MCP for messaging: how AI agents can send SMS and WhatsApp safely

An MCP server for messaging exposes a messaging API as tools that an AI agent can discover and call through the Model Context Protocol, so an assistant can send an SMS or a WhatsApp message on request. BroadNet runs one at https://mcp.broadnet.me/mcp, using the Streamable HTTP transport and a Bearer token, over the same API that serves WhatsApp, SMS, RCS, Telegram, Push, Email, Messenger and Instagram. This guide explains how it works and, more importantly, how to stop an agent from messaging the wrong people.

Key takeaways

• MCP is an open protocol, built on JSON-RPC 2.0, that lets AI applications discover and call external tools. A messaging MCP server turns send, template and report endpoints into tools.
• Remote servers use the Streamable HTTP transport: one HTTPS endpoint, every client message an HTTP POST. Local servers usually use stdio.
• The BroadNet MCP server is at https://mcp.broadnet.me/mcp and refuses any request without an Authorization: Bearer header.
• A token is a send credential. The agent acts with its permissions, exactly as your own code would.
• The MCP specification says there SHOULD always be a human in the loop who can deny tool calls, and that servers MUST rate-limit tool invocations. Build consent, quiet hours, caps and approvals around every send tool.

What is the Model Context Protocol?

The MCP specification describes MCP as "an open protocol that enables seamless integration between LLM applications and external data sources and tools". It uses JSON-RPC 2.0 messages between three roles: hosts (the AI application), clients (connectors inside the host) and servers (services that provide tools, resources and prompts). As of 26 September 2026, the latest revision of the specification is dated 2026-07-28.

Tools are the part that matters for messaging. A client lists them with tools/list, the model chooses one, and the client invokes it with tools/call. The specification calls tools "model-controlled": the model decides when to use them. That is exactly why a send tool needs guardrails the model cannot talk its way around.

How does an MCP server for SMS and WhatsApp work?

The request path has five hops. The design point is that the MCP server adds no new sending power; it exposes the API you already have, under the same token and the same controls.

1. 1A user asks the AI host, for example: "send the delivery update to this customer on WhatsApp".
2. 2The model picks a tool from the list the MCP client retrieved, such as a WhatsApp send tool, and fills in its arguments.
3. 3The MCP client sends a tools/call request as an HTTP POST to https://mcp.broadnet.me/mcp with the Bearer token.
4. 4The BroadNet MCP server validates the token and calls the corresponding BroadNet API endpoint.
5. 5The API routes the message to WhatsApp or to the mobile network and returns a result, which travels back to the model as the tool result.

In the product team's demo recording, the client lists 380 BroadNet tools, among them send_message, post_sms_send, post_whatsapp_message_send, get_whatsapp_template_list, post_whatsapp_template_send, post_rcs_message_send and get_report_delivery. The exact list depends on the server version and your account; see the MCP server documentation.

Streamable HTTP or stdio: which transport?

The specification defines two standard transports. Which one you use depends on where the server runs, and it decides how you authenticate.

For HTTP servers, the 2025-06-18 revision of the specification also requires servers to validate the Origin header and recommends that they authenticate every connection. The latest revision (2026-07-28) makes each request self-contained, carrying the protocol version and client capabilities in its own metadata; earlier revisions opened a session with an initialize handshake, and clients detect which revision a server speaks and fall back.

How do you connect an AI agent to BroadNet's MCP server?

1. 1Get a token from your BroadNet account. In the BroadAdmin portal, Integrations, then MCP Integration, issues a temporary key; a permanent key comes from your account admin or master account.
2. 2Add the server to your MCP client. Most clients take a JSON configuration like the one below. Field names vary slightly between clients, so check your client's documentation.
3. 3Keep the token out of files you commit. Use your client's environment-variable support, as the configuration below does.
4. 4Open the tool list and switch off every tool the agent does not need.
5. 5Test with one message to a number you own before you let the agent near customer data.

