PushNotif Official MCP Server
REMOTE · PUSHNOTIF.BIZ.ID
Web Push (VAPID), Android (FCM), iOS (APNs), In-App Popup, Toast & Transactional Email OTP engine.
Available components
Last scanned (3 hours ago)
Scores higher than 44% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Communication
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security51
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: this server exposes a tool marked destructive (delete_app) and its handshake is open, but we could not confirm whether a tool call is gated, so we do not assert it is callable unauthenticated. View diagnostics → Unverified
- HTTPS check failed: the endpoint is reachable over plaintext HTTP. See how to fix → View diagnostics → Fail
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability64
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 6709 tokens (~353/item across 19 items; 19 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management37
- Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities20
- Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.
- 29 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
- 27 Oct 26 +1
- Server version: 2.5.1 → 2.5.3 functional
- 26 Oct 26 0
- Stability: unverified → 0.03 ▲ functional
- Server version: 2.5.0 → 2.5.1 functional
- “configure_inapp_banner” added an optional parameter “inapp_custom_html” cosmetic
- “configure_inapp_banner” added an optional parameter “inapp_image_size” cosmetic
- “configure_inapp_banner” added an optional parameter “inapp_image_transparent” cosmetic
- “configure_inapp_banner” added an optional parameter “inapp_image_url” cosmetic
- “configure_inapp_banner” added an optional parameter “inapp_template_id” cosmetic
- “configure_inapp_banner” added an optional parameter “segment_tag” cosmetic
- “send_push_notification” added an optional parameter “icon_url” cosmetic
- “send_push_notification” reworded the description of “segment” cosmetic
- 25 Oct 26 57
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://pushnotif.biz.id/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=pushnotif.biz.id | CN=YE2,O=Let's Encrypt,C=US | 15 Oct 2026 | 13 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 618e120616a17df6b795022f409ce03bbe8 |
| SANs: *.pushnotif.biz.id, pushnotif.biz.id | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of pushnotif.biz.id. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| id. | present | 26887 | 8 | Verified |
| biz.id. | present | 50973 | 10 | Verified |
| pushnotif.biz.id. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains; preload |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=(), payment=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://pushnotif.biz.id/mcp | Verified | 200 | |
| http (plaintext) | http://pushnotif.biz.id/mcp | Served over HTTP | 200 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_billing_and_qris_status ~213
Check QRIS top-up order payment status (PENDING or PAID), current workspace credit balance, credit mutation ledger history, and official downloadable PDF invoice URLs. Use this tool to verify whether an order from create_qris_invoice has settled or to audit credit consumption; do not use it to generate a new payment invoice (use create_qris_invoice instead) or view campaign click rates (use get_campaign_analytics instead). Read-only operation requiring PUSHNOTIF_API_KEY with 0 credit cost; pass order_id to inspect a single invoice or omit it to list recent orders and ledger entries. Returns JSON { credits_balance, orders: [{ id, amount_rp, credits_added, status, invoice_pdf_url, created_at }], recent_ledger: [{ id, delta, reason, created_at }] }.
| Name | Type | Req | Description |
|---|---|---|---|
| order_id | string | – | Optional specific QRIS order ID in format ord_xxxx (from create_qris_invoice) to check; omit to return the latest orders and ledger history |
No output schema declared.
No examples provided.
configure_email_automation ~290
Configure per-app module switches (ON/OFF) for Transactional Email OTP, Automated Payment Webhook Email Receipts, Order Status Emails, and the Web Push Notification collector, plus sender brand name and Reply-To email address. Use this tool to enable or disable individual channels per website; do not use it to send an immediate email or OTP (use send_transactional_email instead). Requires PUSHNOTIF_API_KEY and costs 0 credits. Returns JSON { ok, app_id, push_enabled, email_otp_enabled, email_invoice_enabled, email_status_enabled, email_brand_name, email_reply_to }.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | Target application ID in format app_xxxx (obtain from list_apps) |
| email_brand_name | string | – | Sender brand name shown in the recipient inbox (e.g., 'Kopi Nusantara') |
| email_invoice_enabled | boolean | – | Set true to automatically send paid invoice receipts via email when a payment webhook arrives |
| email_otp_enabled | boolean | – | Set true to enable 6-digit Email OTP generation and verification for this app |
| email_reply_to | string | – | Business Reply-To email address where customer replies are routed |
| email_status_enabled | boolean | – | Set true to enable order status and shipping tracking emails |
| push_enabled | boolean | – | Set true to enable Web Push Notification collection on the website, or false to disable |
No output schema declared.
