io.github.codespar/mcp-twilio
NPM · @CODESPAR/MCP-TWILIO · SCANNED SEP 20
MCP server for Twilio — global SMS, WhatsApp, Voice, Verify, and Lookup across 180+ countries
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 95 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 89 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability79
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2401 tokens (~109/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
- Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "send_message" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.codespar/mcp-twilio server?
io.github.codespar/mcp-twilio runs locally as an npm package, launched with npx -y @codespar/mcp-twilio. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @codespar/mcp-twilio
claude mcp add codespar-mcp-twilio -- npx -y @codespar/mcp-twilio
{
"mcpServers": {
"codespar-mcp-twilio": {
"command": "npx",
"args": [
"-y",
"@codespar/mcp-twilio"
]
}
}
} {
"servers": {
"codespar-mcp-twilio": {
"command": "npx",
"args": [
"-y",
"@codespar/mcp-twilio"
]
}
}
} codex mcp add codespar-mcp-twilio -- npx -y @codespar/mcp-twilio
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"codespar-mcp-twilio": {
"type": "local",
"command": [
"npx",
"-y",
"@codespar/mcp-twilio"
],
"enabled": true
}
}
} openclaw mcp add codespar-mcp-twilio --command npx --arg -y --arg @codespar/mcp-twilio
mcp_servers:
codespar-mcp-twilio:
command: "npx"
args: ["-y", "@codespar/mcp-twilio"] {
"McpServers": {
"codespar-mcp-twilio": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@codespar/mcp-twilio"
]
}
}
} assistant mcp add codespar-mcp-twilio -t stdio -c npx -a -y @codespar/mcp-twilio
{
"mcpServers": {
"codespar-mcp-twilio": {
"command": "npx",
"args": [
"-y",
"@codespar/mcp-twilio"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 −3
- Stability: pass → 0.80 functional
- 14 Sept 26 +1
- Stability: 0.97 → pass security
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 8 Sept 26 −3
- Stability: pass → 0.80 functional
- 7 Sept 26 +1
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@codespar/mcp-twilio@0.2.2
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 95 packages
| Packages resolved | 95 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_conversation_participant ~153
Add a participant to a Conversation. For SMS / WhatsApp, pass MessagingBinding.Address (+E164 or whatsapp:+E164) + MessagingBinding.ProxyAddress (your Twilio number). For chat participants, pass Identity.
| Name | Type | Req | Description |
|---|---|---|---|
| Attributes | string | – | JSON string of custom participant attributes |
| ConversationSid | string | yes | Conversation SID (CH...) or UniqueName |
| Identity | string | – | Chat identity (use for in-app chat participants) |
| MessagingBinding.Address | string | – | Participant's address: +E164 for SMS, whatsapp:+E164 for WhatsApp |
| MessagingBinding.ProxyAddress | string | – | Your Twilio number the participant messages with (E.164 or whatsapp:+E164) |
No output schema declared.
No examples provided.
buy_phone_number ~138
Provision a new phone number. Supply either a specific `PhoneNumber` (from AvailablePhoneNumbers search) or an `AreaCode` to let Twilio pick one.
| Name | Type | Req | Description |
|---|---|---|---|
| AreaCode | string | – | Area code — Twilio picks any available number in it |
| FriendlyName | string | – | Friendly label |
| PhoneNumber | string | – | Exact E.164 number to buy (from AvailablePhoneNumbers search) |
| SmsUrl | string | – | TwiML URL for incoming SMS |
| StatusCallback | string | – | Webhook URL for number status events |
| VoiceUrl | string | – | TwiML URL for incoming calls |
No output schema declared.
No examples provided.
check_verification ~67
Check a Verify (2FA) code against a Service SID. Returns status=approved when the code matches.
| Name | Type | Req | Description |
|---|---|---|---|
| Code | string | yes | Code the user entered |
| ServiceSid | string | yes | Verify Service SID (VA...) |
| To | string | yes | Destination that received the code |
No output schema declared.
No examples provided.
create_conversation ~105
Create a Twilio Conversation. Conversations host multi-channel (SMS / WhatsApp / chat) threads with server-side history.
| Name | Type | Req | Description |
|---|---|---|---|
| Attributes | string | – | JSON string of custom attributes stored on the conversation |
| FriendlyName | string | – | Human-readable label for the conversation |
| MessagingServiceSid | string | – | Messaging Service SID (MG...) used for outbound SMS/WhatsApp in this conversation |
| UniqueName | string | – | Developer-defined unique identifier (alternative addressable key) |
No output schema declared.
No examples provided.
create_taskrouter_task ~152
Create a TaskRouter Task on a Workspace. TaskRouter routes work (calls, chats, tickets) to eligible Workers based on attributes.
| Name | Type | Req | Description |
|---|---|---|---|
| Attributes | string | – | JSON string of task attributes used for routing (e.g. {"selected_language":"pt-br"}) |
| Priority | number | – | Priority (higher = more urgent) |
| TaskChannel | string | – | Task channel unique_name or SID (e.g. voice, chat, sms, default) |
| Timeout | number | – | Seconds before the task times out (default 86400) |
| WorkflowSid | string | – | Workflow SID (WW...) that decides how this task is routed |
| WorkspaceSid | string | yes | TaskRouter Workspace SID (WS...) |
No output schema declared.
