Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Vobiz

NPM · @VOBIZ/MCP · 2 COMPONENTS

Vobiz voice calls, IVRs, call records, numbers, SIP trunks, SMS/MMS/RCS and Vobiz skills.

66 Trust /100

Last scanned (13 hours ago)

Scores higher than 38% of npm servers

Category Communication

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security39
  • Malware scan not yet available for this package.Unverified
  • CVE check failed: a known high-severity CVE affects uuid 9.0.1, reached via @google-cloud/storage > gaxios > uuid. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 77 of 245 dependencies flagged as unhealthy (3 deprecated). View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to vobiz-ai/Vobiz-MCP-Server). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 0 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability80
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 27976 tokens (~225/item across 124 items; 106 tools + 18 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management13
  • Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 14 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 108 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 23 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
    • Package version: 1.4.2 → 1.4.3 functional
  • 22 Oct 26 +16
    • Malware scan: unverified → pass ▲ security
  • 21 Oct 26 +2
    • Malware scan: unverified → pass ▲ security
    • Schema quality: 138 → 226 ▼ functional
    • Tool coverage: 62% → 100% ▲ functional
    • First check of Tool coverage: 100 functional
    • Schema quality: good → excellent functional
    • Package version: 1.4.1 → 1.4.2 functional
  • 20 Oct 26 −18
    • CVE-2026-41907 affects this package: high ▼ security
    • Malware scan: pass → unverified ▼ security
    • Known CVEs: pass → fail ▼ security
    • Package version: 1.1.4 → 1.4.1 functional
  • 19 Oct 26 81

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 23 Oct 2026 · Analysed npm/@vobiz/mcp@1.4.3

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo vobiz-ai/Vobiz-MCP-Server
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/vobiz-ai/Vobiz-MCP-Server/.github/workflows/release.yml@refs/tags/v1.4.3
Rekor log index 3419309868
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:585d54f2d2f17ff0f804aa5464029fa89ba66cc60d36b8095195f08820d78999c419817e85b51a252429283f1289aee3865b80271222739a7303d75aa

Background: How many MCP packages publish verified provenance →

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-w5hq-g745-h8pq CVE-2026-41907 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 245 packages
Packages resolved 245
Deprecated 3
Stale 74
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 106 exposed · ~26,129 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
send_message ~558

Send a real SMS, MMS or RCS message through Vobiz (POST /api/v1/sms/messages). Each recipient becomes its own message and is billed. Required: `from`, `to`, `idempotency_key`, and `confirm: true` after the user approved the exact sender, recipients and text. For sms/mms, `from` is one of your Vobiz messaging numbers (see list_messaging_numbers); for rcs it is your RCS sender name. Use preview_message_cost first to show the price and segment count. Opted-out recipients are refused by Vobiz (opted_out). status `scheduled` = held until scheduled_at; `sent` = handed to the network; delivery receipts update it to `delivered` or `failed` (check get_message). Repeating an idempotency_key never sends twice.

NameTypeReqDescription
channelstring–sms (default), mms or rcs.
confirmbooleanyesMust be true, set only after the user explicitly approved this send. If your client supports MCP elicitation, the server asks the user to approve directly and this flag is not relied on; otherwise it…
dlt_entity_idstring–India TRAI DLT Principal Entity ID.
dlt_header_idstring–India TRAI DLT sender header ID.
dlt_template_idstring–India TRAI DLT content template ID; text must match it.
failover_to_smsboolean–RCS only: send the text as SMS if RCS cannot be delivered.
fromstringyesSender: an E.164 Vobiz messaging number (sms/mms), or your RCS sender name (rcs).
idempotency_keystringyesUnique key for this intended operation (e.g. a UUID). Repeating it replays the first result instead of acting again.
media_urlsarray–Public https media URLs (MMS up to 10; RCS sends the first).
scheduled_atstring–Send later at this RFC 3339 time, e.g. 2026-11-01T09:00:00Z.
tagstring–Your label, stored on every message; filter list_messages by it.
textstring–Message body. Required for sms and rcs. Long SMS are split into billed segments.
titlestring–MMS subject line.
toarrayyesRecipient numbers in E.164, e.g. ['+14155550123']. Capped by VOBIZ_MAX_RECIPIENTS_PER_SEND.
NameTypeReqDescription
http_statusesarray–HTTP status Vobiz returned for each accepted recipient.
messagesarray–One entry per recipient, in the order given: id, to, status (scheduled, sent, not_sent, unknown), errorCode and errorMessage when not sent.
not_sent_countnumber–Recipients refused or failed; see their errorCode (e.g. opted_out).
notestring–What the statuses mean and what to do next.
okboolean–True only when every recipient was handed to the network; false when any recipient was not sent, or when the result is an error.
sent_countnumber–Recipients whose message was accepted (status scheduled or sent).

No examples provided.

speak_text ~390

Read `text` aloud into a LIVE call with Vobiz text-to-speech (POST /Call/{uuid}/Speak/). Use it for dynamic sentences; for a pre-recorded file use play_audio, and to connect your own AI voice agent or transcription use start_audio_stream. Plain text or SSML (`type: ssml`), up to 3000 characters, spoken in `language` (default en-US) with a WOMAN (default) or MAN voice; `mix` and `loop` work as in play_audio. Speech ends when the text finishes, or earlier with stop_speaking (stop_audio does not stop it). A call that is not live fails with call_not_active.

