Developer Documentation

Build with Carrier MCP

113 tools. 5 prompts. OAuth 2.1 + PKCE. One API your AI can talk to — every eSIM, subscriber, package, and network event.

Start here

Quick start

Install snippets for Claude Desktop, Claude Code, Cursor, Windsurf, and Smithery. Up in under 30 seconds.

Onboarding

Connect OCS

Link Carrier Console to eSIMVault: Managed mode, BYO API token, or portal login. Resume onboarding anytime.

BYO setup

Get your OCS token

Where to find the eSIMVault / Bridge4IP reseller API token in the OCS portal, and how to paste it into Carrier.

113 tools

API Reference

All 113 tools with input schemas, scope requirements, and example invocations. Filterable by read / write / admin.

mcp.carrier.llc

MCP Server

Carrier MCP runs at mcp.carrier.llc as a Cloudflare Worker with StreamableHTTP transport and Durable Object session state.

OAuth 2.1

Authentication

OAuth 2.1 + PKCE per-user token vault. Each user authenticates once; Carrier stores their eSIMVault token encrypted in KV.

5 prompts

Examples

Five production-ready prompt workflows: fleet_health_report, subscriber_deep_dive, revenue_optimization, coverage_analysis, bulk_operations_planner.

v0.1.0

Changelog

Version history. v0.1.0: first public release — 113 tools, 5 prompts, OAuth 2.1, npm @carrierllc/mcp.

Quick start

Pick your AI client. Paste the snippet. Authenticate once via OAuth.

Claude Code — HTTP (recommended)

claude mcp add --transport http carrier https://mcp.carrier.llc/mcp

Claude Desktop — HTTP

{
  "mcpServers": {
    "carrier": {
      "url": "https://mcp.carrier.llc/mcp",
      "headers": { "Authorization": "Bearer <your-token>" }
    }
  }
}

Cursor / Windsurf — HTTP

{
  "mcpServers": {
    "carrier": {
      "url": "https://mcp.carrier.llc/mcp",
      "headers": { "Authorization": "Bearer <your-token>" }
    }
  }
}

Alternative: local stdio (npm)

# Keeps your token on your machine — no outbound auth call to Carrier
ESIMVAULT_API_TOKEN=<your-token> npx -y @carrierllc/mcp

Smithery

npx -y @smithery/cli install @carrierllc/mcp --client claude

After installing, type Run fleet_health_report in Claude to verify everything is connected.

Authentication

Carrier uses OAuth 2.1 with PKCE. The flow:

01Your AI client initiates an OAuth flow to mcp.carrier.llc/oauth/authorize
02You log in and paste your eSIMVault API token. Carrier encrypts it and stores it in the CARRIER_USERS KV namespace — bound to your session.
03All subsequent tool calls use your stored token. Carrier never holds a shared OCS credential.

Carrier does not store your eSIMVault password — only the API token you explicitly provide. You can revoke access at any time by rotating your token.

Passkey support — Sign in to app.carrier.llc with a passkey. No password needed — your device biometric or security key authenticates you directly.