MCP server

io.github.virtualsms-io/sms

mcp:virtualsms-io/mcp-server

Real SIM numbers for AI agents: SMS verification, rentals, proxies, cloud browser, x402 deposits.

awesome-mcp-servers Glama MCP Registry

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 26, 2026, 13:31 UTC at 4878ead

findings

high

highest severity

threat classes

files scanned

542/542

checks satisfied

package advisories

Why this verdict

mcp-server . Suspicious

suspicious: unverified finding mcp-server:.:.mcp.json:4:SUPPLY

skill skills/virtualsms-sms-verification Suspicious

suspicious: unverified finding skill:skills/virtualsms-sms-verification:skills/virtualsms-sms-verification/SKILL.md:41:SUPPLY

Security findings 2

Supply chain

highUnverifiedlow confidence

The shipped .mcp.json launches the server with unpinned `npx virtualsms-mcp` (no version), so whatever npm currently serves runs with the user's API key, whereas server.json pins 1.3.3.

.mcp.json:4

"command": "npx",

conceal:remotevector:metadata

Supply chain

mediumUnverifiedlow confidence

The setup docs tell users to run the unpinned npm package `virtualsms-mcp` via npx, so whatever version is latest at runtime executes locally; this is a documented install path for the declared service, not a concealed one.

skills/virtualsms-sms-verification/SKILL.md:41

npx virtualsms-mcp

vector:instruction

Open questions 3

What the analysis could not settle from the code alone.

The server passes SERVER_INSTRUCTIONS (defined in src/instructions.ts, not shown here) into the MCP instructions field; its content could steer the agent beyond the declared task and cannot be judged from these units.

Agent hijacking

[file request src/resources.ts] Do resource definitions or content contain directives that override agent behavior, impose secrecy, or steer beyond the declared task?

Agent hijacking

[file request src/index.ts] What is the content of SERVER_INSTRUCTIONS (and tool/prompt/resource descriptions) sent to the agent? Does it steer the agent beyond the declared SMS verification task, condition other tools, or contain hidden directives?

Tool poisoning

Coverage gaps 2

Parts of the artifact the static analysis could not fully examine.

no_tools_extracted MCP server target with no statically extractable tools/prompts/resources

package.json

request_unanswered request.2: request.0/resources-defs: resolved_clean: citation not shown or quote not in it