No examples provided.
create_verify_service ~105
Create a Verify Service (VA...). A service groups verification attempts and holds per-service config (code length, friendly name).
| Name | Type | Req | Description |
|---|---|---|---|
| CodeLength | number | – | OTP code length, 4-10 (default 6) |
| DefaultTemplateSid | string | – | Default message template SID |
| FriendlyName | string | yes | Human-readable name for the service (e.g. your app name) |
| LookupEnabled | boolean | – | Run Lookup on targets before sending (blocks invalid numbers) |
No output schema declared.
No examples provided.
delete_message ~27
Delete a message from history. Irreversible.
| Name | Type | Req | Description |
|---|---|---|---|
| Sid | string | yes | Message SID |
No output schema declared.
No examples provided.
execute_studio_flow ~110
Trigger a Studio Flow Execution for a contact. Studio flows are visual IVR / workflow builders — this kicks one off for a specific To/From pair.
| Name | Type | Req | Description |
|---|---|---|---|
| FlowSid | string | yes | Studio Flow SID (FW...) |
| From | string | yes | Your Twilio number (E.164 or whatsapp:+E164) |
| Parameters | string | – | JSON string of variables injected into the flow's execution context |
| To | string | yes | Contact address (E.164 or whatsapp:+E164) |
No output schema declared.
No examples provided.
get_call ~27
Retrieve a call resource by SID (CA...).
| Name | Type | Req | Description |
|---|---|---|---|
| Sid | string | yes | Call SID |
No output schema declared.
No examples provided.
get_message ~30
Retrieve a message resource by SID (SM... or MM...).
| Name | Type | Req | Description |
|---|---|---|---|
| Sid | string | yes | Message SID |
No output schema declared.
No examples provided.
list_conversations ~98
List Conversations. Returns a paginated list; pass PageSize to cap.
| Name | Type | Req | Description |
|---|---|---|---|
| EndDate | string | – | Only include conversations created on/before this ISO-8601 date |
| PageSize | number | – | Max rows per page (default 50, max 1000) |
| StartDate | string | – | Only include conversations created on/after this ISO-8601 date |
| State | string | – | Filter by conversation state |
No output schema declared.
No examples provided.
list_incoming_numbers ~82
List Twilio-provisioned phone numbers on this account. Filter by PhoneNumber (partial), FriendlyName, or Beta.
| Name | Type | Req | Description |
|---|---|---|---|
| FriendlyName | string | – | Filter by friendly name |
| PageSize | number | – | Max rows per page (default 50, max 1000) |
| PhoneNumber | string | – | Filter by partial phone number match |
No output schema declared.
No examples provided.
list_messages ~148
List messages with optional filters. Returns Twilio's paginated list; pass PageSize to cap.
| Name | Type | Req | Description |
|---|---|---|---|
| DateSent | string | – | Filter by exact send date (YYYY-MM-DD). Use DateSentAfter / DateSentBefore for ranges. |
| DateSentAfter | string | – | Return messages sent on/after this date (YYYY-MM-DD) |
| DateSentBefore | string | – | Return messages sent on/before this date (YYYY-MM-DD) |
| From | string | – | Filter by sender |
| PageSize | number | – | Max rows per page (default 50, max 1000) |
| To | string | – | Filter by destination (E.164 or whatsapp:+E164) |
No output schema declared.
No examples provided.
list_messaging_services ~50
List Messaging Services (MG...). A Messaging Service bundles sender pools, templates, and routing rules.
| Name | Type | Req | Description |
|---|---|---|---|
| PageSize | number | – | Max rows per page (default 50, max 1000) |
No output schema declared.
No examples provided.
list_recordings ~119
List call recordings on this account. Optionally filter by CallSid, or by DateCreated range. Returns Twilio's paginated list.
| Name | Type | Req | Description |
|---|---|---|---|
| CallSid | string | – | Restrict to recordings produced by this Call SID (CA...) |
| DateCreatedAfter | string | – | Return recordings created on/after this date (YYYY-MM-DD) |
| DateCreatedBefore | string | – | Return recordings created on/before this date (YYYY-MM-DD) |
| PageSize | number | – | Max rows per page (default 50, max 1000) |
No output schema declared.
No examples provided.
list_taskrouter_workers ~129
List Workers on a TaskRouter Workspace. Optionally filter by ActivityName, Available, or TargetWorkersExpression.
| Name | Type | Req | Description |
|---|---|---|---|
| ActivityName | string | – | Filter by activity name (e.g. Available, Idle, Offline) |
| Available | string | – | Filter by availability: 'true' or 'false' |
| PageSize | number | – | Max rows per page (default 50, max 1000) |
| TargetWorkersExpression | string | – | TaskRouter expression to filter workers (e.g. languages HAS "pt-br") |
| WorkspaceSid | string | yes | TaskRouter Workspace SID (WS...) |
No output schema declared.
