Name: TextKit
Author: jointextkit

TextKit MCP

SMS for developers: send and receive texts, verify phones, and buy US and Canada numbers.

Tool-list grade A Remote · Streamable HTTP No auth needed 148 tools v1.0.2

No reviews yet by jointextkit The publisher’s own endpoint — this marketplace is not in the path

93/100

tool-list score

148

tools declared

remote

at its publisher

—

calls last 7d

What it does

SMS for developers: send and receive texts, verify phones, and buy US and Canada numbers.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http jointextkit-textkit-mcp https://mcp.jointextkit.com

# 2 — ask your agent for something these tools do
#   send_message, get_message, delete_message and 145 more

TextKit costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

jointextkit1 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Send one SMS from one of your numbers. Set category "marketing" for promotions (the opt-in check applies) and scheduled_at to send later. Quiet hours apply to every message: outside 8am-9pm (8pm in Florida, Maryland and Oklahoma) in the recipient's local time a marketing message is refused and anything else is held until 8am, except one-time codes and replies within 4 hours of their text. In sandb

Parameter	Type	Required	Notes
to	string	yes	—
from	string	no	One of your numbers, or a sender pool id (pool_...): TextKit picks a pool member, the same one for each recipient every time. Optional when the account has exactly one number for the key's mode.
body	string	yes	—
customer_id	string	no	Optional. Attribute to one of your customers. Defaults to the customer the from-number is assigned to; a number assigned to another customer is rejected (400).
scheduled_at	string	no	Optional. Future ISO timestamp (or epoch ms), up to 30 days out. The message is queued and the response is a scheduled_message object instead of a message. A marketing message scheduled into the recip
category	string	no	Optional. It can make a message stricter (marketing), never looser: what a message is comes from the sending number's registration and its wording ([which messages are marketing](/docs/compliance-ch
quiet_hours	string	no	Optional. What to do with a message in the recipient's quiet hours: block refuses it (403 quiet_hours), defer holds it until their next 8:00am. Omitted: the account default (a single marketing sen
shorten_links	boolean	no	Optional. Rewrite every http(s) link in body to a short link with clicks tracked (links on the message, message.link_clicked events): on links.jointextkit.com, or on your own link domain when yo
tags	array	no	Optional. Your own labels, up to 10 (letters, digits, space _ . : -; up to 32 characters each; lowercased), for example a campaign or a flow. Stored on the message, sent on its webhook events, and rep
consent	object	no	Optional. How the recipient agreed to your messages. A recurring non-marketing message from a number linked to a registration needs an opt-in on file for that registration; when none is, this records
media	array	no	Reserved for MMS; currently returns 400 mms_not_enabled.
status_callback	string	no	Optional. Also send this message's status events (message.sent, message.delivered, message.failed, message.blocked) to this https URL, signed with your callback secret (POST /v1/webhooks/callback_secr
idempotency_key	string	no	Optional. Retries are already safe: the same call with the same inputs within 10 minutes is done once and answers with the first result. Pass your own key to dedupe across a longer gap, or a new one t

Retrieve a message by its msg_... id, with its delivery timeline.

Parameter	Type	Required	Notes
id	string	yes	Message id (msg_...)

Delete a finished message (delivered, failed or received) and every copy of its text, for a privacy request. Opt-out records and billing are kept. Cannot be undone.

Parameter	Type	Required	Notes
id	string	yes	Message id (msg_...)

Empty a finished message's text and media everywhere it is kept, keeping its status, price and timeline (redacted_at is set). Cannot be undone.

Parameter	Type	Required	Notes
id	string	yes	Message id (msg_...)

List your messages, newest first. Filter by number, direction, status, failure reason, date, batch schedule or customer.

Parameter	Type	Required	Notes
limit	number	no	Max results (default 25, max 100)
cursor	string	no	next_cursor from the previous page
number	string	no	Filter to messages to or from this number
to	string	no	Exact destination number (E.164)
from	string	no	Exact sending number (E.164)
status	string	no	—
blocked_reason	string	no	Blocked messages with this reason. Implies status=blocked.
failure_code	string	no	Filter to messages that failed for this reason (the failure.code on a message)
direction	string	no	—
created_after	string	no	Inclusive. ISO timestamp or epoch ms.
created_before	string	no	Exclusive. ISO timestamp or epoch ms.
customer_id	string	no	Filter to one customer's messages
schedule_id	string	no	Filter to the occurrences of one recurring schedule (sch_...)
tag	string	no	Filter to messages sent with this tag

Send a one-time verification code (OTP) to a phone number by text, or to an email address with channel "email". TextKit generates the code, handles expiry (10 min) and attempt limits (5), and blocks SMS-pumping and email-bombing abuse.

Parameter	Type	Required	Notes
channel	string	no	How the code goes out. sms needs phone; email needs email.
phone	string	no	The number to text the code to (channel sms). to works too.
email	string	no	The address to email the code to (channel email). Disposable addresses are refused.
app_name	string	no	Your product name, shown in the message
user_ip	string	no	Optional. Your end user's IP address, as your server saw it. With it, one person requesting codes for many numbers or addresses is limited (20 an hour per IP on your account, texts and emails together
from	string	no	Optional, channel sms only: send from a number you own instead of the TextKit pool
customer_id	string	no	Optional: attribute the verification to one of your customers
idempotency_key	string	no	Optional. Retries are already safe: the same call with the same inputs within 10 minutes is done once and answers with the first result. Pass your own key to dedupe across a longer gap, or a new one t

Check a verification code submitted by a user, by the phone or email it went to. Returns {verified, status, channel, charged}. Billed only when verified is true.

Parameter	Type	Required	Notes
phone	string	no	The number the code was texted to. Send this or email.
email	string	no	The address the code was emailed to. After a fallback, check by email: the code proves the address, not the phone, and a check by phone answers 409 invalid_state.
code	string	yes	The code last sent

The text did not arrive: email a new code for the same pending verification (one id, one charge). The emailed code replaces the texted one and is checked by the email address, which it proves (not the phone). Once per verification.

