mcp-server (smallest-inc/mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 48 out of 100, grade D. It declares 84 tools. No publisher has claimed this listing.

D
Caution
48/100

mcp-server

Smallest Public MCP Server

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

smallest-inc

Source: Glama · also listed on github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Secret credentials may flow to a network call
6 flows detected: ATOMS_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 4 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 1 credential: ATOMS_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes84 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

add_agent_tool
add_audience_members

Add members (contacts) to an existing audience. Each member must include the phone number column defined when the audience was created (use get_audience to check). Max 10,000 members per request. Duplicate phone numbers are skipped.

get_dashboard

Get the full analytics dashboard in a single call — includes summary KPIs, call volume timeseries, call outcomes, pickup rates by number, hourly performance, and duration stats.

get_call_volume

Get call volume over time as a daily timeseries. Shows how many calls were made each day in the date range.

get_call_outcomes

Get call outcome distribution over time — daily breakdown of completed, failed, and no-answer calls, plus totals.

get_agent_performance

Compare agent performance — shows each agent's total calls, average duration, completion rate, and cost. Use to find top and bottom performers.

get_hourly_performance

Get performance metrics by hour of day (0-23). Shows call count, average duration, and cost per hour. Useful for identifying peak hours.

get_pickup_rates

Get pickup rate by phone number — shows total calls, answered calls, and pickup rate for each outbound number. Useful for optimizing caller IDs.

get_phone_number_trends

Get per-phone-number daily trends — calls, pickup rate, and average duration per day for each number.

get_weekly_trends

Get weekly aggregated metrics — calls, average duration, and cost per week. Good for spotting week-over-week trends.

get_duration_stats

Get call duration statistics — average, median, min, max, and p95 duration. Shows how long calls typically last.

get_attempt_cohorts

Get attempt cohort analysis — shows volume and success rate by attempt number (1st attempt, 2nd attempt, etc.). Useful for optimizing retry strategies.

get_call_counts_by_day

Get call count per day as a simple histogram. Shows { day, count } pairs.

get_credit_usage

Get daily credit/cost usage over time — shows credits consumed each day and total for the period. Useful for billing and budget tracking.

get_concurrency

Get concurrent call counts for a specific date — minute-by-minute concurrency data plus per-agent max concurrency. Shows how many calls were running simultaneously.

get_call_start_distribution

Get call start distribution by hour for a specific date — shows how many calls started in each hour (0-23). Useful for scheduling and capacity planning.

get_daily_summary

Get summary statistics for a specific date — total calls, completed, failed, no-answer, in-progress, in-queue, average duration, and total cost.

chat_with_agent
configure_call_actions

Enable/disable the agent's end_call action and set/remove a transfer_call number. These are AGENT-LEVEL settings (the console's Tools tab) that apply to the whole agent — for multi-agent (Playbooks) agents the runtime injects them into every playbook, never gated behind auth. Changes land on the bra

create_agent

Create a new AI agent in your organization. By default the agent is a single_prompt agent with gpt-4.1 model and daniel voice (waves_lightning_v3_1); set workflow_type to multi_agents for a Playbooks agent (an intent router + specialist SOP playbooks — add them via add_playbooks after creation). The

create_branch

Create a new branch to work on a set of changes in isolation, without touching the live agent. The branch starts from a source branch's head (the live branch by default). Edit its draft with the usual tools (pass the new branch_id), publish_draft to commit, then make_branch_live to serve it.

create_campaign

Create a new outbound calling campaign. Requires an agent and an audience (contact list). The campaign is created in draft status unless a scheduled time is provided, in which case it will be scheduled. Use start_campaign to begin dialing.

debug_call

Get detailed info about a single call — use this to check call status, debug failures, or get transcripts. Returns call status, failure reasons, errors, transcript, post-call analytics, latency metrics, cost breakdown, variables, voice/model config at time of call, and full event timeline. Works for

delete_agent

Archive (soft-delete) an agent by its ID. Archived agents are inactive. Cannot archive agents with active campaigns. Unarchiving is not supported — to restore an agent, use app.smallest.ai.

delete_audience_members

Remove specific members from an audience by their member IDs. Use get_audience_members or search_audience_members to find member IDs. If all members are removed, the audience itself may be deleted.

delete_audience

Delete an audience by ID. Cannot delete an audience that is linked to a campaign — remove or delete the campaign first.

delete_branch

Delete (archive) a branch, along with its revisions and open draft. The default branch cannot be deleted, and the live branch cannot be deleted — make another branch live first. Use list_branches to find branch IDs.

delete_campaign

Delete a campaign. This permanently removes the campaign and its execution data.

