Key Takeaways
- MCP logging on an Android SMS gateway is an audit of who invoked send — not a dump of SMS bodies into a chat host.
- The wrapper is a REST client. Cursor/Claude are hosts, not first-party plugins. Keys stay in env.
- Correlate tool call id → POST /messages id → DLR. Confirm fields in Developer Center.
- Do not log full MSISDNs and message text together in a laptop transcript.
- You bring the phone and operator credit. Platform pricing is devices plus send volume.
Log the tool, not the body
Concepts: MCP for SMS. Spec: Model Context Protocol. Live JSON: Developer Center. Auth: MCP auth and API keys.
We meter devices and volume. A louder log does not include pulsa.
What belongs in an audit row
Actor (host + user), tool name, time, Idempotency-Key, gateway message id, deviceId, truncated destination. That is enough to answer “who burned this segment.” REST remains POST /api/v1/messages.
“If your only audit is the model’s chat history, you will lose the argument the first time legal asks who sent the 02:14 OTP.”
Logging failure modes
| Gap | What you cannot prove | Fix |
|---|---|---|
| No message id | Which radio send | Persist id from POST |
| Bodies in Cursor logs | Minimization | Redact in the wrapper |
| No DLR join | Delivered vs accepted | DLR |
| Shared staging key | Which laptop | Per-host staging keys |
| Retries unlogged | Duplicate SMS | Log Idempotency-Key hits |
Webhooks close the story
Terminal status arrives on webhooks. HMAC verify, then append to the same row.
OTP is a special class
Never store plaintext codes in MCP traces. OTP. Pricing.
Next steps
Canary one staff send. Confirm the audit row has id + DLR. Operator credit stays yours.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- device setup guidePair and go live
- download the Android gateway appGet the APK
