Back to Browse

Textbee MCP Server

Developer ToolsModerate5.4MCP RegistryLocal
Free

Server data from the Official MCP Registry

Send and read SMS through your own Android phone via textbee.dev, the open-source SMS gateway.

About

Send and read SMS through your own Android phone via textbee.dev, the open-source SMS gateway.

Security Report

5.4
Moderate5.4Moderate Risk

This is a well-structured MCP server for sending and reading SMS through a textbee account, with API key auth via env var or per-request credentials, strict E.164 validation, and fail-closed credential handling. The main concerns are that the API key has full account access, send_sms can cost real messages and is exposed to prompt-injection-driven spam, and the hosted remote mode passes the key through a third-party server, which users should understand. Permissions (network_http, env_vars) match the SMS gateway purpose, and no exfiltration, obfuscation, or shell execution patterns were found. Supply chain analysis found 9 known vulnerabilities in dependencies (2 critical, 4 high severity). Package verification found 1 issue.

12 files analyzed · 15 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

API key from the textbee dashboard (app.textbee.dev/dashboard).Required

Environment variable: TEXTBEE_API_KEY

Self-hosted instance URL. Defaults to https://api.textbee.dev; the /api/v1 suffix is added automatically.Optional

Environment variable: TEXTBEE_BASE_URL

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-textbee-mcp": {
      "env": {
        "TEXTBEE_API_KEY": "your-textbee-api-key-here",
        "TEXTBEE_BASE_URL": "your-textbee-base-url-here"
      },
      "args": [
        "-y",
        "@textbee/mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

@textbee/mcp

npm version CI license

MCP server for textbee.dev, the open source SMS gateway that turns an Android phone into an SMS API. Gives Claude, Cursor, and any MCP client the ability to send and read SMS through your own phone and your own number.

Three tools, no per-message markup, works with self-hosted textbee instances.

Setup

You need a textbee account with a paired Android device and an API key from the dashboard. The key has full account access; treat it like a password.

claude.ai, Claude Desktop, and the Claude mobile apps (no install)

These use the hosted endpoint at https://mcp.textbee.dev/mcp, which runs the same tools from this package.

  1. In claude.ai or Claude Desktop, open Customize, then Connectors, then + Add and Add custom connector.
  2. Enter the name textbee and the URL https://mcp.textbee.dev/mcp, then click Continue twice.
  3. Choose Sign in now, leave the OAuth client on the recommended option, and click Add.
  4. Paste your API key on the textbee sign-in page and click Connect.

One connection works on the web, in Claude Desktop, and in the Claude mobile apps (the mobile apps cannot add connectors themselves). On Team and Enterprise plans, an owner adds the connector for the organization first. It lasts 90 days, then Claude asks you to reconnect. textbee checks the key and does not store it, but the key does pass through textbee's server. Revoke the key in the dashboard to disconnect. To keep the key on your machine, use the local setup below.

Claude Code

Local, with the key in your own config:

claude mcp add textbee -s user -e TEXTBEE_API_KEY=your-key -- npx -y @textbee/mcp

Or hosted, signing in with your key in the browser:

claude mcp add --transport http -s user textbee https://mcp.textbee.dev/mcp

Then run /mcp in Claude Code, select textbee, and choose Authenticate.

Claude Desktop (local)

Add to claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json, Windows: %APPDATA%\Claude\claude_desktop_config.json), then restart Claude Desktop:

{
  "mcpServers": {
    "textbee": {
      "command": "npx",
      "args": ["-y", "@textbee/mcp"],
      "env": { "TEXTBEE_API_KEY": "your-key" }
    }
  }
}

Cursor

The same object in ~/.cursor/mcp.json. Clients that support remote servers with headers can use https://mcp.textbee.dev/mcp instead and send the key as x-textbee-api-key or Authorization: Bearer <key>.

Full setup guide: textbee.dev/docs/agents/mcp.

Slow first start

npx downloads the package on first run. If your client times out waiting, install globally once and point the config at the binary:

npm install -g @textbee/mcp
{ "mcpServers": { "textbee": { "command": "textbee-mcp", "env": { "TEXTBEE_API_KEY": "your-key" } } } }

Tools

send_sms

Send an SMS to one or more recipients (E.164 format, for example +15550100123). The sending phone is chosen automatically: your default device, otherwise the enabled device with the most recent heartbeat. Optional device_id, sim_subscription_id, and scheduled_at. Returns an sms_batch_id for delivery checks when the account uses the SMS queue.

get_messages

Read messages across every device on the account. Defaults to received messages, newest first. Filter by direction (received, sent, all), free-text search, sms_batch_id (per-recipient delivery status of a send), device_ids, and a from/to time window. Supports cursor pagination for polling without duplicates or gaps.

list_devices

The phones on the account: ids, enabled state, which one sends by default, last check-in, and message counts.

Self-hosted textbee

Point the server at your own instance:

"env": {
  "TEXTBEE_API_KEY": "your-key",
  "TEXTBEE_BASE_URL": "https://sms.example.com"
}

The /api/v1 suffix is optional and added automatically. Subpath deployments like https://example.com/textbee work too. An invalid URL is an error rather than a silent fallback, so a typo never sends your key to the public API.

Environment variables

VariableRequiredDefaultPurpose
TEXTBEE_API_KEYyesnoneAPI key from the textbee dashboard
TEXTBEE_BASE_URLnohttps://api.textbee.devYour instance's URL when self-hosting
TEXTBEE_TIMEOUT_MSno30000Per-request timeout in milliseconds

Notes

  • Your key stays on your machine: this server talks only to the textbee API at the base URL above.
  • Sends count against your textbee plan quota, and the plan's rate limits apply server-side.
  • All diagnostics go to stderr; stdout is reserved for the MCP protocol.

Using it as a library

The package also exports its tool definitions for embedding in another MCP host (this is how the hosted remote endpoint reuses them):

import { createTextbeeMcpServer, staticCredentials, loadConfig } from '@textbee/mcp'

const server = createTextbeeMcpServer({
  credentials: staticCredentials(loadConfig(process.env)),
})

Credentials are resolved per tool call, so a multi-tenant host can inject a different key per request. See credentialsFromAuthInfoExtra.

License

MIT. Part of the textbee project.

Reviews

No reviews yet

Be the first to review this server!