NameTypeReqDescription
call_uuidstringyesUUID of the LIVE call to act on: the request_uuid returned by make_call, or a UUID from list_live_calls.
languagestring–Locale the text is spoken in, e.g. en-US (default), en-IN, hi-IN, de-DE; pick the one matching the text.
legsstring–Which call leg the action applies to: aleg (the call's first leg, default), bleg (the leg bridged to it by <Dial>) or both.
loopboolean–Repeat the text until stop_speaking is called (default false).
mixboolean–true: speak over the conversation so the parties still hear each other; false: replace the leg's audio while speaking.
textstringyesText to speak, or SSML markup when type is ssml; 1-3000 characters.
typestring–text (default): `text` is plain text; ssml: `text` is SSML markup for pauses, emphasis and prosody.
voicestring–Voice: WOMAN (default) or MAN.
NameTypeReqDescription
backend_messagestring|null–Vobiz's own confirmation text for the request, or null when it sent none.
call_uuidstring–The call UUID the action was applied to, echoed from the request.
http_statusinteger–HTTP status Vobiz answered with: 202 when an action was accepted, 204 when one was stopped.
okboolean–True on success. On a failure the result is isError with ok: false plus `error` (kind), `message`, `retryable` and sometimes `http_status`.
speakingboolean–True once Vobiz accepted the speech request; audio starts within moments.

No examples provided.

start_audio_stream ~528

Fork the audio of a LIVE Vobiz call to your WebSocket server in near real time (POST /Call/{uuid}/Stream/), for example for live transcription or an AI voice agent. service_url must be wss:// on an approved host. bidirectional: true lets your server play audio back into the call and requires audio_track inbound (the default when bidirectional). content_type sets the inbound audio format (L16 8 kHz default, L16 16 kHz, or mu-law 8 kHz). Returns a stream_id for get_audio_stream / stop_audio_stream. This sends live call audio to an external server, so it requires confirm: true after the user approves the destination. Fails with call_not_active once the call has ended. To play audio into the call without a socket use play_audio; to see streams already running use list_audio_streams.

NameTypeReqDescription
audio_trackstring–Which audio to fork. Default both; must be inbound when bidirectional is true.
bidirectionalboolean–Allow your server to send audio back into the call (playAudio). Default false.
call_uuidstringyesUUID of the live call to fork: the request_uuid returned by make_call, or call_uuid from list_live_calls.
confirmbooleanyesMust be true, set only after the user explicitly approved: sending this call's live audio to this WebSocket server. If your client supports MCP elicitation, the server asks the user to approve direct…
content_typestring–Inbound audio format sent to your server. Default audio/x-l16;rate=8000.
extra_headersstring–Comma-separated header:value pairs (e.g. X-Session:abc123) passed with the stream. Use the wss:// URL path, not these headers, to authenticate the socket.
service_urlstringyeswss:// URL of your WebSocket server. Its host must be on the server's VOBIZ_ALLOWED_URL_HOSTS allowlist (or be a public host when any host is allowed).
status_callback_methodstring–HTTP method for status_callback_url (default POST). Ignored without status_callback_url.
status_callback_urlstring–https URL (approved host) that receives stream status events (StartStream, PlayedStream, StopStream...).
stream_timeoutinteger–Stop the stream automatically after this many seconds. Default 86400.
NameTypeReqDescription
audio_trackstring–Which side is forked: inbound, outbound or both.
backend_message––Message from Vobiz about the operation, or null.
bidirectionalboolean–Whether your server may send audio back into the call.
call_uuidstring–The call whose audio is being forked.
http_statusnumber–HTTP status Vobiz answered with.
okboolean–true on success; false (with error and message) when the tool failed.
stream_id––ID of the new stream for get_audio_stream and stop_audio_stream, or null if Vobiz did not return one.
streamingboolean–true once the stream is running.

No examples provided.

start_conference_recording ~189

Start recording the mixed audio of a live Vobiz conference room (POST /Conference/{name}/Record/) in mp3 (default) or wav. Recording may require consent from every participant in your jurisdiction, so confirm with the user first (consider announcing it). Vobiz queues the recording; the reply carries no recording ID or file URL, and the file appears in list_recordings after the room ends. Stop with stop_conference_recording. Requires confirm: true. A room that is not running returns the not_found error.

NameTypeReqDescription
conference_namestringyesConference room name, exactly as used in the <Conference> XML element.
confirmbooleanyesMust be true, set only after the user explicitly asked to record this conference.
file_formatstring–Audio format of the file: mp3 (default, smaller) or wav (uncompressed).
NameTypeReqDescription
backend_message––Vobiz's own status message, or null.
conference_namestring–Room the action was applied to.
file_formatstring–Format that will be produced: mp3 or wav.
http_statusnumber–HTTP status Vobiz answered with (202 = accepted, 204 = done).
notestring–Where to find the file later.
okboolean–True on success; false when the result is an error (then error, message and retryable are set).
recordingboolean–Always true: recording was queued.

