
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
Model Context Protocol server for ICTFax. Lets AI assistants list and track faxes and, with writes enabled, upload documents and send faxes over the ICTCore REST API.
A Model Context Protocol server for ICTFax, the open-source fax server built on the ICTCore framework by ICT Innovations.
It lets an AI assistant list fax transmissions and check their status, and — only when you turn writes on — upload a document and send a fax.
npx -y ictfax-mcp # no install
npm install -g ictfax-mcp
Requires Node.js 18 or newer.
| Variable | Required | Default | |
|---|---|---|---|
ICTFAX_BASE_URL | yes | ICTCore REST base, normally ending in /api, e.g. https://your-ictfax/api | |
ICTFAX_USERNAME | yes | API account email (ICTCore logs in by email) | |
ICTFAX_PASSWORD | yes | Password for that account | |
ICTFAX_ACCOUNT_ID | no | 1 | Account id to send faxes from |
ICTFAX_MCP_ALLOW_WRITE | no | false | Unlock upload/send (see Safety) |
ICTFAX_TIMEOUT_MS | no | 30000 | Per-request timeout |
ICTFAX_TLS_INSECURE | no | false | Skip TLS verification — self-signed test servers only |
{
"mcpServers": {
"ictfax": {
"command": "npx",
"args": ["-y", "ictfax-mcp"],
"env": {
"ICTFAX_BASE_URL": "https://your-ictfax/api",
"ICTFAX_USERNAME": "admin@example.com",
"ICTFAX_PASSWORD": "your-password"
}
}
}
}
Read tools are always available:
| Tool | What it does |
|---|---|
ictfax_list_faxes | List fax transmissions (id, contact, status, direction) |
ictfax_get_fax_status | Status of one transmission by id |
Write tools appear only when ICTFAX_MCP_ALLOW_WRITE=true:
| Tool | What it does |
|---|---|
ictfax_upload_document | Upload a local PDF as a fax document; returns a document_id |
ictfax_send_fax | Send a local document as a fax to a number — dials a real number |
The server is read-only by default. Sending a fax dials a real number and can
cost money, so ictfax_upload_document and ictfax_send_fax are not registered at
all unless you set ICTFAX_MCP_ALLOW_WRITE=true.
ICTFax runs on ICTCore, which authenticates with a JWT from POST /authenticate
(login by email) and reads it back from the Authorization: Bearer header. Sending
a fax is a short chain the server handles for you: upload the document (metadata
then raw bytes, which ICTFax converts to fax format), create the recipient and a
sendfax program, create the transmission and send it.
Built by Tahir Almas at ICT Innovations — the team behind ICTFax, ICTPBX, ICTContact, ICTDialer and the ICTCore framework these share. ICTFax is free and open source; learn more at ictfax.org.
MIT licensed. Issues and PRs welcome at github.com/ictinnovations/ictfax-mcp.
FAQs
Model Context Protocol server for ICTFax. Lets AI assistants list and track faxes and, with writes enabled, upload documents and send faxes over the ICTCore REST API.
The npm package ictfax-mcp receives a total of 23 weekly downloads. As such, ictfax-mcp popularity was classified as not popular.
We found that ictfax-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.