Parameter	Type	Required	Notes
id	string	yes	Verification id (ver_...)
email	string	yes	The address to email the code to
channel	string	no	The channel to fall back to. Only email today.
user_ip	string	no	Optional. Your end user's IP address, counted in the same per-IP limit as POST /verify.

List the phone numbers on your account.

Parameter	Type	Required	Notes
customer_id	string	no	Only this customer's numbers
tag	string	no	—
pool	string	no	Pool id
mode	string	no	—
q	string	no	Matches digits of the number or its label

Ask our team for a short code (or a toll-free number they set up). Provisions nothing by itself; carriers take 8-12 weeks to approve a short code.

Parameter	Type	Required	Notes
type	string	yes	—
business_name	string	yes	—
monthly_volume	string	yes	—
use_case	string	yes	What you will send, in a sentence or two.

Open short-code and toll-free requests.

No parameter schema on file.

Search purchasable numbers by area code (default 415).

Parameter	Type	Required	Notes
area_code	string	no	—

Buy a phone number for your account (free sandbox numbers with test keys). Live numbers are billed monthly.

Parameter	Type	Required	Notes
phone_number	string	yes	—
customer_id	string	no	Optional: assign the number to one of your customers
registration_id	string	no	Optional (live numbers): the registration this number should send for. Without it the number follows your account's registration.
idempotency_key	string	no	Optional. Retries are already safe: the same call with the same inputs within 10 minutes is done once and answers with the first result. Pass your own key to dedupe across a longer gap, or a new one t

Release a number you own. It cannot be got back.

Parameter	Type	Required	Notes
phone_number	string	yes	E.164 number you own

Look up line type (mobile, landline, VoIP) and carrier for any US/Canada number.

Parameter	Type	Required	Notes
phone	string	yes	E.164 number

Sandbox only: simulate an inbound SMS to one of your test numbers (emits message.received; STOP, START and HELP act as for real).

Parameter	Type	Required	Notes
to	string	no	One of your sandbox numbers (never a live number). Optional while the account has one sandbox number.
from	string	yes	—
body	string	yes	—

List recent events (message.sent/delivered/failed/received, number.purchased/released, ...), newest first.

Parameter	Type	Required	Notes
limit	number	no	Max results (default 25, max 100)
cursor	string	no	next_cursor from the previous page
type	string	no	—

Retrieve a verification by id: its status and attempts (never the code).

Parameter	Type	Required	Notes
id	string	yes	Verification id

Retrieve one of your numbers: status, sender registration, tags, pools, customer.

Parameter	Type	Required	Notes
phone_number	string	yes	E.164 number you own

Buy several numbers in one area code at once (e.g. for a sender pool). Live numbers are billed monthly each.

Parameter	Type	Required	Notes
area_code	string	yes	—
quantity	integer	yes	—
pool_id	string	no	Add the new numbers to this pool
tags	array	no	—
idempotency_key	string	no	Optional. Retries are already safe: the same call with the same inputs within 10 minutes is done once and answers with the first result. Pass your own key to dedupe across a longer gap, or a new one t

Attach a number to an approved 10DLC registration so it can send that registration's traffic.

Parameter	Type	Required	Notes
phone_number	string	yes	E.164 number you own
registration_id	string	yes	—

Platforms: attribute a number (and its messages and usage) to one of your customers, or clear it with customer_id null.

Parameter	Type	Required	Notes
phone_number	string	yes	E.164 number you own
customer_id	string	yes	A customer id, or null to unassign

Act on many numbers at once: tag, untag, assign to a customer, or release. Releasing cannot be undone.

Parameter	Type	Required	Notes
ids	array	yes	—
action	string	yes	—
pool_id	string	no	add_to_pool / remove_from_pool
tags	array	no	add_tags / remove_tags. Lowercased; up to 20 per number.
label	string	no	set_label; null clears
confirm	string	no	release only

Your numbers as CSV text.

Parameter	Type	Required	Notes
tag	string	no	—
pool	string	no	—
mode	string	no	—
q	string	no	—

List sender pools.

No parameter schema on file.

Create a sender pool from numbers you own.

Parameter	Type	Required	Notes
name	string	yes	—
description	string	no	—
routing	string	no	How a recipient gets a number. sticky: the same member every time. local: a member in the recipient's area code, else one in their time zone, else any; still the same one each time.

Retrieve a sender pool and its numbers.

Parameter	Type	Required	Notes
id	string	yes	Pool id

Rename a sender pool or change its numbers.

Parameter	Type	Required	Notes
id	string	yes	Pool id
name	string	no	—
description	string	no	—
routing	string	no	How a recipient gets a number. sticky: the same member every time. local: a member in the recipient's area code, else one in their time zone, else any; still the same one each time.

Delete a sender pool. Its numbers are kept.

Parameter	Type	Required	Notes
id	string	yes	Pool id

Copy a sender pool under a new name.

Parameter	Type	Required	Notes
id	string	yes	Pool id
name	string	no	—

Create or update up to 500 contacts per call, matched by phone_number. Attributes go in fields (up to 20 strings, e.g. plan) for segments and {{field:name}} merge tags; tags group contacts. opt_in carries consent evidence (status: false records an opt-out). import_id from the first response groups several calls; dry_run: true returns what would change and writes nothing.

Parameter	Type	Required	Notes
contacts	array	yes	—
campaign_id	string	no	Applies to every opt_in row that does not name its own campaign_id
dry_run	boolean	no	—
check_line_types	boolean	no	dry_run only. Looks up line types to count landlines; live lookups are paid, so only the first 500 numbers are checked.
import_id	string	no	From a previous response, to group several requests as one import.
name	string	no	A label for the import (first request only).

Find out where an audience is and the ways to bring it in. Without source: questions to ask the person (where their people are, which group, what they can sign in to, whether consent was recorded, once or kept in sync) and the kinds of source known. With source (their words, e.g. "Mixpanel", "Shopify", "our Postgres users table", "a Google Sheet"): the ways in, best first, each with steps and a co

Parameter	Type	Required	Notes
source	string	no	Where the people are, in your words. Omit to get the questions first.

