# Voodoo SMS MCP by usefulapi (remote · voodoo-sms.usefulapi.io)

Read Voodoo SMS credits, reports, inbox and lists; send one SMS; manage the opt-out blacklist.

- Trust score: 64/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-17

## Components

- remote · `voodoo-sms.usefulapi.io`: 64/100 (this document), [markdown](https://verifymcp.io/servers/io-usefulapi-voodoo-sms/voodoo-sms.md), [page](https://verifymcp.io/servers/io-usefulapi-voodoo-sms/voodoo-sms)

## Channel facts

- Endpoint: `https://voodoo-sms.usefulapi.io/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-17.

- **Endpoint Security**: 78/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS enforcement could not be verified: the plaintext port redirected somewhere other than https, so enforcement is unproven.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but the endpoint redirected instead of responding directly.
- **Schema Quality & AI Usability**: 80/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2095 tokens (~161/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 17/100
  - Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the Voodoo SMS MCP by usefulapi server?

Voodoo SMS MCP by usefulapi is a hosted endpoint at https://voodoo-sms.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http io-usefulapi-voodoo-sms 'https://voodoo-sms.usefulapi.io/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "io-usefulapi-voodoo-sms": {
      "url": "https://voodoo-sms.usefulapi.io/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "io-usefulapi-voodoo-sms": {
      "type": "http",
      "url": "https://voodoo-sms.usefulapi.io/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.io-usefulapi-voodoo-sms]
url = "https://voodoo-sms.usefulapi.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-usefulapi-voodoo-sms": {
      "type": "remote",
      "url": "https://voodoo-sms.usefulapi.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-usefulapi-voodoo-sms --url 'https://voodoo-sms.usefulapi.io/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-usefulapi-voodoo-sms:
    url: "https://voodoo-sms.usefulapi.io/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "io-usefulapi-voodoo-sms": {
      "Transport": "http",
      "Url": "https://voodoo-sms.usefulapi.io/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add io-usefulapi-voodoo-sms -t streamable-http -u 'https://voodoo-sms.usefulapi.io/mcp'
```

### Other

```json
{
  "mcpServers": {
    "io-usefulapi-voodoo-sms": {
      "type": "http",
      "url": "https://voodoo-sms.usefulapi.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-16 (score 64, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-14 (score 63, +3)

- [security] The server rewrote its instructions, which are the text every model session reads
- [functional] The server now declares the “prompts” capability
- [functional] First check of Schema quality: 100
- [functional] New prompt “getting_started”
- [functional] Server version: 1.0.0 → 1.1.0

### 2026-10-13 (score 60, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-10-12 (score 60)

First indexed and scored.

## MCP tools (13)

### `voodoosms_get_credits` (~52 tokens)

Get credit balance

Get the SMS credit balance of the account. One credit pays for one 160-character SMS part (153 characters per part in a long message). Voodoo SMS REST: GET /credits.

### `voodoosms_list_delivery_reports` (~266 tokens)

List delivery reports

List delivery reports of sent messages (message_id, sender_id, to, sent_at, delivered_at, price, status), optionally filtered. Use it to check whether a message was delivered. Dates accept a UNIX timestamp, ISO 8601 (2026-10-01T09:00:00+00:00) or plain English ('yesterday', '2 weeks'). Voodoo SMS REST: GET /report.

Input parameters:

- `delivered_at` (string): Only messages delivered at this date/time.
- `end` (string): End of the date range to filter on.
- `external_reference` (string): The external_reference used when sending.
- `limit` (integer): Number of reports to return (default 25, max 1000).
- `message_id` (string): The messages[].id returned when the SMS was sent.
- `sender_id` (string): The sender id the messages were sent with.
- `sent_at` (string): Only messages sent at this date/time.
- `start` (string): Start of the date range to filter on.
- `status` (string): Only messages with this status.
- `to` (string): Only messages sent to this number (international format, e.g. 447700900123).

### `voodoosms_list_scheduled_messages` (~53 tokens)

List scheduled messages

List SMS that were scheduled through the send API and are still waiting to go out (messages scheduled in the portal's Web SMS are not shown). Voodoo SMS REST: GET /schedule.

