Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.virtualsms-io/sms

NPM · VIRTUALSMS-MCP · 2 COMPONENTS

Real SIM numbers for AI agents: SMS verification, rentals, proxies, cloud browser, x402 deposits.

−3 this week 78 Trust /100

Last scanned (7 hours ago)

Scores higher than 58% of npm servers

Category Communication

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 33 of 107 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 42 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability87
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Tool/resource definitions use about 4128 tokens (~96/item across 43 items; 40 tools + 3 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management77
  • Stability observed for 23 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 40 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 42 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 −4
    • Stability: pass → 0.77 functional
  • 30 Oct 26 +1
    • Stability: 0.97 → pass security
  • 29 Oct 26 −1
    • Stability: pass → 0.97 functional
  • 24 Oct 26 −5
    • CVE-2023-54404 affects this package: high ▼ security
    • Known CVEs: pass → fail ▼ security
  • 22 Oct 26 +1
    • Stability: 0.97 → pass security
  • 21 Oct 26 −1
    • Stability: pass → 0.97 functional
  • 17 Oct 26 +3
    • Stability: 0.80 → pass security
  • 16 Oct 26 −3
    • Stability: pass → 0.80 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/virtualsms-mcp@1.3.3

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 107 packages
Packages resolved 107
Stale 33
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 40 exposed · ~3,844 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
virtualsms_buy_proxy ~165

Purchase proxy traffic (GB) for a selected pool type. Returns proxy credentials and remaining balance. country_code here is only a soft preference for provisioning. For actual per-connection targeting (country/state/city/zip/asn) or a ready-to-use connection string, use virtualsms_generate_proxy_endpoint after buying. To persist a default targeting on the sub-user, use virtualsms_set_proxy_targeting.

NameTypeReqDescription
country_codestring–Optional ISO-2 country preference (e.g. us, gb)
gbnumberyesAmount of traffic to add in GB
idempotency_keystring–Optional key for safe retries without double charges
pool_typestringyesPool type: residential, residential_premium, mobile, datacenter

No output schema declared.

No examples provided.

virtualsms_cancel_all_orders ~44

Bulk-cancel every currently active order in your account. Returns the number of orders cancelled plus any failures. Useful for quick cleanup after a batch run or test session.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

virtualsms_cancel_order ~103

Cancel an order and request a refund. Only works if no SMS has been received yet. Use this if the service is taking too long or you want to try a different number. **Cooldown:** cancel is only available 120 seconds after purchase. Check `cancel_available_at` on the order before calling. Calling earlier returns a `cooldown_active` error from this MCP server (no backend round-trip).

NameTypeReqDescription
order_idstringyesOrder ID to cancel

No output schema declared.

No examples provided.

virtualsms_cancel_rental ~63

Cancel a rental for a full refund. Only eligible within 20 minutes of purchase AND before any SMS has been received. Works for either tier. Past that window a rental runs to its natural expiry.

NameTypeReqDescription
rental_idstringyesRental ID to cancel

No output schema declared.

No examples provided.

virtualsms_check_number ~64

Public carrier + line-type lookup for an arbitrary E.164 phone number (mobile/landline/VoIP, spam risk). No API key required.

NameTypeReqDescription
numberstringyesPhone number in E.164 format (e.g. "+447911123456")

No output schema declared.

No examples provided.

virtualsms_create_order ~103

Purchase a virtual phone number for SMS verification. Returns order_id and phone_number. Codes typically arrive within ~10-60 seconds after purchase. Use get_sms to poll for the verification code, or use wait_for_sms to block until it arrives.

NameTypeReqDescription
countrystringyesCountry ISO code (e.g. "US", "GB", "RU")
servicestringyesService code (e.g. "telegram", "whatsapp", "google")

No output schema declared.