Create a contact, or update the existing one with the same phone_number.

Parameter	Type	Required	Notes
phone_number	string	yes	E.164, US or Canada
name	string	no	Display name. Defaults to first + last name.
tags	array	no	—
fields	object	no	Up to 20 string values (account id, plan, location...), usable in segments and as {{field:key}} merge fields
notes	string	no	—
first_name	string	no	—
last_name	string	no	—
email	string	no	—
company	string	no	—
state	string	no	—
source	string	no	Where the contact came from. Defaults to "api".
opt_in	object	no	Import only (POST /v1/contacts/import). Stored as consent evidence; never lifts an opt-out.

List contacts, newest first. Filter by tag, segment_id, list_id, exact phone_number, or a free-text q (name, email, company).

Parameter	Type	Required	Notes
limit	number	no	Max results (default 25, max 100)
cursor	string	no	next_cursor from the previous page
tag	string	no	—
phone_number	string	no	E.164
segment_id	string	no	—
list_id	string	no	—
q	string	no	Search text

Retrieve a contact.

Parameter	Type	Required	Notes
id	string	yes	Contact id

Update a contact. Only the inputs you pass change; tags and fields replace the whole list or map.

Parameter	Type	Required	Notes
id	string	yes	Contact id
phone_number	string	no	E.164, US or Canada
name	string	no	—
tags	array	no	—
fields	object	no	Up to 20 string values
notes	string	no	—
first_name	string	no	—
last_name	string	no	—
email	string	no	—
company	string	no	—
state	string	no	—
source	string	no	—

Delete a contact. Messages, consent records, and topic preferences for the number are kept.

Parameter	Type	Required	Notes
id	string	yes	Contact id

Add tags to, remove tags from, or delete many contacts by id.

Parameter	Type	Required	Notes
action	string	yes	—
ids	array	yes	—
tags	array	no	Required for add_tags and remove_tags

Subscribe a contact to a topic, or unsubscribe them (e.g. "promotions" vs "order updates").

Parameter	Type	Required	Notes
id	string	yes	Contact id
topic	string	yes	Topic id (see list_topics)
subscribed	boolean	yes	—
source	string	no	Where the change came from, e.g. "preference_page". Default "api".

Create a list: a fixed group of contacts (Audience → Lists). Use a list when the user names exactly who belongs ("add these people to VIPs"); use a segment when membership follows rules.

Parameter	Type	Required	Notes
name	string	no	—
description	string	no	—

List contact lists with their contact counts.

No parameter schema on file.

Retrieve a list and its contact count.

Parameter	Type	Required	Notes
id	string	yes	List id

Rename a list or change its description.

Parameter	Type	Required	Notes
id	string	yes	List id
name	string	no	—
description	string	no	—

Delete a list (its contacts stay).

Parameter	Type	Required	Notes
id	string	yes	List id

Page through a list's contacts, most recently added first.

Parameter	Type	Required	Notes
id	string	yes	List id
limit	integer	no	—
cursor	string	no	—

Add contacts to a list by contact_ids and/or phone_numbers (up to 1,000; numbers must already be contacts).

Parameter	Type	Required	Notes
id	string	yes	List id
contact_ids	array	no	—
phone_numbers	array	no	—

Remove contacts from a list (they stay contacts).

Parameter	Type	Required	Notes
id	string	yes	List id
contact_ids	array	no	—
phone_numbers	array	no	—

Save an audience (a segment, a cohort): it appears in the console under Audience → Segments, and broadcasts can be sent to it. Everyone who can be texted: one rule, status is subscribed. Contacts matching all (or any) of up to 10 rules. Attributes: tags, contact fields, custom fields (field = "field", key = the name), opt-in status, topic, import, created_at. Behaviour: last_message_at, last_reply

Parameter	Type	Required	Notes
name	string	no	—
description	string	no	—
match	string	no	—
rules	array	no	—

List saved segments.

No parameter schema on file.

Retrieve a segment and its rules.

Parameter	Type	Required	Notes
id	string	yes	Segment id

Rename a segment or replace its rules.

Parameter	Type	Required	Notes
id	string	yes	Segment id
name	string	no	—
description	string	no	—
match	string	no	—
rules	array	no	—

Delete a segment. Contacts are not touched.

Parameter	Type	Required	Notes
id	string	yes	Segment id

Count a cohort without saving anything (nothing appears in the console): run up to 10 segment rules now and get the counts (matched, opted out, eligible to text) and the first contacts. Examples: replied in the last 7 days (last_reply_at after 7d); got a batch and did not reply (batch sent, and batch replied with is_not); started checkout but never purchased (event exists, event not_exists); VIPs

Parameter	Type	Required	Notes
match	string	no	—
rules	array	no	—
topic_id	string	no	Topic id or name: eligible also removes contacts unsubscribed from it
limit	integer	no	How many matching contacts to return

Count the contacts a segment matches right now and how many a broadcast would reach (opted-out contacts removed, and with topic_id those unsubscribed from it). notes says when an event rule names an event never tracked.

Parameter	Type	Required	Notes
id	string	yes	Segment id
topic_id	string	no	Count only contacts subscribed to this topic

List subscription topics.

No parameter schema on file.

Create a subscription topic, so people can opt out of one kind of message (e.g. promotions) and keep others.

Parameter	Type	Required	Notes
name	string	yes	—
description	string	no	—

Save a message template. Merge tags: {{first_name}}, {{name}}, {{phone}}, {{field:<custom>}}, and per-recipient variables.

Parameter	Type	Required	Notes
name	string	yes	—
body	string	yes	—

List message templates.

No parameter schema on file.

Retrieve a template.

Parameter	Type	Required	Notes
id	string	yes	Template id

Rename or edit a template.

Parameter	Type	Required	Notes
id	string	yes	Template id
name	string	no	—
body	string	no	—

Delete a template.

