npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, 👋, I’m Ryan Hefner  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you 🙏

© 2026 – Pkg Stats / Ryan Hefner

@mulmobridge/twilio-sms

v0.1.1

Published

Twilio SMS bridge for MulmoBridge — inbound SMS via webhook, outbound via Twilio REST API

Vulnerabilities

Powered byPowered by Snyk
  • 0High
  • 0Medium
  • 0Low

Links

Maintainers

isamuisamusnakajimasnakajima

Keywords

Readme

@mulmobridge/twilio-sms

Experimental — please test and report issues.

SMS bridge for MulmoClaude via Twilio Programmable Messaging. Every phone on Earth can text your AI agent — no app install needed.

Public URL required (Twilio posts a webhook every time an SMS arrives on your number).

Setup

1. Get a Twilio number

  1. Sign up at twilio.com (trial includes credits).
  2. Phone Numbers → Buy a Number → pick one with SMS capability.
  3. Note the Account SID + Auth Token (Twilio console top-right / Settings → General).

2. Expose the bridge with a tunnel

ngrok http 3010
# copy the https URL — e.g. https://abcd.ngrok-free.app

3. Configure the Twilio number

In the Twilio console, open the number → Messaging → A Message Comes In → Webhook, method HTTP POST → URL https://<your-tunnel>/sms.

4. Run the bridge

TWILIO_ACCOUNT_SID=AC... \
TWILIO_AUTH_TOKEN=... \
TWILIO_FROM_NUMBER=+15551234567 \
TWILIO_PUBLIC_URL=https://abcd.ngrok-free.app \
npx @mulmobridge/twilio-sms

Text the Twilio number — you'll get a reply.

Environment variables

| Variable | Required | Default | Description | |--------------------------|-------------|---------|-------------| | TWILIO_ACCOUNT_SID | yes | — | Twilio Account SID | | TWILIO_AUTH_TOKEN | yes | — | Twilio Auth Token (used for REST + signature verification) | | TWILIO_FROM_NUMBER | yes | — | Your Twilio number in E.164, e.g. +15551234567 | | TWILIO_WEBHOOK_PORT | no | 3010 | HTTP port | | TWILIO_PUBLIC_URL | yes (prod) | — | Full public URL the bridge is reachable at (e.g. https://abcd.ngrok-free.app, including any query string Twilio signs). Required to verify Twilio's X-Twilio-Signature. The bridge refuses to start without it unless TWILIO_ALLOW_UNVERIFIED=1 is also set. | | TWILIO_ALLOW_UNVERIFIED| no | — | Set to 1 to skip signature verification (local testing only). Prints a loud warning and leaves /sms wide open. Do not set in production. | | TWILIO_ALLOWED_NUMBERS | no | (all) | CSV of sender E.164 numbers allowed (empty = accept every number) | | MULMOCLAUDE_AUTH_TOKEN | no | auto | MulmoClaude bearer token override | | MULMOCLAUDE_API_URL | no | http://localhost:3001 | MulmoClaude server URL |

How it works

  1. Twilio posts form-encoded From, To, Body, MessageSid to /sms every time an SMS arrives.
  2. The bridge verifies X-Twilio-Signature (HMAC-SHA1 over the full URL — including query string — + sorted form params) using the auth token. TWILIO_PUBLIC_URL must match the URL Twilio sees (scheme + host + optional path prefix); the request's actual query string is read from req.originalUrl.
  3. We ACK 204 immediately so Twilio doesn't retry, then (asynchronously) forward the trimmed body to MulmoClaude keyed by the sender's number.
  4. The reply is sent back via POST /2010-04-01/Accounts/{SID}/Messages.json with Basic auth; long replies are chunked at 1 600 chars (Twilio's concatenated-SMS ceiling).

Troubleshooting

| Symptom | Cause | Fix | |---|---|---| | 401 at Twilio side | Signature verification failed | Verify TWILIO_PUBLIC_URL matches the URL Twilio actually hits (scheme + host + path, no trailing /) | | No reply delivered | Messages.json REST call failing | docker logs / npx output will show [twilio-sms] send failed: …. Common cause: trial account can only message verified numbers | | Duplicate replies | Twilio retried before ACK | Ensure reachable https:// endpoint (not HTTP) and the bridge responds 2xx under 15 s |

Security notes

  • The auth token is equivalent to root credentials on your Twilio account. Rotate in the console if leaked.
  • TWILIO_PUBLIC_URL is strongly recommended — without it, anyone who finds your webhook can impersonate Twilio and converse with your agent.
  • Trial Twilio accounts can only SMS pre-verified numbers. Upgrade to production before real use.
  • SMS is plaintext — don't discuss secrets over it. Use Signal / WhatsApp / Matrix instead for sensitive content.

Ecosystem

Part of the @mulmobridge/* package family.

Shared libraries:

Bridges (one npm package per platform):