Authn8

io.github.authn8Published by GitHub account authn8v1.1.3Updated Nov 5, 2026

Shared 2FA for teams: let AI agents get TOTP codes for the accounts your Authn8 token can see.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Authn8 MCP server that lets an AI agent list shared 2FA accounts and fetch TOTP codes so it can finish sign-ins for your team.

What you can do
  • List the 2FA accounts a token can reach, with names and issuer domains
  • Fetch a current TOTP code for an account by ID or by name/issuer search, with ambiguous matches returned for retry
  • Inspect the current token: token name, business, scoped groups, expiry and account count
  • Return typed structured results alongside text for every tool
When to use it
Use it when an agent needs to complete a sign-in that requires a TOTP code for an account your team shares in Authn8, without a person reading the code from a phone. It suits teams already on Authn8 that want agent access to be logged and scoped by token.
Requirements
An Authn8 business on a paid plan; MCP tokens are not available on the Free plan and stop working if the subscription ends. An MCP token starting with pat_, created under Settings → MCP Tokens, passed as the Authorization bearer header for the hosted endpoint or as the AUTHN8_API_KEY environment variable for the npm package. Node.js 18 or later only for the local npm package; the hosted endpoint needs nothing installed.
Before you install
The token grants access to live second-factor codes, so anyone holding it can complete sign-ins for the accounts it reaches; scope it to chosen groups and set an expiry. Codes fetched are recorded in Authn8's access log with the token name. The token is a secret: keep it out of shared config files and version control. The server needs a paid subscription, and tokens stop working when it ends.

Installation

In SourceWeft

  1. Open Authn8 in the dashboard and add it to a workspace.
  2. Connect Authorization token credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.authn8%2Fmcp-server/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "authn8": {
      "type": "http",
      "url": "https://api.authn8.com/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

README

@authn8/mcp-server

MCP server for Authn8, shared 2FA for teams. It lets AI agents fetch TOTP codes for the 2FA accounts your team shares in Authn8, so an agent can finish a sign-in without anyone reading a code out of a phone. Every code it fetches is recorded in Authn8's access log with the name of the token that asked for it.

Listed in the MCP Registry as io.github.authn8/mcp-server.

Requirements

  • An Authn8 business on a paid plan. MCP tokens are not available on the Free plan, and a business's tokens stop working if its subscription ends.
  • An MCP token. Create one in Authn8 under Settings → MCP Tokens (how to create an MCP token). Tokens start with pat_. A token only reaches the 2FA accounts its creator can already access, and you can narrow it further to chosen groups and give it an expiry date.
  • Node.js 18 or later, if you run the npm package. The hosted endpoint needs nothing installed.

Two ways to connect

Hosted endpointnpm package
InstallNonenpx runs it locally
TransportStreamable HTTPstdio
Addresshttps://api.authn8.com/mcpnpx -y @authn8/mcp-server
TokenAuthorization: Bearer pat_... headerAUTHN8_API_KEY environment variable

Both offer the same three tools: list_accounts, get_otp and whoami.

Hosted endpoint

Point any MCP client that supports streamable HTTP at https://api.authn8.com/mcp and send your token in the Authorization header as Bearer pat_your_token_here.

Claude Code

bash
claude mcp add --transport http --scope user authn8 https://api.authn8.com/mcp \  --header "Authorization: Bearer pat_your_token_here"

npm package

Claude Code

bash
claude mcp add --env AUTHN8_API_KEY=pat_your_token_here --transport stdio --scope user authn8 \  -- npx -y @authn8/mcp-server

--scope user makes the server available in all your projects. Leave it out to add it to the current project only.

Claude Desktop

Open Settings → Developer → Edit Config, or edit the file directly:

  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
  • Windows: %APPDATA%\Claude\claude_desktop_config.json
  • Linux: ~/.config/Claude/claude_desktop_config.json
json
{  "mcpServers": {    "authn8": {      "command": "npx",      "args": ["-y", "@authn8/mcp-server"],      "env": {        "AUTHN8_API_KEY": "pat_your_token_here"      }    }  }}

Quit and restart Claude Desktop after saving.

Cursor

Add this to ~/.cursor/mcp.json for all projects, or to .cursor/mcp.json in a project:

json
{  "mcpServers": {    "authn8": {      "command": "npx",      "args": ["-y", "@authn8/mcp-server"],      "env": {        "AUTHN8_API_KEY": "pat_your_token_here"      }    }  }}

Other clients

Run npx -y @authn8/mcp-server as a stdio server with AUTHN8_API_KEY set.

Environment variables

VariableRequiredDefaultDescription
AUTHN8_API_KEYYes-Your MCP token (pat_...)
AUTHN8_API_URLNohttps://api.authn8.comAPI base URL

On startup the server checks the token and prints the business name, token name, account count and expiry date to stderr. It exits if the token is missing or rejected.

Tools

All tools declare an output schema and return structuredContent alongside the text block, so clients get typed results without re-parsing JSON out of text.

list_accounts

Returns all 2FA accounts accessible to this token.

Example response:

json
{  "accounts": [    {      "id": "924c52a6-4457-4970-a39f-4dc620217683",      "name": "AWS Production",      "issuerDomain": "amazon.com"    }  ]}

get_otp

Generates a TOTP code for a specific account.

Parameters:

  • account_id (string, optional): UUID of the account
  • account_name (string, optional): name or issuer domain to search for (case-insensitive partial match)

Provide either account_id or account_name. If more than one account matches the name, the tool returns them in multipleMatches so you can retry with an account_id.

Example response:

json
{  "name": "AWS Production",  "code": "483920",  "length": 6}

Ambiguous match:

json
{  "error": "Multiple accounts match 'aws'. Please be more specific or use account_id.",  "length": 0,  "multipleMatches": [    {      "id": "924c52a6-4457-4970-a39f-4dc620217683",      "name": "AWS Production",      "issuerDomain": "amazon.com"    }  ]}

whoami

Returns information about the current token.

Example response:

json
{  "tokenName": "Claude Code",  "businessName": "Acme Ltd",  "scopedGroups": [    { "id": "cfeba14a-e990-49e8-b6e5-61d63f7d68c8", "name": "Engineering" }  ],  "expiresAt": "2027-06-30T23:59:59Z",  "accountCount": 12}

Links

Source: README.md at commit b27179e

Tools

0
This server asks for a credential such as an API key, so SourceWeft could not read its tools without one and has not indexed them.

Version history

1
  1. v1.1.3LatestNov 5, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts