Loading…
AI phone secretary for placing calls, reading transcripts, and managing agents and stats.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 27 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The KaiCalls MCP server exposes 51 tools, focused primarily on communication capabilities. Its published description reads: "AI phone secretary for placing calls, reading transcripts, and managing agents and stats". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates KaiCalls F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Hidden instructions in a tool description" and "Hidden instructions in a tool description". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check KaiCalls's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add KaiCalls to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://www.kaicalls.com/api/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Initiate a real outbound phone call via a KaiCalls AI agent. Pass an idempotency_key to make the request safely retryable: a replay with the same key returns the original call instead of dialing again
Check the status of a call by its ID
List recent calls for the authenticated business
Get the transcript and summary of a completed call
Get the real call recording URL for a call so reviewers can listen to the voice/audio instead of relying only on the transcript.
List the KaiCalls agents on the authenticated account. Use this before setting anything up, to see whether this business already has a secretary answering its calls.
Read back what a business already has: profile details, how many agents are configured, and recent call volume. Start here when someone wants a business number that answers missed calls, so nothing is
Audit the business-level operational setup required before changing a live account: staff alert recipients, SMS/email alert flags, escalation rules, textable send-link entries, and assigned agent voic
Configure business-owned staff alert recipients and post-call escalation rules. Use this for emergency/urgent texts, callback alerts, billing/provider follow-up alerts, and ensuring alerts go only to
Create or repair the business_links entries used by the send_link/send_sms tools. Use this when callers need booking, directions, cancellation, sister-location, or service-specific links texted withou
Safely add or replace a named operational rules section inside an agent inbound prompt, then route the prompt patch through the governed agent.patch broker. Use this for cross-business handoffs, callb
List leads for the authenticated business, with optional status/source/agent filters. Includes the latest AI lead score when available.
Get full details for a single lead by ID, including the latest AI lead score and explanation.
List recent voicemails for the authenticated business, including transcripts and recording URLs.
List recent SMS messages for the authenticated business. Filter by conversation or direction (inbound/outbound).
List outbound call campaigns for the authenticated business.
Create an outbound call campaign (cadence + lead batch) and optionally launch it immediately. Launching queues calls for the orchestrator; existing TCPA/consent gating still applies at dial time. Requ
List the cadence/campaign workflow templates KaiCalls can run (standard, aggressive, nurture, custom), including each template's retry interval, defaults (call windows, days, attempts), and a ready-to
Get a dashboard summary (lead counts by status, conversion rate, call volume and duration, top agents, and business outcomes by type) over a recent time window.
Create a new lead or update existing leads for the authenticated business, routed through the governed leads API (business access-checked, usage-logged, and audited). To create one, pass `lead` with a
Send an outbound text message from one of your agents' phone lines to a recipient, routed through the governed messaging API. Compliance gates (opt-out / Do-Not-Call / quiet-hours), rate limits, and m
Edit an agent's live runtime configuration — greeting/first message, inbound or SMS prompt, voice, language model, max call duration, and call-transfer settings — routed through the governed update br
Ask the KaiCalls on-behalf update broker to perform a scoped, governed mutation. Supported intents: phone.emergency_address.set, transcripts.sink.configure, agent.patch, numbers.purchase, agent.config
List recent API usage events (endpoint, method, status code, cost) for the caller's account. Mirrors GET /api/v1/usage.
Get per-business minutes-used and subscription status across every business the caller can access. Mirrors GET /api/v1/balance.
List phone numbers owned by the accessible business(es), with capability and compliance flags. Use this to confirm the working number to read back once setup is finished. Mirrors GET /api/v1/numbers.
List SMS conversation threads (counterparty timeline metadata) for the authenticated business, most recent first. Mirrors GET /api/v1/sms/conversations.
Get a single SMS conversation thread by ID. Mirrors GET /api/v1/sms/conversations?id=.
List the configured outbound webhook(s) for a business, including supported event types. Mirrors GET /api/v1/webhooks.