No examples provided.

start_recording ~322

Start recording a LIVE call (POST /Call/{uuid}/Record/) into one file, either mixed (mono, default) or one party per channel (stereo). Recording ends at `time_limit` seconds (default 60, max 8 hours), when the call hangs up, or with stop_recording; the file then appears in get_call_recording / list_recordings and its storage is billed. Playback and speech on the call (play_audio, speak_text) are unaffected; to capture only a caller's answer inside an IVR use the record action of generate_answer_xml instead. Recording may require consent from the other party in your jurisdiction, so confirm with the user first. Requires confirm: true.

NameTypeReqDescription
call_uuidstringyesUUID of the LIVE call to act on: the request_uuid returned by make_call, or a UUID from list_live_calls.
confirmbooleanyesMust be true, set only after the user explicitly asked to record this call. If your client supports MCP elicitation, the server asks the user to approve directly and this flag is not relied on; other…
file_formatstring–Audio format of the file: mp3 (default) or wav.
record_channel_typestring–mono (default): both parties mixed into one channel; stereo: each party on its own channel.
time_limitinteger–Maximum seconds to record, 1-28800 (default 60). The recording also ends when the call does.
NameTypeReqDescription
backend_messagestring|null–Vobiz's own confirmation text for the request, or null when it sent none.
call_uuidstring–The call UUID the action was applied to, echoed from the request.
http_statusinteger–HTTP status Vobiz answered with: 202 when an action was accepted, 204 when one was stopped.
notestring–Reminder that the file is only retrievable (get_call_recording) after the recording stops.
okboolean–True on success. On a failure the result is isError with ok: false plus `error` (kind), `message`, `retryable` and sometimes `http_status`.
recordingboolean–True once Vobiz accepted the request and started recording.
recording_idstring|number|null–Identifier Vobiz assigned to this recording, or null when it did not report one.
urlstring|null–URL of the recording file as Vobiz reports it; pass it to stop_recording to stop just this recording. Null when not reported.

No examples provided.

stop_audio ~95

Stop audio started by play_audio on a LIVE call (DELETE /Call/{uuid}/Play/); the call itself continues. It does not stop text-to-speech (use stop_speaking), a recording (stop_recording) or an audio stream (stop_audio_stream). A call that is not live fails with call_not_active.

NameTypeReqDescription
call_uuidstringyesUUID of the live call whose play_audio playback should stop.
NameTypeReqDescription
call_uuidstring–The call UUID the action was applied to, echoed from the request.
http_statusinteger–HTTP status Vobiz answered with: 202 when an action was accepted, 204 when one was stopped.
okboolean–True on success. On a failure the result is isError with ok: false plus `error` (kind), `message`, `retryable` and sometimes `http_status`.
playingboolean–False once Vobiz accepted the stop request.

No examples provided.

stop_audio_stream ~166

Stop one audio stream on a LIVE Vobiz call (DELETE /Call/{uuid}/Stream/{stream_id}/): the undo of start_audio_stream. Other streams on the call keep running, and the call itself continues; to end the call use end_call. No confirmation is needed because it only stops something started on a call the user already placed. If the call has ended, or the stream is unknown or already stopped, it fails with call_not_active and nothing is streaming for it.

NameTypeReqDescription
call_uuidstringyesUUID of the live call the stream is on (request_uuid from make_call or call_uuid from list_live_calls).
stream_idstringyesThe stream's ID: stream_id as returned by start_audio_stream or listed by list_audio_streams.
NameTypeReqDescription
call_uuidstring–The call the stream was on.
http_statusnumber–HTTP status Vobiz answered with.
okboolean–true on success; false (with error and message) when the tool failed.
stream_idstring–The stream that was stopped.
streamingboolean–false once the stream is stopped.

No examples provided.

stop_audio_to_conference_member ~137

Stop audio started by play_audio_to_conference_member for members of a live Vobiz conference (DELETE /Conference/{name}/Member/{id}/Play/). It succeeds even when nothing is playing. A room that is not running, or a member who already left, returns the not_found error.

NameTypeReqDescription
conference_namestringyesConference room name, exactly as used in the <Conference> XML element.
member_idstringyesConferenceMemberID from the ConferenceEnter callback (or get_conference), a comma-separated list such as 17,45,82, or `all` for every member.
NameTypeReqDescription
conference_namestring–Room the action was applied to.
http_statusnumber–HTTP status Vobiz answered with (202 = accepted, 204 = done).
member_id––Members the action was applied to: the literal "all", or the list of member IDs as Vobiz echoed them (or as requested).
okboolean–True on success; false when the result is an error (then error, message and retryable are set).
playingboolean–Always false: playback is stopped.

No examples provided.

stop_conference_recording ~98

Stop the recording started by start_conference_recording on a live Vobiz conference room (DELETE /Conference/{name}/Record/). Use it when the part you needed is captured; the conference itself keeps running and the file appears later in list_recordings. A room that is not running returns the not_found error.

NameTypeReqDescription
conference_namestringyesConference room name, exactly as used in the <Conference> XML element.
NameTypeReqDescription
conference_namestring–Room the action was applied to.
http_statusnumber–HTTP status Vobiz answered with (202 = accepted, 204 = done).
okboolean–True on success; false when the result is an error (then error, message and retryable are set).
recordingboolean–Always false: recording is stopped.

