ElevenLabs Agents

@mindstone/mcp-server-elevenlabs-agents

ElevenLabs Conversational AI MCP server for Model Context Protocol hosts. Inspect and author voice agents, review conversation transcripts and recordings, manage phone-number assignments, place outbound calls, submit or monitor scheduled batch calls, and write to the knowledge base through the ElevenLabs ConvAI API.

Status

• Version: 0.2.1 · npm
• Auth: API key (ELEVENLABS_API_KEY)
• Tools: 31 (configure, agents, agent tools, conversations, phone numbers, outbound calls, batch calls, knowledge base)
• Surface: cloud-api
• Machine-readable: STATUS.json

Requirements

• Node.js 20+
• npm
• An ElevenLabs API key with Conversational AI access

One-click install

After clicking the button, your host will prompt you to fill: ELEVENLABS_API_KEY.

{
  "mcpServers": {
    "ElevenLabs Agents": {
      "command": "npx",
      "args": [
        "-y",
        "@mindstone/mcp-server-elevenlabs-agents"
      ],
      "env": {
        "ELEVENLABS_API_KEY": ""
      }
    }
  }
}

Quick Start

Install & build

cd <path-to-repo>/connectors/elevenlabs-agents
npm install
npm run build

Local

node dist/index.js

Configuration

Environment variables

• ELEVENLABS_API_KEY — ElevenLabs API key (starts with sk_)
• MCP_WORKSPACE_PATH — optional sandbox root for knowledge-base file uploads
• MCP_HOST_BRIDGE_STATE — optional path to a host bridge state file used for credential management
• MINDSTONE_REBEL_BRIDGE_STATE — backwards-compatible alias for MCP_HOST_BRIDGE_STATE

Host configuration example

{
  "mcpServers": {
    "ElevenLabs Agents": {
      "command": "node",
      "args": ["<path-to-repo>/connectors/elevenlabs-agents/dist/index.js"],
      "env": {
        "ELEVENLABS_API_KEY": "your-api-key"
      }
    }
  }
}

Tools (31)

Configuration

• configure_elevenlabs_agents_api_key — Save your ElevenLabs API key

Agents

• list_agents — List voice agents in the workspace
• get_agent — Get one agent, including prompts and nested conversation config
• create_agent — Create a new agent from a user-friendly authoring surface
• update_agent — Partially update one agent via PATCH deep-merge semantics
• duplicate_agent — Duplicate an existing agent before experimenting
• delete_agent — Permanently remove an agent
• simulate_conversation — Test an agent with a simulated user message before telephony work

Agent tools (workspace tools)

• list_agent_tools — List webhook/client/system tools available to agents
• add_agent_tool — Add a webhook or client tool to the workspace

Conversations

• list_conversations — List conversations, optionally filtered by agent/date/success
• get_conversation — Get a full conversation transcript and analysis
• get_conversation_audio — Download the conversation recording to a tmp file
• submit_conversation_feedback — Submit like/dislike feedback on a reviewed conversation

Phone numbers

• list_phone_numbers — List configured phone numbers
• get_phone_number — Get one phone number and its label/assignment
• import_phone_number — Import a Twilio or SIP trunk number into the workspace
• update_phone_number — Update one phone number label and/or assigned agent
• delete_phone_number — Permanently remove an imported phone number

Outbound calls

• make_outbound_call — Place one outbound call after resolving the phone-number provider automatically

Batch calls

• submit_batch_call — Submit a multi-recipient batch, optionally scheduled for the future
• list_batch_calls — List recent batch-call jobs in the workspace
• get_batch_call — Inspect one batch job, including per-recipient statuses
• cancel_batch_call — Cancel a queued or scheduled batch job
• retry_batch_call — Retry a previously submitted batch job

Knowledge base

• list_knowledge_base_docs — List knowledge-base documents
• get_knowledge_base_doc — Get one knowledge-base document (metadata + /content body, capped ~50KB)
• add_knowledge_base_document — Add a KB document in text, file, or URL mode
• delete_knowledge_base_document — Delete a KB document, optionally with force
• get_knowledge_base_rag_index_status — Check whether a document is indexed and retrievable
• rebuild_knowledge_base_rag_index — Trigger (re)indexing of a KB document

Security notes

All external text returned by the ElevenLabs API is wrapped in <untrusted-content> envelopes before it reaches the model. This is especially important for conversation transcripts, which can contain attacker-controlled caller speech. Enveloping is deny-by-default: anything that is not a recognised structural value (IDs, enums, timestamps, phone numbers) is wrapped, including responses whose root is a bare JSON value rather than an object.