No examples provided.

virtualsms_create_rental ~211

Rent a phone number for an extended period (as opposed to a one-off number via create_order). Two tiers: "full_access" = local SIM inventory, works across ANY service on that number. "platform" = sourced via our global supplier network, locked to ONE chosen service, durations 1/3/7 days only. Both tiers carry the same refund terms: a full refund within 20 minutes of purchase and before the first SMS arrives. Check rentals_available and rentals_price/rentals_pricing first to confirm country/service/duration and cost.

NameTypeReqDescription
auto_renewboolean–full_access tier only. Auto-renew at expiry (default: false)
countrystringyesISO-2 country code
duration_hoursnumberyesDuration in hours (platform tier: 24, 72, or 168 only)
servicestring–Service code. Required for platform tier; optional for full_access
tierstringyesRental tier

No output schema declared.

No examples provided.

virtualsms_extend_rental ~58

Extend an active rental by an additional duration. Charges your balance at the current catalog price for that duration.

NameTypeReqDescription
duration_hoursnumberyesAdditional duration in hours to add
rental_idstringyesRental ID to extend

No output schema declared.

No examples provided.

virtualsms_find_cheapest ~80

Find the cheapest countries for a given service, sorted by price. Returns available countries with prices and stock levels so you can pick the best deal.

NameTypeReqDescription
limitnumber–Number of cheapest options to return (default: 5)
servicestringyesService code (e.g. "telegram", "whatsapp", "google")

No output schema declared.

No examples provided.

virtualsms_generate_proxy_endpoint ~310

Build ready-to-use proxy connection string(s) for an owned proxy: country/state/city/zip/asn targeting, rotating or sticky session, HTTP or SOCKS5, in host:port:user:pass / user:pass@host:port / curl format. Nothing is purchased or changed server-side. This only composes a connection string from the proxy's existing credentials (same convention as the VirtualSMS dashboard's endpoint generator). Sub-country targeting (state/city/zip/asn) bills the proxy's own GB at 2x on non-premium pools, free on residential_premium.

NameTypeReqDescription
countnumber–How many endpoint strings to generate (default: 1)
country_codestringyesISO-2 country to target (e.g. "us", "gb")
formatstring–Output string format (default: host:port:user:pass)
location_codestring–Location value matching target_by. Required when target_by is not "country"
protocolstring–Proxy protocol (default: HTTP)
proxy_idstringyesProxy ID returned by list_proxies or buy_proxy
sessionstring–rotating = new IP per connection (default). sticky = holds one IP per generated endpoint.
sticky_ttl_minutesnumber–How long a sticky session holds its IP, in minutes (default: 10)
target_bystring–Refinement level (default: country)

No output schema declared.

No examples provided.

virtualsms_get_balance ~45

Check your VirtualSMS account balance in USD. Requires VIRTUALSMS_API_KEY to be set.

NameTypeReqDescription
currencystring–Display balance in specific currency (default: USD)

No output schema declared.

No examples provided.

virtualsms_get_order ~72

Get the full details of a specific order, including status, phone number, service, country, timestamps, and any received SMS code/text. Use this when you have an order_id and need the latest state beyond what get_sms returns.

NameTypeReqDescription
order_idstringyesOrder ID to retrieve full details for

No output schema declared.

No examples provided.

virtualsms_get_price ~76

Check the price and availability for a specific service + country combination. Always check price before buying to confirm availability.

NameTypeReqDescription
countrystringyesCountry ISO code (e.g. "US", "GB", "RU")
servicestringyesService code (e.g. "telegram", "whatsapp", "google")

No output schema declared.

No examples provided.

virtualsms_get_profile ~38

Full account profile: email, Telegram link status, current balance, lifetime spend, total orders, active API keys, and account creation date.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

virtualsms_get_proxy_usage ~58

Get cached GB used/remaining and request count for one proxy. Cheap, no upstream call. Reads a cached value refreshed every ~5 minutes.