No examples provided.
configure_inapp_banner ~738
Configure and publish an on-site In-App Popup or Banner (center modal, top sticky bar, or bottom slide-in toast) rendered inside the website by the PushNotif SDK without requiring browser push permission. Use this tool for visual in-page promos and announcements; do not use it for OS lock-screen notifications (use send_push_notification instead). Prerequisite: call list_apps first to obtain app_id. Requires PUSHNOTIF_API_KEY; saving configuration is idempotent and costs 0 credits, while each live visitor display deducts 1 credit (inapp_trigger controls when the banner fires—such as 'scroll_50' for 50% page scroll or 'event:add_to_cart' for custom DOM events—combined with inapp_freq to cap repeat impressions per visitor). Returns JSON { ok, app_id, inapp_enabled, inapp_style, inapp_trigger, inapp_freq }.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | Target application ID in format app_xxxx (obtain from list_apps) |
| inapp_accent | string | – | Optional 6-digit hex color code for the CTA button and accent border (default: '#0058BE') |
| inapp_body | string | yes | Banner supporting message text (1 to 240 characters) |
| inapp_cta_text | string | – | Optional CTA button label (must be paired with inapp_cta_url to render a clickable action button) |
| inapp_cta_url | string | – | Optional HTTPS destination URL opened when the CTA button is clicked |
| inapp_custom_html | string | – | Optional raw HTML card markup when inapp_template_id is ai_custom (renders up to 96vw x 94vh) |
| inapp_enabled | boolean | – | Set true to publish the banner live on the website, or false to pause it (default: true) |
| inapp_freq | string | – | Per-visitor frequency cap: 'once_forever' (one-time announcement per visitor, never shown again), 'once_per_session' (default), 'once_per_day', 'cooldown_3h', 'cooldown_12h', 'once_per_week', or 'alw… |
| inapp_image_size | string | – | Optional poster width preset when using image_only: 'compact', 'standard' (default), 'large', 'xl', or 'full' |
| inapp_image_transparent | boolean | – | Set true when using a transparent PNG/WEBP poster in image_only style so no card box is rendered |
| inapp_image_url | string | – | Optional HTTPS image/poster URL (supports transparent PNG/WEBP) |
| inapp_style | string | – | Visual layout: 'modal' (center dialog), 'top_bar' (sticky top ribbon), or 'bottom_slide' (corner slide-in toast) |
| inapp_template_id | string | – | Optional template preset: 'default', 'ai_custom' (custom HTML card), 'voucher_copy', 'flash_timer', 'feature_grid', or 'event_invite' |
| inapp_title | string | yes | Banner headline text (1 to 100 characters) |
| inapp_trigger | string | – | Trigger condition: 'immediate' (default), 'delay_5s', 'delay_10s', 'scroll_50', 'scroll_80', or custom DOM event 'event:<name>' |
| segment_tag | string | – | Optional target segment/merchant tag (e.g., 'seblak-nearby') to display a dedicated In-App Banner on pages matching that tag under a single shared App ID (default: 'all' for global fallback) |
No output schema declared.
