Xpress Flow Systems
REMOTE · WWW.XPRESSFLOWSYSTEMS.COM.NG
No-sign-up eSIMs for 200+ countries, phone-number eSIMs, domains and proxies. You approve payment.
Available components
Last scanned (10 hours ago)
Scores higher than 64% of remote servers
Reachable. Last reached 5 Nov 2026.
Category E-commerce
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security80
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability66
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2891 tokens (~180/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management37
- Stability check failed: schema churn in the 14 days we've observed: 0 tool removals, 2 breaking changes, 0 auth/transport breaks, 4 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 16 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Nov 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “create_cart_order” rewrote its description, which is the text the model reads security
- Tool “list_proxy_products” rewrote its description, which is the text the model reads security
- “create_proxy_order” reworded the description of “target_country” cosmetic
- 2 Nov 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “create_cart_order” rewrote its description, which is the text the model reads security
- 1 Nov 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “create_cart_order” rewrote its description, which is the text the model reads security
- Tool “create_esim_order” rewrote its description, which is the text the model reads security
- Tool “get_cart_status” rewrote its description, which is the text the model reads security
- Tool “get_order_status” rewrote its description, which is the text the model reads security
- 30 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 14 to 17.
- 28 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 11.
- 26 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 1 to 4.
- 25 Oct 26 −1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “create_esim_order” rewrote its description, which is the text the model reads security
- Tool “get_order_status” rewrote its description, which is the text the model reads security
- Schema quality: 2283 → 2851 ▼ functional
- New tool “create_cart_order” functional
- New tool “get_cart_status” functional
- “create_esim_order” added an optional parameter “customer_phone” cosmetic
- “create_esim_order” added an optional parameter “id_document” cosmetic
- “search_esim_plans” reworded the description of “location” cosmetic
- 24 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “create_esim_order” rewrote its description, which is the text the model reads security
- Schema quality: 1892 → 2283 ▼ functional
- Schema quality: good → excellent functional
- New tool “request_email_code” functional
- New tool “verify_email_code” functional
- “create_domain_order” added an optional parameter “email_verification_token” cosmetic
- “create_esim_order” added an optional parameter “accept_aup” cosmetic
- “create_esim_order” added an optional parameter “email_verification_token” cosmetic
- “create_esim_order” added an optional parameter “name” cosmetic
- “create_proxy_order” added an optional parameter “email_verification_token” cosmetic
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://www.xpressflowsystems.com.ng/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=www.xpressflowsystems.com.ng | CN=WR1,O=Google Trust Services,C=US | 8 Oct 2026 | 6 Jan 2027 | RSA 2048 | SHA256-RSA | 33d9a6fce730ba801321d9374bd22699 |
| SANs: www.xpressflowsystems.com.ng | ||||||
| CN=WR1,O=Google Trust Services,C=US (CA) | CN=GTS Root R1,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | RSA 2048 | SHA256-RSA | 7fd9e2c2d2048a0474b627a26d0868a7 |
| CN=GTS Root R1,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 19 Jun 2020 | 28 Jan 2028 | RSA 4096 | SHA256-RSA | 77bd0d6cdb36f91aea210fc4f058d30d |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of www.xpressflowsystems.com.ng. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ng. | present | 45566 | 13 | Verified |
| com.ng. | absent | Delegated | ||
| xpressflowsystems.com.ng. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains |
| content-security-policy | default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://aiagentsdirectory.com; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self' https://*.bachs.io; upgrade-insecure-requests |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=(), payment=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://www.xpressflowsystems.com.ng/api/mcp | Verified | 200 | |
| http (plaintext) | http://www.xpressflowsystems.com.ng/api/mcp | HTTPS enforced | 308 | https://www.xpressflowsystems.com.ng/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_domain_availability ~142
Check whether one domain name is free to register. Answers from the public registry for that ending: available, unavailable (taken) or unknown (that ending cannot be checked here). Takes one full name such as yourbrand.com.ng. When it can be ordered online, gives the first-year price. Prices are in US dollars outside Nigeria and in naira in Nigeria; pass currency to choose.