NameTypeReqDescription
proxy_idstringyesProxy ID returned by list_proxies or buy_proxy

No output schema declared.

No examples provided.

virtualsms_get_proxy_usage_history ~70

Get a per-day traffic (GB) and request-count series for one proxy over the last 7 or 30 days.

NameTypeReqDescription
proxy_idstringyesProxy ID returned by list_proxies or buy_proxy
rangestring–History window (default: 7d)

No output schema declared.

No examples provided.

virtualsms_get_rental ~69

Get the full details of a specific rental by ID, including tier, phone number, country, service lock, status, expiry, and any received SMS. Use list_rentals first if you do not have the rental_id.

NameTypeReqDescription
rental_idstringyesRental ID to retrieve

No output schema declared.

No examples provided.

virtualsms_get_sms ~79

Check if an SMS verification code has been received for an order. Returns status, phone_number, and (when delivered) messages[] array plus an extracted code. Poll this every 5-10 seconds after buying a number, or use wait_for_sms to block until delivery.

NameTypeReqDescription
order_idstringyesOrder ID returned from create_order

No output schema declared.

No examples provided.

virtualsms_get_stats ~62

Account usage stats aggregated from your order history: total orders, success rate, total spend, top services/countries, and status breakdown over a configurable lookback window.

NameTypeReqDescription
since_daysnumber–Window in days for activity stats (default: 30)

No output schema declared.

No examples provided.

virtualsms_get_transactions ~137

Transaction history for the account with optional filters for type, date range, and pagination. Types: "deposit", "purchase", "refund", "admin_credit".

NameTypeReqDescription
fromstring–Lower bound on created_at: RFC3339 or YYYY-MM-DD
limitnumber–Max transactions (1-200, default: 50)
offsetnumber–Pagination offset (default: 0)
tostring–Upper bound on created_at: RFC3339 or YYYY-MM-DD
typestring–Filter by type: "deposit", "purchase", "refund", "admin_credit"

No output schema declared.

No examples provided.

virtualsms_list_countries ~47

Get all available countries for SMS verification. Use this to discover valid country codes before buying a number.

NameTypeReqDescription
servicestring–Filter countries available for a specific service (optional)

No output schema declared.

No examples provided.

virtualsms_list_orders ~69

List your active orders. Essential for crash recovery. If your session was interrupted, use this to find pending orders and their phone numbers, then use get_sms to retrieve codes.

NameTypeReqDescription
statusstring–Optional status filter: "pending", "sms_received", "cancelled", "completed"

No output schema declared.

No examples provided.

virtualsms_list_proxies ~48

List all proxies on your account with remaining GB and login credentials. Returns proxy_id values for use with get_proxy_usage, rotate_proxy, set_proxy_targeting, and generate_proxy_endpoint.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

virtualsms_list_proxy_catalog ~32

List available proxy pool types, countries, and price-per-GB. Use this before buying proxy traffic.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

virtualsms_list_proxy_locations ~122

List available cities, states, ASNs, or ZIP codes for a pool type + country. Use this to discover valid location_code values before calling virtualsms_generate_proxy_endpoint or virtualsms_set_proxy_targeting with sub-country targeting. Public endpoint, no purchase required. Not available for residential_premium (only residential, mobile, datacenter).

NameTypeReqDescription
countrystringyesISO-2 country code (e.g. "US", "DE")
kindstringyesWhich location dimension to list
pool_typestringyesPool type

No output schema declared.

No examples provided.

virtualsms_list_rentals ~85

List your rentals across both tiers, optionally filtered by status. Returns rental_id, tier, country, phone number, status, and expiry for each. Use get_rental for full detail on one.

NameTypeReqDescription
statusstring–Optional status filter: "active", "cancelled", "completed", "expired", or "all" (default: "active")

No output schema declared.

No examples provided.

virtualsms_list_services ~51

Get all available SMS verification services (Telegram, WhatsApp, Google, etc.). Use this to discover valid service codes before buying a number.

