About simhook
simhook turns an Android phone into an SMS API. This page says who makes it, why it exists, what is open, where the hosted service runs, and how to reach us.
who makes it
simhook is made by Enes. It started in 2026, it is built in the open, and the reasoning behind each part of it is written down in the decision records in the repository.
why it exists
Most SMS APIs rent you a number and charge for every message. Many people already own numbers: the phone on the desk, a spare SIM, the shop's line. simhook lets code send and receive texts through those, without per-message pricing. The phone does the sending and receiving through its own SIM. The server keeps the records: what was sent, what the carrier said about it, what came back, and a signed webhook for each step.
Nothing about the number changes. Texts you send show your number, and texts people send you still land in the phone's messaging app; they reach your code as well.
what is open
Everything is in one repository. The API, the dashboard, the Android app, and the deployment files are under the AGPL-3.0: run them for yourself or your company without restriction, and if you change them and offer the result to others as a service, publish your changes. The TypeScript SDK, the MCP server, and the API contract are under the MIT licence, so they fit into any project.
The Android app is not on Google Play. It is published as a signed APK on the releases page, with a checksum next to it. Every release is signed with the same key, and Android's installer only accepts an update signed with the key of the version already installed. The changelog lists every release of the app, the SDK, and the MCP server.
where it runs
The hosted service runs on servers at Hetzner, behind Cloudflare. This site, the dashboard, and the API run on one host from one Compose file, with a database dump every night. Resend sends the emails an account needs, and Google's Firebase Cloud Messaging wakes phones; a push carries no message content, only a nudge to check in. The privacy page lists what is stored, for how long, and who else sees it.
A copy you run yourself keeps its data on your server. Self-hosting is one Compose file on a small machine.
how to reach us
- Anything[email protected]
- Vulnerabilities[email protected], as SECURITY.md describes. Please do not open a public issue for something that could be exploited before it is fixed.
- Bugs and requestsGitHub issues
what it is not for
Bulk marketing, and texting people who did not ask to hear from you. A consumer SIM is for a person's messages, carriers watch for anything else, and most countries regulate who you may text and when. simhook paces sends and shows you what went out; the rest is your responsibility. The home page has a note on what carriers tolerate, and the comparison says when a hosted SMS API is the better tool.