# Xpress Flow Systems (remote · www.xpressflowsystems.com.ng)

No-sign-up eSIMs for 200+ countries, phone-number eSIMs, domains and proxies. You approve payment.

- Trust score: 75/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `www.xpressflowsystems.com.ng`: 75/100 (this document), [markdown](https://verifymcp.io/servers/ng-com-xpressflowsystems-www-esim-domains/api-mcp.md), [page](https://verifymcp.io/servers/ng-com-xpressflowsystems-www-esim-domains/api-mcp)

## Channel facts

- Endpoint: `https://www.xpressflowsystems.com.ng/api/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.2.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 80/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 66/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2891 tokens (~180/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 37/100
  - Stability check failed: schema churn in the 14 days we've observed: 0 tool removals, 2 breaking changes, 0 auth/transport breaks, 4 additions.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 16 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the Xpress Flow Systems MCP server?

Xpress Flow Systems is a hosted endpoint at https://www.xpressflowsystems.com.ng/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http ng-com-xpressflowsystems-www-esim-domains 'https://www.xpressflowsystems.com.ng/api/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "ng-com-xpressflowsystems-www-esim-domains": {
      "url": "https://www.xpressflowsystems.com.ng/api/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "ng-com-xpressflowsystems-www-esim-domains": {
      "type": "http",
      "url": "https://www.xpressflowsystems.com.ng/api/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.ng-com-xpressflowsystems-www-esim-domains]
url = "https://www.xpressflowsystems.com.ng/api/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ng-com-xpressflowsystems-www-esim-domains": {
      "type": "remote",
      "url": "https://www.xpressflowsystems.com.ng/api/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ng-com-xpressflowsystems-www-esim-domains --url 'https://www.xpressflowsystems.com.ng/api/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  ng-com-xpressflowsystems-www-esim-domains:
    url: "https://www.xpressflowsystems.com.ng/api/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "ng-com-xpressflowsystems-www-esim-domains": {
      "Transport": "http",
      "Url": "https://www.xpressflowsystems.com.ng/api/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add ng-com-xpressflowsystems-www-esim-domains -t streamable-http -u 'https://www.xpressflowsystems.com.ng/api/mcp'
```

### Other

```json
{
  "mcpServers": {
    "ng-com-xpressflowsystems-www-esim-domains": {
      "type": "http",
      "url": "https://www.xpressflowsystems.com.ng/api/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-03 (score 75, +1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “create_cart_order” rewrote its description, which is the text the model reads
- [security] Tool “list_proxy_products” rewrote its description, which is the text the model reads
- [cosmetic] “create_proxy_order” reworded the description of “target_country”

### 2026-11-02 (score 74, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “create_cart_order” rewrote its description, which is the text the model reads

### 2026-11-01 (score 74, +1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “create_cart_order” rewrote its description, which is the text the model reads
- [security] Tool “create_esim_order” rewrote its description, which is the text the model reads
- [security] Tool “get_cart_status” rewrote its description, which is the text the model reads
- [security] Tool “get_order_status” rewrote its description, which is the text the model reads

### 2026-10-30 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 14 to 17.

### 2026-10-28 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 11.

### 2026-10-26 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 1 to 4.

### 2026-10-25 (score 70, −1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “create_esim_order” rewrote its description, which is the text the model reads
- [security] Tool “get_order_status” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 2283 → 2851
- [functional] New tool “create_cart_order”
- [functional] New tool “get_cart_status”
- [cosmetic] “create_esim_order” added an optional parameter “customer_phone”
- [cosmetic] “create_esim_order” added an optional parameter “id_document”
- [cosmetic] “search_esim_plans” reworded the description of “location”

### 2026-10-24 (score 71, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “create_esim_order” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 1892 → 2283
- [functional] Schema quality: good → excellent
- [functional] New tool “request_email_code”
- [functional] New tool “verify_email_code”
- [cosmetic] “create_domain_order” added an optional parameter “email_verification_token”
- [cosmetic] “create_esim_order” added an optional parameter “accept_aup”
- [cosmetic] “create_esim_order” added an optional parameter “email_verification_token”
- [cosmetic] “create_esim_order” added an optional parameter “name”
- [cosmetic] “create_proxy_order” added an optional parameter “email_verification_token”

## MCP tools (16)

### `check_domain_availability` (~142 tokens)

Check whether one domain name is free to register. Answers from the public registry for that ending: available, unavailable (taken) or unknown (that ending cannot be checked here). Takes one full name such as yourbrand.com.ng. When it can be ordered online, gives the first-year price. Prices are in US dollars outside Nigeria and in naira in Nigeria; pass currency to choose.

