mcp-server (smallest-inc/mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 48 out of 100, grade D. It declares 84 tools. No publisher has claimed this listing.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
smallest-inc
Source: Glama · also listed on github_repo_search
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
add_agent_tooladd_audience_membersAdd members (contacts) to an existing audience. Each member must include the phone number column defined when the audience was created (use get_audience to check). Max 10,000 members per request. Duplicate phone numbers are skipped.
get_dashboardGet the full analytics dashboard in a single call — includes summary KPIs, call volume timeseries, call outcomes, pickup rates by number, hourly performance, and duration stats.
get_call_volumeGet call volume over time as a daily timeseries. Shows how many calls were made each day in the date range.
get_call_outcomesGet call outcome distribution over time — daily breakdown of completed, failed, and no-answer calls, plus totals.
get_agent_performanceCompare agent performance — shows each agent's total calls, average duration, completion rate, and cost. Use to find top and bottom performers.
get_hourly_performanceGet performance metrics by hour of day (0-23). Shows call count, average duration, and cost per hour. Useful for identifying peak hours.
get_pickup_ratesGet pickup rate by phone number — shows total calls, answered calls, and pickup rate for each outbound number. Useful for optimizing caller IDs.
get_phone_number_trendsGet per-phone-number daily trends — calls, pickup rate, and average duration per day for each number.
get_weekly_trendsGet weekly aggregated metrics — calls, average duration, and cost per week. Good for spotting week-over-week trends.
get_duration_statsGet call duration statistics — average, median, min, max, and p95 duration. Shows how long calls typically last.
get_attempt_cohortsGet attempt cohort analysis — shows volume and success rate by attempt number (1st attempt, 2nd attempt, etc.). Useful for optimizing retry strategies.
get_call_counts_by_dayGet call count per day as a simple histogram. Shows { day, count } pairs.
get_credit_usageGet daily credit/cost usage over time — shows credits consumed each day and total for the period. Useful for billing and budget tracking.
get_concurrencyGet concurrent call counts for a specific date — minute-by-minute concurrency data plus per-agent max concurrency. Shows how many calls were running simultaneously.
get_call_start_distributionGet call start distribution by hour for a specific date — shows how many calls started in each hour (0-23). Useful for scheduling and capacity planning.
get_daily_summaryGet summary statistics for a specific date — total calls, completed, failed, no-answer, in-progress, in-queue, average duration, and total cost.
chat_with_agentconfigure_call_actionsEnable/disable the agent's end_call action and set/remove a transfer_call number. These are AGENT-LEVEL settings (the console's Tools tab) that apply to the whole agent — for multi-agent (Playbooks) agents the runtime injects them into every playbook, never gated behind auth. Changes land on the bra…
create_agentCreate a new AI agent in your organization. By default the agent is a single_prompt agent with gpt-4.1 model and daniel voice (waves_lightning_v3_1); set workflow_type to multi_agents for a Playbooks agent (an intent router + specialist SOP playbooks — add them via add_playbooks after creation). The…
create_branchCreate a new branch to work on a set of changes in isolation, without touching the live agent. The branch starts from a source branch's head (the live branch by default). Edit its draft with the usual tools (pass the new branch_id), publish_draft to commit, then make_branch_live to serve it.
create_campaignCreate a new outbound calling campaign. Requires an agent and an audience (contact list). The campaign is created in draft status unless a scheduled time is provided, in which case it will be scheduled. Use start_campaign to begin dialing.
debug_callGet detailed info about a single call — use this to check call status, debug failures, or get transcripts. Returns call status, failure reasons, errors, transcript, post-call analytics, latency metrics, cost breakdown, variables, voice/model config at time of call, and full event timeline. Works for…
delete_agentArchive (soft-delete) an agent by its ID. Archived agents are inactive. Cannot archive agents with active campaigns. Unarchiving is not supported — to restore an agent, use app.smallest.ai.
delete_audience_membersRemove specific members from an audience by their member IDs. Use get_audience_members or search_audience_members to find member IDs. If all members are removed, the audience itself may be deleted.
delete_audienceDelete an audience by ID. Cannot delete an audience that is linked to a campaign — remove or delete the campaign first.
delete_branchDelete (archive) a branch, along with its revisions and open draft. The default branch cannot be deleted, and the live branch cannot be deleted — make another branch live first. Use list_branches to find branch IDs.
delete_campaignDelete a campaign. This permanently removes the campaign and its execution data.
