CallRail MCP
PYPI · CALLRAIL-MCP · SCANNED SEP 21
CallRail REST API v3: 57 tools for calls, leads, trackers, tags, users, and agency reporting.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 1 of 33 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 13 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability64
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 11829 tokens (~207/item across 57 items; 57 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management47
- Stability observed for 14 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 6 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_tracker" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 57 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the CallRail MCP server?
CallRail MCP runs locally as a PyPI package, launched with uvx callrail-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · callrail-mcp
claude mcp add pghdma-callrail-mcp -- uvx callrail-mcp
{
"mcpServers": {
"pghdma-callrail-mcp": {
"command": "uvx",
"args": [
"callrail-mcp"
]
}
}
} {
"servers": {
"pghdma-callrail-mcp": {
"command": "uvx",
"args": [
"callrail-mcp"
]
}
}
} codex mcp add pghdma-callrail-mcp -- uvx callrail-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"pghdma-callrail-mcp": {
"type": "local",
"command": [
"uvx",
"callrail-mcp"
],
"enabled": true
}
}
} openclaw mcp add pghdma-callrail-mcp --command uvx --arg callrail-mcp
mcp_servers:
pghdma-callrail-mcp:
command: "uvx"
args: ["callrail-mcp"] {
"McpServers": {
"pghdma-callrail-mcp": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"callrail-mcp"
]
}
}
} assistant mcp add pghdma-callrail-mcp -t stdio -c uvx -a callrail-mcp
{
"mcpServers": {
"pghdma-callrail-mcp": {
"command": "uvx",
"args": [
"callrail-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 +4
- Stability: unverified → 0.27 ▲ functional
- 8 Sept 26 +25
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- First check of Tool coverage: 0 functional
- First check of Schema quality: fail functional
- First check of Schema quality: excellent functional
- First check of Schema quality: fail functional
- First check of Destructive annotations: 0 functional
- First check of Tool coverage: 100 functional
- 7 Sept 26 0
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool safety: Tool safety not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet. security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- First check of Tool coverage: 0 functional
- First check of Schema quality: fail functional
- First check of Schema quality: excellent functional
- First check of Schema quality: fail functional
- First check of Destructive annotations: 0 functional
- First check of Tool coverage: 100 functional
- Capabilities: Protocol version not yet verified: we do not have a sandbox capture of the MCP handshake this version of the package performs yet. functional
- Tool coverage: Tool coverage not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet. functional
- Schema quality: Schema quality not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. functional
- Package version: 1.1.2 → 1.2.2 functional
- Package version: 1.1.2 → 1.2.1 functional
- Package version: 1.1.2 → 1.2.0 functional
- 26 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed pypi/callrail-mcp@1.2.2
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 33 packages
| Packages resolved | 33 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
update_form_submission ~170
Update an existing form submission: notes, tags, value, spam, lead status. Args: submission_id: CallRail form-submission id (prefix 'FOR...'). account_id: Auto-resolves if omitted. note, tags, value, spam, lead_status: same semantics as `update_call`. Empty-string fields (e.g. `note=""`) are rejected to prevent accidental field-clearing. See `update_call` docstring. Length caps (rejected pre-network): - `note`: 4000 chars - `tags`: 100 entries max
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | – | – | – |
| lead_status | – | – | – |
| note | – | – | – |
| spam | – | – | – |
| submission_id | string | yes | – |
| tags | – | – | – |
| value | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
update_notification ~325
Update a notification rule. Pass None to leave a field unchanged; only fields with explicit values are sent in the PUT body. Notification rules trigger emails / desktop pushes / SMS when calls or form submissions match conditions. Use this to rewire targets, change triggering events, or silence a noisy rule without deleting it (set all `send_*` to False). Args: notification_id: Notification rule ID. name: Display name for the rule. alert_type: Common values: 'all_calls', 'first_time_callers', 'missed_calls', 'voicemails', 'all_texts', 'first_time_texters', 'all_form_submissions' (same set as `create_notification`). Plan-specific: unknown values warn but do not reject. send_email: Send email notification. send_desktop: Send desktop browser push. send_push: Send mobile push notification. call_enabled: Trigger on call events. sms_enabled: Trigger on SMS events. email: Override target email (defaults to user's primary). Validated as RFC-822-ish. account_id: CallRail account ID. Auto-resolves if omitted. Returns: JSON string with the updated notification rule.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | – | – | – |
| alert_type | – | – | – |
| call_enabled | – | – | – |
| – | – | – | |
| name | – | – | – |
| notification_id | string | yes | – |
| send_desktop | – | – | – |
| send_email | – | – | – |
| send_push | – | – | – |
| sms_enabled | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