The same walk runs on every response surface — agents, conversations, knowledge base, phone numbers, simulations, and outbound/batch calls. No surface carries a list of known prose field names, so a text field added upstream (an agent name, a workflow branch name, a future summary) is enveloped from the day it first appears in a response.

Nor does an unexpected shape route text around the walk. A response whose root is a bare JSON value, a list whose items are bare strings, and a transcript field carrying a string or an object where an array of turns was expected all go through the same deny-by-default walk rather than being returned unchanged.

Because reads come back enveloped, the agent authoring tools strip one envelope from the values they are given. Copying a language, model id, prompt, or advanced_config fragment out of get_agent and back into update_agent therefore stores the original text upstream rather than the envelope around it.

The structural literal exemptions in the walk are path-aware and value-shape-aware, not key-name-based. Inside arbitrary collaborator-authored maps — webhook request_headers, advanced_config passthroughs, JSON-Schema parameter fragments, and the caller-authored open maps submitted with call initiation (conversation_initiation_client_data, conversation_config_override, custom_llm_extra_body, overrides, which ElevenLabs reflects on the conversation, call, and batch-call surfaces) — key names are data rather than schema, so no string stays literal there at all: a property named status in a request-header map is collaborator text, not a trusted enum, and is enveloped whatever its value looks like. Because advanced_config is deep-merged into the config body before it is sent upstream, its reflected shape carries no advanced_config ancestor to key off; on the agent and workspace-tool surfaces a string therefore also stays literal only when every ancestor key from the surface root is a known schema position, so a flattened passthrough fragment (for example tool_config.custom.status) is enveloped however structural its key names and value shape look. Elsewhere on trusted paths, a string only stays literal under id/status/role/type keys when it is id/enum-shaped (no whitespace, no : or /, and not phrase-shaped or built from instruction-shaping words — alphabet shape alone cannot tell an identifier from whitespace-free authored text such as IGNORE_PRIOR_INSTRUCTIONS), under timestamp only when it is ISO-8601-shaped, and under phone-number keys only when it is E.164. Values under credential-shaped keys (token, sid, *_secret, *_password, *_api_key) are replaced with [redacted] instead of being passed on at all, and import_phone_number additionally strips the exact submitted credentials — the Twilio SID/token pair, and SIP trunk credential values such as a trunk username — from any success payload or upstream error detail that reflects them.

URLs the connector asks ElevenLabs to dereference server-side must be public https:// addresses. This covers webhook tools via add_agent_tool, URL-mode knowledge-base documents, and every url-keyed string in the agent authoring tools' advanced_config (create_agent / update_agent) — ElevenLabs fetches custom_llm.url on every conversation turn and dereferences platform_settings webhook URLs, so the merged agent body is validated recursively before any upstream call. Non-HTTP schemes, plain HTTP, embedded credentials, loopback/private/link-local/CGNAT/multicast IP literals (including the cloud-metadata address 169.254.169.254), IPv4-mapped/NAT64/6to4/Teredo and documentation IPv6 ranges, localhost-style hostnames, and single-label hostnames are rejected before any upstream call; trailing root-label dots are stripped before classification, so DNS-equivalent spellings such as localhost. are rejected too. A public hostname can still resolve or redirect to an internal address once ElevenLabs fetches it — that residual DNS/redirect trust boundary is inherent to server-side dereferencing and is not closed by this validation. add_agent_tool's advanced_config deep-merges last but cannot set first-class fields (type, name, description, expects_response, api_schema.url, api_schema.method), and the merged tool config is revalidated before it is sent.

Outbound numbers are validated in E.164 format before any billing-surface call is sent upstream. Scheduled batches run on ElevenLabs' servers even if the client app is closed, so they should be monitored with list_batch_calls / get_batch_call and stopped with cancel_batch_call when needed.

Licence

FSL-1.1-MIT — Functional Source License, Version 1.1, with MIT future licence. The software converts to MIT licence on 2030-04-08.