Create or update a business outbound webhook (URL + subscribed events). Returns a webhook secret on first creation only. Mirrors POST /api/v1/webhooks.
Remove a business outbound webhook by ID. Mirrors DELETE /api/v1/webhooks.
List canned mock-conversation eval scenarios for an agent (or all accessible agents). Mirrors GET /api/v1/evals.
Run a single eval scenario (eval_id) or every scenario for an agent (agent_id) against its live Vapi assistant and grade the result. Bills Vapi compute. Mirrors POST /api/v1/evals/run.
List the curated, credential-free voice catalog (id, display name, accent, language, gender, sample URL) used to configure agent voices. Mirrors GET /api/v1/voices.
Create a new KaiCalls agent — the secretary that answers this business’s calls (Vapi assistant + KaiCalls records) — with a system prompt, greeting, voice, and model. Mirrors POST /api/v1/agents. Ever
Assign a phone number already in the KaiCalls registry pool to a business (and optionally route it directly to an agent). Does NOT purchase a new number — use search_available_numbers + buy_number for
Release a phone number from a business back to the unassigned registry pool. Mirrors DELETE /api/v1/phone-numbers.
Search the carrier for phone numbers available to purchase (real-time Twilio inventory lookup). Mirrors GET /api/v1/phone-numbers/search.
Purchase a real phone number from the carrier and register it to a business. This spends real money — the number is billed by the carrier immediately, so the purchase is APPROVAL-GATED: without human-
List agent knowledge base entries for a business. Mirrors GET /api/v1/knowledge.
Create a new agent knowledge base entry, or update one when `id` is provided. Mirrors POST /api/v1/knowledge. Creating requires title, content, and content_type.
List a business's agent product catalog. Mirrors GET /api/v1/products.
Create a new product row, or update one when `id` is provided. Mirrors POST /api/v1/products. Creating requires name and business_id. Pass `quantity` to set/update inventory.
List an agent's hashed, redacted assistant config version history (rollback lineage included). Pass `version` to fetch one version's full redacted config_snapshot instead of the list. Mirrors GET /api
List an agent's recent config-change audit trail (change_type, change_source, old/new value, timestamp) from admin_change_history — the same record the admin_get_change_history voice tool reads over t
Roll an agent's deployed voice configuration back to a prior assistant_config_versions snapshot — restoring greeting, voice, prompt, and scalar model params (never secrets/credentials) onto the live a
List a business-scoped timeline of compact call-runtime events and redacted integration-delivery attempts. Mirrors GET /api/v1/observability-events and uses bounded keyset pagination.
List per-call Vapi tool execution traces from vapi_tool_execution_logs — outcome, latency, timeout, and a redacted result preview for each routed tool call. Mirrors GET /api/v1/tool-execution-logs. An
List plan/price change history from subscription_change_history — the billing analogue of admin_change_history, written from the Stripe webhook and the right-size apply job. Mirrors GET /api/v1/subscr
List the idempotent overage-minutes ledger from billing_overage_charges (legacy per-minute-overage tiers only — 2026 plans carry no overage). GET /v1/balance/get_balance only returns an aggregate; thi
List per-period auto-right-size decisions from plan_rightsize_recommendations, including the dry_run -> notified -> (kept | applied | superseded) lifecycle. Answers "is this business about to get righ
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: update_agent_config
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
":"Full inbound system prompt that drives the agent."},"outbound_prompt":{"tyRecommendationRemove model-directed instructions from tool descriptions.
tool: create_agent
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
cords) — with a system prompt, greeting, voice, and model. Mirrors POST /api/RecommendationRemove model-directed instructions from tool descriptions.
tool: make_call
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "context"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: make_call
A tool description tries to alter the model’s use of another tool.
ead of dialing again, and the same key with different arguments is rejecteRecommendationDescriptions must describe only their own tool.
tool: get_call_recording
A tool description tries to alter the model’s use of another tool.
y on the transcript.RecommendationDescriptions must describe only their own tool.
