mcp-signal
mcp-signal
一个本地模型上下文协议 (MCP) 服务器,通过
signal-export从本地加密数据库读取 Signal Desktop 历史记录,并通过signal-cli发送出站消息。
mcp-signal 专注于个人 Signal 自动化的核心工作流——列出聊天、读取消息、搜索消息、检查群组以及向直接聊天或群组发送消息。所有操作均在本地运行;使用 stdio 传输,无网络监听。
注意——混合后端。 读取/搜索功能来自本地 Signal Desktop 数据库。发送功能使用
signal-cli,该工具必须单独安装并关联到 Signal 账户。如果signal-cli不可用,读取/搜索功能仍可正常工作,但发送工具将无法使用。
功能
从 Signal Desktop 列出直接聊天和群组聊天
读取聊天中的最近消息
在单个聊天或所有聊天中搜索消息
列出带有
signal-cli群组 ID 的群组聊天,以便进行出站发送发送消息至:
通过电话号码发送给直接收件人
通过群组 ID 发送给群组
通过精确的聊天名称发送给聊天(带有歧义检查)
完全在您的机器上运行;使用 stdio 传输,无网络监听
Related MCP server: Signal MCP
设置
先决条件
Python 3.13+
带有现有本地消息数据库的 Signal Desktop
如果需要出站发送,请安装并关联
signal-cli
安装
克隆此仓库
git clone https://github.com/Sealjay/mcp-signal.git cd mcp-signal安装依赖项
uv sync安装
signal-cli(可选——仅在需要出站发送时才需要)在 macOS 上,最简单的方法是使用 Homebrew:
brew install signal-cli
配置出站发送
如果存在,服务器会自动从仓库根目录加载本地 .env.local 文件。此文件已被 gitignore 忽略,是存放机器本地配置的推荐位置。
cat > .env.local <<'EOF'
SIGNAL_ACCOUNT="+441234567890"
EOF可选环境变量:
变量 | 用途 |
| 覆盖 |
| 覆盖 Signal Desktop 数据目录 |
| 如有需要,为加密桌面数据库提供密码 |
| 如有需要,为加密桌面数据库提供原始密钥 |
在 shell 中设置的环境变量优先级高于 .env.local。
关联 signal-cli(仅限首次运行)
mcp-signal 本身不管理关联。请先关联本地 signal-cli 设备:
signal-cli link -n "signal-mcp"在 Signal 移动应用中扫描二维码(设置 → 已关联设备 → 关联新设备)。
在当前的 signal-cli 版本中,请不要向 link 命令传递 -a / --account 参数——关联新的辅助设备时不需要电话号码。
二维码被接受后,确认已关联的账户可见:
signal-cli listAccounts该账户应与 .env.local 中的 SIGNAL_ACCOUNT 值匹配。
signal-cli 将其关联账户状态存储在自己的本地数据目录下(macOS/Linux 上通常为 ~/.local/share/signal-cli/data)。该状态位于此仓库之外,且不会被 mcp-signal 提交。
验证一切连接正常:
uv run signal-mcp smokeMCP 客户端配置
所有客户端都通过 stdio 以相同方式启动服务器。在 macOS 上,您可能需要 uv 的绝对路径——请参阅下方的 macOS: uv PATH。
Claude Code
最快的方法是使用 CLI:
claude mcp add --transport stdio signal --scope user -- uv run --directory /absolute/path/to/mcp-signal signal-mcp serve或者,将其添加到项目根目录的 .mcp.json 中(或用户范围服务器的 ~/.claude.json 中):
{
"mcpServers": {
"signal": {
"type": "stdio",
"command": "uv",
"args": ["run", "--directory", "/absolute/path/to/mcp-signal", "signal-mcp", "serve"]
}
}
}如果您直接编辑该文件,请重启 Claude Code 会话以使其生效。
Claude Desktop
添加到 ~/Library/Application Support/Claude/claude_desktop_config.json(macOS):
{
"mcpServers": {
"signal": {
"command": "uv",
"args": ["run", "--directory", "/absolute/path/to/mcp-signal", "signal-mcp", "serve"]
}
}
}重启 Claude Desktop。您应该会看到 signal 列为可用的集成。
Cursor
添加到 ~/.cursor/mcp.json:
{
"mcpServers": {
