MCP Server by sv-number

Findings (2)

• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a prepare script

  npm run build

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  SVN_API_BASE, SVN_LANG, SVN_POLL_SECONDS

Network activity

Tools exposed (9)

• get_balance

  Current account balance. Ordering a number needs a funded balance; there is no free tier.

• list_countries

  Every country the numbers can come from, with its id and operators. Use the id in order_number.

• list_services

  Services available in a country, best match first. Order the code of the site you are registering with: a number bought for one service does not receive another service's SMS. Search by site name or domain, both work. The codes are arbitrary, so look them up instead of guessing: uk is Airbnb, not th

• order_number

  Order a private number for one service in one country. The number is held for 20 minutes and belongs to this activation alone. Money is held now and charged when the code arrives. The service code has to be the one for the site you are registering with, otherwise its SMS goes to a different pool and

• wait_for_code

  Wait for the verification code on an ordered number. Polls on its own and returns the code itself, already parsed out of the SMS. Trigger the SMS on the target service first.

• finish_activation

  Close an activation after the code was used. Do this on every success: a forgotten activation holds money until it expires.

• cancel_activation

  Cancel an activation when no code arrived; the money returns to the balance in full. Can be called right after ordering. If the API answers that it is too early, wait a couple of minutes and repeat.

• request_another_sms

  Ask for one more code on the same number, for a password reset or a re-send. Works only after a first code has already arrived; before that the API refuses it.

• totp_code

  Compute the authenticator code for an account whose second factor was set up with a shared secret. Runs locally by RFC 6238: the secret never leaves this machine.