NameTypeReqDescription
searchstring–Filter services by name (optional)

No output schema declared.

No examples provided.

virtualsms_order_history ~154

List past orders with optional filters for status, service, country, and a lookback window in days. Returns up to 50 orders (server cap) ordered most-recent-first.

NameTypeReqDescription
countrystring–Optional country ISO code filter (e.g. "US", "GB")
limitnumber–Max orders to return (default: 20, server cap: 50)
servicestring–Optional service code filter (e.g. "telegram", "whatsapp")
since_daysnumber–Only include orders from the last N days
statusstring–Optional status filter: "completed", "cancelled", "expired", "sms_received", "waiting"

No output schema declared.

No examples provided.

virtualsms_rentals_available ~122

List countries with rental stock, available counts, and pricing. tier=full_access (default) shows local-SIM inventory; tier=platform shows countries available via our global supplier network (with per-country service counts and popular services). Use this before creating a rental.

NameTypeReqDescription
countrystring–Optional ISO-2 country filter
servicestring–Optional service filter (full_access tier only)
tierstring–Which tier to list (default: full_access)
typestring–Optional full_access sub-type filter

No output schema declared.

No examples provided.

virtualsms_rentals_price ~65

Get the catalog-driven retail price for a (service, country, duration) platform-tier rental combo.

NameTypeReqDescription
country_codestringyesISO-2 country code
duration_hoursnumberyesDuration in hours
servicestringyesService code

No output schema declared.

No examples provided.

virtualsms_rentals_pricing ~82

List all active rental pricing tiers (Full Access tier: local SIM inventory, durations and prices). This is a raw catalog dump and may list rows that are not purchasable today, so confirm against rentals_available (authoritative per country) before creating a rental. Use rentals_price for platform-tier (per-country, per-service) pricing instead.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

virtualsms_rentals_services ~91

List services available for platform-tier rental in a given country, with physical stock counts and retail price. Platform-tier rentals are locked to ONE chosen service per number. Use this to pick a valid service code before creating one.

NameTypeReqDescription
country_codestringyesISO-2 country code (e.g. "GR")
duration_hoursnumber–Duration in hours (default: 24)

No output schema declared.

No examples provided.

virtualsms_retry_order ~69

Ask the provider to resend the SMS to the SAME phone number on an existing order (order must be in waiting/created status). Not all order types support this. Some providers only support swap_number instead, which returns a NEW number.

NameTypeReqDescription
order_idstringyesOrder ID to retry

No output schema declared.

No examples provided.

virtualsms_rotate_proxy ~63

Request a fresh IP for an existing proxy. Useful when an endpoint flags the current exit IP.

NameTypeReqDescription
portnumber–Optional proxy port. Defaults to rotating HTTP port.
proxy_idstringyesProxy ID returned by list_proxies or buy_proxy

No output schema declared.

No examples provided.

virtualsms_search_services ~71

Find the right service code using natural language. Don't know the exact code? Just search "uber", "binance", "steam" etc. Returns matching services with similarity scores.

NameTypeReqDescription
querystringyesNatural language search query (e.g. "uber", "whatsapp", "binance")

No output schema declared.

No examples provided.

virtualsms_set_proxy_targeting ~179

Persist a default geo-targeting (country, and optionally cities/ASNs) on an existing proxy sub-user. Country-only is free. Adding cities or ASNs bills the GB on your OWN allocation at 2x (not on residential_premium, where refined targeting is included free). This changes the STORED default. For a one-off connection string with any targeting (including state/zip), use virtualsms_generate_proxy_endpoint instead.

NameTypeReqDescription
asnsarray–Optional ASN numbers. Triggers 2x billing on non-premium pools
citiesarray–Optional city slugs. Triggers 2x billing on non-premium pools
country_codestringyesISO-2 country code (required)
proxy_idstringyesProxy ID returned by list_proxies or buy_proxy

No output schema declared.