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | – | Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from. |
| domain | string | yes | One full domain name, for example yourbrand.com.ng. |
No output schema declared.
No examples provided.
create_cart_order ~261
Start one purchase for several eSIMs and proxy packs together: one payment_url for the whole total, in US dollars outside Nigeria and in naira in Nigeria. This does not charge anyone. After a verified payment every item is delivered within 10 minutes. Returns each item reference with its own status_url. Poll get_cart_status with reference and status_token.
| Name | Type | Req | Description |
|---|---|---|---|
| accept_terms | boolean | yes | Set true only if your user agreed to the Terms of Use and Privacy Policy on this website. |
| country | string | – | Optional: the payer's two-letter country. Outside Nigeria (NG) they pay in US dollars. |
| currency | string | – | Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from. |
| string | yes | Required: the person's email, for receipts and order details. | |
| email_verification_token | string | – | verification_token from verify_email_code for this email (required while email checks are on). |
| items | array | yes | Items: { kind: "esim", location, plan_code, qty } or { kind: "proxy", product, gb, offer_id, target_country, qty }. qty 1 to 5. |
No output schema declared.
No examples provided.
create_domain_order ~284
Start an order to register an available domain for a person. This does not charge anyone. It returns an approval_url that the person must open and pay (in US dollars outside Nigeria, in naira in Nigeria); the name is held for 60 minutes. Send approval_url to your user and wait. Poll get_order_status afterwards.
| Name | Type | Req | Description |
|---|---|---|---|
| accept_terms | boolean | yes | Set true only if your user has agreed to the Terms of Use and Privacy Policy on this website. |
| address | string | yes | Street address of the registrant. |
| city | string | yes | City. |
| country | string | yes | Country, for example Nigeria. |
| currency | string | – | Optional: USD or NGN, the currency the person pays in. By default US dollars outside Nigeria and naira in Nigeria, from where the request comes from. |
| customer_email | string | yes | Their email address. |
| customer_name | string | yes | Full name of the person who will own the domain. |
| customer_phone | string | yes | A phone number we can reach, for example 08012345678. |
| domain | string | yes | The available domain to register. |
| email_verification_token | string | – | verification_token from verify_email_code for this email (required while email checks are on). |
| organisation | string | – | Optional organisation name. |
| state | string | yes | State or region. |
No output schema declared.
No examples provided.
create_esim_order ~539
Start an eSIM purchase for a person. Phone-number plans need name, accept_aup: true and a real (not temporary) email, and are limited to 3 numbers per person. Any number past 3 needs customer_phone and id_document and waits for an ID check (status pending_payment with no payment_url yet, nothing charged) before payment_url is given. This does not charge anyone: it returns payment_url (card, bank transfer or crypto) for the person to pay, in US dollars outside Nigeria and in naira in Nigeria. After a verified payment the eSIM is delivered within 10 minutes; if it needs more time the buyer is emailed and can ask for a full refund before delivery. Poll get_order_status with reference and status_token. Use plan_code and location from search_esim_plans, or phone_plan_code from search_phone_plans.