No examples provided.

stop_recording ~153

Stop a recording on a LIVE call (DELETE /Call/{uuid}/Record/): pass the `url` returned by start_recording to stop that one recording, or omit it to stop every recording on the call. The file is finalised and appears in get_call_recording shortly after; the call itself, playback (stop_audio) and speech (stop_speaking) are unaffected. A call that is not live fails with call_not_active (the hangup already closed its recordings).

NameTypeReqDescription
call_uuidstringyesUUID of the live call being recorded.
urlstring–Recording file URL from start_recording, to stop only that recording. Omit to stop all recordings on the call.
NameTypeReqDescription
call_uuidstring–The call UUID the action was applied to, echoed from the request.
http_statusinteger–HTTP status Vobiz answered with: 202 when an action was accepted, 204 when one was stopped.
okboolean–True on success. On a failure the result is isError with ok: false plus `error` (kind), `message`, `retryable` and sometimes `http_status`.
recordingboolean–False once Vobiz accepted the stop request.
stoppedstring–"one" when a url was given, "all" when every recording on the call was stopped.

No examples provided.

stop_speaking ~97

Stop text-to-speech started by speak_text on a LIVE call (DELETE /Call/{uuid}/Speak/); the call itself continues. It does not stop play_audio playback (use stop_audio), a recording (stop_recording) or an audio stream (stop_audio_stream). A call that is not live fails with call_not_active.

NameTypeReqDescription
call_uuidstringyesUUID of the live call whose speak_text speech should stop.
NameTypeReqDescription
call_uuidstring–The call UUID the action was applied to, echoed from the request.
http_statusinteger–HTTP status Vobiz answered with: 202 when an action was accepted, 204 when one was stopped.
okboolean–True on success. On a failure the result is isError with ok: false plus `error` (kind), `message`, `retryable` and sometimes `http_status`.
speakingboolean–False once Vobiz accepted the stop request.

No examples provided.

transfer_call ~549

Blind-transfer a LIVE call (POST /Call/{uuid}/): Vobiz stops whatever the chosen leg is doing (IVR, playback, bridge) and fetches new VobizXML from the transfer URL. Give either `destination` (an E.164 number or sip: URI; this server hosts a <Dial> flow for it, A leg only, HTTP mode with VOBIZ_PUBLIC_URL) or your own `aleg_url` / `bleg_url` on an approved host, never both. For an attended (warm) transfer build the flow with generate_answer_xml (hold music, then dial) and pass its URL. To park a leg use hold_call, to run a keypad menu on it use gather_dtmf, to end the call use end_call. A destination number must pass the server's destination policy and becomes a new, billed call leg; a call that is not live fails with call_not_active. Requires confirm: true.

NameTypeReqDescription
aleg_methodstring–HTTP method Vobiz uses to fetch aleg_url: GET or POST (default POST).
aleg_urlstring–https URL on an approved host that returns the VobizXML the A leg runs next. Required when legs is aleg or both and no destination is given.
bleg_methodstring–HTTP method Vobiz uses to fetch bleg_url: GET or POST (default POST).
bleg_urlstring–https URL on an approved host that returns the VobizXML the B leg runs next. Required when legs is bleg or both.
call_uuidstringyesUUID of the LIVE call to act on: the request_uuid returned by make_call, or a UUID from list_live_calls.
caller_idstring–Caller ID the destination sees: an E.164 number on this account. Only used together with `destination`.
confirmbooleanyesMust be true, set only after the user explicitly asked to transfer this call. If your client supports MCP elicitation, the server asks the user to approve directly and this flag is not relied on; oth…
destinationstring–Where to connect the A leg: an E.164 number such as +14155550100, or sip:user@host. The server hosts the <Dial> flow (HTTP mode only). Not combinable with aleg_url/bleg_url.
legsstring–Leg to transfer: aleg (the call's first leg, default), bleg (the party bridged by <Dial>) or both. With `destination` only aleg is allowed.
NameTypeReqDescription
backend_messagestring|null–Vobiz's own confirmation text for the request, or null when it sent none.
call_uuidstring–The call UUID the action was applied to, echoed from the request.
http_statusinteger–HTTP status Vobiz answered with: 202 when an action was accepted, 204 when one was stopped.
legsstring–The leg(s) the action was applied to (aleg when none was given).
okboolean–True on success. On a failure the result is isError with ok: false plus `error` (kind), `message`, `retryable` and sometimes `http_status`.
transferredboolean–True once Vobiz accepted the transfer; the leg fetches and runs the new XML asynchronously.

No examples provided.

unassign_number_from_subaccount ~201

Move a number from a sub-account back to this Vobiz account's pool (DELETE /account/{id}/numbers/{e164}/assign-subaccount). It is the undo of assign_number_to_subaccount. A 15-day cool-off applies: a number with a call in the last 15 days stays with the sub-account and the tool fails with not_allowed until the cool-off ends. Gated by VOBIZ_ENABLE_PROVISIONING and confirm: true.