diff

Compare two agent configs and show what changed, section by section (field paths with old/new values). Each side is a reference: a revision_id (from list_revisions) or "<branch_id>:draft" for a branch's open draft (branch_id from list_branches). E.g. diff a branch's draft against the live head to pr

duplicate_agent

Duplicate an existing agent, creating a new agent with the same configuration. The new agent is created in the target organization (defaults to your own org). Useful for creating variants of an agent for testing or A/B comparisons.

export_campaign_logs

Export call logs for a campaign. Returns detailed call data grouped by audience member, including call status, duration, recording URL, transcript, cost, retry attempts, and post-call analytics.

get_agent_prompt

Read the current system prompt / instructions for an agent. Returns the prompt text and any configured tools.

get_agent

Get full details for a single agent by ID, including voice config, model, prompt, language, call behavior settings, and workflow type.

get_agents

List AI agents in your organization. Returns agent configuration including voice, LLM model, language settings, and call statistics. Supports pagination, filtering, and sorting.

get_audience_members

List members (contacts) in an audience with pagination. Each member has a data object containing their phone number and any other fields from the original CSV upload.

get_audience

Get details for a specific audience by ID, including name, description, and phone number column name.

get_audiences

List all audiences in your organization. Shows audience name, member count, linked campaigns, and the phone number column name. Audiences are contact lists used by campaigns for outbound calling.

get_auto_reload

Get the current auto-reload configuration for your organization. Auto-reload automatically adds credits when your balance drops below a threshold.

get_billing_alerts

Get the current billing alert configuration for your organization. Billing alerts notify you when credit usage reaches specified thresholds.

get_branch_draft

Get a branch's pending (unpublished) draft — its latest draft revision and edit history (which sections changed per edit). Each branch has at most one open draft. Use list_branches to see which branches have one (hasOpenDraft).

list_calls

Search and list calls across your organization. Use this to browse calls with filters (by status, type, date range, agent, phone number, campaign). Returns a summary list with metadata, duration, cost, and disconnection reasons. For detailed info about a specific call (status, transcript, errors, de

get_campaign

Get detailed information about a specific campaign, including status, execution progress, events timeline, and metrics (participants, contacts called, contacts connected).

get_campaigns

List outbound calling campaigns for your organization. Shows campaign status, progress, agent used, audience, retry config, and execution details.

get_credit_balance

Get the current credit balance for your organization, including plan information and enterprise status.

get_credit_ledger

Get the credit transaction history (ledger) for your organization. Shows purchases, usage deductions, bonuses, admin adjustments, coupon credits, and more. Supports filtering by date range, transaction type, and scope.

get_features

Get the effective features for your organization — the actual feature access, limits, and credit rates after applying your plan and any custom overrides. Shows what your org can use and at what cost per unit.

get_invoices

List all invoices for your organization from Stripe. Shows invoice details including amounts, status, and dates.

get_payment_methods

List all payment methods (cards) configured for your organization. Shows card brand, last 4 digits, expiry, and which is the default.

get_phone_numbers

List phone numbers acquired by your organization. Shows product ID (needed for make_call's from_product_id), number, country, provider, and which agent it's assigned to.

get_plans

List available plans and optionally get the features included in a specific plan. Use this to understand plan pricing, included features, and credit rates.

get_revision

Get a single committed revision — its metadata and fully resolved config. Use list_revisions to find revision IDs.

get_usage_breakdown

Get a breakdown of credit usage by feature and product scope for your organization. Shows how credits are being consumed across different services (voice AI, voice models, platform).

get_usage_stats

Get call usage statistics for your organization — total calls, pickup rate, duration, costs, and unique users reached. Each metric includes current period, previous period, and percent change. Useful for understanding usage patterns and costs.

get_voices

List available voices for agents. Returns voice IDs, names, gender, language, and supported models. Use the voiceId with update_agent's synthesizer.voiceConfig to change an agent's voice. A voice whose supportedModels include 'lightning-v3.1-pro' is a Lightning V3.1 Pro voice (use it with the waves_

invite_member
list_branches

List the agent's branches. The live (serving) branch is marked with isLive; hasOpenDraft flags a branch that has unpublished draft changes waiting for publish_draft. Use this to find a branch_id (for make_branch_live) or to see where edits are in progress before publishing or discarding.

list_revisions

List the committed revisions on a specific branch, newest first. Revisions are branch-scoped — this returns one branch's history, not a global list. Shows revision number, label, who published it, and its security-check status. Use get_revision for a single revision's config.

make_branch_live

Make a branch's head revision the live (serving) configuration for the agent. Under the branch model only a branch head can serve — so this switches which branch the agent runs. Use list_branches to find branch IDs. The head must have passed its security check (otherwise this is rejected).

make_call

Initiate an outbound phone call using a specific agent. The agent will call the provided phone number and follow its configured prompt. Only telephony outbound calls are supported — for webcall or chat, use app.smallest.ai.