| Name | Type | Req | Description |
|---|---|---|---|
| accept_aup | boolean | – | Required true with phone_plan_code: your user agreed to the Acceptable Use Policy (/acceptable-use): no spam, scams, impersonation, bulk SMS or robocalls; a violation cancels the number with no refun… |
| accept_terms | boolean | yes | Set true only if your user agreed to the Terms of Use and Privacy Policy on this website. |
| country | string | – | Optional: the payer's two-letter country. Outside Nigeria (NG) they pay in US dollars. Defaults to where the request comes from. |
| currency | string | – | Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from. |
| customer_phone | string | – | Only when asked (VERIFICATION_REQUIRED): the person's own phone number. |
| string | yes | Required: the person's email, for their receipt and order details (the eSIM). | |
| email_verification_token | string | – | verification_token from verify_email_code for this email (required while email checks are on). |
| id_document | string | – | Only when asked (VERIFICATION_REQUIRED): data URL (data:image/jpeg;base64,... or application/pdf) of a passport, driving licence or national ID, under 3 MB. Kept private. |
| location | string | – | Destination code from search_esim_plans, for example US. Not needed with phone_plan_code. |
| name | string | – | With phone_plan_code: the person's full name (first and last). |
| phone_plan_code | string | – | plan_code from search_phone_plans, for an eSIM with a phone number. |
| plan_code | string | – | plan_code from search_esim_plans. |
No output schema declared.
No examples provided.
create_proxy_order ~303
Start a proxy purchase for a person. This does not charge anyone: it returns payment_url for the person to pay, in US dollars outside Nigeria and in naira in Nigeria. After a verified payment the proxies are issued within 10 minutes. Poll get_order_status with reference and status_token.
| Name | Type | Req | Description |
|---|---|---|---|
| accept_terms | boolean | yes | Set true only if your user agreed to the Terms of Use and Privacy Policy on this website. |
| country | string | – | Optional: the payer's two-letter country. Outside Nigeria (NG) they pay in US dollars. Defaults to where the request comes from. |
| currency | string | – | Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from. |
| string | yes | Required: the person's email, for their receipt and order details (the lines). | |
| email_verification_token | string | – | verification_token from verify_email_code for this email (required while email checks are on). |
| gb | number | yes | Pack size (GB, or Mbps for a speed tier). |
| offer_id | string | yes | offer_id of the pack from list_proxy_products. |
| product | string | yes | Product id from list_proxy_products. |
| target_country | string | – | Optional: two-letter target country from this pack's locations.countries. Omit only for Network default, which does not guarantee a country. This is separate from the payer country. |
No output schema declared.
No examples provided.
create_wallet ~101
Create an empty Xpress wallet (no sign-up, no free credit). Returns a 32-character wallet code and an xk_live_ API key, shown once. Fund it with create_deposit on /api/mcp/wallet, then buy domains and eSIMs from the wallet balance within the caps the wallet owner sets.
| Name | Type | Req | Description |
|---|---|---|---|
| accept_terms | boolean | yes | Set true only if your user agreed to the Terms of Use and Privacy Policy on this website. |
No output schema declared.
No examples provided.
fetch ~102
Full details for one id returned by search, for example esim:GB (every plan and price for that destination). Prices are in US dollars outside Nigeria and in naira in Nigeria; pass currency to choose.
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | – | Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from. |
| id | string | yes | An id from search, for example esim:GB. |
No output schema declared.
No examples provided.
get_cart_status ~151
Look up a cart made with create_cart_order: the cart status and each item with its own status_url. Statuses: pending_payment (waiting for payment; for a phone-number order held for an ID check, payment_url appears once approved and nothing is charged before that), paid, activating (paid and being prepared, delivered within 10 minutes; if it needs more time the note says so and the buyer is emailed, and they can ask for a full refund before delivery), delivered, failed, refunded. Delivered orders carry the eSIM activation details or the proxy lines.
| Name | Type | Req | Description |
|---|---|---|---|
| reference | string | yes | Cart reference (XC-...). |
| status_token | string | yes | status_token from create_cart_order. |
No output schema declared.
No examples provided.
get_order_status ~165
Look up an order made with create_domain_order, create_esim_order or create_proxy_order. Statuses: pending_payment (waiting for payment; for a phone-number order held for an ID check, payment_url appears once approved and nothing is charged before that), paid, activating (paid and being prepared, delivered within 10 minutes; if it needs more time the note says so and the buyer is emailed, and they can ask for a full refund before delivery), delivered, failed, refunded. Delivered orders carry the eSIM activation details or the proxy lines. For domains, delivered means registered.
| Name | Type | Req | Description |
|---|---|---|---|
| reference | string | yes | Order reference such as XF-7K3Q9DFA. |
| token | string | yes | The access token: the last part of status_url. |
No output schema declared.
