C

Twilio MCP

Official Twilio MCP server that exposes all Twilio APIs via OpenAPI spec auto-generation

Overall Score58/100

Score Breakdown

Server Info

Package
@twilio-alpha/mcp
Registry
npm
Maintainer
TwilioVendor
Category
Communication
Tags
smsvoicemessaging
Last Scanned
7 Apr 2026

Findings

6 issues

Authentication & Identity

HIGHNo per-request auth - requires instance-per-user

Stdio-only transport. Credentials passed via CLI arguments (accountSid, apiKey, apiSecret) or in 'accountSid/apiKey:apiSecret' format. Uses HTTP Basic auth to the Twilio API (apiKey:apiSecret). AccountSid validated with regex /^AC[a-fA-F0-9]{32}$/ and ApiKey with /^SK[a-fA-F0-9]{32}$/. No MCP OAuth ... For multi-tenant deployment, the platform must spawn a separate server instance per user.

Remediation

Add HTTP/SSE transport to accept per-request Authorization headers, or implement the MCP OAuth spec.

Tool Schema Quality

MEDIUMOnly 0 of 2 schemas have parameter constraints

Most schemas lack maxLength, enum, or pattern constraints on string parameters.

Remediation

Add constraints to string parameters, especially on write operations.

CRITICALDangerous execution surface: TwilioServerlessV1--UploadServerlessFunction

Tool allows raw code/query execution which could be exploited via prompt injection.

Remediation

Use parameterized queries or validated command sets.

LLM Safety

HIGHTool descriptions contain instructional language

Descriptions include directives that could influence LLM behavior beyond tool selection.

Remediation

Remove instructional language. Descriptions should be purely factual.

Data Exposure

LOWNo field selection on responses

Responses return full records rather than projected fields.

Remediation

Implement field selection to return only relevant fields.

Maintenance & Trust

HIGH19 dependency vulnerabilities (1 critical, 7 high)

npm audit found 1 critical and 7 high severity CVEs.

Remediation

Run `npm audit fix` and update vulnerable dependencies.

Tools

2 total
NameDescriptionRisk
TwilioServerlessV1--UploadServerlessFunctionUpload a JavaScript file as a Twilio Serverless Function. This creates a new version of the function that can be deployed.write
TwilioServerlessV1--UploadServerlessAssetCreate a new Asset resource. Assets are static files like HTML, CSS, images, or client-side JavaScript files that can be referenced by your Serverless Functions or served directly to clients.write

Deploy Twilio MCP securely

CompleteFlow adds per-user authentication, permission scoping, and audit logging to any MCP server out of the box.

Deploy on CompleteFlow