diffCompare two agent configs and show what changed, section by section (field paths with old/new values). Each side is a reference: a revision_id (from list_revisions) or "<branch_id>:draft" for a branch's open draft (branch_id from list_branches). E.g. diff a branch's draft against the live head to pr…
duplicate_agentDuplicate an existing agent, creating a new agent with the same configuration. The new agent is created in the target organization (defaults to your own org). Useful for creating variants of an agent for testing or A/B comparisons.
export_campaign_logsExport call logs for a campaign. Returns detailed call data grouped by audience member, including call status, duration, recording URL, transcript, cost, retry attempts, and post-call analytics.
get_agent_promptRead the current system prompt / instructions for an agent. Returns the prompt text and any configured tools.
get_agentGet full details for a single agent by ID, including voice config, model, prompt, language, call behavior settings, and workflow type.
get_agentsList AI agents in your organization. Returns agent configuration including voice, LLM model, language settings, and call statistics. Supports pagination, filtering, and sorting.
get_audience_membersList members (contacts) in an audience with pagination. Each member has a data object containing their phone number and any other fields from the original CSV upload.
get_audienceGet details for a specific audience by ID, including name, description, and phone number column name.
get_audiencesList all audiences in your organization. Shows audience name, member count, linked campaigns, and the phone number column name. Audiences are contact lists used by campaigns for outbound calling.
get_auto_reloadGet the current auto-reload configuration for your organization. Auto-reload automatically adds credits when your balance drops below a threshold.
get_billing_alertsGet the current billing alert configuration for your organization. Billing alerts notify you when credit usage reaches specified thresholds.
get_branch_draftGet a branch's pending (unpublished) draft — its latest draft revision and edit history (which sections changed per edit). Each branch has at most one open draft. Use list_branches to see which branches have one (hasOpenDraft).
list_callsSearch and list calls across your organization. Use this to browse calls with filters (by status, type, date range, agent, phone number, campaign). Returns a summary list with metadata, duration, cost, and disconnection reasons. For detailed info about a specific call (status, transcript, errors, de…
get_campaignGet detailed information about a specific campaign, including status, execution progress, events timeline, and metrics (participants, contacts called, contacts connected).
get_campaignsList outbound calling campaigns for your organization. Shows campaign status, progress, agent used, audience, retry config, and execution details.
get_credit_balanceGet the current credit balance for your organization, including plan information and enterprise status.
get_credit_ledgerGet the credit transaction history (ledger) for your organization. Shows purchases, usage deductions, bonuses, admin adjustments, coupon credits, and more. Supports filtering by date range, transaction type, and scope.
get_featuresGet the effective features for your organization — the actual feature access, limits, and credit rates after applying your plan and any custom overrides. Shows what your org can use and at what cost per unit.
get_invoicesList all invoices for your organization from Stripe. Shows invoice details including amounts, status, and dates.
get_payment_methodsList all payment methods (cards) configured for your organization. Shows card brand, last 4 digits, expiry, and which is the default.
get_phone_numbersList phone numbers acquired by your organization. Shows product ID (needed for make_call's from_product_id), number, country, provider, and which agent it's assigned to.
get_plansList available plans and optionally get the features included in a specific plan. Use this to understand plan pricing, included features, and credit rates.
get_revisionGet a single committed revision — its metadata and fully resolved config. Use list_revisions to find revision IDs.
get_usage_breakdownGet a breakdown of credit usage by feature and product scope for your organization. Shows how credits are being consumed across different services (voice AI, voice models, platform).
get_usage_statsGet call usage statistics for your organization — total calls, pickup rate, duration, costs, and unique users reached. Each metric includes current period, previous period, and percent change. Useful for understanding usage patterns and costs.
get_voicesList available voices for agents. Returns voice IDs, names, gender, language, and supported models. Use the voiceId with update_agent's synthesizer.voiceConfig to change an agent's voice. A voice whose supportedModels include 'lightning-v3.1-pro' is a Lightning V3.1 Pro voice (use it with the waves_…
invite_memberlist_branchesList the agent's branches. The live (serving) branch is marked with isLive; hasOpenDraft flags a branch that has unpublished draft changes waiting for publish_draft. Use this to find a branch_id (for make_branch_live) or to see where edits are in progress before publishing or discarding.
list_revisionsList the committed revisions on a specific branch, newest first. Revisions are branch-scoped — this returns one branch's history, not a global list. Shows revision number, label, who published it, and its security-check status. Use get_revision for a single revision's config.
make_branch_liveMake a branch's head revision the live (serving) configuration for the agent. Under the branch model only a branch head can serve — so this switches which branch the agent runs. Use list_branches to find branch IDs. The head must have passed its security check (otherwise this is rejected).
