The safe order is built into the tool set: balance and sender list cost nothing and confirm both authentication and that the header you plan to use is approved, and for commercial traffic the consent check answers whether you are allowed to message that number at all. Only then does the send call spend anything. Two things catch people out — the API access toggle in the panel, which produces a 401 that looks like bad credentials, and the cancellation window, which only exists while a scheduled order has not started sending.
A client for iletiMerkezi, a Turkish BTK-licensed bulk SMS and OTP platform. Its tool shapes are generated from the vendor's own API manifest rather than hand-written, so the schemas track the live API.
- SMS sent to one or many Turkish or international numbers in a single request, returning an order id that everything downstream is keyed on
- A future-dated order cancelled before it reaches the carrier — the window closes once sending starts
- The delivery report for one order: overall status, total, delivered, undelivered and waiting counts, timestamps, sender, order price, and the per-recipient result
- A summary list of every order in a date range, with the same counters but no per-recipient breakdown
- The account's remaining balance in lira and how many standard messages that funds
- The approved sender headers on the account — the send call only accepts values from that list, and rejects anything else
- A blacklist read, added to and removed from one number at a time; blocked numbers are skipped during sending, and re-adding a number is harmless
- İYS consent records created in the Turkish national registry for commercial messaging, and any recipient's consent or rejection status checked before a commercial send
An iletiMerkezi account with API access, and two values from its panel under Settings, Security, API Access: ILETIMERKEZI_API_KEY and ILETIMERKEZI_API_HASH. Copy the hash as issued rather than computing it yourself. Allow API access has to be switched on separately under Access Permissions, or every call returns 401 — the server's error message points back at that toggle. It runs over stdio as npx -y @iletimerkezi/mcp-server; hosted clients that need a remote HTTPS endpoint are not supported today. Tool schemas come from the vendor manifest through a local cache valid for 24 hours, a live fetch, then a copy bundled at publish time, so API changes reach a running client without an update. Sending costs money and cannot be undone: it dispatches real messages and deducts credit.
One command plus a key — npx -y @iletimerkezi/mcp-server, then supply credentials