"signal": {
"command": "uv",
"args": ["run", "--directory", "/absolute/path/to/mcp-signal", "signal-mcp", "serve"]
}
}
}重启 Cursor。
macOS: uv PATH
GUI 应用程序(Claude Desktop、Cursor)并不总是从您的交互式终端继承 PATH,因此 uv 可能会因 spawn uv ENOENT 而失败。通过在 command 中使用 uv 的绝对路径来修复:
Homebrew —
/opt/homebrew/bin/uv(Apple Silicon) 或/usr/local/bin/uv(Intel)手动安装 — 在终端运行
which uv以查找路径
示例:
{
"mcpServers": {
"signal": {
"command": "/opt/homebrew/bin/uv",
"args": ["run", "--directory", "/absolute/path/to/mcp-signal", "signal-mcp", "serve"]
}
}
}架构
组件 | 描述 |
MCP 服务器 | Python/FastMCP,stdio 传输 |
读取路径 |
|
发送路径 | 按需启动的 |
状态 | 无独立缓存;直接从 Signal Desktop 数据读取 |
数据流
MCP 客户端通过 stdio 启动
signal-mcp serve。读取/搜索工具针对本地 Signal Desktop 数据库调用
signal-export。群组列表和出站发送调用
signal-cli -a ACCOUNT jsonRpc。结果以结构化 JSON 形式返回。
项目结构
mcp-signal/
src/mcp_signal/
config.py
main.py
reader.py
server.py
signal_cli.py
tests/
CLAUDE.md
LICENSE
README.md
SECURITY.md工具
工具 | 用途 |
| 从 Signal Desktop 列出直接聊天和群组聊天 |
| 读取特定聊天中的消息 |
| 在单个聊天或所有聊天中搜索消息 |
| 从 |
| 向直接收件人或群组发送文本消息 |
| 显示桌面数据库 / |
隐私与安全
无云端中继。无网络监听。所有数据保留在您的机器上。
读取/搜索仅使用您的本地 Signal Desktop 数据。
发送操作需要本地配置的
signal-cli账户。.env.local旨在用于存放本地机密(如SIGNAL_ACCOUNT),且不会被提交。signal-cli关联设备状态存储在它自己的本地应用数据目录中,位于此仓库之外,且不会被提交。
请参阅 SECURITY.md 了解如何报告漏洞。
限制
提示注入风险: 与许多 MCP 服务器一样,此服务器也受到 the lethal trifecta 的影响。恶意的传入消息可能会尝试指示代理窃取其他消息。请相应地对待工具界面,并在批准出站操作前进行审查。
混合后端: 聊天记录来自 Signal Desktop,而出站发送来自
signal-cli。无附件: 仅支持发送文本。
无实时通知: 仅支持轮询/读取。
每个 MCP 实例仅支持单个账户。
群组发送需要
signal-cli: 仅靠本地数据库读取无法提供安全发送到群组所需的信息。
开发
uv sync
uv run signal-mcp smoke
uv run pytest
uv run ruff check .故障排除
找不到
signal-cli— 确认signal-cli在PATH中,或在.env.local中设置SIGNAL_CLI_PATH。在 macOS 上,brew install signal-cli是最简单的方法。读取/搜索正常但发送失败 —
signal-cli未关联或未设置SIGNAL_ACCOUNT。运行signal-cli listAccounts进行验证,然后检查.env.local。signal-cli link挂起或失败 — 在当前版本中,请勿向link传递-a/--account参数。运行signal-cli link -n "signal-mcp"并从手机扫描二维码。MCP 客户端无法启动服务器 —
args必须包含仓库的绝对路径,而不是相对路径。如果uv本身因spawn uv ENOENT而失败,请参阅 macOS:uvPATH。未返回消息 — 确认已安装 Signal Desktop 并拥有消息历史记录。读取路径直接查询本地 Signal Desktop 数据库。
贡献
欢迎通过 Pull Request 贡献代码。请:
在推送前运行
uv run ruff check .。确保
uv run pytest通过。
请参阅 CLAUDE.md 了解完整的开发工作流。
许可证
MIT 许可证 — 请参阅 LICENSE。
Available Tools
8 toolschat_activityA
List Signal chats ranked by recent activity, showing last message date, last reply date, and count of unanswered inbound messages.
