Africa's Talking MCP by usefulapi

io.usefulapi/africas-talkingusefulapi.iostreamable-httpv1.0.0Scanned 1 hour ago

Read Africa's Talking balance, incoming SMS, transactions; send SMS, airtime, data and voice calls.

10 tools: 4 can delete or cancel things and 6 only read.

Reads private data · 1
Reads text others write · 10
Can send data out · 3
No findings

Anlyon alternative

4 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

10 tools

Deletes or cancels 4Removes, cancels or revokes something.Claude Code: deny

africastalking_make_voice_callWRITE: place an outbound voice call from one of your Africa's Talking numbers to up to 10 phone numbers.Reads text others writeNo findings
Why it is in this group
- The name "africastalking_make_voice_call" says "call": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
WRITE: place an outbound voice call from one of your Africa's Talking numbers to up to 10 phone numbers. The call is billed and rings real phones; what is said is decided by the voice callback URL configured for the number in the dashboard. Needs confirm=true after the user approved the numbers. Live apps only (the sandbox has no voice service). Returns a per-number queue status. POST voice /call.
Annotations the server declares
- title: Make voice call
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
africastalking_send_airtimeWRITE: top up mobile airtime for up to 25 phone numbers.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "africastalking_send_airtime" says "send": a word for sending, and what is sent cannot be taken back.
- The description says "cannot be reversed".
- The input addresses people (input.recipients): what it sends cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "africastalking_send_airtime" says "send": it sends or publishes something to other people.
Description, as the server wrote it
WRITE: top up mobile airtime for up to 25 phone numbers. Spends account credit immediately and cannot be reversed. Needs confirm=true after the user approved each number and amount. Amounts are in the given ISO currency (e.g. KES, UGX, TZS). Pass an idempotency_key to make a retry safe. Returns per-number status and requestId (use africastalking_find_airtime_transaction to follow up). POST /version1/airtime/send.
Annotations the server declares
- title: Send airtime
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
africastalking_send_mobile_dataWRITE: send mobile data bundles to up to 25 phone numbers from your Africa's Talking data wallet.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "africastalking_send_mobile_data" says "send": a word for sending, and what is sent cannot be taken back.
- The description says "cannot be reversed".
- The input addresses people (input.recipients): what it sends cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "africastalking_send_mobile_data" says "send": it sends or publishes something to other people.
Description, as the server wrote it
WRITE: send mobile data bundles to up to 25 phone numbers from your Africa's Talking data wallet. Spends wallet credit and cannot be reversed. Needs confirm=true after the user approved each number and bundle. product_name is your data product (created in the Africa's Talking dashboard). Pass an idempotency_key to make a retry safe. Returns per-number status and transactionId (see africastalking_find_mobile_data_transaction). POST bundles /mobile/data/request.
Annotations the server declares
- title: Send mobile data bundle
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
africastalking_send_smsWRITE: send one text message to up to 100 phone numbers.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "africastalking_send_sms" says "send": a word for sending, and what is sent cannot be taken back.
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "africastalking_send_sms" says "send": it sends or publishes something to other people.
Description, as the server wrote it
WRITE: send one text message to up to 100 phone numbers. Spends account credit and delivers to real phones (the sandbox app only reaches the simulator). Needs confirm=true after the user approved the recipients and text. Returns the vendor's per-recipient status (statusCode 101 = sent), message ids and cost. Never retried. POST /version1/messaging.
Annotations the server declares
- title: Send SMS
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true