pause_campaign

Pause a running campaign. Active calls in progress will complete, but no new calls will be initiated. Use start_campaign to resume.

get_playbooks

Read a multi_agents agent's Playbooks config: the intent router (fallback + mid-call rerouting), shared auth tools, and the SOP list (id, intent, auth level, tool count). Pass playbook_id for one playbook's full detail (prompt, tools, intent description). Reads the branch's open draft when it has on

add_playbooks

Add one or more playbooks (SOPs) to a multi_agents agent. Each playbook = an intent (name + description the classifier routes on) + a specialist prompt + optional scoped tools and an auth level. Edits land on the branch's draft — use publish_draft to go live. The first enabled playbook becomes the r

update_playbook

Edit one playbook (SOP) on a multi_agents agent: change its prompt, intent, auth level, tools, or archive/restore it (enabled=false/true — playbooks are archived, never deleted, so call history stays resolvable). Edits land on a draft (auto-created when draft_id omitted); publish_draft to go live. T

configure_playbooks

Configure the section-level Playbooks settings of a multi_agents agent: the intent router (fallback playbook, mid-call rerouting), the conversation guide (persona/tone/global rules injected into EVERY playbook — define them once here, not per-SOP), and the shared identity tools that satisfy weak/str

publish_draft
redeem_coupon

Redeem a coupon code to add credits to your organization's balance. Use validate_coupon first to check the code before redeeming.

remove_agent_tool
rename_branch

Rename a branch. The default branch cannot be renamed, and 'main' is reserved. Use list_branches to find branch IDs.

search_audience_members

Search for members in an audience. Supports general search across all fields, or field-specific search (e.g. by phone number or name). Returns up to 10 results.

start_campaign

Start a campaign to begin dialing contacts. Works on campaigns in draft or paused status. For paused campaigns, this resumes from where it left off. The campaign enters processing state and begins making calls asynchronously.

test_agent

Start a test call against a branch — its committed head by default, its open draft (include_draft: true) to try unpublished changes, or a specific revision_id. Modes: webcall (default) or chat return LiveKit connection details; telephony places a real call to to_phone (required, E.164).

text_to_speech
transcribe_audio
update_agent

Update an agent — name, prompt/instructions, first message, voice, model, language, variables, the pre-call API, and other settings. Only provided fields are updated. Config changes are saved to the branch's draft (publish_draft to make them live, or test first with test_agent using include_draft);

update_billing_alerts

Configure billing alert settings. Set up to 3 credit usage thresholds that trigger email notifications. Alerts can be sent to additional email addresses beyond the account owner.

validate_coupon

Check if a coupon code is valid and see how many credits it would give. Does not redeem the coupon — use redeem_coupon to actually apply it.

create_webhook
get_webhooks

List the organization's webhooks, or fetch a single one by ID. Each webhook includes its subscriptions — the agents and event types (pre-conversation, post-conversation, analytics-completed) it's attached to.

update_webhook
delete_webhook

Delete a webhook and all of its agent/event subscriptions. This detaches it from every agent it was attached to.

get_webhook_events

List recent delivery events (attempts, payloads, and outcomes) for a webhook. Use this to verify that call-start/call-end/analytics events are firing and reaching your endpoint.

attach_agent_webhook
get_agent_webhooks

List an agent's current webhook subscriptions — which webhook it's attached to and for which events (pre-conversation, post-conversation, analytics-completed).

detach_agent_webhooks

Remove ALL of an agent's webhook subscriptions. The agent will stop receiving call-start/call-end/analytics deliveries until re-attached with attach_agent_webhook. This does not delete the webhook endpoint itself.

// known CVEs in dependencies4 high2 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highws@8.18.0GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

ws: Uninitialized memory disclosure

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretATOMS_API_KEYYour Smallest AI API key
configATOMS_API_URL
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

84/84 tools missing one or more hints — add_agent_tool (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); add_audience_members (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_dashboard (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +81 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Secrets stay with their owner

3 secrets sent to a request target we could not resolve (ATOMS_API_KEY → dynamic, ATOMS_API_KEY → dynamic) — often a configured endpoint, not necessarily third-party

Audit where credentials are sent. A NOTION_TOKEN should only reach api.notion.com — never a third-party host.

Production dependencies are patched

0 critical, 4 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Domain consistency

npm scope @developer-smallestai doesn't match GitHub owner smallest-inc

Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/smallest-inc/mcp-server?variant=verified)](https://m8ven.ai/mcp/smallest-inc/mcp-server)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: cbd0666d0a92690df74c160296929742749db00f
code hash: f098e048e6c7d90f7693b3964abb0f3e6694790bb5b0d07127654ace4c2fc348
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client