Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "myotp": {
      "type": "http",
      "url": "https://mcp.myotp.app/mcp",
      "headers": {
        "X-API-Key": "${X_API_KEY}"
      }
    }
  }
}

claude mcp add --transport http myotp https://mcp.myotp.app/mcp --header "X-API-Key: ${X_API_KEY}"

[mcp_servers.myotp]
url = "https://mcp.myotp.app/mcp"
env_http_headers = { "X-API-Key" = "X_API_KEY" }

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "myotp": {
      "type": "remote",
      "url": "https://mcp.myotp.app/mcp",
      "enabled": true,
      "headers": {
        "X-API-Key": "{env:X_API_KEY}"
      }
    }
  }
}

{
  "mcpServers": {
    "myotp": {
      "type": "http",
      "url": "https://mcp.myotp.app/mcp",
      "headers": {
        "X-API-Key": "${X_API_KEY}"
      }
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=myotp&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vbWNwLm15b3RwLmFwcC9tY3AiLCJoZWFkZXJzIjp7IlgtQVBJLUtleSI6IiR7WF9BUElfS0VZfSJ9fQ%3D%3D"
}

{
  "servers": {
    "myotp": {
      "type": "http",
      "url": "https://mcp.myotp.app/mcp",
      "headers": {
        "X-API-Key": "${X_API_KEY}"
      }
    }
  }
}

{
  "mcpServers": {
    "myotp": {
      "httpUrl": "https://mcp.myotp.app/mcp",
      "headers": {
        "X-API-Key": "${X_API_KEY}"
      }
    }
  }
}

extensions:
  "myotp":
    enabled: true
    name: "myotp"
    type: streamable_http
    uri: "https://mcp.myotp.app/mcp"
    headers:
      "X-API-Key": "${X_API_KEY}"
    timeout: 300

Placeholders to fill from your own secret store: ${X_API_KEY}. The registry never accepts secret values.

Quality 91 / 100strong

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene100 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations10 of 10 tools declare readOnlyHint or destructiveHint
pass
tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
pass
tools.token_costabout 2,901 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability100 · weight 15

pass
stability.changes1 tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvabledeps.dev does not know @myotp/[email protected]

10 tools, about 2,901 tokens to load them all · tool set 3e4ff2c2c718 · tools last changed 2026-10-13 · checked 2026-10-19 10:20 UTC

Tool changes

2026-10-13generate_otpchangedinput schema

Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 97 / 100

provenance90

liveness100

freshness100

hygiene100

+repository +namespace-matches-repo +website +reachable +uptime-100% +updated-6d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Dependencies

@myotp/[email protected] npmthis version is not known to the dependency resolver

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://mcp.myotp.app/mcp` streamable-http	none	yes	100%	577 ms	2025-11-25	2026-10-19

package	registry	version	runtime	secrets
`@myotp/mcp`	npm	0.1.14	–	`MYOTP_API_KEY`

Tools (10)

