_id, exact phone_number, or a free-text q (name, email, company).

    Annotations the server declares

    • title: List contacts
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_customersList your customers.No findings

    Why it is in this group

    • The name "list_customers" says "list": a word for reading.
    Description, as the server wrote it
    List your customers.

    Annotations the server declares

    • title: List customers
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_eventsList recent events (message.sent/delivered/failed/received, number.purchased/released, ...), newest first.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_events" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "message": it reads messages.
    • untrusted-inputThe description's first sentence says "list" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    List recent events (message.sent/delivered/failed/received, number.purchased/released, ...), newest first.

    Annotations the server declares

    • title: List events
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_integrationsThe connected tools: status, settings, last sync (found, added, opted out), and their list.1 finding

    Why it is in this group

    • The name "list_integrations" says "list": a word for reading.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "..., added, opted out), and their list. No credentials."

      What this check looks for
    Description, as the server wrote it
    The connected tools: status, settings, last sync (found, added, opted out), and their list. No credentials.

    Annotations the server declares

    • title: List integrations
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_list_contactsPage through a list's contacts, most recently added first.Reads private dataNo findings

    Why it is in this group

    • The name "list_list_contacts" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_list_contacts" says "list" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "contact": it reads contacts.
    Description, as the server wrote it
    Page through a list's contacts, most recently added first.

    Annotations the server declares

    • title: List list contacts
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_listsList contact lists with their contact counts.Reads private dataNo findings

    Why it is in this group

    • The name "list_lists" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    Description, as the server wrote it
    List contact lists with their contact counts.

    Annotations the server declares

    • title: List lists
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_messagesList your messages, newest first.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_messages" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_messages" says "list" and "message": it reads messages.
    • private-dataThe description's first sentence says "list" and "message": it reads messages.
    • untrusted-inputThe name "list_messages" says "list" and "message": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    List your messages, newest first. Filter by number, direction, status, failure reason, date, batch schedule or customer.

    Annotations the server declares

    • title: List messages
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_number_poolsList sender pools.No findings

    Why it is in this group

    • The name "list_number_pools" says "list": a word for reading.
    Description, as the server wrote it
    List sender pools.

    Annotations the server declares

    • title: List number pools
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_numbersList the phone numbers on your account.No findings

    Why it is in this group

    • The name "list_numbers" says "list": a word for reading.
    Description, as the server wrote it
    List the phone numbers on your account.

    Annotations the server declares

    • title: List numbers
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_opt_outsList opted-out numbers (the suppression list).No findings

    Why it is in this group

    • The name "list_opt_outs" says "list": a word for reading.
    Description, as the server wrote it
    List opted-out numbers (the suppression list).

    Annotations the server declares

    • title: List opt outs
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_registration_submissionsThe filed copies of a 10DLC registration, newest first.No findings

    Why it is in this group

    • The name "list_registration_submissions" says "list": a word for reading.
    Description, as the server wrote it
    The filed copies of a 10DLC registration, newest first.

    Annotations the server declares

    • title: List registration submissions
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_registrationsList 10DLC brand and campaign registrations and their status.No findings

    Why it is in this group

    • The name "list_registrations" says "list": a word for reading.
    Description, as the server wrote it
    List 10DLC brand and campaign registrations and their status. Marketing from a local number needs an approved one.

    Annotations the server declares

    • title: List registrations
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_scheduled_messagesList single messages scheduled for later and not yet sent.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_scheduled_messages" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_scheduled_messages" says "list" and "message": it reads messages.
    • private-dataThe description's first sentence says "list" and "message": it reads messages.
    • untrusted-inputThe name "list_scheduled_messages" says "list" and "message": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    List single messages scheduled for later and not yet sent.

    Annotations the server declares

    • title: List scheduled messages
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_schedulesList recurring schedules.No findings

    Why it is in this group

    • The name "list_schedules" says "list": a word for reading.
    Description, as the server wrote it
    List recurring schedules.

    Annotations the server declares

    • title: List schedules
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_segmentsList saved segments.No findings

    Why it is in this group

    • The name "list_segments" says "list": a word for reading.
    Description, as the server wrote it
    List saved segments.

    Annotations the server declares

    • title: List segments
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_templatesList message templates.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_templates" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "message": it reads messages.
    • untrusted-inputThe description's first sentence says "list" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    List message templates.