Read-only with no side effects. Use this to identify chats that need a response. Use list_chats instead for a general chat directory with message previews.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of chats to return, between 1 and 200. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Explicitly declares 'Read-only with no side effects.' Since no annotations are provided, the description adequately covers behavioral transparency. However, it lacks details on sorting or time window for 'recent activity,' which would be beneficial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each serving a purpose: first conveys functionality, second declares safety, third provides usage guidance. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With one parameter and an output schema, the description covers purpose, behavior, and usage guidance comprehensively. No gaps remain for this complexity level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter (limit) with 100% schema description coverage. The tool description adds no extra meaning beyond the schema's explanation of the limit range and default. Baseline score 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool lists Signal chats ranked by recent activity with specific fields (last message date, last reply date, count of unanswered inbound messages). Differentiates from sibling list_chats by specifying its unique output.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use this tool ('identify chats that need a response') and when to use the alternative ('Use list_chats instead for a general chat directory with message previews').
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
decrypt_attachmentA
Decrypt a locally stored Signal attachment and return the path to the decrypted file.
The encrypted_path and local_key values come from attachment metadata in read_messages or search_messages results. Read-only on Signal data; writes a decrypted copy to a temporary directory. Use this after reading messages that contain attachments.
| Name | Required | Description | Default |
|---|---|---|---|
| encrypted_path | Yes | Absolute filesystem path to the encrypted attachment file, as returned in the 'encrypted_path' field of message attachment metadata. | |
| local_key | Yes | Base64-encoded 64-byte key (32-byte AES-CBC + 32-byte HMAC-SHA256), from the 'local_key' field of attachment metadata. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description bears full burden. Discloses that it is read-only on Signal data and writes a decrypted copy to a temporary directory. Adds important safety and side-effect information beyond basic decryption.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences covering purpose, parameter source, and usage context. No redundancy, well-structured, and front-loaded with the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (2 parameters, output schema exists), the description covers purpose, parameter sourcing, safety behavior, and usage timing. No obvious gaps for an agent to correctly select and invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with detailed descriptions. Description adds context on the origin and nature of the parameters (from attachment metadata, base64-encoded key structure), which aids correct invocation beyond schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb ('Decrypt'), resource ('locally stored Signal attachment'), and outcome ('return the path to the decrypted file'). Distinct from siblings which involve chat activity, status, lists, and messages.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states where the input parameters come from ('encrypted_path and local_key values come from attachment metadata in read_messages or search_messages') and advises using it after reading messages with attachments. No explicit exclusions, but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_statusA
Check whether the Signal MCP server can read local messages and send outbound messages.
Returns boolean fields: source_dir_exists, signal_cli_available, signal_account_configured, read_available, send_available. Read-only with no side effects. Call this before read or send operations to verify the server is correctly configured.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, but description states 'Read-only with no side effects' and lists return fields, fully disclosing behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose, no wasted words. Efficient and clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool is simple with no parameters. Description covers purpose, return fields, and usage context. Output schema exists for further detail, making this complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters; schema coverage 100%. Description adds value by explaining return fields, which is sufficient for a zero-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool checks server ability to read and send messages, with specific verb and resource. Distinct from sibling tools like read_messages or send_message.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly recommends calling before read or send operations, providing clear context. No need for alternatives as this is a single-purpose health check.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_chatsA
List direct and group Signal chats from the local desktop database, sorted by most recent message.
