Loading…
Official EZTexting MCP server: SMS/MMS messaging, contacts, workflows, and account administration.
Do not connect
The assessed surface is high-risk. Remediate the findings before connecting.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The eztexting-admin MCP server exposes 8 tools, focused primarily on communication capabilities. Its published description reads: "Official EZTexting MCP server: SMS/MMS messaging, contacts, workflows, and account administration". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates eztexting-admin D- — the assessed surface is high-risk and should be remediated before use. Its most notable findings include "Tool input schema requests a secret" and "No authorization on a public remote server". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check eztexting-admin's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add eztexting-admin to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.eztexting.com/mcp/adminStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Account email, creation timestamp, billing plan, credit balance, purchase eligibility, default phone number.
Buy 150–10000 credits using card on file. Requires last 4 of card to confirm.
Paged list of the account's phone numbers. Optional isDefault filter restricts to the account's default number.
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: webhook_create
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: account_details
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: buy_credits
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: phone_number_list
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: stat_get
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: webhook_create
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: webhook_delete
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: webhook_list
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: keyword_list
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
Validates up to 75,000 URLs per job checking status codes, redirects, and response times.
Pay-per-call AI API marketplace with 47 endpoints — OCR, TTS, LLM chat, image generation, weather, and crypto pricing — paid via x402 USDC micropayments on Base.
EPA drinking water quality data in plain English, providing AI agents with tap water quality information for US cities via nine public-data tools.
AI phone answering and appointment booking tools for service businesses.
Aggregates Romanian TV, streaming, cinema, and theater listings for AI agents.
Agent-callable Parallax services — catalog browsing, pricing, project start, and booking.
Official EZTexting MCP server: SMS/MMS messaging, contacts, workflows, and account administration.
Official EZTexting MCP server: SMS/MMS messaging, contacts, workflows, and account administration.
Official EZTexting MCP server: SMS/MMS messaging, contacts, workflows, and account administration.
Official EZTexting MCP server: SMS/MMS messaging, contacts, workflows, and account administration.
Account stats. type=MSG: total SMS/MMS sent. type=AI_COMPOSE: SMS/MMS made with AI Compose, by source.
Create webhook. type and callbackUrl required. Optional shared secret.
Delete webhook by id (irreversible). Pass confirmed=true to actually delete; otherwise returns a no-op confirmation preview.
Webhook subscriptions. Omit id to list. Set id to fetch single. Types: inbound_text.received, keyword.opt_in, contact.created.
List keywords acquired by the account (5-min cache).