Only reads 6Looks things up and changes nothing.Show 6 read-only tools

africastalking_fetch_messagesFetch incoming SMS received on your shortcodes/numbers, oldest first, in batches (default 25 per call).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "africastalking_fetch_messages" says "fetch": a word for reading.
What it can reach
- private-dataThe name "africastalking_fetch_messages" says "fetch" and "message": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "africastalking_fetch_messages" says "fetch" and "message": it reads messages, which other people can write.
Description, as the server wrote it
Fetch incoming SMS received on your shortcodes/numbers, oldest first, in batches (default 25 per call). Pass last_received_id (0 for the first call, then `next_last_received_id` from the previous reply) to move through them; `has_more` stays true while a call returns messages, so keep calling until `count` is 0. Optional shortcode and keyword filters. GET /version1/messaging.
Annotations the server declares
- title: Fetch received SMS
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
africastalking_find_airtime_transactionLook up an airtime transaction by its transaction id (the requestId / ATPid_...Reads text others writeNo findings
Why it is in this group
- The name "africastalking_find_airtime_transaction" says "find": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Look up an airtime transaction by its transaction id (the requestId / ATPid_... from a send reply): status, amount, destination and discount. GET /query/transaction/find.
Annotations the server declares
- title: Find airtime transaction
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
africastalking_find_mobile_data_transactionLook up a mobile data transaction by its transactionId (from a send reply): status, product, destination and cost.Reads text others writeNo findings
Why it is in this group
- The name "africastalking_find_mobile_data_transaction" says "find": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "reply": it reads comments, which other people can write.
Description, as the server wrote it
Look up a mobile data transaction by its transactionId (from a send reply): status, product, destination and cost. GET bundles /query/transaction/find.
Annotations the server declares
- title: Find mobile data transaction
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
africastalking_get_balanceThe Africa's Talking app balance (SMS/airtime wallet), e.g.Reads text others writeNo findings
Why it is in this group
- The name "africastalking_get_balance" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
The Africa's Talking app balance (SMS/airtime wallet), e.g. {"balance": "KES 1250.0000"}. The sandbox app has no balance. GET /version1/user.
Annotations the server declares
- title: Get account balance
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
africastalking_get_mobile_data_wallet_balanceThe balance of the mobile data wallet, e.g.Reads text others writeNo findings
Why it is in this group
- The name "africastalking_get_mobile_data_wallet_balance" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
The balance of the mobile data wallet, e.g. {"status": "Success", "balance": "KES 500.0000"}. GET bundles /query/wallet/balance.
Annotations the server declares
- title: Get mobile data wallet balance
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
africastalking_get_voice_queue_statusNumber of outbound calls currently queued on each of your voice numbers.Reads text others writeNo findings
Why it is in this group
- The name "africastalking_get_voice_queue_status" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Number of outbound calls currently queued on each of your voice numbers. Live apps only. POST voice /queueStatus (a read: nothing is changed).
Annotations the server declares
- title: Get voice queue status
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

30 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; africastalking_fetch_messages
Reads text others write10: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; africastalking_fetch_messages
africastalking_find_airtime_transaction
africastalking_find_mobile_data_transaction
africastalking_get_balance
africastalking_get_mobile_data_wallet_balance
africastalking_get_voice_queue_status
africastalking_make_voice_call
africastalking_send_airtime
africastalking_send_mobile_data
africastalking_send_sms
Can send data out3: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; africastalking_send_airtime
africastalking_send_mobile_data
africastalking_send_sms

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__africas-talking__africastalking_fetch_messages"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http africas-talking https://africas-talking.usefulapi.io/mcp

claude mcp add --transport http africas-talking https://africas-talking.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__africas-talking__africastalking_get_balance",
      "mcp__africas-talking__africastalking_fetch_messages",
      "mcp__africas-talking__africastalking_find_airtime_transaction",
      "mcp__africas-talking__africastalking_find_mobile_data_transaction",
      "mcp__africas-talking__africastalking_get_mobile_data_wallet_balance",
      "mcp__africas-talking__africastalking_get_voice_queue_status"
    ],
    "ask": [],
    "deny": [
      "mcp__africas-talking__africastalking_send_sms",
      "mcp__africas-talking__africastalking_send_airtime",
      "mcp__africas-talking__africastalking_send_mobile_data",
      "mcp__africas-talking__africastalking_make_voice_call"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as africas-talking. Review it before you use it.

Capability tags behind 10 rules

mcp__africas-talking__africastalking_get_balance untrusted-input
mcp__africas-talking__africastalking_fetch_messages private-data, untrusted-input
mcp__africas-talking__africastalking_send_sms untrusted-input, outbound
mcp__africas-talking__africastalking_send_airtime untrusted-input, outbound
mcp__africas-talking__africastalking_find_airtime_transaction untrusted-input
mcp__africas-talking__africastalking_send_mobile_data untrusted-input, outbound
mcp__africas-talking__africastalking_find_mobile_data_transaction untrusted-input
mcp__africas-talking__africastalking_get_mobile_data_wallet_balance untrusted-input
mcp__africas-talking__africastalking_make_voice_call untrusted-input
mcp__africas-talking__africastalking_get_voice_queue_status untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/africas-talking/verify?hash=3be7b779cac3b7d085765f2754383f286a7c4d5e74eb4babcc27f9c632044c4a" | jq -e '.changed == false'

Pinned hash 3be7b779cac3, from Oct 24, 2026, 16:19 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/africas-talking/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.usefulapi/africas-talking.svg)](https://anlyon.dev/servers/io.usefulapi/africas-talking)

Source: MCP Registry · repository. Synced Oct 24, 2026, 17:17 UTC.