NameTypeReqDescription
confirmbooleanyesMust be true, set only after the user explicitly approved: returning this number to the parent account pool. If your client supports MCP elicitation, the server asks the user to approve directly and…
phone_numberstringyesThe number to take back, E.164; it must currently be assigned to one of this account's sub-accounts.
NameTypeReqDescription
http_statusnumber–HTTP status Vobiz answered with.
okboolean–true on success; false (with error and message) when the tool failed.
phone_numberstring–The number, E.164.
unassignedboolean–true once the number is back in the main account's pool.

No examples provided.

undeafen_conference_member ~148

Let deafened members of a live Vobiz conference hear the room again (DELETE /Conference/{name}/Member/{id}/Deaf/); the reverse of deafen_conference_member. Undeafening a member who is not deafened still succeeds. A room that is not running, or a member who already left, returns the not_found error.

NameTypeReqDescription
conference_namestringyesConference room name, exactly as used in the <Conference> XML element.
member_idstringyesConferenceMemberID from the ConferenceEnter callback (or get_conference), a comma-separated list such as 17,45,82, or `all` for every member.
NameTypeReqDescription
backend_message––Vobiz's own status message, or null.
conference_namestring–Room the action was applied to.
deafboolean–New deaf state of the members (deafen and undeafen tools only).
http_statusnumber–HTTP status Vobiz answered with (202 = accepted, 204 = done).
member_id––Members the action was applied to: the literal "all", or the list of member IDs as Vobiz echoed them (or as requested).
mutedboolean–New mute state of the members (mute and unmute tools only).
okboolean–True on success; false when the result is an error (then error, message and retryable are set).

No examples provided.

unhold_call ~263

Take a leg of a LIVE call off emulated hold by transferring it to `resume_url` (VobizXML on an approved host, for example a hosted flow from generate_answer_xml or the url from gather_dtmf). Vobiz cannot return to the point the call was at before hold_call, so the resume XML decides what happens next (speak, dial the other party again, a menu). To end the call instead use end_call. Only meaningful after hold_call; a call that is not live fails with call_not_active. Requires confirm: true.

NameTypeReqDescription
call_uuidstringyesUUID of the LIVE call to act on: the request_uuid returned by make_call, or a UUID from list_live_calls.
confirmbooleanyesMust be true, set only after the user explicitly asked to take this call off hold. If your client supports MCP elicitation, the server asks the user to approve directly and this flag is not relied on…
legsstring–Leg to resume: the same value given to hold_call (default aleg).
resume_urlstringyeshttps URL on an approved host returning the VobizXML that controls the leg after hold.
NameTypeReqDescription
call_uuidstring–The call UUID the action was applied to, echoed from the request.
emulatedboolean–Always true: hold and resume are transfers between hosted flows, not a native Vobiz hold.
http_statusinteger–HTTP status Vobiz answered with: 202 when an action was accepted, 204 when one was stopped.
legsstring–The leg(s) the action was applied to (aleg when none was given).
okboolean–True on success. On a failure the result is isError with ok: false plus `error` (kind), `message`, `retryable` and sometimes `http_status`.
on_holdboolean–False once Vobiz accepted the transfer to resume_url.

No examples provided.

unmute_conference_member ~146

Unmute members of a live Vobiz conference (DELETE /Conference/{name}/Member/{id}/Mute/) so the room can hear them again; the reverse of mute_conference_member. Unmuting a member who is not muted still succeeds. A room that is not running, or a member who already left, returns the not_found error.

NameTypeReqDescription
conference_namestringyesConference room name, exactly as used in the <Conference> XML element.
member_idstringyesConferenceMemberID from the ConferenceEnter callback (or get_conference), a comma-separated list such as 17,45,82, or `all` for every member.
NameTypeReqDescription
backend_message––Vobiz's own status message, or null.
conference_namestring–Room the action was applied to.
deafboolean–New deaf state of the members (deafen and undeafen tools only).
http_statusnumber–HTTP status Vobiz answered with (202 = accepted, 204 = done).
member_id––Members the action was applied to: the literal "all", or the list of member IDs as Vobiz echoed them (or as requested).
mutedboolean–New mute state of the members (mute and unmute tools only).
okboolean–True on success; false when the result is an error (then error, message and retryable are set).

No examples provided.

update_application ~570

Change selected fields of an existing Vobiz voice application (name, webhook URLs and methods, default-app flags). Only the fields you pass change; app_id and sub_account cannot change. Vobiz resets default_endpoint_app to false whenever it is omitted, so this tool reads the current value and re-sends it. New URLs must be https on an approved host (VOBIZ_ALLOWED_URL_HOSTS). Use create_application for a new application and update_phone_number to change which application a number uses. An unknown app_id raises not_found. Gated by VOBIZ_ENABLE_PROVISIONING and confirm: true.

