OTPilot

io.github.OTPilotPublished by GitHub account OTPilotv0.2.0Updated Oct 24, 2026

Use your OTPilot accounts (passwords, 2FA codes) to sign in and run commands, without seeing them.

The publisher's own server: QuickBooks Connector by Meridian

VerifiedSTDIODesktop onlyBrowser AutomationDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

OTPilot lets an AI agent sign in to websites and run commands using your stored passwords and 2FA codes, without the agent ever seeing the secrets.

What you can do
List the accounts the agent is allowed to use, by name and site, and request access to more with a reason you approve in the browser extension. Sign in to a site with the account's username, password and 2FA, returning a Playwright session state file instead of credentials. Run a command with secrets injected into its environment, such as a database password or a fresh 2FA code, and get the output back with every secret scrubbed. Check whether a pending access request has been answered.
When to use it
Useful when an agent needs to log in to sites or run commands that require credentials, and you would rather not paste secrets into the chat. Suited to developers running Claude Code, Codex, Cursor or similar agents on their own machine or a trusted server.
Requirements
A local Node.js runtime to run the npm package over stdio, plus a free OTPilot account and the OTPilot browser extension for approving the agent and its accounts. Google Chrome or Edge for browser sign-in, or a Playwright Chromium install. On machines without a keychain, credentials are stored in a local config file.
Before you install
The agent can act with your credentials: an agent that runs commands decides what they do and could try to reveal a secret on purpose, so limit allowed accounts and commands or enable ask-every-time. Allowed accounts are usable by anyone with root on the machine where it runs. Session files are saved in a local directory that should be kept out of git. Revoking in the extension is needed in addition to disconnecting locally.

Installation

In SourceWeft

  1. Open OTPilot in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

OTPilot for AI agents (@otpilot/mcp)

Let Claude Code, Codex, Cursor or any MCP agent sign in to websites and run commands with your passwords and 2FA codes — without the agent ever seeing them. You choose which accounts each agent may use, in the OTPilot browser extension.

bash
npx -y @otpilot/mcp@latest connect
  1. It shows a verification code and opens a page to sign in to OTPilot (a free account works).
  2. In the extension, Agents shows the agent: approve it if the code matches.
  3. Allow it some accounts (Agents → + Add account), or let it ask for them as it works.

Claude Code plugin (the MCP server plus a skill that teaches Claude to use it):

/plugin install otpilot --marketplace OTPilot/OTPilot

(Before Claude Code 2.1.275: /plugin marketplace add OTPilot/OTPilot, then /plugin install otpilot@otpilot.)

then connect it once: npx -y @otpilot/mcp@latest connect --name "Claude Code".

Or add the server to your agent yourself (connect prints these for you):

Agent
Claude Codeclaude mcp add otpilot -- npx -y @otpilot/mcp@latest
Codex~/.codex/config.toml: [mcp_servers.otpilot] command = "npx" args = ["-y", "@otpilot/mcp@latest"]
Cursor~/.cursor/mcp.json: { "mcpServers": { "otpilot": { "command": "npx", "args": ["-y", "@otpilot/mcp@latest"] } } }

For Codex and other agents that read AGENTS.md, add a line so they reach for it: "For passwords, 2FA codes, API keys or any login, use the otpilot MCP tools (list_accounts, browser_login, run); never ask me to paste a secret."

Each agent is its own identity, approved on its own: connect Claude Code and Codex separately (connect --name Codex), and add --profile <name> as connect shows.

On a server or VPS

Run it where the agent runs — your laptop, a VPS, a container. On a server without a browser, skip the opener and open the printed link on any device signed in to OTPilot, then approve it in the extension if the codes match:

bash
npx -y @otpilot/mcp@latest connect --name VPS --no-opennpx -y @otpilot/mcp@latest --profile vps                 # what the agent runsnpx playwright install --with-deps chromium       # only for browser_login without Chrome

With no keychain (a bare Linux box) the credentials go to ~/.config/otpilot/mcp-<profile>.json (0600): the accounts you allow are opened on that machine, so connect only machines you trust — whoever has root there can use them.