    Annotations the server declares

    • title: List templates
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_toll_free_verificationsList toll-free verifications and their status (draft, in_review with our team, submitted to the carriers, verified, rejected).Reads text others writeNo findings

    Why it is in this group

    • The name "list_toll_free_verifications" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "list" and "review": it reads comments, which other people can write.
    Description, as the server wrote it
    List toll-free verifications and their status (draft, in_review with our team, submitted to the carriers, verified, rejected). A toll-free number texts the public only once verified.

    Annotations the server declares

    • title: List toll free verifications
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_topicsList subscription topics.No findings

    Why it is in this group

    • The name "list_topics" says "list": a word for reading.
    Description, as the server wrote it
    List subscription topics.

    Annotations the server declares

    • title: List topics
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_webhook_deliveriesDelivery attempts to your webhook endpoints, with response status codes.No findings

    Why it is in this group

    • The name "list_webhook_deliveries" says "list": a word for reading.
    Description, as the server wrote it
    Delivery attempts to your webhook endpoints, with response status codes.

    Annotations the server declares

    • title: List webhook deliveries
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_webhooksList webhook endpoints.No findings

    Why it is in this group

    • The name "list_webhooks" says "list": a word for reading.
    Description, as the server wrote it
    List webhook endpoints.

    Annotations the server declares

    • title: List webhooks
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • lookup_phoneLook up line type (mobile, landline, VoIP) and carrier for any US/Canada number.Reads text others writeNo findings

    Why it is in this group

    • The name "lookup_phone" says "lookup": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Look up line type (mobile, landline, VoIP) and carrier for any US/Canada number.

    Annotations the server declares

    • title: Lookup phone
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • preview_segmentCount the contacts a segment matches right now and how many a broadcast would reach (opted-out contacts removed, and with topic_id those unsubscribed from it).Reads private dataNo findings

    Why it is in this group

    • The name "preview_segment" says "preview": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "count" and "contact": it reads contacts.
    Description, as the server wrote it
    Count the contacts a segment matches right now and how many a broadcast would reach (opted-out contacts removed, and with topic_id those unsubscribed from it).

    Annotations the server declares

    • title: Preview segment
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_available_numbersSearch purchasable numbers by area code (default 415).No findings

    Why it is in this group

    • The name "search_available_numbers" says "search": a word for reading.
    Description, as the server wrote it
    Search purchasable numbers by area code (default 415).

    Annotations the server declares

    • title: Search available numbers
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • wait_for_eventsWait up to 25 seconds for the next events after a cursor (a reply, a delivery receipt), then return them.Reads text others writeNo findings

    Why it is in this group

    • The name "wait_for_events" says "wait": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "wait" and "reply": it reads comments, which other people can write.
    Description, as the server wrote it
    Wait up to 25 seconds for the next events after a cursor (a reply, a delivery receipt), then return them.

    Annotations the server declares

    • title: Wait for events
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

2880 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 6 outbound tools breaks every one.

Reads private data16
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write30
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out6
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__textkit__export_csv",
      "mcp__textkit__replay_event",
      "mcp__textkit__send_batch",
      "mcp__textkit__send_message",
      "mcp__textkit__send_verification",
      "mcp__textkit__test_webhook"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

4 warn5 info
  • Warnlist_number_requests

    The server marks "list_number_requests" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "list_number_requests" says "list": a word for reading.

    What this check looks for
  • Warnplan_import

    The server marks "plan_import" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "plan_import" says "import": a word for a change.

    What this check looks for
  • Warnquery_audience

    The server marks "query_audience" destructive (destructiveHint: true), and its name says "query", a word for reading.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":false}; The name "query_audience" says "query": a word for reading.

    What this check looks for
  • Warnexport_csv

    The server marks "export_csv" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for
  • Infoconnect_integration

    The description mentions "credentials".

    Matched text

    description: "...rty holds their phone (phoneField). Use credentials the person gives you or keeps in their..."

    What this check looks for
  • Infoconnect_integration

    The input schema at properties.mode.description mentions "credentials".

    Matched text

    inputSchema.properties.mode.description: "Mixpanel / Amplitude: pull with credentials every 6 hours (default when credentials..."