`check_otp_status`read-only	Check whether a previously sent OTP is still active and (with DLR_ACCESS entitlement on Enterprise plan) get its delivery status. Returns `is_active` (bool) and `expires_at` (ISO timestamp) on every plan. On Enterprise plans, also returns `DLR`: 'delivered', 'sent', 'read', 'pending', or a failure as `failed.<reason>` (on WhatsApp, `failed.Undeliverable` means the number cannot receive WhatsApp and `failed.Provider` means a retry is worth it). Useful when an end user reports they didn't receive the code — you can confirm whether MyOTP delivered it before deciding to resend. Does NOT verify a code; use `verify_otp` for that.
`create_account`	Create a MyOTP.App agent account and return its one-time API key. No API key is required for this tool. The new account starts with zero balance; USDC top-ups work immediately, while card top-ups unlock after a human confirms the email address.
`extend_otp`	Extend the expiry time of an active OTP without sending a new one. Useful when the end user is taking longer than expected to enter the code (e.g., switched apps, dealing with carrier delivery delay). Adds `duration` seconds (60-14400) to the current `expires_at`. Requires the EXTEND_OTP entitlement (Business or Enterprise plan). Some destination countries don't allow extensions — the API will return 403 in that case. Cheaper and less spammy than calling `generate_otp` again.
`generate_otp`	Send a one-time password (OTP) to a phone number via SMS, WhatsApp, or Telegram. MyOTP.App generates the code, formats the message, picks the best carrier route, and delivers it. Returns a `message_id` (UUID) — keep it; you'll pass it to `verify_otp`, `check_otp_status`, or `extend_otp` later. Each call deducts credits from the account balance; the per-message cost varies by destination country and channel and is returned in the `cost` field. Use this whenever an app needs to verify someone's phone — signup, login 2FA, password reset, transaction confirmation, etc.
`get_account_info`read-only	Return account details for the API key in use. Always returns at least the account `email`; depending on plan and platform version may also return balance/credit/plan info. Use this as a sanity check when wiring up MyOTP for the first time — if this call succeeds, your API key and IP whitelist are configured correctly.
`get_account_status`	Return email verification, balance, plan, and status for the configured MyOTP agent account. Set resend_verification to request another confirmation email first. Unverified accounts can top up with USDC, but cards stay locked.
`get_topup_quote`read-only	Get the live price and payment options for buying MyOTP credits, without making a purchase. Use this when generate_otp or another send fails with HTTP 403 insufficient balance / NoBalance, or before calling `top_up_credits` to show the cost. Returns USDC and card client commands and never exposes the configured API key.
`get_usage_report`read-only	Fetch a paginated list of OTP transactions for a date range. Each transaction includes message_id, timestamp, phone_number, channel, country, cost, status, and the originating client IP. Date range cannot exceed 31 days. Defaults: last 7 days, page 1, 10 per page. Requires the API_REPORTING entitlement (Business or Enterprise plan). Use this to: audit recent activity, build internal dashboards, reconcile billing, or debug delivery issues across many recipients.
`top_up_credits`destructive	Prepare or complete an autonomous MyOTP credit purchase with USDC or card through Machine Payments Protocol (MPP). Use this when generate_otp or another send fails with HTTP 403 insufficient balance / NoBalance. The tool quotes first, then returns a structured 402 challenge and exact retry details for the agent's own MPP client; if fetch is already wrapped by a credential-carrying MPP runtime, it returns the credited response directly.
`verify_otp`	Verify a code submitted by an end user against the OTP MyOTP delivered. Returns `{status: 'success'}` if the code matches and the OTP hasn't expired — at that point the OTP is consumed and cannot be reused. Returns `{status: 'failed', reason: 'invalid' \| 'expired' \| 'not found'}` otherwise. You MUST pass either `phone_number` or `message_id` to identify which OTP you're verifying against. Call this after collecting the code from the user (login form, signup screen, etc.).

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "io.github.brntech/myotp",
  "title": "MyOTP.App",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://mcp.myotp.app/mcp",
      "type": "streamable-http",
      "headers": [
        {
          "name": "X-API-Key",
          "isSecret": true,
          "description": "MyOTP.App API key, sent per request so the hosted server never stores it. Omit it to call create_account or get_topup_quote, which need no key. Note: calls reach the MyOTP API from 108.61.176.199, so add that IP to your key's allowlist or every call returns 403."
        }
      ]
    }
  ],
  "version": "0.1.14",
  "packages": [
    {
      "version": "0.1.14",
      "transport": {
        "type": "stdio"
      },
      "identifier": "@myotp/mcp",
      "registryType": "npm",
      "registryBaseUrl": "https://registry.npmjs.org",
      "environmentVariables": [
        {
          "name": "MYOTP_API_KEY",
          "isSecret": true,
          "description": "MyOTP.App API key, needed by every tool except create_account and get_topup_quote. No key yet? Start the server without it and call create_account to get one."
        }
      ]
    }
  ],
  "repository": {
    "url": "https://github.com/brntech/myotp-agentkit",
    "source": "github",
    "subfolder": "mcp-server"
  },
  "websiteUrl": "https://mcp.myotp.app",
  "description": "Send and verify one-time passcodes over SMS, WhatsApp and Telegram."
}