SMS, OTP and webhooks for Claude Code, Cursor and Windsurf
Plug unlimited SMS, OTP verification, and inbound webhooks into your AI coding assistant using your paired Android phone as the gateway. Same SMS8 API key, JSON-RPC tools for every flow. No Twilio, no A2P 10DLC, no per-message fees.
What your AI assistant can do
Every tool re-uses the same send pipeline as the SMS8 dashboard. Credits, retries, multi-device routing and webhook signing behave identically to a direct API call.
setup_sms8
Handshake. Validates the API key, returns devices, plan and integration context.
send_sms
Send a single SMS through a paired Android. Per-device and per-SIM routing.
send_otp
Generate and dispatch a verification code. Configurable length, expiry and attempts.
verify_otp
Constant-time compare against the latest OTP. Returns remaining attempts on mismatch.
wait_for_otp NEW
Block until an OTP-shaped SMS lands on your paired Android. Extracts the code. Closes the autonomous-agent gap.
get_messages
Fetch recent inbox or sent SMS. Filter by direction or phone.
list_devices
List paired Android devices. Pick the sender when load-balancing across SIMs.
get_balance NEW
Lightweight credit check. Returns remaining SMS, days until renewal, one-line human summary.
create_webhook
Register a callback URL for inbound SMS. HTTPS only, SSRF-protected, HMAC-signed.
Read the docs
Full API + OTP reference with curl examples, rate limits, and security model.
Three install paths, pick one
SMS8 ships as a hosted HTTP MCP server, a Claude Code plugin with a built-in Skill, and an npx launcher for stdio clients.
- Hosted HTTP works in Claude Code, Cursor and Windsurf with a Bearer token
- Claude plugin via
/plugin marketplace add 1fancy/sms8-sms-gateway - npx launches the stdio bridge:
npx -y sms8-mcp
{
"mcpServers": {
"sms8": {
"url": "https://mcp.sms8.io",
"transport": "http",
"headers": {
"Authorization":
"Bearer YOUR_SMS8_API_KEY"
}
}
}
}
Install via npm
Nine npm packages cover every flow: AI agent through MCP, terminal scripts, OTP flows, React hooks + Capacitor and Cordova plugins for Ionic mobile apps + components. One API key, one paired Android phone.
MCP launcher for Claude Code, Cursor, Windsurf, OpenCode. Paste into your MCP config and your AI assistant gets 9 SMS tools.
$ npx -y sms8-mcp
Terminal CLI. Send SMS, send / verify / wait for OTPs, read inbox, list devices. Perfect for scripts, cron, CI.
$ npx sms8-cli send +14155550100 "Hi"
React useSms8Otp() hook + ready-to-use <OtpInput /> with separators, RTL, mask, render props.
$ npm i react-sms-otp
Same React code as react-sms-otp, SEO-targeted for "sms otp verify" + "otp input" searches.
$ npm i sms-otp-verify
Capacitor plugin for Ionic apps: native iOS Swift + Android Kotlin bridges with web fallback.
$ npm i capacitor-sms-otp-send-verify
Cordova plugin for Ionic apps: native iOS Swift + Android Kotlin send/verify OTP bridges.
$ cordova plugin add cordova-plugin-sms-otp-send
OTP-focused brand of the CLI. Send and verify SMS OTP codes through your own phone — no Twilio, no per-OTP fees.
$ npx sms-otp-using-myphone send +1234
Phone-as-gateway brand of the CLI. Same backend, search-optimised for teams looking for a phone SMS gateway.
$ npx phone-sms-gateway send +1234 "Hi"
Android-first brand of the CLI. Same code, search-optimised for developers searching for “send SMS from Android”.
$ npx send-sms-from-android send +1234 "Hi"
Or browse the source on GitHub ↗
Use cases you can paste right now
Phone verification
"Wire phone-number verification into this app using the sms8 MCP. Use send_otp on /signup, verify_otp on /verify-phone, render the remaining attempts on error."
Order notifications
"When an order ships, send the customer an SMS with their tracking link using the sms8 MCP."
Two-way support inbox
"Register a webhook with the sms8 MCP at https://app.com/sms-in. Scaffold the handler that verifies HMAC and routes inbound SMS to the support queue."
Passwordless login
"Replace the magic-link email login with SMS OTPs using the sms8 MCP. 6-digit code, 5-minute expiry."
Appointment reminders
"Read tomorrow's appointments from the DB and send a reminder SMS 24h before each one. Use send_sms."
2FA for admin
"Add SMS 2FA to /admin login via the sms8 MCP. Lock the account after 5 failed verify_otp attempts."
SMS8 MCP vs Twilio vs MessageBird
| Capability | SMS8 MCP | Twilio | MessageBird |
|---|---|---|---|
| Built-in MCP server | Yes | No | No |
| Per-message fee | None | $0.0079+ | $0.05+ |
| A2P 10DLC required | No | Yes | Yes |
| Phone number provisioning | Not needed | $1+ / mo | $2+ / mo |
| Setup time | 60 seconds | Days to weeks | Days |
| OTP verification | Built-in, free | Extra service | Extra service |
| Open-source MCP code | MIT | No | No |
Security defaults, not foot-guns
Hard per-phone cap
5 OTPs per number per 24h. Not user-configurable.
Race-proof rate limits
Cooldown and cap checks wrapped in DB transactions with row locks.
POST-only OTP endpoints
GET returns 405. Cookies ignored.
API key redaction
setup_sms8 returns only the last 4 chars of your key.
SSRF-guarded webhooks
Blocks loopback, RFC1918, CGNAT, link-local and IPv4-mapped IPv6.
HMAC-signed deliveries
Inbound SMS and delivery events signed with HMAC-SHA256.
Frequently asked questions
What is the SMS8 MCP server?
A Model Context Protocol server at mcp.sms8.io so AI coding tools (Claude Code, Cursor, Windsurf, Codex, Devin) can send SMS, issue one-time passwords and configure webhooks. SMS routes through a paired Android phone via the SMS8 SMS gateway.
Do I need A2P 10DLC?
No. SMS8 uses your own Android phone and SIM card as the gateway. No A2P 10DLC registration, no per-message carrier fees, no phone-number provisioning.
How do I add SMS to a Claude Code project?
Add the MCP server to ~/.config/claude/mcp-servers.json with the HTTP transport pointing at https://mcp.sms8.io and your SMS8 API key as a Bearer token. Or run /plugin marketplace add 1fancy/sms8-sms-gateway then /plugin install sms8-sms-gateway.
Does this work with Cursor and Windsurf?
Yes. Both support HTTP MCP servers. Add https://mcp.sms8.io with your SMS8 API key as a Bearer header to ~/.cursor/mcp.json or ~/.codeium/windsurf/mcp_config.json.
Is this a Twilio alternative?
Yes. SMS8 uses your own Android phone with your existing SIM. No per-message fees, no A2P 10DLC, no phone number to provision. Flat pricing from $29/month with unlimited SMS.
Is the source code public?
Yes, MIT-licensed at github.com/1fancy/sms8-sms-gateway.