Twilio
Send SMS, manage phone numbers, query call logs. The standard for voice/SMS workflows from inside an agent.
Delv Safety Grade: A+
Score 92/100 · assessed 2026-04-28
Twilio's official MCP server is maintained by twilio-labs, the vendor's experimental arm, giving it strong organisational backing and legitimacy. The server provides scoped access to Twilio's SMS, voice, and phone number management APIs through well-defined tools. It requires account credentials via environment variables, which is standard for API integrations but does grant write access to send messages and modify account resources. The npm package distribution is clean and follows standard practices. Transparency is excellent with open source code and clear documentation. The permissions are reasonably scoped to Twilio's API domain, though they do include message sending and account modification capabilities. No known security incidents. The main consideration is that credentials grant full account access within Twilio's API scope, so credential management is critical.
Lethal Trifecta (prompt-injection exposure)
TRIFECTA RISKInbound SMS and voice are untrusted by definition. Address book is private. SMS/voice send is outbound.
Green flags
- Official Twilio Labs package, backed by major communications vendor
- Open source with clear repository and documentation
- Standard npm distribution with versioning
- Well-scoped to Twilio API domain, no filesystem or shell access
- No known security incidents or credential leaks
Red flags
- Auth token grants full Twilio account access, not scoped to specific resources
- Can send SMS to any number, potential for abuse if credentials leak
- Package is alpha release (@twilio-alpha), may have stability issues
Permissions requested
Install
npx -y @twilio-alpha/mcp
TWILIO_ACCOUNT_SIDTWILIO_AUTH_TOKENReview
If you're already using Twilio for SMS or voice, install this. It's faster than writing your own API client and it works reliably. Skip it if you're not a Twilio customer or you only send messages once a quarter.
Good at
- Official Twilio integration, so it tracks API changes and gets vendor support.
- Saves you from writing boilerplate for common SMS and call log tasks.
- Clean authentication via environment variables, no credentials in prompts.
- Useful for both production workflows and one-off debugging tasks like pulling call logs.
Watch out
- No npm package, so you have to build from source yourself.
- Requires an active Twilio account with funded balance, not a free tool.
- Manual config needed for hosts beyond Claude Desktop, no auto-setup.
- Doesn't abstract Twilio's pricing, so you can accidentally spend money if you're not careful.
Getting started
Works with
Similar MCPs
- Bluesky Social MCPFull Bluesky control over the atproto client, covering profiles, feeds, posts, follows, and interactions.
- GmailRead, search, send, label Gmail messages from Claude. Note: original repo archived March 2026; community forks may be more current.
- ResendResend's official MCP for transactional email. Send, list, schedule from Claude — straightforward, fast, well-documented.
- DiscordRead messages, post to channels, manage server members. Useful for community moderators and gamedev teams.