# @simplepush/mcp Send tasks and notifications to people's phones. Answers build a queryable knowledge base. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the package rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 0.3.1 - **Author:** sh.simplepu - **License:** MIT OR Apache-2.0 - **npm:** @simplepush/mcp - **Endpoints:** streamable-http https://mcp.simplepu.sh/mcp - **Source:** https://github.com/simplepush/simplepush-mcp - **Endpoint health:** reachable (last checked 2026-09-17T01:22:06.629Z, 2 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the package rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 5 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-13T18:09:42.695Z - **Version scanned:** 0.3.0 - **CVEs:** none found by OSV at scan time ## Tools 14 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `send_notification` - `send_task` - `append_subtask` — Add a follow-up question or checklist item to a task sent with send_task. Pass the append_token from that result: a task's token appends to that one task; a gro - `cancel_task` — Withdraw something sent earlier: pass a task_id (tsk_...), subtask_id (sub_...) or group_id (grptsk_...). Pending recipients see it as canceled and can no longe - `get_task_answer` — Check whether a task sent with send_task, or a subtask added with append_subtask, has been answered. Pass exactly one of task_id or subtask_id. Returns the answ - `get_notification_answer` — Check whether a notification sent with send_notification and an `input` has been answered. Pass the notification_id it returned. Returns the pick, pending if un - `query_tasks` — Answers 'which tasks are open, expired, declined or done, and who has them'. Status only — it never shows what people answered or reported; for that use get_tas - `get_task` — Answers 'what exactly was asked and answered on this task'. The full content of one task and every subtask appended to it: the questions, the answers given, rep - `get_group_status` — Answers 'who has answered and who has not' for a task sent to several people as independent copies (a grptsk_ group id, as shown on tasks from query_tasks): one - `query_events` - `query_submissions` — Answers 'did anyone report something on their own' — reports people sent without being asked (not answers to a task): text, photo, file, voice note, location, w - `search_knowledge` - `get_activity` — Use this first for 'any problems with ?', 'what is going on with / at the site?', 'catch me up', 'anything I should know?'. One call returns th - `download_attachment` — Fetches a photo, voice recording or file by the id of what holds it and the id of the file, the same pair the SDK's download takes. Images come back inline so y ## Install **Verdict: review** — Installable, but 1 thing to check first: No publisher has proved control of this listing; it is indexed, not vouched for. **Cautions** (coverage gaps and advisories — never blocking) - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"mcp\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@simplepush/mcp\"\n ],\n \"env\": {\n \"SP_API_TOKEN\": \"\",\n \"SP_INTEGRATION_TOKEN\": \"\",\n \"SP_KEYS\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `SP_API_TOKEN` — Sp API Token (optional) - `SP_INTEGRATION_TOKEN` — Sp Integration Token (optional) - `SP_KEYS` — Sp Keys (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 3 credentials (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Moderate blast radius — runs locally and hosted; holds an api key. - Floor 29, ceiling 29 (tier: moderate) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/%40simplepush%2Fmcp - Install plan: https://forgeregistry.com/api/v1/packages/%40simplepush%2Fmcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/%40simplepush%2Fmcp - HTML page: https://forgeregistry.com/registry/%40simplepush%2Fmcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.