No examples provided.

virtualsms_start_manual_registration_session ~196

Beta, invite-only. Start a country-matched cloud browser you drive yourself: returns a viewer_url, an authenticated live-viewer link you open to watch and drive the session (manual takeover), plus optional order phone number and timeline. Agent-driven navigation is the separate opt-in session tools. Pair with create_order for OTP + browser in one agent flow.

NameTypeReqDescription
countrystring–ISO-2 country for proxy match
device_modestring–Viewport profile
modestring–Session attach mode
order_idstring–Activation order UUID to attach
prep_presetstring–Prep preset
run_prepboolean–Run prep after start
service_namestring–Service hint (telegram, whatsapp, …)
target_urlstring–URL for generic prep
with_proxyboolean–Attach matching VSMS proxy

No output schema declared.

No examples provided.

virtualsms_swap_number ~111

Swap a phone number on an existing order. Gets a new number for the same service and country without additional charge. Use when the current number isn't receiving SMS. **Cooldown:** swap is only available 120 seconds after purchase. Check `swap_available_at` on the order before calling. Calling earlier returns a `cooldown_active` error from this MCP server (no backend round-trip).

NameTypeReqDescription
order_idstringyesOrder ID to swap. Must be in waiting/created status with no SMS received

No output schema declared.

No examples provided.

virtualsms_test_proxy ~140

Make one request through a proxy and report the exit IP, country, city, ISP, and latency. Proves the proxy works and which country it exits from. Consumes a small amount of the proxy's GB allocation. Rate-limited to about once per 20 seconds per proxy.

NameTypeReqDescription
countrystringyesISO-2 country to test the exit IP through (e.g. "us", "gb")
protocolstring–Protocol to test (default: http)
proxy_idstringyesProxy ID returned by list_proxies or buy_proxy
sessionstring–Connection session type (default: rotating)

No output schema declared.

No examples provided.

virtualsms_wait_for_sms ~140

Wait (block) until the SMS arrives on an existing order_id, or until timeout. Codes typically arrive within ~10-60 seconds. This call BLOCKS for up to timeout_seconds (default 60, max 600) before returning. Uses real-time WebSocket delivery with automatic polling fallback. Pass an order_id from create_order. To buy AND wait in one step, call create_order then this tool.

NameTypeReqDescription
order_idstringyesExisting order ID returned from create_order
timeout_secondsnumber–How long to wait for SMS in seconds (default: 60, min: 5, max: 600)

No output schema declared.

No examples provided.

Install

How do I install the io.github.virtualsms-io/sms MCP server?

io.github.virtualsms-io/sms runs locally as an npm package, launched with npx -y virtualsms-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · virtualsms-mcp

# add to Claude Code
claude mcp add virtualsms-io-sms -- npx -y virtualsms-mcp
Common questions

What is the io.github.virtualsms-io/sms MCP server?

io.github.virtualsms-io/sms is an MCP server listed in the public MCP registry as io.github.virtualsms-io/sms. Real SIM numbers for AI agents: SMS verification, rentals, proxies, cloud browser, x402 deposits. This page covers its npm package (virtualsms-mcp).

Is the io.github.virtualsms-io/sms MCP server safe to use?

io.github.virtualsms-io/sms scores 78 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.virtualsms-io/sms MCP server expose?

io.github.virtualsms-io/sms exposes 40 tools: virtualsms_list_proxy_catalog, virtualsms_list_proxies, virtualsms_buy_proxy, virtualsms_rotate_proxy, virtualsms_get_proxy_usage, and 35 more. Their descriptions and schemas cost roughly 3,844 tokens of context every time the server is loaded.

Is the io.github.virtualsms-io/sms MCP server still maintained?

io.github.virtualsms-io/sms is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.virtualsms-io/sms MCP server under?

io.github.virtualsms-io/sms declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.