1{
2  "mcpServers": {
3    "broadnet": {
4      "type": "http",
5      "url": "https://mcp.broadnet.me/mcp",
6      "headers": {
7        "Authorization": "Bearer ${BROADNET_TOKEN}"
8      }
9    }
10  }
11}

To test the connection without a client, send the initialize request yourself:

1curl -X POST https://mcp.broadnet.me/mcp \
2  -H "Authorization: Bearer $BROADNET_TOKEN" \
3  -H "Content-Type: application/json" \
4  -H "Accept: application/json, text/event-stream" \
5  -d '{"jsonrpc":"2.0","id":1,"method":"initialize",
6       "params":{"protocolVersion":"2025-06-18","capabilities":{},
7                 "clientInfo":{"name":"curl","version":"1.0"}}}'

Without the header, the server refuses the call at the protocol level. This is its actual reply to an unauthenticated initialize request, checked on 26 September 2026:

1event: message
2data: {"jsonrpc":"2.0","id":1,"error":{"code":-32001,
3  "message":"Authorization bearer token is required. Connect with an
4  'Authorization: Bearer <BroadNet token>' header."}}

Is it safe to give an AI agent a messaging API key?

Only with limits around it. The token is a send credential: anyone, or any agent, holding it can send messages from your account, and every send costs money and reaches a real person. Agents also act on natural-language instructions, and some of that text comes from outside: an inbound customer message or a web page can contain instructions the model may try to follow. The MCP specification is direct about this. It says hosts must obtain explicit user consent before invoking any tool, that there SHOULD always be a human in the loop with the ability to deny tool invocations, and that clients must treat tool annotations as untrusted unless they come from a trusted server.

Which guardrails stop an agent from spamming customers?

Put the controls where the model cannot bypass them: in the client configuration, in your own middleware, or in the account settings, not in the prompt.

The BroadNet API has no idempotency header, so a retry after a timeout can send twice. The safe pattern is to store the message ID the API returns and check delivery status before resending; our idempotency and retries guides show how.

Which messaging actions should need human approval?

MCP or a plain REST API: which should an agent use?

Both reach the same platform. The difference is who decides which call to make.

A sensible split: use MCP where a person is steering the agent and a confirmation prompt is acceptable, and use the REST API, with the quickstart and the curl generator, for flows that must run the same way every time. Our API reference documents the endpoints behind the MCP tools.

Frequently asked questions

What is an MCP server for messaging?

A server that exposes a messaging API, such as send SMS, send WhatsApp message or get delivery report, as tools an AI agent can discover and call through the Model Context Protocol.

What is the BroadNet MCP server URL?

https://mcp.broadnet.me/mcp. It uses the MCP Streamable HTTP transport and requires an Authorization: Bearer header with your BroadNet token on every request.

Which AI clients can connect to it?

Any MCP client that can connect to a remote server over Streamable HTTP and send a custom Authorization header. The BroadNet demo recording uses Cursor.

Can the agent send real messages?

Yes. The tools act with your token's permissions, exactly as your own API calls would. Treat every send as real: enable only the tools the agent needs and require confirmation before sends.

How does Bearer authentication work with MCP?

For HTTP transports the client sends Authorization: Bearer followed by the token on every request, even within the same session, and never in the URL query string. BroadNet's server rejects requests without it.

What is the difference between stdio and Streamable HTTP?

stdio runs the server as a local subprocess and exchanges newline-delimited JSON-RPC over standard input and output. Streamable HTTP runs the server as a web service where every client message is an HTTP POST to one endpoint.

How do I stop an AI agent from spamming customers?

Enforce consent checks, quiet hours and send caps outside the model, enable only the tools you need, require human approval for marketing and multi-recipient sends, and log every tool call.

Should I use MCP or the REST API?

Use MCP when a person steers an agent in natural language. Use the REST API or the TypeScript SDK for fixed production flows such as OTP and alerts, where your code, not a model, decides what to send.

Sources

• Model Context Protocol, Specification overview (revision 2026-07-28), accessed 26 September 2026.
• Model Context Protocol, Transports (2025-06-18) and Transports (2026-07-28), accessed 26 September 2026.
• Model Context Protocol, Authorization (2025-06-18), accessed 26 September 2026.
• Model Context Protocol, Tools (2026-07-28), accessed 26 September 2026.
• BroadNet, MCP server documentation, and a live probe of https://mcp.broadnet.me/mcp on 26 September 2026.

Related reading: AI agents in customer messaging and choosing an enterprise agentic AI platform.