com.politicalcomms/api
NPM · @POLITICAL-COMMS/MCP · SCANNED SEP 20
Compliant political SMS/MMS from MCP clients: projects, contacts, analytics, billing.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 3 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability81
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1363 tokens (~90/item across 15 items; 15 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the com.politicalcomms/api MCP server?
com.politicalcomms/api runs locally as an npm package, launched with npx -y @political-comms/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @political-comms/mcp
claude mcp add com-politicalcomms-api -- npx -y @political-comms/mcp
{
"mcpServers": {
"com-politicalcomms-api": {
"command": "npx",
"args": [
"-y",
"@political-comms/mcp"
]
}
}
} {
"servers": {
"com-politicalcomms-api": {
"command": "npx",
"args": [
"-y",
"@political-comms/mcp"
]
}
}
} codex mcp add com-politicalcomms-api -- npx -y @political-comms/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-politicalcomms-api": {
"type": "local",
"command": [
"npx",
"-y",
"@political-comms/mcp"
],
"enabled": true
}
}
} openclaw mcp add com-politicalcomms-api --command npx --arg -y --arg @political-comms/mcp
mcp_servers:
com-politicalcomms-api:
command: "npx"
args: ["-y", "@political-comms/mcp"] {
"McpServers": {
"com-politicalcomms-api": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@political-comms/mcp"
]
}
}
} assistant mcp add com-politicalcomms-api -t stdio -c npx -a -y @political-comms/mcp
{
"mcpServers": {
"com-politicalcomms-api": {
"command": "npx",
"args": [
"-y",
"@political-comms/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 0
- Stability: 0.97 → pass security
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 −3
- Stability: pass → 0.80 functional
- 13 Sept 26 0
- Stability: 0.97 → pass security
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@political-comms/mcp@0.2.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
archive_project ~55
Archive a completed project so it no longer appears in default project listings. Only projects in completed status can be archived; other statuses are rejected with INVALID_STATE_TRANSITION.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | ID of the project to archive |
No output schema declared.
No examples provided.
copy_project ~71
Copy an existing project into a new draft. The copy keeps the message, phone numbers, and settings but drops contact lists, schedule, and stats, and gets a versioned name (X becomes X_v2). Copying never sends messages.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | ID of the project to copy |
No output schema declared.
No examples provided.
create_project ~334
Create a new messaging project (a draft send). Requires the owning organization, a name, protocol (sms or mms), sending phone number IDs, contact list IDs, and the message text. For channel=10dlc also pass brand_id and campaign_id; for channel=toll-free pass toll_free_verification_id. Creating a project does not send messages by itself.
| Name | Type | Req | Description |
|---|---|---|---|
| brand_id | string | – | Required when channel=10dlc |
| campaign_id | string | – | Required when channel=10dlc |
| channel | string | – | Messaging channel. Defaults to 10dlc. |
| confirm | boolean | yes | Must be true to run this write operation. Set it only after the user has explicitly confirmed. |
| contact_list_ids | array | yes | Contact list IDs to send to |
| link_tracking_destination_url | string | – | Destination URL for tracked links |
| link_tracking_domain_id | string | – | Tracking domain ID |
| link_tracking_enabled | boolean | – | Enable link tracking |
| link_tracking_param_field | string | – | Contact field appended as a redirect query param on tracking links |
| media_ids | array | – | Media file IDs for MMS |
| message_text | string | yes | The message body to send |
| name | string | yes | Project name |
| organization_id | string | yes | Owning organization ID |
| phone_number_ids | array | yes | Sending phone number IDs (1-49) |
| protocol | string | yes | Message protocol |
| suppression_list_ids | array | – | Contact list IDs to suppress |
| toll_free_verification_id | string | – | Required when channel=toll-free |
No output schema declared.
No examples provided.
get_contact_list ~35
Get one contact list by ID, including import progress and list analysis results when available.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Resource ID |
No output schema declared.
No examples provided.
get_hierarchy ~43
Get the full organization hierarchy tree visible to the API key, including nested child organizations and their brands.
| Name | Type | Req | Description |
|---|---|---|---|
| organization_id | string | – | Filter to a specific descendant organization |
No output schema declared.