No examples provided.
configure_payment_webhook ~457
Generate the ready-to-paste Universal Incoming Webhook URL (POST /api/v1/apps/{app_id}/incoming-event) for 9 auto-detected formats (Midtrans, Xendit, Mayar, Lynk.id, Duitku, Tripay, Supabase Database/Auth, Saweria/Trakteer, Shopify, WooCommerce, GitHub, and Custom JSON), or trigger a live test event when simulate_test=true. Use this tool when connecting a payment gateway, Supabase backend, creator tipping page, or e-commerce store to automatically show a Live Activity Toast, broadcast a Web Push, and/or send a transactional receipt email upon settlement; do not use it for RSS blog feeds (use configure_rss_autopush instead) or manual push campaigns (use send_push_notification instead). Prerequisite: call list_apps first to obtain app_id. Requires PUSHNOTIF_API_KEY; generating the webhook URL costs 0 credits, while live or simulated push broadcasts deduct 1 credit per delivered device (toast_only mode costs 0 credits on display). Returns JSON { ok, app_id, mode, webhook_url, supported_platforms, setup_guides, simulation_result }.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | Target application ID in format app_xxxx (obtain from list_apps) |
| buyer_name | string | – | Optional custom actor/buyer name for test simulation (default: 'Budi (Jakarta)') |
| item_name | string | – | Optional custom product/order/table name for test simulation (default: 'Paket Premium Rp 149.000') |
| mode | string | – | Action when incoming webhook event arrives: 'both' (default: show Live Activity Toast on website + send Web Push), 'toast_only' (show Live Activity Toast only, 0 credits), or 'push_only' (send Web Pu… |
| platform | string | – | Platform format to simulate when simulate_test=true: 'midtrans' (default), 'supabase', 'saweria', 'shopify', 'xendit', 'woocommerce', or 'github' |
| simulate_test | boolean | – | Set true to immediately fire a test incoming webhook event to verify Live Activity Toast and Web Push delivery |
No output schema declared.
No examples provided.
configure_rss_autopush ~375
Configure automated 24/7 RSS, Atom, or XML Sitemap polling for an app_id, or trigger an immediate feed check and push broadcast via dispatch_now=true. Use this tool when a blog, news portal, or store wants newly published URLs automatically broadcast as push notifications; do not use it for manual one-off messages (use send_push_notification instead) or fixed-time calendar campaigns (use schedule_push_notification instead). Prerequisite: call list_apps first to obtain app_id. Requires PUSHNOTIF_API_KEY; feed URLs are validated against SSRF rules, deduplicated by item GUID/URL so each post is sent only once, and deduct 1 credit per delivered subscriber when a new item is broadcast (setting dispatch_now=true immediately fetches and broadcasts the newest feed entry even if rss_enabled=false). Returns JSON { ok, app_id, rss_enabled, rss_feed_url, rss_interval, dispatched_now, latest_item_title }.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | Target application ID in format app_xxxx (obtain from list_apps) |
| dispatch_now | boolean | – | Set true to immediately fetch the latest feed entry and broadcast it to active subscribers right now |
| rss_enabled | boolean | – | Set true to enable background RSS/Sitemap polling at rss_interval, or false to pause background polling |
| rss_feed_url | string | – | Public HTTPS URL of the RSS 2.0, Atom, or XML Sitemap feed (required when enabling polling or calling dispatch_now=true) |
| rss_interval | string | – | Background polling interval: '5m', '15m', '30m' (default), '1h', '3h', or 'daily_digest' |
| rss_prefix | string | – | Optional text prepended to each auto-generated notification title (e.g., 'Artikel Baru: ') |
No output schema declared.
No examples provided.
configure_social_toast ~411
Configure the standalone on-site Live Activity Social Proof Toast (corner notification card showing recent subscriber joins, logins, and purchases) and its 3 automated DOM/webhook sensors for an app_id without overwriting the In-App Promo Banner. Use this tool to enable/disable social proof toasts, change visual theme or screen corner, or toggle auto-capture sensors; do not use it for promo popups (use configure_inapp_banner instead). Requires PUSHNOTIF_API_KEY and costs 0 credits. Returns JSON { ok, app_id, toast_enabled, toast_theme, toast_position, toast_action, sensors }.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | Target application ID in format app_xxxx (obtain from list_apps) |
| toast_action | string | – | Click behavior: 'subscribe_push' (default), 'custom_url', or 'none' |
| toast_custom_body | string | – | Optional custom message body override for the Live Toast |
| toast_custom_html | string | – | Optional bespoke HTML/CSS markup when toast_theme='ai_custom' |
| toast_custom_title | string | – | Optional custom headline override for the Live Toast (leave empty to use automated sensor feed) |
| toast_custom_url | string | – | Optional HTTPS URL opened when toast_action='custom_url' |
| toast_enabled | boolean | – | Set true to enable Live Activity Toast on the website, or false to turn it off |
| toast_position | string | – | Screen corner: 'bottom_left' (default) or 'bottom_right' |
| toast_sensor_auth | boolean | – | Auto-detect signup/login forms on the website |
| toast_sensor_buy | boolean | – | Auto-detect checkout/payment forms and incoming payment webhooks |
| toast_sensor_sub | boolean | – | Auto-show toast when a new visitor subscribes to push notifications |
| toast_theme | string | – | Visual theme: 'light_emerald' (default), 'dark_slate', 'royal_blue', or 'ai_custom' (bespoke HTML/CSS) |
No output schema declared.