make_callInitiate an outbound phone call using a specific agent. The agent will call the provided phone number and follow its configured prompt. Only telephony outbound calls are supported — for webcall or chat, use app.smallest.ai.
pause_campaignPause a running campaign. Active calls in progress will complete, but no new calls will be initiated. Use start_campaign to resume.
get_playbooksRead a multi_agents agent's Playbooks config: the intent router (fallback + mid-call rerouting), shared auth tools, and the SOP list (id, intent, auth level, tool count). Pass playbook_id for one playbook's full detail (prompt, tools, intent description). Reads the branch's open draft when it has on…
add_playbooksAdd one or more playbooks (SOPs) to a multi_agents agent. Each playbook = an intent (name + description the classifier routes on) + a specialist prompt + optional scoped tools and an auth level. Edits land on the branch's draft — use publish_draft to go live. The first enabled playbook becomes the r…
update_playbookEdit one playbook (SOP) on a multi_agents agent: change its prompt, intent, auth level, tools, or archive/restore it (enabled=false/true — playbooks are archived, never deleted, so call history stays resolvable). Edits land on a draft (auto-created when draft_id omitted); publish_draft to go live. T…
configure_playbooksConfigure the section-level Playbooks settings of a multi_agents agent: the intent router (fallback playbook, mid-call rerouting), the conversation guide (persona/tone/global rules injected into EVERY playbook — define them once here, not per-SOP), and the shared identity tools that satisfy weak/str…
publish_draftredeem_couponRedeem a coupon code to add credits to your organization's balance. Use validate_coupon first to check the code before redeeming.
remove_agent_toolrename_branchRename a branch. The default branch cannot be renamed, and 'main' is reserved. Use list_branches to find branch IDs.
search_audience_membersSearch for members in an audience. Supports general search across all fields, or field-specific search (e.g. by phone number or name). Returns up to 10 results.
start_campaignStart a campaign to begin dialing contacts. Works on campaigns in draft or paused status. For paused campaigns, this resumes from where it left off. The campaign enters processing state and begins making calls asynchronously.
test_agentStart a test call against a branch — its committed head by default, its open draft (include_draft: true) to try unpublished changes, or a specific revision_id. Modes: webcall (default) or chat return LiveKit connection details; telephony places a real call to to_phone (required, E.164).
text_to_speechtranscribe_audioupdate_agentUpdate an agent — name, prompt/instructions, first message, voice, model, language, variables, the pre-call API, and other settings. Only provided fields are updated. Config changes are saved to the branch's draft (publish_draft to make them live, or test first with test_agent using include_draft); …
update_billing_alertsConfigure billing alert settings. Set up to 3 credit usage thresholds that trigger email notifications. Alerts can be sent to additional email addresses beyond the account owner.
validate_couponCheck if a coupon code is valid and see how many credits it would give. Does not redeem the coupon — use redeem_coupon to actually apply it.
create_webhookget_webhooksList the organization's webhooks, or fetch a single one by ID. Each webhook includes its subscriptions — the agents and event types (pre-conversation, post-conversation, analytics-completed) it's attached to.
update_webhookdelete_webhookDelete a webhook and all of its agent/event subscriptions. This detaches it from every agent it was attached to.
get_webhook_eventsList recent delivery events (attempts, payloads, and outcomes) for a webhook. Use this to verify that call-start/call-end/analytics events are firing and reaching your endpoint.
attach_agent_webhookget_agent_webhooksList an agent's current webhook subscriptions — which webhook it's attached to and for which events (pre-conversation, post-conversation, analytics-completed).
detach_agent_webhooksRemove ALL of an agent's webhook subscriptions. The agent will stop receiving call-start/call-end/analytics deliveries until re-attached with attach_agent_webhook. This does not delete the webhook endpoint itself.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
ws: Memory exhaustion DoS from tiny fragments and data chunks
ws: Uninitialized memory disclosure
ATOMS_API_KEYYour Smallest AI API keyATOMS_API_URLTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
84/84 tools missing one or more hints — add_agent_tool (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); add_audience_members (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_dashboard (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +81 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Secrets stay with their owner
3 secrets sent to a request target we could not resolve (ATOMS_API_KEY → dynamic, ATOMS_API_KEY → dynamic) — often a configured endpoint, not necessarily third-party
Audit where credentials are sent. A NOTION_TOKEN should only reach api.notion.com — never a third-party host.
Production dependencies are patched
0 critical, 4 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Domain consistency
npm scope @developer-smallestai doesn't match GitHub owner smallest-inc
Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/smallest-inc/mcp-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check