No examples provided.
lookup_phone ~127
Validate and normalize a phone number via Lookups v2. Optional `Fields` lets you request carrier info, line_type_intelligence, caller_name, identity_match, etc.
| Name | Type | Req | Description |
|---|---|---|---|
| CountryCode | string | – | ISO-3166 alpha-2. Required only if PhoneNumber is not in E.164. |
| Fields | string | – | Comma-separated list of add-ons (e.g. `line_type_intelligence,caller_name`). Billed per field. |
| PhoneNumber | string | yes | Number to look up (E.164 recommended; Lookups v2 will format if possible) |
No output schema declared.
No examples provided.
make_call ~136
Place an outbound voice call. Twilio fetches TwiML from `Url` on connect to drive the call.
| Name | Type | Req | Description |
|---|---|---|---|
| From | string | yes | Twilio-provisioned caller ID in E.164 |
| Method | string | – | HTTP method Twilio uses to fetch Url (default POST) |
| StatusCallback | string | – | Webhook URL for call-status events |
| StatusCallbackEvent | array | – | Events to subscribe to: initiated, ringing, answered, completed |
| To | string | yes | Destination number in E.164 |
| Url | string | yes | HTTP(S) URL returning TwiML that drives the call |
No output schema declared.
No examples provided.
send_conversation_message ~114
Post a message into a Conversation. Fanned out to all participants via their channel (SMS / WhatsApp / chat).
| Name | Type | Req | Description |
|---|---|---|---|
| Attributes | string | – | JSON string of custom message attributes |
| Author | string | – | Identity of the author (defaults to `system` if omitted) |
| Body | string | – | Message text (UTF-8) |
| ConversationSid | string | yes | Conversation SID (CH...) or UniqueName |
| MediaSid | string | – | Media SID (ME...) from a prior MCS upload |
No output schema declared.
No examples provided.
send_message ~223
Send an SMS or WhatsApp message. For WhatsApp, prefix `To` (and `From`) with `whatsapp:+E164`. Supply either `From` (a Twilio phone number) OR `MessagingServiceSid` (a Messaging Service). If neither is given, falls back to env TWILIO_MESSAGING_SERVICE_SID.
| Name | Type | Req | Description |
|---|---|---|---|
| Body | string | yes | Message text (UTF-8) |
| From | string | – | Twilio phone number in E.164, or `whatsapp:+E164` for WhatsApp. Omit if using MessagingServiceSid. |
| MediaUrl | array | – | Optional list of media URLs (MMS / WhatsApp media) |
| MessagingServiceSid | string | – | Messaging Service SID (MG...). Overrides env default. Omit if using From. |
| StatusCallback | string | – | Webhook URL Twilio calls on delivery-status transitions |
| To | string | yes | Destination in E.164 (e.g. +5511999999999) or `whatsapp:+E164` for WhatsApp |
No output schema declared.
No examples provided.
start_verification ~100
Start a Verify (2FA) challenge. Sends a one-time code to `To` via the chosen channel. Requires a Verify Service SID (VA...).
| Name | Type | Req | Description |
|---|---|---|---|
| Channel | string | yes | Delivery channel |
| Locale | string | – | Message locale (e.g. pt-br, en, es) |
| ServiceSid | string | yes | Verify Service SID (VA...) |
| To | string | yes | Destination in E.164 (or email for email channel) |
No output schema declared.
No examples provided.
update_call ~94
Modify an in-progress call. Set Status='completed' to hang up, or pass a new Url to redirect the call to fresh TwiML.
| Name | Type | Req | Description |
|---|---|---|---|
| Method | string | – | HTTP method for the new Url |
| Sid | string | yes | Call SID |
| Status | string | – | canceled (before answered) or completed (hang up) |
| Url | string | – | New TwiML URL — redirects the live call |
No output schema declared.
No examples provided.
What is the io.github.codespar/mcp-twilio server?
io.github.codespar/mcp-twilio is listed in the public MCP registry as io.github.codespar/mcp-twilio. MCP server for Twilio, global SMS, WhatsApp, Voice, Verify, and Lookup across 180+ countries. This page covers its npm package (@codespar/mcp-twilio).
Is the io.github.codespar/mcp-twilio server safe to use?
io.github.codespar/mcp-twilio scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.codespar/mcp-twilio server expose?
io.github.codespar/mcp-twilio exposes 22 tools: send_message, get_message, list_messages, delete_message, make_call, and 17 more. Their descriptions and schemas cost roughly 2,334 tokens of context every time the server is loaded.
Is the io.github.codespar/mcp-twilio server still maintained?
io.github.codespar/mcp-twilio is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.codespar/mcp-twilio server under?
io.github.codespar/mcp-twilio declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.