Parameter	Type	Required	Notes
id	string	yes	Template id

Which text should we send? Ranked SMS copy for a goal (abandoned_cart, welcome, winback, failed_payment, trial, promo, ... or any) by expected revenue per message, each with its evidence: the factors that moved its score, the closest published SMS-only case studies with source links, and how much comes from this account's own sends (clicks, STOPs, revenue from tracked events). Pass your own drafts

Parameter	Type	Required	Notes
industry	string	yes	The sender's industry
company_type	string	yes	Kind of business
goal	string	no	The message type to write, or any to compare the types that fit audience
audience	string	no	Who gets it, in words, e.g. "opened the paywall and left"
brand	string	yes	Business name as customers know it
product	string	yes	What is being sold, as the customer would say it, e.g. "your second number"
offer	string	no	Optional, e.g. "50% off your first month". Without one no candidate has an offer
code	string	no	Optional promo code
deadline	string	no	Optional, e.g. "tonight"
link	string	no	URL or merge field; default {{link}}
first_name	boolean	no	Your contacts have first names, so candidates may use {{first_name}}
first_message	boolean	no	The first text these people get from the number: the brand and opt-out line are added and counted
candidates	string	no	Your own drafts to score: a JSON array of up to 10 strings
limit	integer	no	—
use_history	boolean	no	false ranks on the case studies only

Send one message to many people (a broadcast or campaign): pick recipients by segment_id, tags, contact_ids, or an explicit recipients list. Opted-out numbers, numbers without marketing consent, and people unsubscribed from topic_id are removed before sending. dry_run: true sends nothing and returns the count, cost, rejected rows and consent.no_opt_in (recipients the send will skip for having no o

Parameter	Type	Required	Notes
from	string	no	One of your numbers. Optional while the key's mode has one number.
body	string	yes	—
name	string	no	—
recipients	array	no	—
tags	array	no	Send to contacts carrying any of these tags (instead of recipients).
contact_ids	array	no	—
segment_id	string	no	Send to the contacts in this saved segment, evaluated when the batch is created (instead of recipients).
list_id	string	no	Send to the contacts in this list, as it is when the batch is created (instead of recipients).
category	string	no	Optional. It can make the batch stricter (marketing), never looser: the sending number's registration and the wording decide ([which messages are marketing](/docs/compliance-checks#which-messages-ar
quiet_hours	string	no	Optional. What to do with a message in the recipient's quiet hours: block refuses it (403 quiet_hours), defer holds it until their next 8:00am. Omitted: each recipient in quiet hours is held until
topic_id	string	no	Subscription topic. Recipients unsubscribed from it are removed at validation (topic_unsubscribed) and skipped at send time, like opt-outs. Omit to apply opt-outs only.
scheduled_at	string	no	Future ISO timestamp or epoch ms, up to 30 days out.
dry_run	boolean	no	Validate only: returns a BatchValidation and sends nothing.
check_line_types	boolean	no	Reject landlines (first 500 unique numbers are checked).

List batches (broadcasts), newest first.

Parameter	Type	Required	Notes
limit	number	no	Max results (default 25, max 100)
cursor	string	no	next_cursor from the previous page
status	string	no	—

Retrieve a batch with its progress counts.

Parameter	Type	Required	Notes
id	string	yes	Batch id

Results of a batch: delivered, failed, pending, replies, opt-outs (stops), spend, and failures grouped by reason.

Parameter	Type	Required	Notes
id	string	yes	Batch id

List a batch's recipients with each one's status.

Parameter	Type	Required	Notes
id	string	yes	Batch id
status	string	no	—
limit	number	no	Max results (default 25, max 100)
cursor	string	no	next_cursor from the previous page

Pause a sending or scheduled batch.

Parameter	Type	Required	Notes
id	string	yes	Batch id

Resume a paused batch.

Parameter	Type	Required	Notes
id	string	yes	Batch id

Cancel a batch. Messages already sent stay sent.

Parameter	Type	Required	Notes
id	string	yes	Batch id

Retry a batch's failed recipients.

Parameter	Type	Required	Notes
id	string	yes	Batch id

Record something a customer did (e.g. signed_up, cart_abandoned, trial_ending), by user_id and/or phone. It starts or advances any active automation listening for that event.

Parameter	Type	Required	Notes
event	string	yes	Letters, digits, and _ . : -
user_id	string	no	—
phone	string	no	—
properties	object	no	Up to 20 scalar values; usable as merge fields and in conditions.
idempotency_key	string	no	Optional. A unique key for this call: a retry with the same key is recorded once.

The questions behind anything a person does here, with this account's options for each: send a text, buy or release a number, register for 10DLC, verify a toll-free number, request a short code, verification codes, a recurring text, a segment, template, list, topic, connecting a tool, a webhook, an API key, a link domain, a spend limit, a number pool, importing opt-outs, automations, broadcasts. t

Parameter	Type	Required	Notes
task	string	no	A task key (buy_number, register_10dlc, ...) or the person's own words ("buy a number"). Omit to list the tasks.

Every input a send needs, as questions to ask the person, with this account's options for each. kind automation: the event that starts it (tracked events with their properties, and the Mixpanel events mapped to them), filters, how long after the event to text, the event that ends it, follow-ups, repeats, who gets it, the message, link, sender and topic. kind broadcast: audience, who to leave out,

Parameter	Type	Required	Notes
kind	string	no	automation (texts started by an event) or broadcast (one send to an audience).

Create a triggered text flow (as a draft): when trigger.event is tracked, run steps such as send_sms, wait, wait_for_event, and condition branches. Example: on cart_abandoned, wait 3600s, then if checkout_completed was not received send a reminder. Settle with the person first: the starting event, how long after it to text, the event that ends it, follow-ups, who gets it and the message. For event

Parameter	Type	Required	Notes
name	string	no	—
from	string	no	One of your numbers. A sandbox number makes it a sandbox flow.
topic_id	string	no	Skip recipients unsubscribed from this topic.
trigger	object	no	—
steps	array	no	—

List automations.

No parameter schema on file.

Retrieve an automation with its trigger and steps.

Parameter	Type	Required	Notes
id	string	yes	Automation id

Edit an automation (name, sender, trigger incl. trigger.cooldown_seconds, or steps). steps replaces every step; step replaces just the one with its id. Pass if_updated_at (the updated_at you read): an edit made by someone else since then answers 409 instead of being overwritten.