No examples provided.
create_app ~208
Register a new website domain or mobile application under the authenticated workspace and generate its unique ECDSA P-256 VAPID keypair and 1-line HTML SDK snippet. Use this tool when adding an additional website or app to an existing account; do not use it to modify an existing app's icon, welcome push, or mobile keys (use update_app_branding instead) or to remove an app (use delete_app instead). Requires PUSHNOTIF_API_KEY, costs 0 credits, and creates a persistent app record where site_url must be a valid HTTPS origin (or http://localhost for local testing). Returns JSON { ok, app: { id, site_name, site_url, vapid_public_key, created_at }, sdk_snippet }.
| Name | Type | Req | Description |
|---|---|---|---|
| site_name | string | yes | Display name of the website or mobile application (2 to 80 characters) |
| site_url | string | yes | Canonical HTTPS origin URL of the website (must start with https:// or http://localhost) |
No output schema declared.
No examples provided.
create_qris_invoice ~292
Create a prepaid credit top-up invoice payable via Indonesian QRIS (all banks and e-wallets) at a flat rate of Rp 0.20 per credit (Rp 1,000 = 5,000 non-expiring credits). Use this tool when the user wants to purchase additional credits; do not use it to check whether an existing invoice has been paid (use check_billing_and_qris_status instead). Requires PUSHNOTIF_API_KEY, generates a PENDING order valid for 30 minutes at 0 fee, and automatically credits the workspace upon payment webhook confirmation; if both package_id and custom amount_rp are supplied, amount_rp takes precedence (minimum Rp 1,000). Returns JSON { ok, order: { id, amount_rp, credits_added, status, qris_checkout_url, expires_at } }.
| Name | Type | Req | Description |
|---|---|---|---|
| amount_rp | integer | – | Custom top-up amount in Indonesian Rupiah (minimum 1000, maximum 10000000; 1 IDR = 5 lifetime credits, overrides package_id) |
| package_id | string | – | Preset package tier: 'starter' (Rp 20,000 = 100,000 credits), 'growth' (Rp 50,000 = 250,000 credits), or 'pro' (Rp 100,000 = 500,000 credits); ignored if amount_rp is explicitly provided |
No output schema declared.
No examples provided.
delete_app ~192
Permanently delete a registered application (app_id) along with all of its subscriber device tokens, scheduled campaigns, and delivery history. Use this tool only when a user explicitly asks to remove a duplicate or decommissioned app; do not use it to pause notifications or change app settings (use update_app_branding or configure_inapp_banner instead). Prerequisite: call list_apps first to verify the exact app_id and active subscriber count. Requires PUSHNOTIF_API_KEY, costs 0 credits, and is irreversibly destructive (confirm_delete must be set to true or the call is rejected). Returns JSON { ok, deleted_app_id, deleted_site_name, subscribers_removed }.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | Target application ID in format app_xxxx to permanently delete (obtain from list_apps) |
| confirm_delete | boolean | yes | Safety confirmation flag: must be explicitly set to true to execute permanent deletion |
No output schema declared.