No examples provided.
get_ledger_usage ~77
Get billing usage totals and per-category breakdown from the ledger for a date range, optionally filtered to a descendant organization.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | string | yes | End date in YYYY-MM-DD format |
| organization_id | string | – | Filter to a specific descendant organization |
| start_date | string | yes | Start date in YYYY-MM-DD format |
No output schema declared.
No examples provided.
get_message_stats ~105
Get aggregate message stats (totals and daily breakdown) for a date range, optionally filtered by organization, brand, or campaign.
| Name | Type | Req | Description |
|---|---|---|---|
| brand_id | string | – | Filter to a specific brand |
| campaign_id | string | – | Filter to a specific campaign |
| end_date | string | yes | End date in YYYY-MM-DD format |
| organization_id | string | – | Filter to a specific descendant organization |
| start_date | string | yes | Start date in YYYY-MM-DD format |
No output schema declared.
No examples provided.
get_project ~47
Get one project by ID with its full configuration: status, channel, message text, phone numbers, contact lists, link tracking settings, and schedule.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Resource ID |
No output schema declared.
No examples provided.
get_project_stats ~48
Get delivery and engagement stats for one project: sent, delivered, undeliverable, replies, opt outs, clicks, and the derived rates.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Resource ID |
No output schema declared.
No examples provided.
list_contact_lists ~55
List contact lists with their contact counts and import status. Optionally filter by organization or brand.
| Name | Type | Req | Description |
|---|---|---|---|
| brand_id | string | – | Filter to a specific brand |
| organization_id | string | – | Filter to a specific descendant organization |
No output schema declared.
No examples provided.
list_organizations ~32
List all organizations visible to the API key, including their status and parent organization. Also useful as a credential check.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_projects ~80
List messaging projects (a project is one composed send: message text, sending numbers, and contact lists). Optionally filter by organization, brand, or campaign.
| Name | Type | Req | Description |
|---|---|---|---|
| brand_id | string | – | Filter to a specific brand |
| campaign_id | string | – | Filter to a specific campaign |
| organization_id | string | – | Filter to a specific descendant organization |
No output schema declared.
No examples provided.
schedule_project ~114
Schedule a project to send to its full contact lists at a specific date and time. This commits a real bulk send to every contact on the lists once the scheduled time arrives.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true to run this write operation. Set it only after the user has explicitly confirmed. |
| id | string | yes | Resource ID |
| scheduled_at | string | yes | ISO 8601 date-time at which to send |
| scheduled_timezone | string | yes | IANA timezone name, for example America/New_York |
No output schema declared.
No examples provided.
test_project ~85
Send real test messages for a project to up to 50 explicit phone numbers. This delivers actual SMS or MMS to those recipients and incurs cost.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true to run this write operation. Set it only after the user has explicitly confirmed. |
| id | string | yes | Resource ID |
| phones | array | yes | Recipient phone numbers for the test send |
No output schema declared.
No examples provided.
unschedule_project ~44
Remove the schedule from a project so it will not send. Safe to call repeatedly; the project returns to an unscheduled state.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Resource ID |
No output schema declared.
No examples provided.
What is the com.politicalcomms/api MCP server?
com.politicalcomms/api is an MCP server listed in the public MCP registry as com.politicalcomms/api. Compliant political SMS/MMS from MCP clients: projects, contacts, analytics, billing. This page covers its npm package (@political-comms/mcp).
Is the com.politicalcomms/api MCP server safe to use?
com.politicalcomms/api scores 85 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the com.politicalcomms/api MCP server expose?
com.politicalcomms/api exposes 15 tools: list_organizations, get_hierarchy, list_projects, get_project, get_project_stats, and 10 more. Their descriptions and schemas cost roughly 1,225 tokens of context every time the server is loaded.
Is the com.politicalcomms/api MCP server still maintained?
com.politicalcomms/api is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the com.politicalcomms/api MCP server under?
com.politicalcomms/api declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.