Parameter	Type	Required	Notes
id	string	yes	Automation id
name	string	no	—
from	string	no	One of your numbers. A sandbox number makes it a sandbox flow.
topic_id	string	no	Skip recipients unsubscribed from this topic.
trigger	object	no	—
steps	array	no	Replaces every step.
step	object	no	One of: send_sms {body, from?}; wait {seconds}; wait_for_event {event, timeout_seconds, on_received, on_timeout}; condition {check, on_met, on_not_met}; end. Branches are "continue", "end", or "goto:<
if_updated_at	string	no	The automation's updated_at as you read it. If it changed since (another edit), nothing is saved and the answer is 409: read it again and redo the edit on the latest.

Delete an automation.

Parameter	Type	Required	Notes
id	string	yes	Automation id

Turn an automation on, so tracked events start runs. With a live number it texts real people.

Parameter	Type	Required	Notes
id	string	yes	Automation id

Pause an automation: no new runs start, and runs in progress wait where they are until it is activated again.

Parameter	Type	Required	Notes
id	string	yes	Automation id

See an automation's texts exactly as they would go out, without sending: works on drafts. Pass sample event properties (e.g. {"amount": 9.99}) and optionally to for a contact's merge fields. Returns each send_sms step's final text (brand and opt-out wording added as we would), segments, encoding, estimated cost, and merge fields that would come out empty.

Parameter	Type	Required	Notes
id	string	yes	Automation id
properties	object	no	Sample event properties for merge fields, e.g. {"plan": "pro"}
to	string	no	E.164. Fills contact merge fields and reads what this person has already been shown

Text an automation's messages to your own verified phone or a verified recipient now, skipping waits and conditions, without activating it (drafts work). Pass sample event properties; steps sends only those step ids. No run starts and stats do not change. Texts from a live number are real and billed.

Parameter	Type	Required	Notes
id	string	yes	Automation id
to	string	yes	E.164: your own verified phone or a verified recipient
from	string	no	Optional. Send this test from another of your numbers in the same mode (the automation is not changed), e.g. a verified toll-free while its own number is in review.
properties	object	no	Sample event properties for merge fields
steps	array	no	Only these send_sms step ids. Default: all of them
idempotency_key	string	no	Optional. Retries are already safe: the same call with the same inputs within 10 minutes is done once and answers with the first result. Pass your own key to dedupe across a longer gap, or a new one t

List an automation's runs, newest first.

Parameter	Type	Required	Notes
id	string	yes	Automation id
limit	number	no	Max results (default 25, max 100)
cursor	string	no	next_cursor from the previous page

Retrieve one run with its step-by-step timeline.

Parameter	Type	Required	Notes
id	string	yes	Automation id
run_id	string	yes	Run id

Cancel a run in progress.

Parameter	Type	Required	Notes
id	string	yes	Automation id
run_id	string	yes	Run id

Retrieve a topic.

Parameter	Type	Required	Notes
id	string	yes	Topic id

Rename or describe a topic.

Parameter	Type	Required	Notes
id	string	yes	Topic id
name	string	no	—
description	string	no	—

Delete a topic you created (built-in topics stay).

Parameter	Type	Required	Notes
id	string	yes	Topic id

A contact's subscription to each topic.

Parameter	Type	Required	Notes
id	string	yes	Contact id

Whether a number is opted in or out, per registration, with its full consent history and proof.

Parameter	Type	Required	Notes
phone	string	yes	E.164 number

Record an opt-in or opt-out from your own system (CRM, checkout, a form). An opt-in for a marketing registration needs proof (source, when, the page).

Parameter	Type	Required	Notes
phone	string	yes	E.164 number
status	string	yes	—
note	string	no	—
campaign_id	string	no	Only with opted_in: the registration the person opted in to. A marketing send from a number linked to that registration looks for this record. Proof is required when its use case is marketing or mixed
proof	object	no	Opt-in evidence (Messaging Policy 1.4). Accepted only with status opted_in.

List opted-out numbers (the suppression list).

Parameter	Type	Required	Notes
limit	number	no	Max results (default 25, max 100)
cursor	string	no	next_cursor from the previous page

Bring a suppression list over from another provider or tool (up to 500 numbers per call), so people who opted out there are never texted here.

Parameter	Type	Required	Notes
phone_numbers	array	yes	—

List single messages scheduled for later and not yet sent.

No parameter schema on file.

Retrieve a pending scheduled message.

Parameter	Type	Required	Notes
id	string	yes	Scheduled message id

Cancel a scheduled message before it sends.

Parameter	Type	Required	Notes
id	string	yes	Scheduled message id

Send the same text to one number every day, week or month at a local time (e.g. a weekly reminder). Every occurrence runs the usual send checks.

Parameter	Type	Required	Notes
to	string	yes	—
from	string	no	One of your numbers. Optional when the account has exactly one number for the key's mode.
body	string	yes	—
repeat	object	yes	—
start_date	string	no	First local date it may run. Defaults to today.
end_date	string	no	Last local date it may run (inclusive).
max_occurrences	integer	no	The schedule completes after this many messages have been sent.
category	string	no	Optional. It can make each occurrence stricter (marketing), never looser: the sending number's registration and the wording decide ([which messages are marketing](/docs/compliance-checks#which-messa
quiet_hours	string	no	Optional. What to do with a message in the recipient's quiet hours: block refuses it (403 quiet_hours), defer holds it until their next 8:00am. Omitted: an occurrence in quiet hours is held until
idempotency_key	string	no	Optional. Retries are already safe: the same call with the same inputs within 10 minutes is done once and answers with the first result. Pass your own key to dedupe across a longer gap, or a new one t

List recurring schedules.

No parameter schema on file.

Retrieve a recurring schedule with its recent occurrences.

Parameter	Type	Required	Notes
id	string	yes	Schedule id

Pause (active: false) or resume (active: true) a recurring schedule.