Input parameters:

- `currency` (string): Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from.
- `domain` (string, required): One full domain name, for example yourbrand.com.ng.

### `list_esim_locations` (~43 tokens)

List every country and region we sell eSIM data plans for, with their codes. Regions (for example Europe or Global) cover many countries in one eSIM.

### `search_esim_plans` (~159 tokens)

eSIM data plans for one destination, cheapest first, with prices. No sign-up: the person orders, pays, and gets an eSIM QR code. Give a country or region name or code, for example "United Kingdom", "GB" or "Europe". Each plan has an order_url: our own order page for the person. Prices are in US dollars outside Nigeria and in naira in Nigeria; pass currency to choose.

Input parameters:

- `currency` (string): Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from.
- `location` (string, required): Country or region name or code, for example United Kingdom, GB, Europe or europe.

### `search` (~44 tokens)

Search what Xpress sells: eSIM destinations by name. Returns ids to pass to fetch.

Input parameters:

- `query` (string, required): Words to search for, for example "japan esim".

### `fetch` (~102 tokens)

Full details for one id returned by search, for example esim:GB (every plan and price for that destination). Prices are in US dollars outside Nigeria and in naira in Nigeria; pass currency to choose.

Input parameters:

- `currency` (string): Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from.
- `id` (string, required): An id from search, for example esim:GB.

### `search_phone_plans` (~141 tokens)

eSIMs with a real carrier phone number (calls, texts and data), with prices. Optional country: US, VN, AU, MN, MV, EU (Europe) or GLOBAL. Each plan has an order_url for the person. Non-refundable once bought. Prices are in US dollars outside Nigeria and in naira in Nigeria; pass currency to choose.

Input parameters:

- `country` (string): Optional: US, VN, AU, MN, MV, EU or GLOBAL.
- `currency` (string): Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from.

### `create_domain_order` (~284 tokens)

Start an order to register an available domain for a person. This does not charge anyone. It returns an approval_url that the person must open and pay (in US dollars outside Nigeria, in naira in Nigeria); the name is held for 60 minutes. Send approval_url to your user and wait. Poll get_order_status afterwards.

Input parameters:

- `accept_terms` (boolean, required): Set true only if your user has agreed to the Terms of Use and Privacy Policy on this website.
- `address` (string, required): Street address of the registrant.
- `city` (string, required): City.
- `country` (string, required): Country, for example Nigeria.
- `currency` (string): Optional: USD or NGN, the currency the person pays in. By default US dollars outside Nigeria and naira in Nigeria, from where the request comes from.
- `customer_email` (string, required): Their email address.
- `customer_name` (string, required): Full name of the person who will own the domain.
- `customer_phone` (string, required): A phone number we can reach, for example 08012345678.
- `domain` (string, required): The available domain to register.
- `email_verification_token` (string): verification_token from verify_email_code for this email (required while email checks are on).
- `organisation` (string): Optional organisation name.
- `state` (string, required): State or region.

### `get_order_status` (~165 tokens)

Look up an order made with create_domain_order, create_esim_order or create_proxy_order. Statuses: pending_payment (waiting for payment; for a phone-number order held for an ID check, payment_url appears once approved and nothing is charged before that), paid, activating (paid and being prepared, delivered within 10 minutes; if it needs more time the note says so and the buyer is emailed, and they can ask for a full refund before delivery), delivered, failed, refunded. Delivered orders carry the eSIM activation details or the proxy lines. For domains, delivered means registered.

Input parameters:

- `reference` (string, required): Order reference such as XF-7K3Q9DFA.
- `token` (string, required): The access token: the last part of status_url.

