agentphone-mcpSAFE
Give AI agents real phone numbers, messages, and voice calls via MCP.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Give AI agents real phone numbers, SMS, and voice calls via the Model Context Protocol.
AgentPhone lets your AI agent buy phone numbers, send/receive SMS, and place voice calls — all through natural language in Cursor, Claude Desktop, or any MCP-compatible client.
Agents are the core concept — each agent gets its own phone numbers, voice personality, system prompt, and webhook. Think of an agent as a virtual team member with its own phone line. You can create agents for different purposes (support, sales, scheduling) and configure how they sound and behave on calls.
Quick Start
1. Get your API key
Sign up at agentphone.ai and create an API key from Settings.
2. Connect via MCP
Option A: Remote server (recommended)
Point your MCP client at the hosted endpoint — no install needed:
{
"mcpServers": {
"agentphone": {
"type": "streamable-http",
"url": "https://mcp.agentphone.ai/mcp",
"headers": {
"Authorization": "Bearer your_api_key_here"
}
}
}
}Works with any MCP client that supports Streamable HTTP transport (Switchboard, remote agent platforms, etc.).
Option B: Local server (stdio)
Runs locally via npx — works with Cursor, Claude Desktop, Windsurf, and Claude Code:
Cursor: Settings > MCP or ~/.cursor/mcp.json Claude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows)
{
"mcpServers": {
"agentphone": {
"command": "npx",
"args": ["-y", "agentphone-mcp"],
"env": {
"AGENTPHONE_API_KEY": "your_api_key_here"
}
}
}
}Option C: Self-hosted HTTP server
Run your own HTTP MCP endpoint:
AGENTPHONE_API_KEY=your_api_key npx agentphone-mcp --http --port 3000
Then connect to http://localhost:3000/mcp.
What Can It Do?
On
9a565d052903OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add agentphone-mcp --env AGENTPHONE_API_KEY=${AGENTPHONE_API_KEY} -- npx -y [email protected]Exposed tools (28)
19 read · 6 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
account_overview | read | Get a complete snapshot of your AgentPhone account: agents, phone numbers, webhook status, |
attach_number | read | Attach a phone number to an agent so the agent handles calls/SMS on that number. |
buy_number | read | Purchase a new phone number. This is a paid purchase that charges the account |
create_agent | write | Create a new agent. An agent owns phone numbers and handles calls/SMS.\n\n |
delete_agent | destructive | Delete an agent permanently. Phone numbers attached to it are kept but unassigned. |
delete_webhook | destructive | Remove a webhook. Pass agent_id to remove an agent |
detach_number | read | Detach a phone number from an agent. The number is kept in your account but becomes unassigned. |
get_agent | read | Get details for a specific agent including its phone numbers, voice configuration, and instructions. |
get_call | read | Get details and transcript for a specific call, identified by its call ID. |
get_conversation | read | Get a specific SMS conversation with full message history, identified by its conversation ID. |
get_messages | read | Get SMS messages for a specific phone number, identified by its number ID. |
get_usage | read | Get account usage statistics. By default returns a summary with number usage plus |
get_webhook | read | Get the webhook configuration. Pass agent_id to get an agent-specific webhook, |
list_agents | read | List all agents with their phone numbers and voice configuration. |
list_calls | read | List recent calls. Scope by agent_id or number_id, or use status/direction/search to filter globally.\n\n |
list_contacts | read | List saved contacts (your address book). Optionally filter with a search term that matches |
list_conversations | read | List SMS conversations. Optionally filter by agent_id to see conversations for a specific agent.\n\n |
list_numbers | read | List all phone numbers in your account, each with its ID, status, country, and assigned agent. |
list_voices | read | List available voices for agents. Each voice has a voice_id used in an agent |
list_webhook_deliveries | read | View recent webhook delivery history. Shows which events were delivered, HTTP status codes, and timing.\n\n |
make_call | read | Initiate an outbound, webhook-driven phone call where your backend handles the |
make_conversation_call | read | Place a phone call where the AI has an autonomous conversation about a given topic — |
manage_contact | destructive | Create, update, or delete a saved contact. Set |
send_message | write | Send an SMS or iMessage from one of your agent |
set_webhook | write | Set a webhook URL to receive inbound messages and call events.\n\n |
test_webhook | write | Send a test event to verify a webhook is working. Returns the HTTP status code and response time.\n\n |
update_agent | write | Update an agent |
update_conversation | write | Set metadata on a conversation. Use this to store custom state, tags, or context |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
delete_agent, delete_webhook, manage_contact
@modelcontextprotocol/sdk, mcp-use, zod, @types/node, tsx, typescript
Gates applied: no_behavioural_pass.
9a565d052903full audit observations/trust-audit/mcp-server/agentphone-ai__agentphone-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 9a565d052903 | SAFE | B | 89 | first audit |
Questions
What is the agentphone-mcp MCP server?
Give AI agents real phone numbers, messages, and voice calls via MCP.
What tools does agentphone-mcp expose?
28 in total: 19 read-only, 6 that write, and 3 that can delete or overwrite (delete_agent, delete_webhook, manage_contact). Every one is listed on this page with its risk.
Is agentphone-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does agentphone-mcp need?
It reads AGENTPHONE_API_KEY, AGENTPHONE_OAUTH_AUTHORIZE, AGENTPHONE_OAUTH_ISSUER, MCP_OAUTH_CLIENT_ID and MCP_OAUTH_CLIENT_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does agentphone-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as agentphone-mcp at 0.7.0.
How current is this page?
The grade is for one exact copy of the source (9a565d052903), read on 2026-10-12. The repository is watched and re-audited when it changes.