Parameter	Type	Required	Notes
id	string	yes	Schedule id
active	boolean	no	false pauses, true resumes.

Delete a recurring schedule.

Parameter	Type	Required	Notes
id	string	yes	Schedule id

Prepaid credit balance and auto-recharge setting.

No parameter schema on file.

Usage by month, today's counters, and plan limits.

Parameter	Type	Required	Notes
months	number	no	How many months back (default 3)

The monthly spend limit and this month's estimated spend.

No parameter schema on file.

Delivery rates by day, destination carrier, or sending number.

Parameter	Type	Required	Notes
group_by	string	no	—
start_date	string	no	YYYY-MM-DD
end_date	string	no	YYYY-MM-DD

List 10DLC brand and campaign registrations and their status. Marketing from a local number needs an approved one.

No parameter schema on file.

A registration with its checks, status, and linked numbers.

Parameter	Type	Required	Notes
id	string	yes	Registration id

List toll-free verifications and their status (draft, in_review with our team, submitted to the carriers, verified, rejected). A toll-free number texts the public only once verified.

Parameter	Type	Required	Notes
status	string	no	—
limit	integer	no	—
cursor	string	no	next_cursor from the previous page

A toll-free verification: status, numbers, the form, what is missing (problems), and the carriers' reason when it was rejected.

Parameter	Type	Required	Notes
id	string	yes	Toll-free verification id (tfv_...)

Connect a tool so its people sync in as contacts, in a list of their own, every 6 hours: Mixpanel (projectId, username, secret = a service account; sourceId = cohort id), Amplitude (apiKey, secretKey, sourceId), HubSpot (accessToken), Shopify (shopDomain, accessToken), Salesforce, or a webhook. Takes the event or property that shows people agreed to texts (consentEvent / consentField) and the prop

Parameter	Type	Required	Notes
provider	string	yes	—
mode	string	no	Mixpanel / Amplitude: pull with credentials every 6 hours (default when credentials are sent), or push: no credentials, the tool's cohort sync posts to the ingest URL.
name	string	no	What to call it (default: the tool and its source).
sourceId	string	no	Mixpanel or Amplitude cohort id; HubSpot list id; Salesforce campaign id; a Shopify customer search. Blank = everyone (HubSpot, Shopify, Salesforce).
projectId	string	no	Mixpanel project id.
region	string	no	Mixpanel / Amplitude data residency.
username	string	no	Mixpanel service account username.
secret	string	no	Mixpanel service account secret.
apiKey	string	no	Amplitude API key.
secretKey	string	no	Amplitude secret key.
accessToken	string	no	HubSpot private app token, or Shopify Admin API access token.
shopDomain	string	no	Shopify store, like acme.myshopify.com.
instanceUrl	string	no	Salesforce My Domain URL.
sfObject	string	no	—
clientId	string	no	Salesforce consumer key, or Shopify client id.
clientSecret	string	no	Salesforce consumer secret, or Shopify client secret.
phoneField	string	no	The tool's property holding the mobile number, when not the usual one ($phone, phone, mobilephone).
consentField	string	no	The tool's property that records SMS consent (e.g. sms_opt_in).
consentEvent	string	no	Mixpanel / Amplitude: the opt-in event the cohort is built on (e.g. SMS Opt In). Everyone in the cohort is recorded as opted in, from that event.
phoneEvent	string	no	Mixpanel: an event that carries the number when profiles do not (e.g. Verification Check Success). A member with no phone on the profile gets it from their latest such event.

The connected tools: status, settings, last sync (found, added, opted out), and their list. No credentials.

No parameter schema on file.

One connected tool and its last sync.

Parameter	Type	Required	Notes
id	string	yes	Integration id

Rename, pause or resume (status), or change an integration's settings or credentials (left-out credentials keep the stored ones). eventTriggers (Mixpanel) maps Mixpanel events to TextKit events; changing only those does not re-test credentials or resync.

Parameter	Type	Required	Notes
id	string	yes	Integration id
name	string	no	—
status	string	no	—
sourceId	string	no	—
phoneField	string	no	—
phoneEvent	string	no	—
phoneEventProperty	string	no	—
eventTriggers	array	no	Mixpanel (with a service account): events to turn into TextKit events within about 10 minutes, so automations start, wait and branch on them. Each entry is a TextKit event name and the Mixpanel events
consentField	string	no	—
consentEvent	string	no	—
username	string	no	—
secret	string	no	—
apiKey	string	no	—
secretKey	string	no	—
accessToken	string	no	—

Confirm the events behind automations: for a Mixpanel integration, each mapped event with its Mixpanel source events and their 7-day volume, how many reached TextKit and when the last did, and which automations start on, wait for or check it. missing names events automations rely on that nothing sends. project_events: true also lists every Mixpanel event name with its 7-day volume, to choose wha

Parameter	Type	Required	Notes
id	string	yes	Integration id
project_events	boolean	no	Also list the Mixpanel project's event names with their 7-day volume.

Sync a connected tool now (up to 6 times an hour) and get what changed.

Parameter	Type	Required	Notes
id	string	yes	Integration id

Disconnect a tool: its credentials and its list are deleted; the contacts stay with their consent.

Parameter	Type	Required	Notes
id	string	yes	Integration id

Send events (message.received, message.delivered, message.opted_out, ...) to a URL: your app, a CRM, an automation tool. Returns the signing secret once.

Parameter	Type	Required	Notes
url	string	yes	—
events		no	Event types to receive. Omit, or send "*" or [], for every event. An unknown type is a 400.
description	string	no	—
numbers	array	no	Optional. Only events about these of your numbers (E.164): message events by their from/to, number events by phone_number. Events about no number (batches, credits, registrations) go only to endpoints

List webhook endpoints.

No parameter schema on file.

Change a webhook endpoint: URL, events, or turn it off (active: false).

Parameter	Type	Required	Notes
id	string	yes	Webhook endpoint id
url	string	no	—
events		no	—
active	boolean	no	false pauses delivery; pending retries for a paused endpoint are dropped.
description	string	no	—
numbers	array	no	Replace the number filter; [] or null clears it.