Tools

ToolWhat the agent gets
list_accountsThe accounts it may use, by name and site
request_access(query, reason)Asks you for another account; you pick it in the extension
browser_login(account, url?)OTPilot signs in (username, password, 2FA — only on the account's own site) and returns a Playwright storageState file with the session
run(command, env)Runs the command with secrets in its environment ({ "PGPASSWORD": "Staging DB/password" }, …/totp for a fresh 2FA code); output comes back with every secret removed
check_request(request_id)Whether you answered a request that was still waiting

No tool returns a password, a 2FA code or any other value.

Security

  • The agent's own key. connect creates an ECDH P-256 keypair; the private key stays in your OS keychain. Each account you allow is a copy, holding only what you chose (just the 2FA code, the sign-in, or chosen fields), encrypted for that key in the extension. OTPilot's servers only see ciphertext.
  • Two approvals. Connecting an agent gives it nothing; each account is allowed per agent. The verification code is derived from the agent's public key on every side, so a swapped key shows a different code.
  • Limits you set: for a while or until revoked, "ask me every time", and "only with these commands": run then accepts only that program, called by name and resolved on the server's PATH (never from the working or temp directory), as a single command with no chaining or redirection — a guard against mistakes and simple tricks, not against an agent that can plant its own binary on your PATH.
  • Only over HTTPS (plain HTTP just for local hosts), and every secret is scrubbed from what comes back — before the output is cut, so none is left half-removed. A timeout kills the command and everything it started.
  • Only on the right site. browser_login fills only on pages the account's saved sites cover.
  • Activity and revoke in the extension's Agents view.
  • The honest limit: an agent that runs commands decides what they do and could try to reveal a secret on purpose. OTPilot scrubs secrets from what it returns; for sensitive accounts allow only the 2FA code, limit the commands, or turn on "ask me every time".

Commands

otpilot-mcp connect [--name "Claude Code"] [--profile p] [--no-open]otpilot-mcp status [--profile p]       # name, verification code, allowed accountsotpilot-mcp disconnect [--profile p]   # forget the credentials here (revoke it in the extension too)otpilot-mcp [serve] [--profile p]      # the MCP server (stdio) — what your agent runs

browser_login uses your installed Google Chrome (or Edge); without one, run npx playwright install chromium. Sessions are saved to .otpilot/ in the working directory: keep it out of git.

License: GPL-3.0. Source: github.com/OTPilot/OTPilot.

Source: mcp/README.md at commit c38acff

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.0LatestOct 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.

Other Pilot integrations

QuickBooks Connector by Meridian

com.pilot.meridianOfficial publisher

Lets an assistant read from and write to QuickBooks Online company data through a hosted remote connector.

Streamable HTTPWeb executableAuth
Business & CommerceCredential requiredOct 24, 2026

AI Agent Connector by Meridian

com.pilot.meridianOfficial publisher

Lets an AI assistant connect to Xero with authorised read or write access across multiple organisations.

Streamable HTTPWeb executableAuth
FinanceCredential requiredOct 24, 2026

XuLan ScreenPilot

Published by GitHub account dahuam

Turn the real Windows screen into a numbered element table your AI agent can operate.

STDIODesktop only
AI & MLNot validated yetNov 3, 2026

Covenant AAP - hosted developer pilot

Published by GitHub account covenant-common

Hosted marketplace and contract-drafting server: search public listings, prepare trade records, draft and compare clauses, and review agreement evidence.

Streamable HTTPWeb executable
Business & Commerce9 toolsOct 31, 2026

Tag Pilot Search Console

Published by GitHub account tagpilot

Read-only Google Search Console MCP server that lets an assistant query clicks, impressions, CTR, positions, sitemaps and index status for your properties.

STDIODesktop only
Business & Commerce9 toolsNov 3, 2026