tool: configure_staff_alerts
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
l only when the token has exactly one accessible business)"},"notificRecommendationRemove side-channel parameters; constrain tool inputs.
tool: configure_textable_links
A tool description tries to alter the model’s use of another tool.
y the send_link/send_sms tools. Use this when callers need booking, direRecommendationDescriptions must describe only their own tool.
tool: configure_agent_business_rules
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: list_workflow_templates
A tool description tries to alter the model’s use of another tool.
config shape blind. Static catalog — no per-business state.RecommendationDescriptions must describe only their own tool.
tool: upsert_lead
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
create when the API key can access multiple businesses."},"lead":{"typeRecommendationRemove side-channel parameters; constrain tool inputs.
tool: send_sms
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: update_agent_config
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: request_kaicalls_update
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
quired when the API key can access multiple businesses."},"target":{"tyRecommendationRemove side-channel parameters; constrain tool inputs.
tool: request_kaicalls_update
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: set_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
turns a webhook secret on first creation only. Mirrors POST /api/v1/weRecommendationRemove side-channel parameters; constrain tool inputs.
tool: set_webhook
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
date a business outbound webhook (URL + subscribed events). Returns a webhook secretRecommendationAnnotate destructive tools and require human approval.
tool: create_agent
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
lls agent — the secretary that answers this business’s calls (Vapi assRecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_agent
A tool description tries to alter the model’s use of another tool.
hange_history / list_config_versions. Compliance: KaiCalls automatically applies staRecommendationDescriptions must describe only their own tool.
tool: attach_number
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
l only when the token can access exactly one business)."},"phone_numbRecommendationRemove side-channel parameters; constrain tool inputs.
tool: attach_number
A tool description tries to alter the model’s use of another tool.
ew number — use search_available_numbers + buy_number for that. Mirrors POST /api/v1/phoRecommendationDescriptions must describe only their own tool.
tool: buy_number
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
l only when the token can access exactly one business)."},"phone_numbRecommendationRemove side-channel parameters; constrain tool inputs.
tool: buy_number
A tool description tries to alter the model’s use of another tool.
an agent; call attach_number afterward to route it. Mirrors POST /api/v1/phoRecommendationDescriptions must describe only their own tool.
tool: upsert_knowledge
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
create when the token can access multiple businesses."},"title":{"typRecommendationRemove side-channel parameters; constrain tool inputs.
tool: list_products
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
l only when the token can access exactly one business)."},"category":RecommendationRemove side-channel parameters; constrain tool inputs.
tool: upsert_product
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
create when the token can access multiple businesses."},"name":{"typeRecommendationRemove side-channel parameters; constrain tool inputs.
tool: list_config_versions
A tool description tries to alter the model’s use of another tool.
/api/v1/agents/versions.RecommendationDescriptions must describe only their own tool.
tool: get_change_history
A tool description tries to alter the model’s use of another tool.
e_agent_config, configure_agent_business_rules, the admin call-in secretary, or the dashboard)RecommendationDescriptions must describe only their own tool.
tool: rollback_config
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
l params (never secrets/credentials) onto the live agent. This OVERWRITRecommendationRemove side-channel parameters; constrain tool inputs.
tool: rollback_config
A tool description tries to alter the model’s use of another tool.
r a target with list_config_versions or get_change_history. Every executed rollbackRecommendationDescriptions must describe only their own tool.
tool: list_overage_charges
A tool description tries to alter the model’s use of another tool.
GET /v1/balance/get_balance only returns an aggregate; this returns the undRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: make_call
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: configure_staff_alerts
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: configure_textable_links
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: configure_agent_business_rules
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: create_campaign
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: upsert_lead
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: send_sms
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: update_agent_config
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: request_kaicalls_update
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: set_webhook
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_webhook
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: run_eval
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: create_agent
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: attach_number
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: detach_number
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: search_available_numbers
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: buy_number
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: upsert_knowledge
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: upsert_product
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: rollback_config
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.