### `voodoosms_list_inbox` (~220 tokens)

List received SMS

List SMS received on the account's Virtual Mobile Numbers (replies and keyword messages). Needs a purchased number; an empty inbox returns an empty result. Dates accept a UNIX timestamp, ISO 8601 or plain English. Voodoo SMS REST: GET /inbox.

Input parameters:

- `end` (string): Newest date of the messages to return.
- `from` (string): The number the message came from (international format).
- `keyword` (string): The keyword (first word of the message).
- `limit` (integer): Number of messages to return (default 25, max 1000).
- `reference` (string): The external_reference of the original outgoing message.
- `skip` (integer): Where to start the returned results (default 0).
- `sort` (string): Sort by id, ASC or DESC (default DESC).
- `start` (string): Oldest date of the messages to return.
- `to` (string): The number the message was sent to: your virtual number (international format).

### `voodoosms_list_numbers` (~50 tokens)

List virtual mobile numbers

List the Virtual Mobile Numbers (VMNs) the account has purchased, used to receive SMS. Returns an empty result if there are none. Voodoo SMS REST: GET /numbers.

### `voodoosms_list_contact_lists` (~94 tokens)

List contact lists

List the account's contact lists (id, name, status, size, created/updated times) without their contacts. Returns an empty result if there are none. Voodoo SMS REST: GET /contacts.

Input parameters:

- `limit` (integer): Number of lists to return (default 100, max 5000).
- `skip` (integer): Where to start the returned results (default 0).

### `voodoosms_get_contact_list` (~105 tokens)

Get contacts in a list

Get one contact list including its contacts (id, number, status, dynamic_data, created_at). Voodoo SMS REST: GET /contacts?contact_list_id=.

Input parameters:

- `contact_list_id` (integer, required): The contact list id (id from list_contact_lists).
- `limit` (integer): Number of contacts to return (default 100, max 5000).
- `skip` (integer): Where to start the returned results (default 0).

### `voodoosms_list_blacklist` (~179 tokens)

List blacklisted numbers

List the numbers on the account's opt-out blacklist (no SMS is ever sent to them), or look up one number (`{empty: true}` means it is not on the list). Returns an empty result when the blacklist is empty. Voodoo SMS REST: GET /blacklist.

Input parameters:

- `end` (string): Newest date a number was added.
- `limit` (integer): Number of entries to return (default 25, max 1000).
- `number` (string): Look up a single number (international format, e.g. 447700900123).
- `skip` (integer): Where to start the returned results (default 0).
- `sort` (string): Sort by id, ASC or DESC (default DESC).
- `start` (string): Oldest date a number was added.

### `voodoosms_send_sms` (~422 tokens)

Send an SMS to one recipient

WRITE: SENDS A REAL SMS to ONE recipient and USES THE ACCOUNT'S CREDITS (1 credit per message part, charged whether or not it is delivered; it cannot be undone). `sandbox` is required: true validates and prices the message without sending or charging, false sends it for real. Optional `schedule` queues it for later (cancel with cancel_scheduled_message). Do not retry after an error or timeout without checking list_delivery_reports / list_scheduled_messages, or the recipient may get it twice. One recipient per call; there is no bulk or list send. Voodoo SMS REST: POST /sendsms.

Input parameters:

- `country_code` (integer): Country calling code of the recipient (e.g. 44), when `to` has no country code.
- `external_reference` (string): Your own reference for this SMS (e.g. an order number); shown in reports.
- `from` (string, required): Sender id shown to the recipient: 4 to 11 letters/digits or a number of up to 15 digits.
- `msg` (string, required): The message text. 160 characters per part (153 in a long message), 70 (67) if it has emoji or other non-GSM characters; maximum 918 (402 with Unicode).
- `sandbox` (boolean, required): REQUIRED. true = validate and price the message only: nothing is sent and no credits are used. false = really send the SMS and use credits. Use true first unless the user clearly asked to send now.
- `schedule` (string): Send later: a UNIX timestamp, ISO 8601 (2026-12-25T09:00:00+00:00) or plain English ('2 weeks'). Must be in the future.
- `timezone` (string): Timezone for `schedule` (default UTC).
- `to` (string, required): ONE recipient number: international format with the country code and no leading 0 (447700900123), or a national number if country_code is given.

