
Security News
How AI Agents Expand the Software Supply Chain Attack Surface
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.
@codespar/mcp-twilio
Advanced tools
MCP server for Twilio — global SMS, WhatsApp, Voice, Verify, and Lookup across 180+ countries
MCP server for Twilio — the global standard for programmable messaging and voice.
SMS, WhatsApp, and Voice across 180+ countries. Verify (2FA) and Lookup (phone validation) included. Fills the global messaging gap in a catalog otherwise tilted to Brazil-specific providers (Z-API, Take Blip, Zenvia, Evolution API).
| Tool | Purpose |
|---|---|
send_message | Send an SMS or WhatsApp message (prefix To with whatsapp:+E164 for WhatsApp) |
get_message | Retrieve a message by SID |
list_messages | List messages with optional filters (To, From, DateSent) |
delete_message | Delete a message from history |
make_call | Place an outbound voice call driven by a TwiML Url |
get_call | Retrieve a call by SID |
update_call | Hang up or redirect an in-progress call |
start_verification | Send a Verify (2FA) code via sms / whatsapp / call |
check_verification | Check a Verify (2FA) code |
lookup_phone | Validate + format + classify a phone number (Lookups v2) |
list_incoming_numbers | List your Twilio-provisioned phone numbers |
buy_phone_number | Provision a new phone number |
npm install @codespar/mcp-twilio
TWILIO_ACCOUNT_SID="AC..." # required
TWILIO_AUTH_TOKEN="..." # required (secret)
TWILIO_MESSAGING_SERVICE_SID="MG..." # optional; default sender for send_message
HTTP Basic auth with AccountSid:AuthToken. The server handles this automatically — you only configure the env vars.
Authorization: Basic <base64(AccountSid:AuthToken)>
https://api.twilio.com/2010-04-01/Accounts/{AccountSid} — Messages, Calls, IncomingPhoneNumbershttps://verify.twilio.com/v2 — 2FA flows (requires a Verify Service SID passed per call)https://lookups.twilio.com/v2 — phone number validation / carrier / line typeRequest bodies are application/x-www-form-urlencoded; responses are JSON (endpoints use the .json suffix on the Accounts API).
Use the same send_message tool, but prefix numbers with whatsapp::
{ "To": "whatsapp:+5511999999999", "From": "whatsapp:+14155238886", "Body": "Olá" }
Sandbox numbers or approved WhatsApp-enabled senders work the same way.
# stdio (default — for Claude Desktop, Cursor, etc)
npx @codespar/mcp-twilio
# HTTP (for server-to-server testing)
MCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-twilio
MIT
FAQs
MCP server for Twilio — global SMS, WhatsApp, Voice, Verify, and Lookup across 180+ countries
The npm package @codespar/mcp-twilio receives a total of 46 weekly downloads. As such, @codespar/mcp-twilio popularity was classified as not popular.
We found that @codespar/mcp-twilio demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.

Security News
A new federal program will let vetted U.S. cybersecurity firms help investigate and disrupt foreign cybercrime groups under government direction.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.