Back to Browse

Esimfly MCP Server

Developer ToolsModerate5.2MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

eSIMfly Business API: search eSIM plans, check usage, diagnose eSIMs, optionally order (confirmed)

About

eSIMfly Business API: search eSIM plans, check usage, diagnose eSIMs, optionally order (confirmed)

Remote endpoints: streamable-http: https://mcp.esimfly.net/mcp

Security Report

5.2
Moderate5.2Moderate Risk

The eSIMfly MCP server is well-structured with proper authentication, secure credential handling, and appropriate authorization patterns. Credentials are required and sourced only from environment variables. The two-step confirmation pattern for write operations provides good safeguards. Minor code quality issues around error handling breadth and potential improvements to input validation prevent a higher score, but the server demonstrates sound security architecture aligned with its purpose. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

7 files analyzed · 9 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

eSIMfly API access code (esf_...)Required

Environment variable: ESIMFLY_ACCESS_CODE

eSIMfly API secret key (sk_...)Required

Environment variable: ESIMFLY_SECRET_KEY

Set to true to enable ordering, top-up, cancel, suspend, SMS and webhook toolsOptional

Environment variable: ESIMFLY_MCP_ALLOW_WRITES

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

@esimfly/mcp — eSIMfly MCP server

eSimfly-Official/esimfly-mcp MCP server npm CI smithery badge M8ven Score

Give your AI assistant hands on the eSIMfly Business API. With this Model Context Protocol server, Claude, Cursor, ChatGPT and other MCP clients can search eSIM plans with your wholesale prices, check balances and usage, diagnose "no data" problems from live network data — and, if you enable it, place orders and top-ups with an explicit confirmation step.

  • Read-only by default. Nothing can spend your balance unless you opt in.
  • Two-step writes. Every write tool returns a preview (what, cost, balance) until called with confirm: true.
  • Built on the official @esimfly/sdk — signing, retries and error codes handled.
  • Ships two prompts: the complete integration guide and an eSIM diagnosis workflow.

Docs: https://docs.esimfly.net · Credentials: Business Dashboard → Settings → API Keys.

Hosted server (no install)

Prefer not to run anything locally? eSIMfly hosts this same server at https://mcp.esimfly.net/mcp. Add it as a remote MCP server in Claude.ai, ChatGPT, Claude Code (claude mcp add --transport http esimfly https://mcp.esimfly.net/mcp), Cursor or VS Code and sign in with your eSIMfly business account — OAuth 2.1, no keys to paste, write tools opt-in on the consent screen. Details: https://docs.esimfly.net/docs/mcp-server

Local install

The server runs locally over stdio; your API key never leaves your machine.

Claude Desktop

claude_desktop_config.json → mcpServers:

{
  "mcpServers": {
    "esimfly": {
      "command": "npx",
      "args": ["-y", "@esimfly/mcp"],
      "env": {
        "ESIMFLY_ACCESS_CODE": "esf_...",
        "ESIMFLY_SECRET_KEY": "sk_..."
      }
    }
  }
}

Claude Code

claude mcp add esimfly -e ESIMFLY_ACCESS_CODE=esf_... -e ESIMFLY_SECRET_KEY=sk_... -- npx -y @esimfly/mcp

Cursor / Windsurf / other MCP clients

.cursor/mcp.json (or the client's equivalent):

{
  "mcpServers": {
    "esimfly": {
      "command": "npx",
      "args": ["-y", "@esimfly/mcp"],
      "env": { "ESIMFLY_ACCESS_CODE": "esf_...", "ESIMFLY_SECRET_KEY": "sk_..." }
    }
  }
}

Docker

docker build -t esimfly-mcp .
docker run -i --rm -e ESIMFLY_ACCESS_CODE=esf_... -e ESIMFLY_SECRET_KEY=sk_... esimfly-mcp

Enable write tools

Add "ESIMFLY_MCP_ALLOW_WRITES": "true" to env. Without it the ordering, top-up, cancel, suspend, SMS and webhook tools are not even registered.

Try it

  • "Find the cheapest 5 GB plan for Turkey and tell me my margin at €9.99."
  • "Which of my eSIMs are active and below 200 MB?"
  • "ICCID 8948010010036785060 says no data — diagnose it." (uses the diagnose_esim prompt)
  • "Set up webhooks for installed / status / low-data events at https://my.app/hooks." (write tool, previews first)
  • "Build me a Node.js integration." (uses the esimfly_integration_guide prompt)

Tools

ToolWhat it doesMode
search_packagesCatalogue search by destination / type with your cost priceread
get_balanceAccount (or enterprise) balanceread
list_esimsYour eSIMs with status, data left, validityread
get_esim_usageStored usage for one eSIM (cheap)read
get_esim_live_statusLive status from the network: install state, last network, device, usageread (expensive)
get_network_eventsLast 7 days of attach / data-session events, wrong-network flagread
get_usage_reportDaily usage by country and operator (up to 90 days)read
list_orders / get_orderOrder history and one order with its eSIMread
get_topup_packagesTop-up options for one eSIMread
get_webhook_settingsWebhook URL, events, recent deliveriesread
create_orderBuy eSIMs — preview → confirm: true + idempotency keywrite
topup_esimAdd data to an eSIM — preview shows package and costwrite
cancel_esimCancel an unused eSIM and refund to balancewrite (destructive)
suspend_esim / activate_esimBlock / restore network accesswrite
send_smsText the device holding the eSIMwrite
set_webhookConfigure webhook URL and eventswrite

Prompts: esimfly_integration_guide (optional stack), diagnose_esim (iccid).

Safety model

  • Read-only unless ESIMFLY_MCP_ALLOW_WRITES=true.
  • Write tools are two-step: a call without confirm returns a preview and makes no mutable API call; create_order additionally requires the idempotency_key from its own preview, so an agent cannot place the same order twice.
  • Tool annotations mark reads as readOnlyHint and cancel/suspend as destructiveHint, so hosts that ask for user approval on risky tools do so.
  • The server never logs credentials and never writes to stdout except the MCP protocol.
  • Give the agent a dedicated API key with the smallest rate limits you are comfortable with, and rotate it from the dashboard if in doubt.

Configuration

VariableRequiredDescription
ESIMFLY_ACCESS_CODEyesAPI access code (esf_…)
ESIMFLY_SECRET_KEYyesAPI secret key (sk_…)
ESIMFLY_MCP_ALLOW_WRITESnotrue to register write tools
ESIMFLY_BASE_URLnoOverride the API base URL

Embedding

import { createEsimflyMcpServer } from '@esimfly/mcp';
const server = createEsimflyMcpServer({ config: { accessCode, secretKey }, allowWrites: false });
// connect it to any MCP transport

Releasing (maintainers)

Bump version in package.json, server.json and MCP_VERSION in src/server.ts, add a CHANGELOG entry, push, then publish a GitHub Release tagged vX.Y.Z — the workflow publishes to npm with Trusted Publishing (OIDC), and the MCP Registry entry is republished automatically afterwards (GitHub OIDC, no tokens).

Support

support@esimfly.net · https://docs.esimfly.net

Reviews

No reviews yet

Be the first to review this server!