### `voodoosms_cancel_scheduled_message` (~91 tokens)

Cancel a scheduled SMS

WRITE: cancels one SMS that was scheduled through the send API, so it will not be sent. A message that has already gone out cannot be cancelled. Whether credits are refunded for a cancelled message is not documented by the vendor. Voodoo SMS REST: DELETE /schedule/{id}.

Input parameters:

- `id` (integer, required): The scheduled message id (id from list_scheduled_messages).

### `voodoosms_add_to_blacklist` (~106 tokens)

Add a number to the blacklist

WRITE: adds one number to the account's opt-out blacklist; from then on no SMS is sent to it (sends to it fail with error 20). Use it for a recipient who asked to stop. This tool cannot remove a number again. Voodoo SMS REST: POST /blacklist.

Input parameters:

- `number` (string, required): Phone number in international format with the country code and no leading 0, e.g. 447700900123.

### `voodoosms_create_contact_list` (~120 tokens)

Create a contact list

WRITE: creates a new contact list with up to 500 contacts (the list name must be unique, at most 32 characters). It does not send anything. Voodoo SMS REST: POST /contacts.

Input parameters:

- `contacts` (array, required): Contacts to put in the list: [{number, dynamic_data?}].
- `country` (integer): Default country calling code for the list (default 44).
- `description` (string): Optional description.
- `name` (string, required): Unique list name, at most 32 characters.

### `voodoosms_update_contact_list` (~120 tokens)

Rename a contact list or add contacts

WRITE: renames a contact list and/or adds up to 500 contacts to it (existing contacts are not removed). Adding dynamic data needs a list created as dynamic. It does not send anything. Voodoo SMS REST: PUT /contacts/{contact_list_id}.

Input parameters:

- `contact_list_id` (integer, required): The contact list id (id from list_contact_lists).
- `contacts` (array): Contacts to add: [{number, dynamic_data?}].
- `name` (string): New list name, at most 32 characters.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-usefulapi-voodoo-sms/voodoo-sms#diagnostics

## Score history

- 2026-10-17: 64
- 2026-10-16: 64
- 2026-10-15: 63
- 2026-10-14: 63
- 2026-10-13: 60
- 2026-10-12: 60

## Common questions

### What is the Voodoo SMS MCP by usefulapi server?

Voodoo SMS MCP by usefulapi is listed in the public MCP registry as io.usefulapi/voodoo-sms. Read Voodoo SMS credits, reports, inbox and lists; send one SMS; manage the opt-out blacklist. This page covers its hosted endpoint (https://voodoo-sms.usefulapi.io/mcp).

### Is the Voodoo SMS MCP by usefulapi server safe to use?

Voodoo SMS MCP by usefulapi scores 64 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Voodoo SMS MCP by usefulapi server expose?

Voodoo SMS MCP by usefulapi exposes 13 tools: voodoosms_get_credits, voodoosms_list_delivery_reports, voodoosms_list_scheduled_messages, voodoosms_list_inbox, voodoosms_list_numbers, and 8 more. Their descriptions and schemas cost roughly 1,878 tokens of context every time the server is loaded.

### Does the Voodoo SMS MCP by usefulapi server require authentication?

Yes. Voodoo SMS MCP by usefulapi asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the Voodoo SMS MCP by usefulapi server still maintained?

Voodoo SMS MCP by usefulapi is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://voodoo-sms.usefulapi.io/mcp
- Repository: https://github.com/m190/usefulapi-mcp
- Website: https://usefulapi.io/voodoo-sms/
- Changelog RSS feed: https://verifymcp.io/servers/io-usefulapi-voodoo-sms/voodoo-sms.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-usefulapi-voodoo-sms/voodoo-sms.json
- HTML version of this page: https://verifymcp.io/servers/io-usefulapi-voodoo-sms/voodoo-sms