No examples provided.
get_campaign_analytics ~238
Retrieve historical push campaign delivery metrics (delivered count, click count, CTR percentage, credits spent) and active scheduled queue items (cmp_sch_xxxx). Use this tool to audit campaign performance or look up scheduled campaign IDs before editing or canceling them with schedule_push_notification; do not use it to inspect QRIS payment invoices (use check_billing_and_qris_status instead) or subscriber device lists (use list_subscribers instead). Read-only operation requiring PUSHNOTIF_API_KEY with 0 credit cost; omitting app_id aggregates metrics across all workspace apps up to limit rows. Returns JSON { summary: { total_sent, total_clicks, avg_ctr_percent }, campaigns: [{ id, app_id, title, delivered_count, click_count, ctr_percent, created_at }], scheduled_queue: [{ id, app_id, title, scheduled_for, recurrence_rule, status }] }.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | – | Optional application ID filter in format app_xxxx (omit to aggregate across all workspace apps) |
| limit | integer | – | Maximum number of recent campaigns to return (1 to 50, default: 10) |
No output schema declared.
No examples provided.
list_apps ~250
List all registered websites and mobile apps in the workspace with active subscriber counts, current credit balance, and optional framework SDK installation snippets (when include_sdk_framework is set). Use this tool first as a prerequisite to obtain a valid app_id before calling send_push_notification, schedule_push_notification, update_app_branding, delete_app, configure_inapp_banner, or configure_rss_autopush; do not use it to inspect individual subscriber devices (use list_subscribers instead). Read-only operation requiring PUSHNOTIF_API_KEY with 0 credit cost; when include_sdk_framework is passed ('html', 'nextjs', 'laravel', 'wordpress', 'flutter'), each app entry also includes ready-to-paste SDK setup code. Returns JSON { tenant_name, credits_balance, total_apps, apps: [{ id, site_name, site_url, active_subscribers, sdk_guide }] }.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | – | Optional specific app_id (format app_xxxx) to filter and inspect in detail |
| include_sdk_framework | string | – | Optional target stack ('html', 'nextjs', 'laravel', 'wordpress', or 'flutter') to include copy-paste SDK & service worker installation code |
No output schema declared.
No examples provided.
list_subscribers ~290
Retrieve active subscriber device records, assigned segment tags, platform breakdown counts (Web VAPID, Android FCM, iOS APNs), or full CSV/JSON backup export for zero-downtime migration. Use this tool to inspect audience size, platform distribution, export subscriber tokens (export_format="csv" or "json"), or obtain a subscriber_id before calling update_subscriber_tags; do not use it to view campaign click metrics (use get_campaign_analytics instead) or modify/import subscribers (use update_subscriber_tags instead). Read-only operation requiring PUSHNOTIF_API_KEY with 0 credit cost; filter by app_id and optional tag to narrow results. Returns JSON { total_active, platform_breakdown: { web, android_fcm, ios_apns }, subscribers: [{ id, app_id, platform, tags, created_at }], export_data }.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | – | Optional application ID filter in format app_xxxx (omit to aggregate across all apps in the workspace) |
| export_format | string | – | Optional backup export format: 'csv' or 'json' to include full VAPID endpoint/p256dh/auth migration dump for the specified app_id |
| limit | integer | – | Maximum number of subscriber records to return (1 to 100, default: 15) |
| tag | string | – | Optional segment tag filter (returns only subscribers carrying this tag) |
No output schema declared.
No examples provided.
login_existing_account ~232
Authenticate an existing PushNotif account using email and password to retrieve its live API key and registered apps, with optional inline profile name or password update (when new_name or new_password is provided). Use this tool for existing users connecting from chat or updating account credentials; do not use it for new signups (use register_new_account instead) or app-level branding (use update_app_branding instead). Requires valid email and password (no prior API key needed), costs 0 credits, and is rate-limited against brute-force attempts; read-only unless new_name or new_password is supplied. Returns JSON { ok, tenant: { id, name, email, api_key, credits }, apps: [{ id, site_name, site_url }], profile_updated }.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Registered PushNotif account email address | |
| new_name | string | – | Optional new workspace display name (2 to 80 characters) to update upon login |
| new_password | string | – | Optional new account password (minimum 6 characters) to replace the current password |
| password | string | yes | Current account login password |
No output schema declared.