NameTypeReqDescription
answer_methodstring–HTTP method used to fetch answer_url: GET or POST (Vobiz default POST).
answer_urlstring–URL Vobiz fetches for VobizXML when a call reaches a number or SIP endpoint linked to this application. Must be https on an approved host (VOBIZ_ALLOWED_URL_HOSTS) and answer within 10 seconds.
app_idstringyesNumeric Vobiz application ID (5-25 digits): the app_id returned by list_applications or create_application.
app_namestring–Application name, 1-120 characters: letters, digits, - and _ only (Vobiz rejects other characters).
confirmbooleanyesMust be true, set only after the user explicitly approved: changing this application. If your client supports MCP elicitation, the server asks the user to approve directly and this flag is not relied…
default_endpoint_appboolean–true makes this the application for newly created SIP endpoints that have none; false clears that. Omitted, the current value is re-sent (Vobiz would otherwise reset it to false).
default_number_appboolean–true makes this the application for newly bought numbers that have none (Vobiz default false). Existing numbers are not re-routed.
fallback_answer_urlstring–Fetched only when answer_url is unreachable, times out or returns invalid VobizXML; must itself return VobizXML. Without one the call drops on answer_url failure. Must be https on an approved host.
fallback_methodstring–HTTP method for fallback_answer_url: GET or POST (Vobiz default POST).
hangup_methodstring–HTTP method for hangup_url: GET or POST (Vobiz default POST).
hangup_urlstring–URL Vobiz notifies when a call on this application ends (CallUUID, CallStatus, Duration, HangupCause). Omitted at creation, it defaults to answer_url. Must be https on an approved host.
NameTypeReqDescription
app_idstring–The application that was changed.
backend_messagestring|null–Status message from Vobiz (e.g. 'created' or 'changed'), when it sent one.
http_statusnumber–HTTP status Vobiz answered with.
okboolean–True on success. On a failure the result is isError with ok: false plus `error` (kind), `message`, `retryable` and sometimes `http_status`.
updatedboolean–True when the change was applied by this call.

No examples provided.

update_ip_acl_entry ~246

Replace a Vobiz IP ACL entry's label and address. Both name and ip_address are required on every update; resend the current value of the one you keep. Traffic from the old address stops being trusted (changes can take a little time to reach the SIP edge); the entry keeps its id, so trunks referencing it need no change. Read the current values with list_ip_acl_entries first. The same address rules as add_ip_acl_entry apply. An unknown ip_acl_id raises not_found. Gated by VOBIZ_ENABLE_PROVISIONING and confirm: true.

NameTypeReqDescription
confirmbooleanyesMust be true, set only after the user explicitly approved: changing this IP ACL entry.
ip_acl_idstringyesIP ACL entry UUID: the id from list_ip_acl_entries or add_ip_acl_entry. Unknown ids raise not_found.
ip_addressstringyesPublic IPv4 address or IPv4 CIDR network, prefix 8-32 (resend the current one to keep it).
namestringyesLabel of 1-255 characters (resend the current one to keep it). Returned by Vobiz as `description`.
NameTypeReqDescription
http_statusnumber–HTTP status Vobiz answered with.
ip_acl_entry––The entry after the change.
okboolean–True on success. On a failure the result is isError with ok: false plus `error` (kind), `message`, `retryable` and sometimes `http_status`.
updatedboolean–True when the change was applied by this call.

No examples provided.

update_origination_uri ~257

Replace a Vobiz origination URI's label and priority, for example to promote a failover destination to primary. Both name and priority are required; resend the current value you keep. To point at a different host, create a new origination URI and delete this one; weight and enabled are managed in the Vobiz console. Read current values with list_origination_uris first. A priority change applies to the next outbound call on every trunk using the URI. An unknown uri_id raises not_found. Gated by VOBIZ_ENABLE_PROVISIONING and confirm: true.

NameTypeReqDescription
confirmbooleanyesMust be true, set only after the user explicitly approved: changing this origination URI.
namestringyesLabel of 1-255 characters (resend the current one to keep it). Returned by Vobiz as `description`.
priorityintegeryesRouting priority, 1-1000: lower is tried first (1 = primary, 2+ = failover). URIs sharing a priority split traffic by weight.
uri_idstringyesOrigination URI UUID: the id from list_origination_uris or create_origination_uri. Unknown ids raise not_found.
NameTypeReqDescription
http_statusnumber–HTTP status Vobiz answered with.
okboolean–True on success. On a failure the result is isError with ok: false plus `error` (kind), `message`, `retryable` and sometimes `http_status`.
origination_uri––The URI after the change.
updatedboolean–True when the change was applied by this call.

No examples provided.

update_phone_number ~413

Change one owned phone number's configuration: replace its tags, link it to a voice application (inbound calls then fetch that application's answer_url) or to a SIP trunk (inbound calls are delivered through the trunk), or unlink either. A number can be linked to an application or a trunk, not both; unlinks run before links, so one call can switch. The number must already be on the account (see list_phone_numbers), otherwise not_found. To buy or release a number use buy_phone_number or release_phone_number. Returns the list of changes applied. Gated by VOBIZ_ENABLE_PROVISIONING and confirm: true.

