dev.hatchloop/sms-whatsapp-messaging

Est-ce que dev.hatchloop/sms-whatsapp-messaging est sûr ?

Au dernier audit MCP Hub, le serveur MCP « dev.hatchloop/sms-whatsapp-messaging » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 10 outils

• check_compliance≈ 372 tokens

  Free, instant pre-flight for the compliance gate: runs the SAME TCPA/GDPR/CASL/CAN-SPAM/10DLC checks as send_message and call_business, in preview mode -- nothing is sent, nothing changes. Tells you whether a send would be permitted before you pay, and if not, names the exact rule and how to fix it. De-risks a paid send the way check_booking_link de-risks a paid booking. [free, no key]

  Paramètres, retour & exemple (6)

  Paramètres

  • channel · string · optionnel · sms | email | voice
    Delivery channel. Omit to auto-infer sms/email from recipient_id; set 'voice'…
  • content · string · requis
    The actual message body you intend to send. The gate classifies the real text,…
  • state_code · string · optionnel
    US state code (e.g. 'CA') for state-specific rules.
  • country_code · string · optionnel
    ISO 3166-1 alpha-2 (e.g. 'US', 'DE', 'CA'). Auto-inferred from phone if…
  • message_type · string · optionnel
    One of transactional, marketing, reminder, follow_up, notification (any case).…
  • recipient_id · string · requis
    Phone in E.164 (e.g. '+14045550100') or email address the message would go to.

  Exemple d'appel

  {"name": "check_compliance", "arguments": {"content": "texte", "recipient_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• find_business≈ 538 tokens

  Find real businesses near a place, sorted by distance (nearest of those examined; see result.search). Data: OpenStreetMap (ODbL, (c) OSM contributors); phone, website, hours only when mapped. Coverage varies; community-mapped, NOT verified by us; source=openstreetmap rows cannot be booked. Answers within about 5 s: status partial (search_in_progress) means repeat the call. If OSM is down: retriable 'temporarily unavailable', never invented rows. [free, no key] [beta]

  Paramètres, retour & exemple (8)

  Paramètres

  • city · string · optionnel
    Instead of location: a city, e.g. 'Muscat, Oman'.
  • region · string · optionnel
    With city: a state or region.
  • location · object · requis
    City/town or ZIP, optionally with country ('Nizwa, Oman'). Geocoded by OSM.
  • vertical · string · optionnel · personal_services | home_services | professional_services
  • capability · string · optionnel
    Kind of business: 'dentist', 'cafe', 'plumber'. Use it or vertical.
  • price_band · object · optionnel
    Supply-network rows only (OpenStreetMap has no prices).
  • max_results · integer · optionnel
  • availability_window · object · optionnel
    Accepted but NOT APPLIED: it does not narrow results (no live calendars). The…

  Exemple d'appel

  {"name": "find_business", "arguments": {"location": {}}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_conversation≈ 187 tokens

  Read a two-way conversation thread you started: its state, every message exchanged, and how many replies the business has sent. [free, requires key]

  Paramètres, retour & exemple (3)

  Paramètres

  • reference · string · optionnel
    The 4-digit request reference, e.g. '4821'. Requires business_number.
  • business_number · string · optionnel
    Scopes a `reference` to one business (references are reused across businesses).
  • conversation_id · string · optionnel
    From the send_message receipt (preferred).

  Exemple d'appel

  {"name": "get_conversation", "arguments": {"reference": "texte", "business_number": "texte", "conversation_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_outcome≈ 93 tokens

  Retrieve the final OutcomeReceipt for a completed operation. [free, no key]

  Paramètres, retour & exemple (1)

  Paramètres

  • operation_id · string · requis

  Exemple d'appel

  {"name": "get_outcome", "arguments": {"operation_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_status≈ 96 tokens

  Query the current state of any in-flight async operation by operation_id. [free, no key]

  Paramètres, retour & exemple (1)

  Paramètres

  • operation_id · string · requis

  Exemple d'appel

  {"name": "get_status", "arguments": {"operation_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• preview_cost≈ 178 tokens

  Return an expected cost estimate, latency estimate, and success-probability estimate for a proposed call before execution. Returns the exact price when it is fixed, and a min/max range when the cost depends on channel or outcome. It does not promise an accuracy percentage - check cost_range. [free, no key]

  Paramètres, retour & exemple (2)

  Paramètres

  • params · object · requis
    The same request body you would pass to the operation
  • operation · string · requis

  Exemple d'appel

  {"name": "preview_cost", "arguments": {"params": {}, "operation": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• self_test≈ 113 tokens

  Service health probe: runs 6 internal checks and reports how many passed. Confirms the server is up and responding - it does NOT probe each tool individually. Use to verify connectivity before production use. [free, no key]

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "self_test", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• send_message≈ 538 tokens

  Send a message on behalf of an agent's user or an SMB across WhatsApp (free during launch), SMS, email, or voice, sent immediately, no scheduling. Every send passes a non-bypassable gate: TCPA, GDPR, CASL where modeled, else the service's own opt-in default (the Gulf included). Marketing on SMS, voice, WhatsApp and non-US email without recorded opt-in is rejected (compliance_violation receipt). US marketing email follows CAN-SPAM opt-out rules. [from $0.02/call, variable, not charged while no payment rail is on] [async→get_outcome] [Not available on this deployment: SMS, Voice.]

  Paramètres, retour & exemple (7)

  Paramètres

  • content · object · requis
  • recipient · object · requis
  • business_id · string · optionnel
    Stable id for the recipient business; used for global demand shaping.
  • message_type · string · requis · transactional | marketing | reminder | follow_up | notification
    'marketing' needs recorded opt-in, except US email (CAN-SPAM opt-out rules).…
  • on_behalf_of · string · optionnel
    Who this message is FOR (your end-user's name/label). On WhatsApp this opens a…
  • idempotency_key · string · optionnel
    Retry key: a 24h replay returns the original receipt, not re-run or charged.
  • preferred_channel · string · optionnel · whatsapp | sms | email | voice | auto

  Exemple d'appel

  {"name": "send_message", "arguments": {"content": {}, "recipient": {}, "message_type": "transactional"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• send_transactional_confirmation≈ 334 tokens

  Idempotent transactional messages: OTPs, booking confirmations, payment receipts, cancellation notices. Falls back across configured channels; an unconfigured channel fails honestly rather than reporting a delivery that did not happen. [$0.02/per_call, not charged while no payment rail is on] [async→get_outcome] [Not available on this deployment: SMS.]

  Paramètres, retour & exemple (5)

  Paramètres

  • data · object · requis
    Type-specific payload; e.g., {otp_code} for otp, {appointment_time, smb_name}…
  • recipient · object · requis
  • idempotency_key · string · optionnel
    Retry key: a 24h replay returns the original receipt, not re-run or charged.
  • confirmation_type · string · requis · otp | booking_confirmation | payment_receipt | cancellation_notice | reminder
  • preferred_channel · string · optionnel · sms | email | auto

  Exemple d'appel

  {"name": "send_transactional_confirmation", "arguments": {"data": {}, "recipient": {}, "confirmation_type": "otp"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• verify_business≈ 142 tokens

  Look up what we know about a business in our supply network: contact channels, capabilities, last verification. A DIRECTORY LOOKUP - it does not contact the business. Supply-network ids only, not osm:... ids. [free, no key] [limited]

  Paramètres, retour & exemple (2)

  Paramètres

  • smb_id · string · requis
  • capability_to_verify · string · optionnel

  Exemple d'appel

  {"name": "verify_business", "arguments": {"smb_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://hatchloop.dev/mcp/sms-whatsapp-messaging