    What this check looks for
Show 3 more findings

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http textkit https://mcp.jointextkit.com
claude mcp add --transport http textkit https://mcp.jointextkit.com

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__textkit__get_message",
      "mcp__textkit__list_messages",
      "mcp__textkit__list_numbers",
      "mcp__textkit__search_available_numbers",
      "mcp__textkit__lookup_phone",
      "mcp__textkit__list_events",
      "mcp__textkit__get_verification",
      "mcp__textkit__get_number",
      "mcp__textkit__list_number_pools",
      "mcp__textkit__get_number_pool",
      "mcp__textkit__list_contacts",
      "mcp__textkit__get_contact",
      "mcp__textkit__list_lists",
      "mcp__textkit__get_list",
      "mcp__textkit__list_list_contacts",
      "mcp__textkit__list_segments",
      "mcp__textkit__get_segment",
      "mcp__textkit__preview_segment",
      "mcp__textkit__list_topics",
      "mcp__textkit__list_templates",
      "mcp__textkit__get_template",
      "mcp__textkit__list_batches",
      "mcp__textkit__get_batch",
      "mcp__textkit__get_batch_results",
      "mcp__textkit__list_batch_recipients",
      "mcp__textkit__list_automations",
      "mcp__textkit__get_automation",
      "mcp__textkit__list_automation_runs",
      "mcp__textkit__get_automation_run",
      "mcp__textkit__get_topic",
      "mcp__textkit__get_contact_topics",
      "mcp__textkit__get_consent",
      "mcp__textkit__list_opt_outs",
      "mcp__textkit__list_scheduled_messages",
      "mcp__textkit__get_scheduled_message",
      "mcp__textkit__list_schedules",
      "mcp__textkit__get_schedule",
      "mcp__textkit__get_balance",
      "mcp__textkit__get_usage",
      "mcp__textkit__get_spend_limit",
      "mcp__textkit__get_deliverability",
      "mcp__textkit__list_registrations",
      "mcp__textkit__get_registration",
      "mcp__textkit__list_toll_free_verifications",
      "mcp__textkit__get_toll_free_verification",
      "mcp__textkit__list_integrations",
      "mcp__textkit__get_integration",
      "mcp__textkit__list_webhooks",
      "mcp__textkit__list_link_domains",
      "mcp__textkit__get_link_domain",
      "mcp__textkit__get_webhook",
      "mcp__textkit__list_webhook_deliveries",
      "mcp__textkit__list_customers",
      "mcp__textkit__get_customer",
      "mcp__textkit__get_customer_usage",
      "mcp__textkit__list_api_keys",
      "mcp__textkit__list_audit_logs",
      "mcp__textkit__wait_for_events",
      "mcp__textkit__list_registration_submissions"
    ],
    "ask": [
      "mcp__textkit__list_number_requests",
      "mcp__textkit__export_numbers",
      "mcp__textkit__plan_import",
      "mcp__textkit__export_csv",
      "mcp__textkit__export_consent"
    ],
    "deny": [
      "mcp__textkit__send_message",
      "mcp__textkit__delete_message",
      "mcp__textkit__redact_message",
      "mcp__textkit__send_verification",
      "mcp__textkit__check_verification",
      "mcp__textkit__fallback_verification",
      "mcp__textkit__request_short_code",
      "mcp__textkit__purchase_number",
      "mcp__textkit__release_number",
      "mcp__textkit__simulate_inbound",
      "mcp__textkit__bulk_purchase_numbers",
      "mcp__textkit__link_number_to_registration",
      "mcp__textkit__assign_number_to_customer",
      "mcp__textkit__bulk_update_numbers",
      "mcp__textkit__create_number_pool",
      "mcp__textkit__update_number_pool",
      "mcp__textkit__delete_number_pool",
      "mcp__textkit__clone_number_pool",
      "mcp__textkit__import_contacts",
      "mcp__textkit__upsert_contact",
      "mcp__textkit__update_contact",
      "mcp__textkit__delete_contact",
      "mcp__textkit__bulk_update_contacts",
      "mcp__textkit__set_contact_topic",
      "mcp__textkit__create_list",
      "mcp__textkit__update_list",
      "mcp__textkit__delete_list",
      "mcp__textkit__add_to_list",
      "mcp__textkit__remove_from_list",
      "mcp__textkit__create_segment",
      "mcp__textkit__update_segment",
      "mcp__textkit__delete_segment",
      "mcp__textkit__query_audience",
      "mcp__textkit__create_topic",
      "mcp__textkit__create_template",
      "mcp__textkit__update_template",
      "mcp__textkit__delete_template",
      "mcp__textkit__send_batch",
      "mcp__textkit__pause_batch",
      "mcp__textkit__resume_batch",
      "mcp__textkit__cancel_batch",
      "mcp__textkit__retry_batch",
      "mcp__textkit__track_event",
      "mcp__textkit__create_automation",
      "mcp__textkit__update_automation",
      "mcp__textkit__delete_automation",
      "mcp__textkit__activate_automation",
      "mcp__textkit__pause_automation",
      "mcp__textkit__cancel_automation_run",
      "mcp__textkit__update_topic",
      "mcp__textkit__delete_topic",
      "mcp__textkit__set_consent",
      "mcp__textkit__import_opt_outs",
      "mcp__textkit__cancel_scheduled_message",
      "mcp__textkit__create_schedule",
      "mcp__textkit__update_schedule",
      "mcp__textkit__delete_schedule",
      "mcp__textkit__connect_integration",
      "mcp__textkit__update_integration",
      "mcp__textkit__sync_integration",
      "mcp__textkit__disconnect_integration",
      "mcp__textkit__create_webhook",
      "mcp__textkit__update_webhook",
      "mcp__textkit__delete_webhook",
      "mcp__textkit__rotate_webhook_secret",
      "mcp__textkit__test_webhook",
      "mcp__textkit__replay_failed_webhooks",
      "mcp__textkit__create_link_domain",
      "mcp__textkit__verify_link_domain",
      "mcp__textkit__replay_event",
      "mcp__textkit__create_customer",
      "mcp__textkit__update_customer",
      "mcp__textkit__delete_customer",
      "mcp__textkit__create_api_key",
      "mcp__textkit__revoke_api_key",
      "mcp__textkit__set_spend_limit",
      "mcp__textkit__delete_link_domain",
      "mcp__textkit__forget_identity"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as textkit. Review it before you use it.