### `create_esim_order` (~539 tokens)

Start an eSIM purchase for a person. Phone-number plans need name, accept_aup: true and a real (not temporary) email, and are limited to 3 numbers per person. Any number past 3 needs customer_phone and id_document and waits for an ID check (status pending_payment with no payment_url yet, nothing charged) before payment_url is given. This does not charge anyone: it returns payment_url (card, bank transfer or crypto) for the person to pay, in US dollars outside Nigeria and in naira in Nigeria. After a verified payment the eSIM is delivered within 10 minutes; if it needs more time the buyer is emailed and can ask for a full refund before delivery. Poll get_order_status with reference and status_token. Use plan_code and location from search_esim_plans, or phone_plan_code from search_phone_plans.

Input parameters:

- `accept_aup` (boolean): Required true with phone_plan_code: your user agreed to the Acceptable Use Policy (/acceptable-use): no spam, scams, impersonation, bulk SMS or robocalls; a violation cancels the number with no refun…
- `accept_terms` (boolean, required): Set true only if your user agreed to the Terms of Use and Privacy Policy on this website.
- `country` (string): Optional: the payer's two-letter country. Outside Nigeria (NG) they pay in US dollars. Defaults to where the request comes from.
- `currency` (string): Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from.
- `customer_phone` (string): Only when asked (VERIFICATION_REQUIRED): the person's own phone number.
- `email` (string, required): Required: the person's email, for their receipt and order details (the eSIM).
- `email_verification_token` (string): verification_token from verify_email_code for this email (required while email checks are on).
- `id_document` (string): Only when asked (VERIFICATION_REQUIRED): data URL (data:image/jpeg;base64,... or application/pdf) of a passport, driving licence or national ID, under 3 MB. Kept private.
- `location` (string): Destination code from search_esim_plans, for example US. Not needed with phone_plan_code.
- `name` (string): With phone_plan_code: the person's full name (first and last).
- `phone_plan_code` (string): plan_code from search_phone_plans, for an eSIM with a phone number.
- `plan_code` (string): plan_code from search_esim_plans.

### `list_proxy_products` (~101 tokens)

Proxy products with packs and prices, cheapest first. Each pack has an offer_id and locations.countries containing its confirmed two-letter target countries. An unavailable list does not establish country support. Prices are in US dollars outside Nigeria and in naira in Nigeria; pass currency to choose.

Input parameters:

- `currency` (string): Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from.

### `create_proxy_order` (~303 tokens)

Start a proxy purchase for a person. This does not charge anyone: it returns payment_url for the person to pay, in US dollars outside Nigeria and in naira in Nigeria. After a verified payment the proxies are issued within 10 minutes. Poll get_order_status with reference and status_token.

Input parameters:

- `accept_terms` (boolean, required): Set true only if your user agreed to the Terms of Use and Privacy Policy on this website.
- `country` (string): Optional: the payer's two-letter country. Outside Nigeria (NG) they pay in US dollars. Defaults to where the request comes from.
- `currency` (string): Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from.
- `email` (string, required): Required: the person's email, for their receipt and order details (the lines).
- `email_verification_token` (string): verification_token from verify_email_code for this email (required while email checks are on).
- `gb` (number, required): Pack size (GB, or Mbps for a speed tier).
- `offer_id` (string, required): offer_id of the pack from list_proxy_products.
- `product` (string, required): Product id from list_proxy_products.
- `target_country` (string): Optional: two-letter target country from this pack's locations.countries. Omit only for Network default, which does not guarantee a country. This is separate from the payer country.

### `create_cart_order` (~261 tokens)

Start one purchase for several eSIMs and proxy packs together: one payment_url for the whole total, in US dollars outside Nigeria and in naira in Nigeria. This does not charge anyone. After a verified payment every item is delivered within 10 minutes. Returns each item reference with its own status_url. Poll get_cart_status with reference and status_token.