update_sms_thread ~233
Update an SMS thread's lead-management fields. This is the texting equivalent of `update_call`. Closes the gap where texting leads couldn't be tagged / noted / qualified via API. Args: thread_id: Thread id (from `list_sms_threads`). notes: Note text (max 4000 chars). Empty string rejected. value: Numeric lead value. tags: Tag names to apply (max 100). append_tags: If True (default), `tags` are ADDED to existing ones (CallRail's `append_tags` flag). If False, `tags` REPLACES the thread's tag list. lead_qualification: e.g. 'good_lead', 'not_a_lead'. Values are plan-configurable so unknown strings are passed through. account_id: Auto-resolves if omitted.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | – | – | – |
| append_tags | boolean | – | – |
| lead_qualification | – | – | – |
| notes | – | – | – |
| tags | – | – | – |
| thread_id | string | yes | – |
| value | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
update_tag ~133
Rename or recolor a tag. Args: tag_id: Numeric tag id. account_id: Auto-resolves if omitted. name: New display name. color: One of the 24 CallRail-supported colors (see VALID_TAG_COLORS): gray1-2, blue1-2, cyan1-2, purple1-2, pink1-4, red1-2, orange1-4, yellow1-2, green1-4.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | – | – | – |
| color | – | – | – |
| name | – | – | – |
| tag_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
update_tracker ~291
Update a tracker's mutable settings: name, destination, whisper, greeting, SMS. Args: tracker_id: 'TRK...' id. account_id: Auto-resolves if omitted. name: New display name. destination_number: Where calls forward (e.g. "+14129548337"). Updates the call_flow's destination too. whisper_message: New whisper text. greeting_text: New automated greeting. **If supplied, you must also supply destination_number**. CallRail's PUT /trackers replaces the entire call_flow object, so updating only greeting_text would silently zero out the destination, breaking the tracker. sms_enabled: Toggle SMS on/off. Field-level rules: - `name`, `destination_number`, `whisper_message`, `greeting_text` must be non-empty strings if provided. Pass `None` (the default) to leave a field unchanged. NOTE: Setting `status` via this PUT is silently ignored by CallRail. To disable a tracker, use `delete_tracker(tracker_id)` (soft-delete / disabled, keeps history). To permanently remove, contact CallRail support.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | – | – | – |
| destination_number | – | – | – |
| greeting_text | – | – | – |
| name | – | – | – |
| sms_enabled | – | – | – |
| tracker_id | string | yes | – |
| whisper_message | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
update_user ~101
Update mutable user fields. Pass None to leave unchanged. Args: user_id: 'USR...' id. company_ids: REPLACES the user's company access list (additive modification not exposed; for additive use the CallRail UI).
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | – | – | – |
| company_ids | – | – | – |
| – | – | – | |
| first_name | – | – | – |
| last_name | – | – | – |
| role | – | – | – |
| user_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
usage_summary ~389
Per-company cost-attribution summary for the current cycle. Aggregates active trackers + per-company call minutes and projects what each client is contributing to the agency's CallRail bill. Useful for: - Deciding which client to renegotiate / upsell / drop - Sanity-checking the upcoming invoice - Quarterly reviews Pricing assumes Call Tracking Starter ($50 base + 5 numbers + 250 mins bundled; $3/local number, $5/toll-free number, $0.05/local minute, $0.08/toll-free minute over bundle). Edit PRICING_* constants in server.py if you're on a different plan. Args: account_id: Auto-resolves if omitted. days: Lookback window in days (default 30 = roughly one cycle). Ignored if `start_date` provided. start_date: 'YYYY-MM-DD'. end_date: 'YYYY-MM-DD' (defaults to today). Returns: - `agency`: plan + totals + bundle utilization + cycle estimate - `by_company[]`: each company's minutes, active numbers, cost share (sorted by cost-share descending) - `biggest_cost_driver`: name of top company - `partial_failures[]`: per-company API errors. Each entry carries `partial_calls_before_failure`, `partial_minutes_before_failure`, `partial_local_numbers`, `partial_tollfree_numbers` so an under- reporting agency_total is observable, not silent. - `notes`: caveats about the cost model (toll-free minute pricing not yet differentiated; SMS not included). Cost shares sum exactly to `agency.estimated_cycle_total` via largest- remainder rounding.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | – | – | – |
| days | integer | – | – |
| end_date | – | – | – |
| start_date | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
What is the CallRail MCP server?
CallRail MCP is listed in the public MCP registry as io.github.pghdma/callrail-mcp. CallRail REST API v3: 57 tools for calls, leads, trackers, tags, users, and agency reporting. This page covers its PyPI package (callrail-mcp).
Is the CallRail MCP server safe to use?
CallRail MCP scores 72 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the CallRail MCP server expose?
CallRail MCP exposes 57 tools: list_accounts, list_companies, list_trackers, get_tracker, create_tracker, and 52 more. Their descriptions and schemas cost roughly 11,829 tokens of context every time the server is loaded.
Is the CallRail MCP server still maintained?
CallRail MCP is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the CallRail MCP server under?
CallRail MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.