Each result includes name, phone number, message count, and a preview of the last message. Read-only with no side effects. Use this to discover exact chat names before calling read_messages or search_messages. Use list_groups instead when you need group_id values for send_message.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Case-insensitive substring to filter by chat name or phone number. Empty string returns all chats. | |
| limit | No | Maximum number of chats to return, between 1 and 200. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Declares read-only with no side effects, and mentions data source and sorting. Without annotations, this provides sufficient behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three efficient sentences: purpose, output details, and usage guidelines. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 2 simple parameters with full schema, no annotations, and an output schema present, the description fully covers what the agent needs: purpose, output format, and when to use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with detailed parameter descriptions. The description adds no extra meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it lists direct and group Signal chats from local desktop database, sorted by most recent message. Differentiates from list_groups by specifying when to use each.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises to use this tool to discover chat names before calling read_messages or search_messages, and to use list_groups for group_id values needed for send_message.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_groupsA
List Signal groups with group_id, name, description, members, and admin lists, sorted alphabetically.
Read-only with no side effects. Queries signal-cli when available; falls back to the local desktop database (without group_id). Use this to obtain group_id values needed by send_message. Use list_chats instead for a combined view of both direct and group chats.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Case-insensitive substring to filter group names. Empty string returns all groups. | |
| limit | No | Maximum number of groups to return, between 1 and 200. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It declares 'Read-only with no side effects' and explains the fallback from signal-cli to local desktop database (noting that group_id is missing in fallback). This is good but could be improved by mentioning any rate limits or error conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each serving a distinct purpose: purpose and output fields, safety and fallback, usage guidance and sibling differentiation. No wasted words, and critical information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers all essential aspects: purpose, output fields, sorting, read-only safety, fallback behavior, when to use, and alternative tools. With an output schema available, return values are handled by schema. No gaps identified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% description coverage and describes both parameters well. The description adds value by stating the output is sorted alphabetically, which is not in the schema. Baseline is 3; the sorting detail justifies a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the verb ('List'), resource ('Signal groups'), and the specific fields returned (group_id, name, description, members, admin lists). Also distinguishes from sibling 'list_chats' by noting that list_chats provides a combined view of direct and group chats.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use this tool: 'to obtain group_id values needed by send_message'. Also provides an alternative for a different use case: 'Use list_chats instead for a combined view'. Additionally, describes fallback behavior, giving clear context on data availability.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_messagesA
Read messages from a single Signal chat, returned newest-first.
Each message includes sender, date, body text, reactions, and attachment metadata. Read-only with no side effects. Requires an exact chat name from list_chats. Use search_messages instead to find messages by keyword across chats.
| Name | Required | Description | Default |
|---|---|---|---|
| chat_name | Yes | Exact chat name as returned by list_chats (case-sensitive). | |
| limit | No | Maximum number of messages to return, between 1 and 200. | |
| offset | No | Number of messages to skip from the most recent, for pagination (0-10000). | |
| after | No | ISO 8601 datetime; only return messages sent after this time, e.g. '2025-01-15T00:00:00'. | |
| before | No | ISO 8601 datetime; only return messages sent before this time, e.g. '2025-02-01T00:00:00'. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
States 'Read-only with no side effects', and describes what each message includes. No annotations provided, so description carries full burden; it adequately discloses read-only nature and output detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four concise sentences with no wasted words. Front-loads purpose and immediately gives key details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters with full schema coverage and output schema present, the description covers purpose, output format, prerequisite, and alternative tool sufficiently without needing to repeat schema details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds minimal extra meaning beyond the schema (e.g., chat_name must be exact from list_chats), but does not significantly enhance parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Read messages from a single Signal chat' with verb and resource, and distinguishes from sibling 'search_messages' which finds messages by keyword across chats.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides prerequisite ('Requires an exact chat name from list_chats') and an alternative ('Use search_messages instead'), but does not explicitly exclude other inappropriate use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_messagesA
Search Signal message bodies for a keyword, within one chat or across all chats, returned newest-first.
