Key Takeaways
- Windsurf MCP for SMS is your adapter + REST — not a first-party plugin. Keys live in process env, never in mcp.json or chat.
- Least-privilege send tools on canary allowlists; keep bulk and customer OTP off the IDE host.
- HMAC verifies gateway webhooks; it does not replace Bearer hygiene on outbound REST.
- OEM + plan caps still apply; no Unlimited SMS titles.
- Developer Center owns live REST fields.
- BYO Android and operator credit. We meter devices and volume (Free 300 lifetime; paid from $19/mo).
Summary
Security for Windsurf MCP SMS is host blast radius: one laptop process, one env var, one scoped key, canary-only tools. Cursor sibling: Cursor MCP SMS security. Spec: modelcontextprotocol.io. REST: Developer Center.
An IDE with a production send key is not a productivity upgrade. It is an unattended SMS desk next to your editor.
IDE host is not a vault
Windsurf registers a command for your MCP adapter. Pairing the Android is still setup. No first-party Windsurf SMS plugin from us.
Context
Teams paste keys into config because tools “appeared.” Treat the MCP process like any other REST client: API hub.
Windsurf MCP SMS controls
- Staging key on the laptop; production keys stay on servers.
- Expose canary_send / list_devices before any broad send tool.
- Destination allowlist in the adapter — not free-form MSISDN for the model.
- Redact bodies and OTP digits from tool results.
- Idempotency required; respect OEM + plan rate limits.
Config surface table
| Surface | Allowed | Forbidden |
|---|---|---|
| mcp.json / host config | Command + args | Bearer / API key |
| Process env | Scoped staging key | Shared prod god key |
| Tool catalog | Canary + read tools | Unbounded bulk_send |
| Results | Message id / class | OTP digits / full body |
Laptop agents spend SIM credit
Accepted sends meter devices/volume and operator airtime. Free/Developer pause on exhausted allowance. Raise OEM ceilings carefully — never market unlimited SMS from the IDE. Pricing.
Operations
Rotate keys when staff laptops change hands. Re-canary after OEM updates on the gateway phone.
HMAC and least privilege
Webhooks that can trigger sends need HMAC on the raw body. Webhooks. HMAC is not a substitute for env Bearer hygiene — see MCP auth security.
Decision guide
Keep Windsurf on staging canaries. Customer OTP stays on your backend REST path.
Checklist
- No secrets in host JSON.
- Allowlist + idempotency + redaction.
- Staging key only on IDE hosts.
- HMAC inbound; OEM + plan caps enforced.
- No first-party plugin claim; no exploit PoCs.
Next steps
Wait-flow redaction: wait-for-OTP agent flow security.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Security and Trust CenterCompliance and posture
- Android SMS gateway product guideDefinition, product, and how to buy