No examples provided.
register_new_account ~356
Two-step onboarding tool to request a 6-digit email OTP (step 1: omit otp_code) or verify the OTP to create a new PushNotif account with 1,000 free lifetime credits, register the initial website, and return a live API key (step 2: pass otp_code, password, and name). Use this tool only for brand-new user signups; do not use it for existing accounts (use login_existing_account instead) or to add websites to an existing account (use create_app instead). Public endpoint requiring no API key; step 1 is rate-limited to 5 OTPs per 10 minutes per IP (valid 10 minutes), while step 2 irreversibly creates a tenant and ECDSA P-256 VAPID keypair. Returns JSON { ok, step, tenant: { id, name, email, api_key, credits }, app: { id, site_name, site_url, vapid_public_key } }.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Email address to register (must not already belong to an existing PushNotif account) | |
| name | string | – | Workspace or company display name (2 to 80 characters; required when verifying otp_code) |
| otp_code | string | – | Optional 6-digit numeric OTP from email: omit on first call to send the OTP email, then provide on second call to complete registration |
| password | string | – | Account login password (minimum 6 characters; required when verifying otp_code) |
| site_name | string | – | Optional display name for the initial website or app (defaults to workspace name) |
| site_url | string | – | Optional full HTTPS origin URL of the initial website (e.g., https://example.com) |
No output schema declared.
No examples provided.
schedule_push_notification ~482
Create a new scheduled or recurring push notification campaign, edit an existing queued campaign (via update_campaign_id), or cancel a queued campaign before execution (via cancel_campaign_id). Use this tool for delayed, recurring, or editable future broadcasts; do not use it for immediate sending (use send_push_notification instead) or automated RSS feed polling (use configure_rss_autopush instead). Prerequisite: call list_apps to obtain app_id, or call get_campaign_analytics to obtain an existing cmp_sch_xxxx ID for editing or cancellation. Requires PUSHNOTIF_API_KEY; scheduling, editing, or canceling costs 0 credits up front, and 1 credit per delivered device is deducted only when the schedule fires (mutually exclusive modes: pass cancel_campaign_id to delete, update_campaign_id to modify fields in-place, or neither to create a new schedule). Returns JSON { ok, action, scheduled_campaign: { id, app_id, title, body, scheduled_for, recurrence_rule, status } }.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | – | Target application ID in format app_xxxx (required when creating a new schedule) |
| body | string | – | Notification body text (1 to 240 characters; required when creating, optional when editing via update_campaign_id) |
| cancel_campaign_id | string | – | Optional existing scheduled campaign ID (format cmp_sch_xxxx from get_campaign_analytics) to cancel and remove from the queue |
| recurrence_rule | string | – | Recurrence pattern: 'once' (default), 'daily', 'twice_daily', 'weekly', 'monthly', 'every_30m', 'every_3h', 'every_6h', or a 5-field cron expression |
| scheduled_for | string | – | ISO-8601 execution timestamp with timezone offset (e.g., '2026-10-21T08:00:00+07:00') |
| title | string | – | Notification headline (1 to 100 characters; required when creating, optional when editing via update_campaign_id) |
| update_campaign_id | string | – | Optional existing scheduled campaign ID (format cmp_sch_xxxx from get_campaign_analytics) to edit in-place with new title, body, url, scheduled_for, or recurrence_rule |
| url | string | – | Optional HTTPS destination URL opened when the notification is tapped |
No output schema declared.
No examples provided.
send_push_notification ~371
Broadcast an immediate push notification across Web Push (VAPID), Android (FCM), and iOS (APNs) to active subscribers of a specific app_id. Use this tool for instant real-time delivery; do not use it for future or recurring broadcasts (use schedule_push_notification instead) or on-site HTML popups (use configure_inapp_banner instead). Prerequisite: call list_apps first to obtain app_id. Requires PUSHNOTIF_API_KEY, deducts 1 credit (Rp 0.20) per successfully delivered device (0 credits charged for 404/410 dead tokens, which are auto-pruned), and is irreversible once dispatched; when segment is set to a custom tag (from update_subscriber_tags) instead of 'all', only subscribers carrying that tag receive the broadcast, and omitting url defaults the tap action to the app's registered site_url. Returns JSON { ok, campaign_id, total_targeted, total_delivered, total_gone_pruned, credits_deducted, credits_remaining }.