NameTypeReqDescription
application_idstring–Application (app_id from list_applications) whose answer_url handles inbound calls to this number. Not with unlink_application or trunk_id.
confirmbooleanyesMust be true, set only after the user explicitly approved: changing this number's routing. If your client supports MCP elicitation, the server asks the user to approve directly and this flag is not r…
phone_numberstringyesAn owned number from list_phone_numbers, in E.164 form (e.g. +918065551234).
tagsarray–Replaces the number's whole tag list (up to 20 tags of 1-50 characters); include every tag to keep. An empty array clears the tags.
trunk_idstring–SIP trunk (trunk_id from list_sip_trunks) that inbound calls to this number are routed through; sent to Vobiz as trunk_group_id. Not with unlink_trunk or application_id.
unlink_applicationboolean–true removes the number's current application link; reverses application_id. Not together with application_id.
unlink_trunkboolean–true removes the number's SIP trunk link so inbound calls stop routing through it; reverses trunk_id. Not together with trunk_id.
NameTypeReqDescription
changesarray–Human-readable list of the changes applied, in the order they ran.
okboolean–True on success. On a failure the result is isError with ok: false plus `error` (kind), `message`, `retryable` and sometimes `http_status`.
phone_numberstring–The number that was changed, in E.164 form.

No examples provided.

update_sip_endpoint ~341

Change a Vobiz SIP endpoint's alias, password, attached application or voice/message/video permissions. Only the fields you pass change; the username is permanent (create a new endpoint to rename). A new password signs out every registered device until it re-registers with it. Vobiz answers 202 with no body, so the result lists the fields sent rather than the new state; read it back with get_sip_endpoint. An unknown endpoint_id raises not_found. Gated by VOBIZ_ENABLE_PROVISIONING and confirm: true.

NameTypeReqDescription
aliasstring–New friendly name, 1-100 characters.
allow_messageboolean–Permit messaging on this endpoint (Vobiz default true).
allow_videoboolean–Permit video calls on this endpoint (Vobiz default false).
allow_voiceboolean–Permit voice calls on this endpoint (Vobiz default true).
application_idstring–Application (app_id from list_applications) that should handle this endpoint's calls from now on; sent to Vobiz as `application`. An unknown id is rejected.
confirmbooleanyesMust be true, set only after the user explicitly approved: changing this SIP endpoint.
endpoint_idstringyesNumeric SIP endpoint ID (4-25 digits): endpoint_id from list_sip_endpoints or create_sip_endpoint. Unknown ids raise not_found.
passwordstring–SECRET: the endpoint's new SIP password (8+ characters; 12+ with mixed case, digits and symbols recommended). It is sent to Vobiz once and never shown again.
NameTypeReqDescription
changedarray–Names of the fields sent to Vobiz (application_id appears as application).
endpoint_idstring–The endpoint that was changed.
http_statusnumber–HTTP status Vobiz answered with.
notestring–Present after a password change: devices must re-register.
okboolean–True on success. On a failure the result is isError with ok: false plus `error` (kind), `message`, `retryable` and sometimes `http_status`.
updatedboolean–True when the change was applied by this call.

No examples provided.

update_sip_trunk ~834

Change settings of an existing Vobiz SIP trunk: only the fields you pass change; trunk_id and trunk_domain never change. Use it to attach authentication (credential_uuid, ipacl_uuid), set outbound routing (primary_uri_uuid, fallback_uri_uuid), adjust limits, turn on recording or the event webhook, or pause a trunk with trunk_status: disabled instead of deleting it. Read current values first with get_sip_trunk; for a new trunk use create_sip_trunk. Returns the updated trunk object with credential fields redacted. An unknown trunk_id raises not_found. Gated by VOBIZ_ENABLE_PROVISIONING and confirm: true.

NameTypeReqDescription
concurrent_calls_limitinteger–Maximum simultaneous calls on the trunk, 1-1000 (Vobiz default 10). Stored on the trunk; the enforced concurrency is the account-level limit.
confirmbooleanyesMust be true, set only after the user explicitly approved: changing this SIP trunk. If your client supports MCP elicitation, the server asks the user to approve directly and this flag is not relied o…
cps_limitinteger–Maximum new calls per second (flood protection), 1-100 (Vobiz default 2). Independent of concurrent_calls_limit; the enforced CPS is the account-level limit.
credential_uuidstring–UUID of a trunk credential (id from list_trunk_credentials or create_trunk_credential) for SIP digest authentication of this trunk's peer.
descriptionstring–Free-text note on the trunk's purpose, up to 1000 characters.
enable_transcriptionboolean–true transcribes recordings automatically (Vobiz default false); only effective while recording is true.
fallback_uri_uuidstring–UUID of the origination URI tried when the primary one fails.
inbound_destinationstring–Destination inbound calls on this trunk are delivered to (inbound trunks), up to 255 characters, in the form your Vobiz trunk setup uses.
ipacl_uuidstring–UUID of an IP ACL entry (id from list_ip_acl_entries or add_ip_acl_entry) so SIP from that address is accepted without a password. May be set together with credential_uuid.
namestring–Display name of the trunk, 1-100 characters.
primary_uri_uuidstring–UUID of the origination URI (id from list_origination_uris or create_origination_uri) that outbound calls are sent to first; failover order is primary, then fallback.
recordingboolean–true records every call on the trunk (Vobiz default false). Required for enable_transcription and recording_webhook_enabled to have any effect.
recording_webhook_enabledboolean–true also sends a recording.completed event to webhook_url after each recording is saved (Vobiz default false); needs recording true and a webhook_url.
secureboolean–true encrypts media with SRTP (Vobiz default false). Signalling encryption is chosen with transport: tls.
transportstring–SIP signalling transport: udp (Vobiz default), tcp or tls (encrypted signalling).
trunk_directionstring–Which calls the trunk carries: inbound (to your numbers), outbound (from your PBX) or both.
trunk_idstringyesSIP trunk UUID: the trunk_id returned by list_sip_trunks, get_sip_trunk or create_sip_trunk.
trunk_statusstring–enabled or disabled. A disabled trunk keeps its configuration, credentials and routing but handles no calls; Vobiz reports the state as active/inactive on the trunk object.
webhook_methodstring–HTTP method for webhook_url deliveries: POST (Vobiz default) or GET.
webhook_urlstring–Public https URL (max 500 characters) that receives CallInitiated and Hangup events for calls on this trunk; private and local hosts are rejected.
NameTypeReqDescription
http_statusnumber–HTTP status Vobiz answered with.
okboolean–True on success. On a failure the result is isError with ok: false plus `error` (kind), `message`, `retryable` and sometimes `http_status`.
trunkobject–The trunk after the change.
updatedboolean–True when the change was applied by this call.

