Key Takeaways
- Streamable HTTP for MCP SMS widens the network surface: TLS, auth binding, session lifetime, and least-privilege tools matter more than stdio on a laptop.
- HMAC protects gateway webhooks; MCP HTTP needs its own auth — Bearer/env keys never in URLs.
- Streaming events must not leak OTP digits or full SMS bodies into agent UIs.
- OEM + plan caps still gate send tools behind the transport.
- Developer Center owns live REST fields; no first-party MCP HTTP product.
- BYO Android and operator credit. We meter devices and volume (Free 300 lifetime; paid from $19/mo).
Summary
Security for streamable HTTP MCP used with an Android SMS gateway is transport binding: who can open the stream, which tools are exposed, and what events may contain. Concepts: streamable HTTP concepts. Spec: modelcontextprotocol.io. REST: Developer Center.
Streaming makes failures feel live. It also makes over-sharing feel live. Redact first; stream second.
Transport is not trust
MCP over streamable HTTP does not replace gateway Bearer keys or Android pairing. It is another hop that must authenticate clients, terminate TLS correctly, and expire sessions. No first-party hosted MCP HTTP product from us — your adapter still calls REST. How the gateway works.
Context
Teams expose MCP HTTP on a LAN “temporarily” and leave send_sms enabled. Treat remote MCP like an admin API: network allowlists, short-lived credentials, and separate staging keys. Laptop stdio remains the safer default for demos.
Harden streamable HTTP
- TLS everywhere; no cleartext MCP on production paths.
- Bind auth to the session; rotate credentials on staff change.
- Expose read tools before write tools; keep bulk off remote MCP.
- Strip SMS bodies and OTP digits from streamed tool results and logs.
- Idle timeout + max session duration; disconnect does not orphan retries.
Surface table
| Surface | Control | Failure if skipped |
|---|---|---|
| MCP HTTP listener | Auth + network allowlist | Internet-facing send tools |
| Gateway REST | Env Bearer, least privilege | Key theft from process/config |
| Webhooks | HMAC on raw body | Forged events trigger SMS |
| Stream events | Redaction filters | OTP digits in agent UIs |
Streams still spend airtime
Each accepted send meters devices/volume and spends operator credit. OEM ceilings and plan pauses still apply — streaming does not create unmetered SMS. Pricing.
Operations
Monitor concurrent MCP sessions and tool-call rates. Canary on staff numbers after any transport change. Setup.
HMAC and least privilege
Gateway inbound webhooks stay on HMAC verification regardless of MCP transport. Webhooks. Do not reuse the webhook secret as the MCP HTTP credential.
Decision guide
Prefer stdio MCP for local agent work. Use streamable HTTP only when you can own auth, TLS, and redaction — see MCP auth and API keys (security).
Checklist
- TLS + authenticated sessions; no keys in URLs.
- Write tools gated; bodies redacted in streams.
- Separate webhook HMAC from MCP auth.
- OEM + plan caps enforced in adapter.
- No first-party streamable HTTP product claim; no exploit PoCs.
Next steps
Tenant isolation: multi-tenant MCP SMS considerations (security).
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- Security and Trust CenterCompliance and posture
- Android SMS gateway product guideDefinition, product, and how to buy
