# @honkio/mcp

HonkIO MCP server — lets AI coding agents send SMS, manage Canadian phone numbers, and handle CASL/DNCL compliance

- **Type:** MCP server
- **Trust:** 60/100 (B), scored on the package rubric
- **Verification:** community-indexed — nobody has claimed this listing
- **Version:** 1.5.0
- **Author:** Unknown
- **License:** MIT
- **npm:** @honkio/mcp
- **Endpoints:** streamable-http https://mcp.honkio.ca/mcp
- **Source:** https://github.com/jeffcaldwellca/honkio
- **Endpoint health:** reachable (last checked 2026-09-08T11:12:45.442Z, 1 sample) — uptime is not a security property and is not part of the trust score
- **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport)

## Trust

60/100 (B), scored on the package rubric
- Publisher verified: no
- Install scripts: nothing suspicious found
- Prompt-injection scan: not run
- Obfuscation scan: not run
- Evidence age: 0 days

## Security scan

- **Status:** clean
- **Scanned:** 2026-09-08T15:05:56.104Z
- **Version scanned:** 1.5.0
- **CVEs:** none found by OSV at scan time

## Tools

40 declared. Statically extracted from the shipped source — a floor on the surface, not a census.
- `send_sms`
- `list_messages` — List SMS messages for your account with optional filters. Returns paginated results. On each message, cost_cents is what it actually cost in CAD cents (settled 
- `get_message` — Get full details of a single SMS message by its ID, including delivery events. cost_cents is what it actually cost in CAD cents (settled to the carrier's part c
- `search_phone_numbers` — Search available Canadian phone numbers you can provision. Filter by area code to find numbers in a specific province.
- `provision_phone_number` — Provision (purchase) a Canadian phone number to your account. Get the phone_number value from search_phone_numbers first.
- `list_phone_numbers` — List all phone numbers provisioned on your account.
- `get_phone_number` — Get details for a specific provisioned phone number.
- `release_phone_number` — Release (cancel) a provisioned phone number. This will stop monthly billing for the number; the one-time activation fee and the current month are not refunded. 
- `record_consent` — Record CASL consent for a phone number before sending commercial messages. Express consent requires source_description. Implied consent requires relationship_ty
- `list_consents` — List CASL consent records for your account, optionally filtered by phone number or status.
- `check_consent` — Check whether a phone number has valid CASL consent before sending a message.
- `revoke_consent` — Revoke CASL consent for a phone number. Future messages to this number will be blocked unless new consent is recorded.
- `record_opt_out` — Manually record an opt-out for a subscriber. Use this when a subscriber contacts you directly to opt out rather than replying STOP to a message.
- `list_opt_outs` — List opt-out records for your account.
- `check_dncl` — Coming soon: check if a Canadian phone number is on the CRTC Do Not Call List. CRTC DNCL checking is not available yet — this endpoint currently returns 501 (DN
- `batch_check_dncl` — Coming soon: check up to 100 Canadian phone numbers against the CRTC Do Not Call List in a single request. CRTC DNCL checking is not available yet — this endpoi
- `request_erasure` — Execute a PIPEDA/Quebec Law 25 right-to-erasure request for a phone number. Purges message bodies, consent records, and opt-out records for the specified number
- `create_webhook` — Register a webhook endpoint to receive HonkIO event notifications. The signing_secret in the response is shown once — store it to verify X-HonkIO-Signature on i
- `list_webhooks` — List all registered webhook endpoints for your account.
- `update_webhook` — Update a webhook endpoint URL, event subscriptions, or active status.
- `delete_webhook` — Delete a registered webhook endpoint.
- `list_webhook_deliveries` — List recent delivery attempts for a webhook (success/failure, HTTP status, duration, timestamp). Use this to debug why customer events are not arriving or why a
- `reactivate_webhook` — Re-enable a webhook that was auto-disabled by repeated delivery failures. The destination URL is re-validated (SSRF check) before reactivation.
- `list_webhook_dead_letters` — List events that exhausted all retry attempts (dead-letter queue). These are events that failed delivery and were never received by your endpoint. Use replay_we
- `replay_webhook_dead_letter` — Resend a dead-lettered event against the original webhook URL. The event is re-signed with the current timestamp; on success the dead-letter row is marked as re
- `discard_webhook_dead_letter` — Permanently discard a dead-lettered event without replaying it. Use when the event is no longer relevant (e.g. the underlying message has expired).
- `get_pricing`
- `start_verification`
- `check_verification` — Submit the OTP a user entered to complete verification. Returns the verification status (verified, invalid_code, expired, max_attempts).
- `get_verification` — Look up the current state of a verification (status, attempts, expiry, and whether it was real). The "mode" field is "LIVE" for a real billed SMS or "TEST" for 
- `list_verifications` — List recent verifications for your account, optionally filtered by phone number or status.
- `get_send_limit` — Your account's sending limits and current usage: the daily cap (a rolling 24 hours, 250/day for new accounts until a volume request is approved),
- `request_send_limit` — File a "request a higher volume" for HonkIO staff to review. Only available once the account has completed its probation period
- `get_topup_allowance` — How much credit can be added to the account right now. Top-ups are capped by a maximum balance and a rolling 30-day total
- `whoami` — Identify the HonkIO account the configured API key belongs to. Returns the account ID, name, credit balance and status. Call this first when you need an account
- `get_account` — Get details for your HonkIO account including name, credit balance, status, and active API keys.
- `update_account` — Update your HonkIO account name.
- `get_usage` — Get usage statistics for your account including message counts, spending, and live delivery health: "delivery" (liveOutbound, delivered, failed, undelivered, pe
- `create_api_key` — Issue a new API key for your account. The raw key is shown once — store it securely.
- `revoke_api_key` — Revoke an API key, immediately blocking all requests using that key. This cannot be undone.

## Install

**Verdict: review** — Installable, but 1 thing to check first: No publisher has proved control of this listing; it is indexed, not vouched for.
**Cautions** (coverage gaps and advisories — never blocking)
- No publisher has proved control of this listing; it is indexed, not vouched for.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"mcp\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"@honkio/mcp\"\n      ],\n      \"env\": {\n        \"HONKIO_API_KEY\": \"<YOUR_HONKIO_API_KEY>\"\n      }\n    }\n  }\n}"
```
**Credentials it will ask for** (names only — Forge never holds a value):
- `HONKIO_API_KEY` — Honkio API Key (required)
Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each <YOUR_NAME> in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one.
- This entry needs 1 credential (1 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset.

## Blast radius

Extensive blast radius — deletes data; runs locally and hosted.
- Floor 55, ceiling 55 (tier: extensive)
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/%40honkio%2Fmcp
- Install plan: https://forgeregistry.com/api/v1/packages/%40honkio%2Fmcp/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/%40honkio%2Fmcp
- HTML page: https://forgeregistry.com/registry/%40honkio%2Fmcp
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.