Key Takeaways
- Securing SMS MCP tools means narrowing what an agent can send, to whom, on which device_id — not publishing exploit PoCs.
- The server is a REST wrapper you run. Not a first-party Cursor or Claude plugin. Staging keys for chat; prod keys for your app.
- Split OTP and promo tools. Allowlist MSISDNs in non-prod. Idempotency on send.
- HMAC on webhooks, Doze on the shelf phone, tokens only in process env. Confirm fields in Developer Center.
- You bring the Android and operator credit. Platform pricing is devices plus send volume.
mcp for sms tool security fails in config, not in a novel GSM attack. Concepts: MCP for SMS. Auth: API keys. Logging: logging. Overview: MCP overview.
Live JSON: Developer Center. Pricing: devices and send volume. Spec: MCP.
allowlist · staging · OTP SIM
If the tool can send anywhere, the chat is the modem.
Least privilege is the product
Expose send-otp-to-allowlist, not send-anywhere. Pair the phone on its own path. Downloads, setup. Keys in env.
A “temporary” prod token in Cursor so the demo looks good is how Friday’s composer becomes Monday’s airtime bill.
Tool hardening table
| Control | Failure if skipped | Ops check |
|---|---|---|
| Staging key | Agent spends prod prepaid | Env name != production |
| Destination allowlist | SMS to arbitrary numbers | Staff MSISDNs only in chat |
| Split OTP / promo tools | Campaign starves login | Two device_ids |
| Idempotency | Duplicate OTP | Stable challenge id |
| No body in traces | Codes in logs | Ids only |
Allowlist destinations
Agentic OTP: OTP failure modes. OTP. Cursor/Claude setup: Cursor, Claude Desktop.
HMAC and Doze still apply
Verify webhook signatures on your URL. Webhooks. Doze. DLR. Messaging practices.
Next steps
Remove send-anywhere from the agent config. Curl a canary with the staging token. Spend 300 lifetime SMS proving the allowlist — then a funded SIM. MCP vs REST: layer mismatches.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
- download the Android gateway appGet the APK