Capability tags behind 40 rules
  • mcp__textkit__send_message untrusted-input, outbound
  • mcp__textkit__get_message private-data, untrusted-input
  • mcp__textkit__list_messages private-data, untrusted-input
  • mcp__textkit__send_verification untrusted-input, outbound
  • mcp__textkit__fallback_verification untrusted-input
  • mcp__textkit__purchase_number untrusted-input
  • mcp__textkit__release_number untrusted-input
  • mcp__textkit__lookup_phone untrusted-input
  • mcp__textkit__list_events private-data, untrusted-input
  • mcp__textkit__bulk_purchase_numbers untrusted-input
  • mcp__textkit__bulk_update_numbers untrusted-input
  • mcp__textkit__list_contacts private-data
  • mcp__textkit__get_contact private-data
  • mcp__textkit__list_lists private-data
  • mcp__textkit__get_list private-data
  • mcp__textkit__list_list_contacts private-data
  • mcp__textkit__query_audience private-data
  • mcp__textkit__preview_segment private-data
  • mcp__textkit__list_templates private-data, untrusted-input
  • mcp__textkit__send_batch untrusted-input, outbound
  • mcp__textkit__get_batch_results untrusted-input
  • mcp__textkit__resume_batch untrusted-input
  • mcp__textkit__retry_batch untrusted-input
  • mcp__textkit__track_event untrusted-input
  • mcp__textkit__activate_automation untrusted-input
  • mcp__textkit__get_contact_topics private-data
  • mcp__textkit__list_scheduled_messages private-data, untrusted-input
  • mcp__textkit__get_scheduled_message private-data, untrusted-input
  • mcp__textkit__create_schedule untrusted-input
  • mcp__textkit__update_schedule untrusted-input
  • mcp__textkit__list_toll_free_verifications untrusted-input
  • mcp__textkit__create_webhook untrusted-input
  • mcp__textkit__update_webhook untrusted-input
  • mcp__textkit__test_webhook untrusted-input, outbound
  • mcp__textkit__replay_failed_webhooks untrusted-input
  • mcp__textkit__replay_event untrusted-input, outbound
  • mcp__textkit__get_customer_usage private-data, untrusted-input
  • mcp__textkit__list_api_keys private-data
  • mcp__textkit__export_csv outbound
  • mcp__textkit__wait_for_events untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.jointextkit/textkit/verify?hash=65bfecd368add04e7c6442a0175b220abbabe2c2b26aba7005f50952f93cc0ac" | jq -e '.changed == false'

Pinned hash 65bfecd368ad, from Oct 29, 2026, 00:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.jointextkit/textkit/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.jointextkit/textkit
[![anlyon.dev](https://anlyon.dev/badge/com.jointextkit/textkit.svg)](https://anlyon.dev/servers/com.jointextkit/textkit)

Source: MCP Registry. Synced Oct 29, 2026, 00:17 UTC.