No examples provided.
list_esim_locations ~43
List every country and region we sell eSIM data plans for, with their codes. Regions (for example Europe or Global) cover many countries in one eSIM.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_proxy_products ~101
Proxy products with packs and prices, cheapest first. Each pack has an offer_id and locations.countries containing its confirmed two-letter target countries. An unavailable list does not establish country support. Prices are in US dollars outside Nigeria and in naira in Nigeria; pass currency to choose.
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | – | Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from. |
No output schema declared.
No examples provided.
request_email_code ~76
Step 1 before any create_*_order: email a 6-digit code to the buyer. Ask your user for the code from that email (it expires in 10 minutes; a new one can be sent after 60 seconds, at most 5 an hour).
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | The buyer's email address. |
No output schema declared.
No examples provided.
search ~44
Search what Xpress sells: eSIM destinations by name. Returns ids to pass to fetch.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | Words to search for, for example "japan esim". |
No output schema declared.
No examples provided.
search_esim_plans ~159
eSIM data plans for one destination, cheapest first, with prices. No sign-up: the person orders, pays, and gets an eSIM QR code. Give a country or region name or code, for example "United Kingdom", "GB" or "Europe". Each plan has an order_url: our own order page for the person. Prices are in US dollars outside Nigeria and in naira in Nigeria; pass currency to choose.
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | – | Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from. |
| location | string | yes | Country or region name or code, for example United Kingdom, GB, Europe or europe. |
No output schema declared.
No examples provided.
search_phone_plans ~141
eSIMs with a real carrier phone number (calls, texts and data), with prices. Optional country: US, VN, AU, MN, MV, EU (Europe) or GLOBAL. Each plan has an order_url for the person. Non-refundable once bought. Prices are in US dollars outside Nigeria and in naira in Nigeria; pass currency to choose.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Optional: US, VN, AU, MN, MV, EU or GLOBAL. |
| currency | string | – | Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from. |
No output schema declared.
No examples provided.
verify_email_code ~93
Step 2: check the 6-digit code your user read from their email. Returns verification_token (valid 24 hours); pass it as email_verification_token to create_domain_order, create_esim_order or create_proxy_order with the same email. 5 tries per code.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | The 6-digit code. |
| string | yes | The same email the code was sent to. |
No output schema declared.
No examples provided.
How do I install the Xpress Flow Systems MCP server?
Xpress Flow Systems is a hosted endpoint at https://www.xpressflowsystems.com.ng/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · www.xpressflowsystems.com.ng
claude mcp add --transport http ng-com-xpressflowsystems-www-esim-domains 'https://www.xpressflowsystems.com.ng/api/mcp'
What is the Xpress Flow Systems MCP server?
Xpress Flow Systems is an MCP server listed in the public MCP registry as ng.com.xpressflowsystems.www/esim-domains. No-sign-up eSIMs for 200+ countries, phone-number eSIMs, domains and proxies. You approve payment. This page covers its hosted endpoint (https://www.xpressflowsystems.com.ng/api/mcp).
Is the Xpress Flow Systems MCP server safe to use?
Xpress Flow Systems scores 75 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Xpress Flow Systems MCP server expose?
Xpress Flow Systems exposes 16 tools: check_domain_availability, list_esim_locations, search_esim_plans, search, fetch, and 11 more. Their descriptions and schemas cost roughly 2,705 tokens of context every time the server is loaded.
Does the Xpress Flow Systems MCP server require authentication?
No. We connected to Xpress Flow Systems without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Xpress Flow Systems MCP server still maintained?
Xpress Flow Systems is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.