| Name | Type | Req | Description |
|---|---|---|---|
| app_id | string | yes | Target application ID in format app_xxxx (obtain from list_apps) |
| body | string | yes | Notification message body text (1 to 240 characters) |
| icon_url | string | – | Optional HTTPS URL of a custom notification icon/logo (e.g., per-merchant logo override on a shared App ID) |
| segment | string | – | Target audience filter: 'all' (default) or a specific subscriber/merchant tag assigned via data-tags, PushNotif.addTag(), or update_subscriber_tags |
| title | string | yes | Notification headline shown on the lock screen (1 to 100 characters) |
| url | string | – | Optional HTTPS destination URL opened when the notification is tapped (defaults to app's site_url) |
No output schema declared.
No examples provided.
send_transactional_email ~329
Send a 1-to-1 locked transactional email (6-digit OTP challenge, paid invoice receipt, or order shipping status update) or verify a 6-digit OTP code entered by a user. Use this tool for transactional 1-to-1 emails and managed OTP verification; bulk marketing or promotional blasts are strictly prohibited. Requires PUSHNOTIF_API_KEY; sending an email or OTP deducts 25 credits (Rp 5), while verifying an OTP code (action=verify_otp) costs 0 credits. Returns JSON delivery receipt or OTP verification token.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Operation mode: 'send_otp' (generate & email 6-digit OTP), 'verify_otp' (verify 6-digit code), 'send_invoice' (send paid receipt email), or 'send_order_status' (send order/shipping update) |
| app_id | string | yes | Target application ID in format app_xxxx (obtain from list_apps) |
| detail_text | string | – | Transaction amount/items or shipping courier tracking info (e.g., 'Rp 85.000 — Kopi Susu' or 'DIKIRIM — Resi JNE: JP882910') |
| otp_code | string | – | 6-digit numeric OTP code (required when action='verify_otp') |
| reference_id | string | – | Invoice number or Order ID (e.g., 'INV-2026-001' or 'ORD-99281' for send_invoice / send_order_status) |
| to_email | string | yes | Single recipient email address (1-to-1 transactional only) |
No output schema declared.
No examples provided.
update_app_branding ~655
Update an existing application's notification icon URL, automated welcome push message (including drip delay welcome_delay_sec and promo target URL welcome_url), zero-downtime custom VAPID keys (vapid_public_key & vapid_private_key for migrating from OneSignal/LaraPush), and optional native mobile push credentials (Android FCM HTTP v1 service account JSON and iOS APNs .p8 key). Use this tool to configure app-level branding, onboarding welcome alerts, custom VAPID key migration, or native mobile credentials; do not use it to create a new app (use create_app instead) or configure on-site HTML popups (use configure_inapp_banner instead). Prerequisite: call list_apps first to obtain app_id. Requires PUSHNOTIF_API_KEY and idempotently updates only the fields provided at 0 configuration cost (when welcome_enabled=true, each new subscriber welcome push deducts 1 credit; APNs requires apns_key_id, apns_team_id, apns_bundle_id, and apns_p8_key together). Returns JSON { ok, app_id, icon_url, welcome_enabled, welcome_url, welcome_delay_sec, custom_vapid_updated, android_fcm_configured, ios_apns_configured }.