Delete a webhook endpoint.

Parameter	Type	Required	Notes
id	string	yes	Webhook endpoint id

Replace a webhook endpoint's signing secret (returned once). expire_previous_in keeps the old one signing for that many seconds so the receiver can switch without dropping events.

Parameter	Type	Required	Notes
id	string	yes	Webhook endpoint id
expire_previous_in	integer	no	Seconds the old secret keeps signing alongside the new one.

Send a signed test.ping to a webhook endpoint and see what it answered.

Parameter	Type	Required	Notes
id	string	yes	Webhook endpoint id

Re-send every event that failed to reach a webhook endpoint in a window (default the last 24 hours, up to 7 days), after fixing the receiver.

Parameter	Type	Required	Notes
id	string	yes	Webhook endpoint id
since	string	no	ISO date or epoch milliseconds. Default: 24 hours before until.
until	string	no	ISO date or epoch milliseconds. Default: now.

Your short-link domains and their status (pending_dns, dns_verified, active). Optional: a message sent with shorten_links: true uses the active one, else links.jointextkit.com.

No parameter schema on file.

One short-link domain, with the DNS records it needs.

Parameter	Type	Required	Notes
id	string	yes	Link domain id (ld_...)

Add a subdomain of the user's own (links.example.com) for short links. Returns two DNS records (CNAME and TXT) the user adds at their DNS host; then verify the domain. Short links never go on a shared domain: carriers filter those.

Parameter	Type	Required	Notes
domain	string	yes	—

Check a link domain's DNS records now. When both are found it is turned on (active) at once.

Parameter	Type	Required	Notes
id	string	yes	Link domain id (ld_...)

Retrieve a webhook endpoint.

Parameter	Type	Required	Notes
id	string	yes	Webhook endpoint id

Delivery attempts to your webhook endpoints, with response status codes.

Parameter	Type	Required	Notes
endpoint_id	string	no	One endpoint (we_...), or status_callback for the attempts to send messages' own status callbacks.
event_id	string	no	Every attempt for one event
limit	number	no	Max results (default 25, max 100)
cursor	string	no	next_cursor from the previous page

Send an event again to one webhook endpoint (after fixing the receiver).

Parameter	Type	Required	Notes
id	string	yes	Event id
endpoint_id	string	yes	—

Platforms sending for other businesses: create a customer to attribute numbers, messages and usage to.

Parameter	Type	Required	Notes
name	string	no	—
external_id	string	no	Your id for them; unique per account
metadata	object	no	Up to 50 string values

List your customers.

Parameter	Type	Required	Notes
limit	integer	no	—
cursor	string	no	—
external_id	string	no	Find the customer with this external_id (0 or 1 results)

Retrieve a customer.

Parameter	Type	Required	Notes
id	string	yes	Customer id

Rename a customer or change its external_id or metadata.

Parameter	Type	Required	Notes
id	string	yes	Customer id
name	string	no	—
external_id	string	no	Your id for them; unique per account
metadata	object	no	Up to 50 string values

Delete a customer.

Parameter	Type	Required	Notes
id	string	yes	Customer id

A customer's messages, verifications and spend for a period.

Parameter	Type	Required	Notes
id	string	yes	Customer id
start	string	no	Default: first day of this month
end	string	no	Default: today

Create an API key for an app you are building, to store as a secret in its environment (for example TEXTKIT_API_KEY) so the app can send texts itself. Same mode (test or live) as this connection; optional scopes limit it. The secret is returned once; the account owner is emailed.

Parameter	Type	Required	Notes
name	string	yes	What the key is for, e.g. "Booking app"
scopes	array	no	Limit the key to these scopes (see /docs/authentication). Omit for full access (full-access callers only).

List the active API keys of this mode (never the secrets).

No parameter schema on file.

Revoke an API key of this mode. Immediate and permanent: anything using it stops working.

Parameter	Type	Required	Notes
id	string	yes	API key id

Export as CSV text for analysis: messages, deliveries, events, opt_outs, webhook_deliveries, usage, usage_monthly, audit_log or credit_history. At most 50,000 rows; narrow the date range with from and to.

Parameter	Type	Required	Notes
kind	string	yes	messages, deliveries, events, opt_outs, webhook_deliveries, usage, usage_monthly, audit_log or credit_history
from	string	no	ISO date/time or epoch ms (messages, deliveries, events, webhook_deliveries)
to	string	no	Inclusive; a bare date means the end of that day (UTC)
status	string	no	messages, deliveries
blocked_reason	string	no	messages, deliveries: blocked messages with this reason
direction	string	no	messages
number	string	no	messages, deliveries: digits matched against either side
to_number	string	no	messages, deliveries: exact recipient (E.164). to/from are the date range here.
from_number	string	no	messages, deliveries: exact sender (E.164)
customer_id	string	no	messages, deliveries
failure_code	string	no	messages, deliveries: failed for this reason (the failure.code on a message)
batch	string	no	messages, deliveries: batch id (bc_...)
q	string	no	messages: body/failure text; events: id/payload text
type	string	no	events, webhook_deliveries
endpoint_id	string	no	webhook_deliveries (default: all endpoints)
ok	boolean	no	webhook_deliveries
months	integer	no	usage: daily rows for the last N months
action	string	no	audit_log: one action, or a group prefix with a trailing dot (team.)
actor	string	no	audit_log: actor id or part of the actor email
target_type	string	no	audit_log

The suppression list, or the full consent ledger with opt-in proof, as CSV text.

Parameter	Type	Required	Notes
type	string	no	—

Who changed what on the account (keys, team, webhooks, spend limit, numbers, consent, settings), newest first.

Parameter	Type	Required	Notes
limit	integer	no	—
cursor	string	no	—
action	string	no	One action, or a group prefix with a trailing dot (team., api_key.)
actor	string	no	Actor id (exact) or part of the actor email (case-insensitive)
target_type	string	no	Target type, e.g. api_key, member, invite, webhook, number, phone
created_after	string	no	Entries at or after this time (ISO 8601)
created_before	string	no	Entries at or before this time (ISO 8601); a bare date means the end of that day (UTC)

Wait up to 25 seconds for the next events after a cursor (a reply, a delivery receipt), then return them.