Read-only with no side effects. Use this to find messages by content. Use read_messages instead to browse a specific chat chronologically.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Case-insensitive substring to search for within message bodies. | |
| chat_name | No | Exact chat name to restrict the search to a single chat. Omit to search across all chats. | |
| limit | No | Maximum number of matching messages to return, between 1 and 200. |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Declares 'Read-only with no side effects', which covers safety. No annotations exist, so description carries full burden. Could mention search scope (message bodies only) but is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences only, no wasted words. Front-loaded with purpose and scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given output schema exists, description is comprehensive: covers usage scope, safety, sorting, and links to alternative. Only minor omission is pagination details, but acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. Description adds value by explaining scope ('within one chat or across all chats') and sort order ('newest-first'), enhancing what schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool searches message bodies by keyword, within one chat or all, and returns newest-first. Distinguishes from sibling read_messages by specifying its use for content search versus chronological browsing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use ('to find messages by content') and when not to ('use read_messages instead to browse a specific chat chronologically'), with a direct sibling alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_messageA
Send a text message via Signal to a direct recipient or group.
This is a write operation that delivers a real message through signal-cli. Exactly one of phone_number, group_id, or chat_name must be supplied; providing zero or more than one raises an error. Rate-limited to 1 message per recipient per second and 10 messages per 60-second window globally. Requires signal-cli and SIGNAL_ACCOUNT to be configured — call get_status first to verify send_available is true. Returns target_type, target identifier, and timestamp on success.
| Name | Required | Description | Default |
|---|---|---|---|
| message | Yes | The text message content to send. | |
| phone_number | No | Recipient phone number in E.164 format (e.g. '+441234567890'). Mutually exclusive with group_id and chat_name. | |
| group_id | No | Target group ID as returned by list_groups. Mutually exclusive with phone_number and chat_name. | |
| chat_name | No | Exact chat name from list_chats; auto-resolves to the matching phone_number or group_id. Mutually exclusive with the other two recipient fields. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description fully disclosures behavioral traits: it is a write operation, rate-limited (1/s per recipient, 10/60s globally), requires signal-cli and SIGNAL_ACCOUNT, and hints at the return structure. This covers all necessary behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with the main purpose front-loaded, followed by essential rules and constraints in a logical order. Every sentence adds value, and there is no redundant or extraneous content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (4 params, 1 required, mutual exclusivity, rate limits, prerequisites, and output schema), the description covers all necessary aspects: how to specify recipient, error conditions, rate limits, preconditions, and return format. It is fully sufficient for correct agent usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and each parameter has a clear description in the schema (including mutual exclusivity). The tool description restates the exclusivity rule but adds no new semantic details about the parameters themselves beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description begins with 'Send a text message via Signal to a direct recipient or group,' which clearly identifies the action and resource. It further distinguishes itself from sibling tools (e.g., read_messages, get_status) by stating it is a write operation that delivers a real message.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use guidance: exactly one recipient field must be supplied, and it warns against providing zero or multiple. It also specifies prerequisites (call get_status first) and rate limits, giving clear boundaries for safe invocation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
16 tool updates
v0.1.3- Added
chat_activity - Added
decrypt_attachment - Changed
list_chats2 fields changed- added
Input schema / properties / limit / descriptionAdded value: +"Maximum number of chats to return, between 1 and 200." - added
Input schema / properties / query / descriptionAdded value: +"Case-insensitive substring to filter by chat name or phone number. Empty string returns all chats."
- Changed
list_groups2 fields changed- added
Input schema / properties / limit / descriptionAdded value: +"Maximum number of groups to return, between 1 and 200." - added
Input schema / properties / query / descriptionAdded value: +"Case-insensitive substring to filter group names. Empty string returns all groups."
