OneSignal

Limits

• send_message reaches real end users. This connector is not capped below the send line. OneSignal marks the tool high-impact so compatible clients may prompt, but that gate is client-side; a client without high-impact confirmation has nothing standing between an agent and a live push, email or SMS.
• Two tools export bulk personal data. Subscription exports include push tokens, email addresses and phone numbers, and optionally IP address and lat/lon. The default call is unfiltered.
• Export URLs are unauthenticated bearer links. Protection is an unguessable random UUID path and a 3-day expiry. The link will sit in your AI client's transcript for that whole window.
• Exports are asynchronous and rate-shaped, not instant. Generation runs at about 2,000 records per second, the URL 404s until ready, and only one export per account can run at a time.
• No delete tool exists in either list. The connector can create and re-key users but not remove them. unsubscribe_email is a reversible status change.
• The delete-capability status is undocumented where the terms say it lives. OneSignal's product terms cite its AI data practices page for that status; the page does not state it (both fetched 2026-08-19).
• The directory carries no permissions label on a connector that sends messages and exports subscriber contact details.
• No OAuth scopes are advertised. The scopes_supported key is absent from the resource descriptor, so no client can distinguish or narrow read, export and send at connect time.
• The directory listing is five tools behind. Anthropic's snapshot names 29; OneSignal documents 34. Do not treat the listing as a complete inventory.
• Access is per-account, not per-app-scoped at the connector. OneSignal states a connection follows the signed-in user's permissions and can reach multiple apps. A broadly-permissioned user grants a broad connector.
• Open beta caveat, from OneSignal. It states app access may require enablement before non-utility tools become available, so tools may be present but inert on a given app.
• Rate limits apply and differ by plan. OneSignal publishes 150 requests/sec/app for message creation on free plans against 6,000 on paid, 1,000/sec/app for user and subscription writes, and 1/sec/app for view endpoints. It also states MCP tool calls are rate limited to help prevent runaway tool loops, without publishing that specific figure.
• Message volume limits can disable an app. OneSignal distinguishes API rate limits, which return 429 and never disable an app, from application message limits, which can temporarily disable one.
• OneSignal places MCP liability on the customer. Its terms deem actions taken by an AI agent through an MCP connection to be actions of the customer, including fees from erroneous or unintended actions, and reserve the right to suspend or throttle MCP connections independently of the account.
• Your subscriber data reaches your model provider. OneSignal's terms state plainly that data accessed through MCP may be transmitted to and processed by the third-party AI service you chose, and that OneSignal is not a party to your agreement with it.
• We could not verify tool behaviour ourselves. The endpoint returns 401 anonymously, so no inputSchema and no readOnlyHint or destructiveHint annotations were readable. Every capability claim here comes from OneSignal's documentation or Anthropic's listing, not from annotations we inspected.
• Prompts are unconfirmed. Anthropic's snapshot lists no prompt names, and the gated endpoint blocked our own check, so we cannot say whether the server serves any.

Frequently asked questions

Sources

• OneSignal MCP Server — https://documentation.onesignal.com/docs/en/model-context-protocol (fetched 2026-08-19; this is the page Anthropic's documentation URL resolves into. The 34-tool capability tables across 9 categories, the send_message guardrails, setup for five client families, Connected apps revocation, the free-of-charge and no-API-key statements, and the open-beta limitation) · retrieved 2026-08-19
• Export subscriptions CSV — https://documentation.onesignal.com/reference/csv-export (fetched 2026-08-19; default and optional column enumeration, the identifier field definition, the ~2,000 records/second rate, 3-day expiry, one-concurrent-export limit, and an inline OpenAPI 3.1 spec for POST /players/csv_export) · retrieved 2026-08-19
• Export audience activity CSV — https://documentation.onesignal.com/reference/export-csv-of-events (fetched 2026-08-19; per-recipient event scope, the random-UUID filename note, 3-day URL validity, and an inline OpenAPI 3.1 spec for POST /notifications/{message_id}/export_events) · retrieved 2026-08-19
• Create user — https://documentation.onesignal.com/reference/create-user (fetched 2026-08-19; the 201 / 202 / 409 outcome split and the conflicting_aliases structure returned on a cross-user alias collision) · retrieved 2026-08-19
• Create message — https://documentation.onesignal.com/reference/create-message (fetched 2026-08-19; send_after and delayed_option scheduling parameters on the endpoint beneath send_message) · retrieved 2026-08-19
• Rate limits and error handling — https://documentation.onesignal.com/reference/rate-limits (fetched 2026-08-19; 150 vs 6,000 requests/sec/app by plan, 1,000/sec for user and subscription writes, 1/sec for view endpoints, and the distinction between API rate limits and app-disabling message volume limits) · retrieved 2026-08-19
• OneSignal AI data practices — https://documentation.onesignal.com/docs/en/ai-data-practices (fetched 2026-08-19; the MCP access-control and revocation section. Cited by OneSignal's terms as the location of the delete-capability status, which it does not state) · retrieved 2026-08-19
• Additional Product Terms — https://onesignal.com/additional-product-terms (fetched 2026-08-19; Section 3.1 Customer AI Agent and MCP Connections — the customer-configures-scope requirement, the acknowledgement that subscriber data may be transmitted to the chosen AI service, agent actions deemed customer actions, and OneSignal's right to suspend or throttle MCP connections independently) · retrieved 2026-08-19
• documentation.onesignal.com/robots.txt publishes Content-Signal: ai-train=yes, search=yes, ai-input=yes — all three axes affirmative (fetched 2026-08-19). It references a sitemap, which lists exactly one MCP page. The host serves an 84 KB llms.txt machine index at documentation.onesignal.com/llms.txt and clean Markdown when .md is appended to any documentation URL — which is how every page above was read · retrieved 2026-08-19
• Live anonymous probe — 2026-08-19: an initialize call to https://api.onesignal.com/mcp/oauth returns HTTP 401 with a plain-text body naming an API key header, and no www-authenticate header. No tool was called and no authentication was attempted · retrieved 2026-08-19
• Live RFC 9728 protected-resource descriptor — https://api.onesignal.com/.well-known/oauth-protected-resource (fetched 2026-08-19; three keys, no scopes_supported). Root and path-append forms return byte-identical 200 bodies; the path-insert form under /mcp/oauth/ returns 401 · retrieved 2026-08-19
• Live RFC 8414 authorization-server metadata — https://api.onesignal.com/.well-known/oauth-authorization-server (fetched 2026-08-19; dashboard.onesignal.com/oauth/authorize, authorization_code and refresh_token grants, PKCE S256, client_secret_post and none, and a present registration_endpoint). The OpenID Connect discovery path returns 400 from a generic API error handler · retrieved 2026-08-19
• Anthropic connector directory — https://claude.ai/directory/f42c585c-280f-4f7b-bf37-9eb34144b04a (snapshot 2026-08-16; 29 tool names, no permissions field, no prompt names, partner tier, five categories, auth_required posture) · retrieved 2026-08-16
• OneSignal support — support@onesignal.com · Privacy — https://onesignal.com/privacy_policy (listed by Anthropic's directory, not fetched)