Parameter	Type	Required	Notes
cursor	string	no	The cursor of the previous response. Omit on the first call.
timeout	integer	no	Seconds to hold the request.

The filed copies of a 10DLC registration, newest first.

Parameter	Type	Required	Notes
id	string	yes	Registration id

Set or remove the monthly spend cap and its alert thresholds. Live sends over the cap are refused.

Parameter	Type	Required	Notes
monthly_limit_usd	number	no	null removes the cap
alert_thresholds	array	no	—

Remove a branded link domain. Every short link already sent on it stops working.

Parameter	Type	Required	Notes
id	string	yes	Link domain id

Privacy erasure: forget the phone number linked to a user_id, so its tracked events stop reaching automations.

Parameter	Type	Required	Notes
user_id	string	yes	Your user id

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install TextKit or to call it, at any volume.

ATool-list grade · score 93 / 100

Release 1.0.2 · scanned 31 Oct 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score93

Findings0 threat · 3 capability

Capabilitymoderate

Coveragemanifest

Verificationnot in this report

Surface digest244163ccfcf64a461b1f5b9955fd5e514d8e63c29570f17aa987050b3ad097d7

Score vectorthreat 100 → client 93

Term	Level	What it prices	Points
capability-exposure	moderate	capability blast radius (moderate) — client exposure if the model is manipulated	−3
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.

Tool	Capability tags	Why the tag was assigned
send_message	external-sink	external-sink: keyword "send_message", declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
get_message	no tags
delete_message	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
redact_message	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_messages	no tags
send_verification	external-sink	external-sink: keyword "sms", declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
check_verification	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
fallback_verification	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
list_numbers	no tags
request_short_code	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_number_requests	no tags
search_available_numbers	no tags
purchase_number	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
release_number	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
lookup_phone	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
simulate_inbound	external-sink	external-sink: keyword "sms", declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
list_events	no tags
get_verification	no tags
get_number	no tags
bulk_purchase_numbers	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
link_number_to_registration	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
assign_number_to_customer	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
bulk_update_numbers	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
export_numbers	no tags
list_number_pools	no tags
create_number_pool	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
get_number_pool	no tags
update_number_pool	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
delete_number_pool	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
clone_number_pool	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
import_contacts	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
plan_import	no tags
upsert_contact	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_contacts	no tags
get_contact	no tags
update_contact	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
delete_contact	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
bulk_update_contacts	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
set_contact_topic	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
create_list	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_lists	no tags
get_list	no tags
update_list	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
delete_list	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_list_contacts	no tags
add_to_list	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
remove_from_list	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
create_segment	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_segments	no tags
get_segment	no tags
update_segment	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
delete_segment	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
query_audience	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
preview_segment	no tags
list_topics	no tags
create_topic	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
create_template	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_templates	no tags
get_template	no tags
update_template	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
delete_template	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
recommend_message	external-sink	external-sink: keyword "sms"
send_batch	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
list_batches	no tags
get_batch	no tags
get_batch_results	no tags
list_batch_recipients	no tags
pause_batch	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
resume_batch	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
cancel_batch	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
retry_batch	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
track_event	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
plan_task	no tags
plan_campaign	no tags
create_automation	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_automations	no tags
get_automation	no tags
update_automation	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
delete_automation	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
activate_automation	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
pause_automation	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
preview_automation	external-sink	external-sink: keyword "sms"
test_automation	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
list_automation_runs	no tags
get_automation_run	no tags
cancel_automation_run	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
get_topic	no tags
update_topic	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
delete_topic	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
get_contact_topics	no tags
get_consent	no tags
set_consent	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_opt_outs	no tags
import_opt_outs	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_scheduled_messages	no tags
get_scheduled_message	no tags
cancel_scheduled_message	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
create_schedule	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
list_schedules	no tags
get_schedule	no tags
update_schedule	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
delete_schedule	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
get_balance	no tags
get_usage	no tags
get_spend_limit	no tags
get_deliverability	no tags
list_registrations	no tags
get_registration	no tags
list_toll_free_verifications	no tags
get_toll_free_verification	no tags
connect_integration	external-sink	external-sink: keyword "webhook", declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
list_integrations	no tags
get_integration	no tags
update_integration	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
get_integration_events	no tags
sync_integration	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
disconnect_integration	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
create_webhook	external-sink	external-sink: keyword "webhook", declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
list_webhooks	no tags
update_webhook	external-sink	external-sink: keyword "webhook", declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
delete_webhook	external-sinkstate-write	external-sink: keyword "webhook"; state-write: declares readOnlyHint: false, destructiveHint: true
rotate_webhook_secret	external-sinkstate-write	external-sink: keyword "webhook"; state-write: declares readOnlyHint: false, destructiveHint: true
test_webhook	external-sink	external-sink: keyword "webhook", declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
replay_failed_webhooks	external-sink	external-sink: keyword "webhook", declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
list_link_domains	no tags
get_link_domain	no tags
create_link_domain	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
verify_link_domain	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
get_webhook	no tags
list_webhook_deliveries	no tags
replay_event	external-sink	external-sink: keyword "webhook", declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
create_customer	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_customers	no tags
get_customer	no tags
update_customer	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
delete_customer	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
get_customer_usage	no tags
create_api_key	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_api_keys	no tags
revoke_api_key	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
export_csv	external-sink	external-sink: keyword "webhook"
export_consent	no tags
list_audit_logs	no tags
wait_for_events	no tags
list_registration_submissions	no tags
set_spend_limit	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
delete_link_domain	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
forget_identity	state-write	state-write: declares readOnlyHint: false, destructiveHint: true

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

flow-1

Untrusted input can drive an external action even though no sensitive source is exposed.

Supply chain and provenance

Integrityfirst-seen

Surface digest244163ccfcf64a46

Scanned2026-10-31

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Where are you running it?

Tool surface

Release history

TextKit MCP

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also