- Changed
read_messages5 fields changed- added
Input schema / properties / after / descriptionAdded value: +"ISO 8601 datetime; only return messages sent after this time, e.g. '2025-01-15T00:00:00'." - added
Input schema / properties / before / descriptionAdded value: +"ISO 8601 datetime; only return messages sent before this time, e.g. '2025-02-01T00:00:00'." - added
Input schema / properties / chat_name / descriptionAdded value: +"Exact chat name as returned by list_chats (case-sensitive)." - added
Input schema / properties / limit / descriptionAdded value: +"Maximum number of messages to return, between 1 and 200." - added
Input schema / properties / offset / descriptionAdded value: +"Number of messages to skip from the most recent, for pagination (0-10000)."
- Changed
search_messages3 fields changed- added
Input schema / properties / chat_name / descriptionAdded value: +"Exact chat name to restrict the search to a single chat. Omit to search across all chats." - added
Input schema / properties / limit / descriptionAdded value: +"Maximum number of matching messages to return, between 1 and 200." - added
Input schema / properties / query / descriptionAdded value: +"Case-insensitive substring to search for within message bodies."
- Changed
send_message4 fields changed- added
Input schema / properties / chat_name / descriptionAdded value: +"Exact chat name from list_chats; auto-resolves to the matching phone_number or group_id. Mutually exclusive with the other two recipient fields." - added
Input schema / properties / group_id / descriptionAdded value: +"Target group ID as returned by list_groups. Mutually exclusive with phone_number and chat_name." - added
Input schema / properties / message / descriptionAdded value: +"The text message content to send." - added
Input schema / properties / phone_number / descriptionAdded value: +"Recipient phone number in E.164 format (e.g. '+441234567890'). Mutually exclusive with group_id and chat_name."
- Removed
signal_chat_activity - Removed
signal_get_chat_messages - Removed
signal_get_status - Removed
signal_list_chats - Removed
signal_list_groups - Removed
signal_read_messages - Removed
signal_search_chat - Removed
signal_search_messages - Removed
signal_send_message
15 tool updates
v0.1.2- First observed
get_status - First observed
list_chats - First observed
list_groups - First observed
read_messages - First observed
search_messages - First observed
send_message - First observed
signal_chat_activity - First observed
signal_get_chat_messages - First observed
signal_get_status - First observed
signal_list_chats - First observed
signal_list_groups - First observed
signal_read_messages - First observed
signal_search_chat - First observed
signal_search_messages - First observed
signal_send_message
TDQS
Scored across 8 tools
Each tool has a distinct purpose: chat_activity for unanswered messages, list_chats for directory, list_groups for group IDs, read_messages for browsing, search_messages for keyword search, send_message for sending, decrypt_attachment for attachments, get_status for configuration. No overlaps or ambiguity.
Most tools follow verb_noun pattern (e.g., decrypt_attachment, list_chats), but chat_activity uses noun_noun. Overall consistent and clear, minor deviation.
8 tools is well-scoped for a Signal messaging server: listing, reading, searching, sending, decrypting, and status checking. Not too few or too many.
Covers key operations: list chats/groups, read/search messages, send messages, decrypt attachments, check status. Missing features like message deletion or editing are likely out of scope for a read-only/send server.
Maintenance
Related MCP Connectors
Your own WhatsApp as an MCP server: read, search and send from any MCP client.
MCP connector for iMessage & Contacts via a local Mac agent + Vercel relay
Unified messaging MCP server: WhatsApp, Instagram, Telegram, SMS, Messenger & email support inbox
Drive WhatsApp from any MCP client: pair devices, send text and media, manage contacts and groups.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceMCP Server for retrieving Signal messages using signal-export logic.8-
- MIT
- FlicenseNot gradedqualityCmaintenanceMCP server for Signal via signal-cli that enables sending and receiving messages, managing contacts and groups, and reacting over stdio.2 npm-
- AlicenseNot gradedqualityAmaintenanceMCP server for a local-first messaging workspace that integrates Google Messages, WhatsApp, and Signal. It enables reading, sending, searching messages, and managing conversations through MCP tools.55-