Input parameters:

- `accept_terms` (boolean, required): Set true only if your user agreed to the Terms of Use and Privacy Policy on this website.
- `country` (string): Optional: the payer's two-letter country. Outside Nigeria (NG) they pay in US dollars.
- `currency` (string): Optional: USD or NGN. By default prices are in US dollars outside Nigeria and in naira inside Nigeria, from where the request comes from.
- `email` (string, required): Required: the person's email, for receipts and order details.
- `email_verification_token` (string): verification_token from verify_email_code for this email (required while email checks are on).
- `items` (array, required): Items: { kind: "esim", location, plan_code, qty } or { kind: "proxy", product, gb, offer_id, target_country, qty }. qty 1 to 5.

### `get_cart_status` (~151 tokens)

Look up a cart made with create_cart_order: the cart status and each item with its own status_url. Statuses: pending_payment (waiting for payment; for a phone-number order held for an ID check, payment_url appears once approved and nothing is charged before that), paid, activating (paid and being prepared, delivered within 10 minutes; if it needs more time the note says so and the buyer is emailed, and they can ask for a full refund before delivery), delivered, failed, refunded. Delivered orders carry the eSIM activation details or the proxy lines.

Input parameters:

- `reference` (string, required): Cart reference (XC-...).
- `status_token` (string, required): status_token from create_cart_order.

### `request_email_code` (~76 tokens)

Step 1 before any create_*_order: email a 6-digit code to the buyer. Ask your user for the code from that email (it expires in 10 minutes; a new one can be sent after 60 seconds, at most 5 an hour).

Input parameters:

- `email` (string, required): The buyer's email address.

### `verify_email_code` (~93 tokens)

Step 2: check the 6-digit code your user read from their email. Returns verification_token (valid 24 hours); pass it as email_verification_token to create_domain_order, create_esim_order or create_proxy_order with the same email. 5 tries per code.

Input parameters:

- `code` (string, required): The 6-digit code.
- `email` (string, required): The same email the code was sent to.

### `create_wallet` (~101 tokens)

Create an empty Xpress wallet (no sign-up, no free credit). Returns a 32-character wallet code and an xk_live_ API key, shown once. Fund it with create_deposit on /api/mcp/wallet, then buy domains and eSIMs from the wallet balance within the caps the wallet owner sets.

Input parameters:

- `accept_terms` (boolean, required): Set true only if your user agreed to the Terms of Use and Privacy Policy on this website.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/ng-com-xpressflowsystems-www-esim-domains/api-mcp#diagnostics

## Score history

- 2026-11-05: 75
- 2026-11-04: 75
- 2026-11-03: 75
- 2026-11-02: 74
- 2026-11-01: 74
- 2026-10-31: 73
- 2026-10-30: 73
- 2026-10-29: 72
- 2026-10-28: 72
- 2026-10-27: 71
- 2026-10-26: 71
- 2026-10-25: 70
- 2026-10-24: 71
- 2026-10-23: 71
- 2026-10-22: 71

## Common questions

### What is the Xpress Flow Systems MCP server?

Xpress Flow Systems is an MCP server listed in the public MCP registry as ng.com.xpressflowsystems.www/esim-domains. No-sign-up eSIMs for 200+ countries, phone-number eSIMs, domains and proxies. You approve payment. This page covers its hosted endpoint (https://www.xpressflowsystems.com.ng/api/mcp).

### Is the Xpress Flow Systems MCP server safe to use?

Xpress Flow Systems scores 75 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Xpress Flow Systems MCP server expose?

Xpress Flow Systems exposes 16 tools: check_domain_availability, list_esim_locations, search_esim_plans, search, fetch, and 11 more. Their descriptions and schemas cost roughly 2,705 tokens of context every time the server is loaded.

### Does the Xpress Flow Systems MCP server require authentication?

No. We connected to Xpress Flow Systems without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Xpress Flow Systems MCP server still maintained?

Xpress Flow Systems is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://www.xpressflowsystems.com.ng/api/mcp
- Website: https://www.xpressflowsystems.com.ng/agents
- Changelog RSS feed: https://verifymcp.io/servers/ng-com-xpressflowsystems-www-esim-domains/api-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/ng-com-xpressflowsystems-www-esim-domains/api-mcp.json
- HTML version of this page: https://verifymcp.io/servers/ng-com-xpressflowsystems-www-esim-domains/api-mcp