Pbx MCP

pbx-mcp

An MCP server that lets an AI assistant inspect and control Asterisk and FreeSWITCH.

Ask "which extensions are offline right now?" or "why is my SIP trunk not registering?" and get a real answer from the live switch, not a guess.

Developed by Tahir Almas at ICT Innovations, the team behind ICTCore, ICTContact, ICTDialer, ICTFax and ICTPBX. The AMI and ESL clients in this repo are the same protocol groundwork those products run on.

Why

Debugging a PBX means memorising two very different command sets. Asterisk speaks AMI and a CLI with hundreds of verbs. FreeSWITCH speaks ESL with its own vocabulary. If you run both, you're context switching all day.

pbx-mcp puts a single, well described tool surface in front of both, so your assistant can go from "calls are failing" to sofia status gateway without you spelling out each step.

New here? The user guide walks through PBX setup, client config, worked examples and troubleshooting. This README is the quick reference.

What your assistant sees

Twelve read-only tools, six per engine, each one described well enough that the model picks the right one without being told. This is the server running under the MCP Inspector:

The four write tools, asterisk_originate, asterisk_hangup, freeswitch_originate and freeswitch_hangup, stay hidden until you set PBX_MCP_ALLOW_WRITE=true.

Install

npm install -g pbx-mcp

Or run it straight from npx, which is what most MCP client configs do:

npx -y pbx-mcp

You need Node 18 or newer.

Docker

There's a prebuilt image if you'd rather not put Node on the machine that talks to your PBX.

docker run -i --rm \

-e ASTERISK_AMI_HOST=10.0.0.10 \ -e ASTERISK_AMI_USERNAME=mcp \ -e ASTERISK_AMI_PASSWORD=change-me \ ghcr.io/ictinnovations/pbx-mcp

The same image is on Docker Hub as ictinnovations/pbx-mcp if that registry is an easier pull for you.

Three things to know:

• -i is not optional. The server speaks MCP over stdio, so without stdin attached the container starts and then sits there saying nothing, which looks exactly like a broken server.
• There is no port to publish. Nothing listens.
• Your PBX has to be reachable from inside the container. If Asterisk runs on the Docker host itself, swap the IP above for host.docker.internal on Mac and Windows, or add --network host on Linux.

The image runs as a non-root user and, like every other way of running this, starts read only.

Configure

Everything comes from environment variables. Set the Asterisk block, the FreeSWITCH block, or both. The server only registers tools for what you've actually configured, so an Asterisk-only shop never sees a FreeSWITCH tool.

Asterisk

Your manager.conf user needs at least read = system,call,command and write = command. Add originate only if you plan to turn on write mode.

[mcp]

secret = change-me read = system,call,command write = command

FreeSWITCH

Shared

Provisioning (Asterisk only, opt-in)

Claude Desktop

Add this to claude_desktop_config.json:

{

"mcpServers": { "pbx": { "command": "npx", "args": ["-y", "pbx-mcp"], "env": { "ASTERISK_AMI_HOST": "10.0.0.10", "ASTERISK_AMI_USERNAME": "mcp", "ASTERISK_AMI_PASSWORD": "change-me", "FREESWITCH_ESL_HOST": "10.0.0.11", "FREESWITCH_ESL_PASSWORD": "ClueCon" } } } }

The same shape works for any MCP client that speaks stdio. There's a copy in examples/claude_desktop_config.json.

To run the container instead of npx, keep the env block and point command at Docker:

{

"mcpServers": { "pbx": { "command": "docker", "args": [ "run", "-i", "--rm", "-e", "ASTERISK_AMI_HOST", "-e", "ASTERISK_AMI_USERNAME", "-e", "ASTERISK_AMI_PASSWORD", "ghcr.io/ictinnovations/pbx-mcp" ], "env": { "ASTERISK_AMI_HOST": "10.0.0.10", "ASTERISK_AMI_USERNAME": "mcp", "ASTERISK_AMI_PASSWORD": "change-me" } } } }

Each -e NAME with no value forwards that variable from env into the container, which keeps the secrets out of the argument list.

Tools

Asterisk

FreeSWITCH

Safety

A PBX is not a scratch pad. Reloading a profile drops registrations, and an originate spends real money on a live trunk. So the default posture is read-only and the guards are layered:

Read-only by default. asterisk_cli accepts an allow list of inspection prefixes (core show, pjsip show, dialplan show, queue show and friends). freeswitch_api accepts the same kind of list (status, show, sofia status, db list and friends), matched on the start of the command so the subcommand counts.

The FreeSWITCH list allows subcommands, it does not deny scary words. sofia status reads, sofia profile internal restart isn't on the list, so it's refused. This used to work the other way around, scanning each word against a list of state changing verbs, and that only ever catches the words somebody thought of. conference 3001 kick all walked straight through it. Reported by Electrical-Place-458 on r/mcp.

Write tools aren't registered at all in read-only mode. asterisk_originate and the other three never appear in tools/list unless you set PBX_MCP_ALLOW_WRITE=true. A model can't call a tool it can't see.

The hangup preview tools are always available. asterisk_hangup_preview and freeswitch_hangup_preview show which live channels a hangup would drop without touching them, so you can see the blast radius before setting the write flag, or catch a typo in a channel name before running the real thing. They're read-only by contract but exercise the same matching the write path uses.

Shell metacharacters are rejected on both transports before a command is sent.

AMI header injection is blocked. Every field that lands in an AMI action is checked for carriage returns and newlines, so a caller ID string can't smuggle in an extra header.

Output is clamped to 20,000 characters. One show channels on a busy switch won't flood the context window.

Even with all that, give the AMI user the narrowest permission set that answers your questions, and put the PBX behind a firewall rather than on the public internet.

Provisioning trunks and extensions (Asterisk, opt-in)

Six more tools create, list and delete PJSIP trunks and SIP extensions through AMI UpdateConfig. They are registered only when PBX_MCP_ALLOW_PROVISION=true, and they are separate from write mode: enabling one does not enable the other.

Codecs are ulaw, alaw, g722, g729, opus. Names and numbers match ^[A-Za-z0-9_-]{1,32}$.

One-time setup

1. Create the managed file, empty, beside pjsip.conf (a missing include is an error), and let Asterisk write to it:

   touch /etc/asterisk/pjsip_mcp.conf

1. Add this single line at the end of pjsip.conf. Nothing else in pjsip.conf is ever touched:

   #include pjsip_mcp.conf

1. Give the AMI user the extra permissions provisioning needs. config is for UpdateConfig/GetConfig, command for the reload and verify steps, originate only if you also use write mode:

   [mcp]

secret = change-me deny = 0.0.0.0/0.0.0.0 permit = 192.0.2.0/24 read = system,call,command write = command,originate,config

1. Trunks reference a transport named transport-udp, transport-tcp or transport-tls; define the ones you will use in pjsip.conf.

How it works

• Everything goes into the managed file