No examples provided.

update_sub_account ~381

Change an existing Vobiz sub-account's name, contact details, description, rate limit, permissions, enabled flag or kyc_mode. Only the fields you pass change; omitted fields keep their values, and a call with no fields fails with invalid_input. Moving to customer_use needs an email on the sub-account and can pause its calls until its KYC is verified. Returns the updated record with credentials removed. To make a new sub-account use create_sub_account; to remove one use delete_sub_account. Gated by VOBIZ_ENABLE_PROVISIONING and confirm: true; needs main-account (MA_) credentials.

NameTypeReqDescription
confirmbooleanyesMust be true, set only after the user explicitly approved: changing this sub-account.
descriptionstring–Free-text note about the sub-account (what or whom it is for), up to 1000 characters.
emailstring–Contact email. Required for kyc_mode customer_use.
enabledboolean–Whether the sub-account can be used (default true).
kyc_modestring–personal_use (default) uses the parent's KYC; customer_use means the sub-account completes its own KYC before placing calls (needs email).
namestring–Human-readable name for the sub-account.
permissionsobject–Access flags. Omitted on create: the sub-account inherits the parent's default access.
phonestring–Contact phone number for the sub-account's owner: digits with an optional leading + and spaces, dashes or brackets, 6 to 20 characters. Not a caller ID.
rate_limitinteger–API rate limit for the sub-account (Vobiz default 1000).
sub_auth_idstringyesThe sub-account's Auth ID (SA_...), from list_sub_accounts.
NameTypeReqDescription
http_statusnumber–HTTP status Vobiz answered with.
okboolean–true on success; false (with error and message) when the tool failed.
sub_account–––
sub_auth_idstring–The sub-account that was changed.
updatedboolean–true once Vobiz applied the change.

No examples provided.

update_trunk_credential ~267

Rotate a trunk credential's password, enable or disable it, or change its description on Vobiz. The username is permanent; to rename, create a new credential and delete the old one. A new password takes effect for the next SIP authentication; only the fields you pass change. Prefer enabled: false over delete_trunk_credential when access may be needed again. Returns the updated credential with the password redacted. An unknown credential_id raises not_found. Gated by VOBIZ_ENABLE_PROVISIONING and confirm: true.

NameTypeReqDescription
confirmbooleanyesMust be true, set only after the user explicitly approved: changing this trunk credential.
credential_idstringyesTrunk credential UUID: the id from list_trunk_credentials or create_trunk_credential. Unknown ids raise not_found.
descriptionstring–Free-text note of up to 255 characters, e.g. why or when the password was rotated.
enabledboolean–false pauses authentication with this credential without deleting it; true re-enables it.
passwordstring–SECRET: the trunk credential's new SIP password (8+ characters; 12+ with mixed case, digits and symbols recommended). It is sent to Vobiz once and never shown again.
NameTypeReqDescription
changedarray–Names of the fields sent to Vobiz.
credential––The credential after the change, password redacted.
http_statusnumber–HTTP status Vobiz answered with.
notestring–Reminder that passwords are never returned here.
okboolean–True on success. On a failure the result is isError with ok: false plus `error` (kind), `message`, `retryable` and sometimes `http_status`.
updatedboolean–True when the change was applied by this call.

No examples provided.

Install

How do I install the Vobiz MCP server?

Vobiz runs locally as an npm package, launched with npx -y @vobiz/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @vobiz/mcp

# add to Claude Code
claude mcp add vobiz-ai-vobiz-mcp -- npx -y @vobiz/mcp
Common questions

What is the Vobiz MCP server?

Vobiz is an MCP server listed in the public MCP registry as io.github.vobiz-ai/vobiz-mcp. Vobiz voice calls, IVRs, call records, numbers, SIP trunks, SMS/MMS/RCS and Vobiz skills. This page covers its npm package (@vobiz/mcp).

Is the Vobiz MCP server safe to use?

Vobiz scores 66 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 23 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Vobiz MCP server expose?

Vobiz exposes 106 tools: make_call, get_call_status, end_call, list_live_calls, send_dtmf, and 101 more. Their descriptions and schemas cost roughly 26,129 tokens of context every time the server is loaded.

Is the Vobiz MCP server still maintained?

Vobiz is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Vobiz MCP server under?

Vobiz declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.