| Name | Type | Req | Description |
|---|---|---|---|
| apns_bundle_id | string | – | Optional iOS application Bundle Identifier (e.g., 'id.company.app') |
| apns_key_id | string | – | Optional 10-character Apple Developer APNs Key ID (provide together with apns_team_id, apns_bundle_id, and apns_p8_key) |
| apns_p8_key | string | – | Optional full PEM content of Apple's AuthKey_XXXX.p8 private key file |
| apns_team_id | string | – | Optional 10-character Apple Developer Team ID |
| app_id | string | yes | Target application ID in format app_xxxx (obtain from list_apps) |
| fcm_service_account_json | string | – | Optional raw JSON string of Google Firebase Service Account key for native Android FCM HTTP v1 delivery |
| icon_url | string | – | Optional direct HTTPS URL to a square PNG/JPG/WebP brand icon (recommended 192x192px) |
| vapid_private_key | string | – | Optional URL-safe Base64 or PEM VAPID Private Key paired with vapid_public_key |
| vapid_public_key | string | – | Optional URL-safe Base64 VAPID Public Key imported from OneSignal, LaraPush, or Webpushr for zero-downtime migration |
| welcome_body | string | – | Body text of the automated welcome push notification (max 180 characters; used when welcome_enabled=true) |
| welcome_delay_sec | integer | – | Optional drip delay in seconds (0 to 300, default: 0) before firing the welcome push notification after opt-in |
| welcome_enabled | boolean | – | Set true to automatically send a welcome push notification immediately after a visitor subscribes |
| welcome_title | string | – | Headline of the automated welcome push notification (max 80 characters; used when welcome_enabled=true) |
| welcome_url | string | – | Optional target promo/onboarding HTTPS URL opened when the subscriber clicks the welcome push notification (defaults to site_url) |
No output schema declared.
No examples provided.
update_subscriber_tags ~330
Assign or remove audience segment tags on a subscriber device (subscriber_id), permanently unsubscribe a device (unsubscribe=true), or bulk-import existing Web Push subscribers via CSV or JSON array (import_app_id + import_csv or import_subscribers) at 0 credit cost. Use this tool to manage subscriber segmentation, remove a device, or migrate subscribers from OneSignal/LaraPush/Webpushr; do not use it to list or export subscribers (use list_subscribers instead). Requires PUSHNOTIF_API_KEY and costs 0 credits. Returns JSON { ok, subscriber_id, action, tags, removed, imported, updated }.
| Name | Type | Req | Description |
|---|---|---|---|
| add_tags | array | – | Optional list of lowercase segment tag strings (e.g., ['vip', 'jakarta']) to attach to the subscriber for targeted broadcasts |
| import_app_id | string | – | Optional target app_id (app_xxxx) when performing a zero-downtime bulk subscriber import via import_csv or import_subscribers |
| import_csv | string | – | Optional CSV text containing endpoint,p256dh,auth,tags rows to bulk-import into import_app_id |
| import_subscribers | array | – | Optional JSON array of subscriber objects ({endpoint, p256dh, auth, tags}) to bulk-import into import_app_id |
| remove_tags | array | – | Optional list of segment tag strings to remove from the subscriber |
| subscriber_id | string | – | Target subscriber device ID in format sub_xxxx (required when updating tags or unsubscribing a single device) |
| unsubscribe | boolean | – | Set true to permanently unsubscribe and delete this subscriber device record |
No output schema declared.
No examples provided.
How do I install the PushNotif Official MCP Server server?
PushNotif Official MCP Server is a hosted endpoint at https://pushnotif.biz.id/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · pushnotif.biz.id
claude mcp add --transport http aarsydesign-pushnotif-mcp 'https://pushnotif.biz.id/mcp'
What is the PushNotif Official MCP Server server?
PushNotif Official MCP Server is listed in the public MCP registry as io.github.AarsyDesign/pushnotif-mcp. Web Push (VAPID), Android (FCM), iOS (APNs), In-App Popup, Toast & Transactional Email OTP engine. This page covers its hosted endpoint (https://pushnotif.biz.id/mcp).
Is the PushNotif Official MCP Server server safe to use?
PushNotif Official MCP Server scores 62 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the PushNotif Official MCP Server server expose?
PushNotif Official MCP Server exposes 19 tools: register_new_account, login_existing_account, list_apps, create_app, update_app_branding, and 14 more. Their descriptions and schemas cost roughly 6,709 tokens of context every time the server is loaded.
Does the PushNotif Official MCP Server server require authentication?
No. We connected to PushNotif Official MCP Server without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the PushNotif Official MCP Server server still maintained?
PushNotif Official MCP Server is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.