MyOTP.App

io.github.brntechPublished by GitHub account brntechv0.1.14Updated Oct 24, 2026

Send and verify one-time passcodes over SMS, WhatsApp and Telegram.

The publisher's own server: MobileValidate

VerifiedStreamable HTTPWeb executableFinanceCommunication & CollaborationSecurity & Monitoring

Overview

AI-generated overview

MyOTP.App server that lets an assistant send, verify, extend and track one-time passcodes over SMS, WhatsApp and Telegram, and manage the OTP account.

What you can do
Send one-time passcodes to a phone number over SMS, WhatsApp or Telegram and get a message ID back for later calls. Verify a code an end user submitted, check whether an OTP is still active and its delivery status, and extend an active OTP's expiry without resending. Read account details, email verification, balance and plan, and resend the verification email. Fetch paginated OTP transaction history for a date range of up to 31 days. Create a new agent account without a key, quote credit purchases, and start a credit top-up through a payment challenge.
When to use it
Useful when an assistant or an app it builds needs phone verification: sending login or signup codes, checking whether a code was delivered, or giving a user more time to enter it. Also suited to agents that manage their own MyOTP account and credits.
Requirements
Either the hosted endpoint or the npm package run locally with Node.js via npx. An API key is needed for most tools, supplied as the MYOTP_API_KEY environment variable for local use or the X-API-Key header (or a bearer token) for the hosted server; create_account and get_topup_quote work without one. Network access to the MyOTP API, and the calling IP must be on the key's allowlist.
Before you install
Sending OTPs costs credits, and top_up_credits can spend real money (USDC or card) with a 25-credit minimum and a $100 daily card cap. The API key is a secret; the hosted server reaches the API from a fixed address that must be allowlisted. A returned API key is shown only once. Returning the OTP code in plain text is for testing only. Sending messages to phone numbers and creating accounts write data and contact third parties.

Installation

In SourceWeft

  1. Open MyOTP.App in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.brntech%2Fmyotp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "myotp-app": {
      "type": "http",
      "url": "https://mcp.myotp.app/mcp"
    }
  }
}

README

@myotp/mcp — MyOTP.App MCP Server

[smithery badge]

A Model Context Protocol server that exposes MyOTP.App's OTP API to any MCP-compatible AI agent: Claude Desktop, Claude Code, Cursor, Windsurf, Codex, and anything else that speaks MCP.

Send and verify one-time passwords (SMS, WhatsApp, Telegram) directly from a chat with your agent, or from any app it builds.

What it does

Exposes 10 tools:

ToolPurpose
generate_otpSend an OTP via SMS, WhatsApp, or Telegram. Returns a message_id.
verify_otpVerify a code submitted by an end user.
check_otp_statusCheck delivery status / whether an OTP is still active.
extend_otpAdd more time to an active OTP without resending.
get_account_infoSanity-check the API key and IP whitelist (calls GET /me).
get_usage_reportPaginated transaction history for a date range.
create_accountCreate an agent account without an API key and return its one-time key.
get_account_statusCheck verification, balance, plan, and status; optionally resend verification.
get_topup_quoteQuote a credit purchase and return USDC and card payment commands.
top_up_creditsReturn an MPP payment challenge and retry details, or the credited result.

Every tool declares an outputSchema, so clients can type-check structuredContent; error results carry { error, status?, endpoint?, body? } with isError: true.

All tools call the public MyOTP REST API at https://api.myotp.app. Override with the MYOTP_BASE_URL env var for a mock server.

Install

You don't need to install anything globally — npx will fetch and run the latest version on demand:

bash
npx @myotp/mcp

Use the scoped name. myotp-mcp is the bin name inside the package, not a package on npm, so npx myotp-mcp does not resolve.

If you want to pin a version or install it locally:

bash
npm install --save-dev @myotp/mcp

Get an API key

Call create_account with an email address and optional name. It is the one account tool that needs no configured key. Save the returned API key immediately: it is shown once, and the new account starts with a zero balance. Configure that key as MYOTP_API_KEY for stdio or send it with hosted requests, then call get_topup_quote or top_up_credits to add credits.

The confirmation email requires a human click. Confirmation unlocks card top-ups; USDC top-ups work before confirmation. Human signup at myotp.app/sign-up/ remains available and follows the dashboard's email, phone, API-key, and IP-allowlist flow.

Use it with Claude Desktop

Edit your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows):

json
{  "mcpServers": {    "myotp": {      "command": "npx",      "args": ["-y", "@myotp/mcp"],      "env": {        "MYOTP_API_KEY": "your-32-character-api-key"      }    }  }}

Restart Claude Desktop. Ask the agent: "Send a test OTP to my phone +1 415 555 0123." It will call generate_otp and report the message_id.

Use it with Claude Code

Add it to your project's .mcp.json:

json
{  "mcpServers": {    "myotp": {      "command": "npx",      "args": ["-y", "@myotp/mcp"],      "env": {        "MYOTP_API_KEY": "your-32-character-api-key"      }    }  }}

Or register it globally with the Claude Code CLI:

bash
claude mcp add myotp -- npx -y @myotp/mcp# Set the env var separately, then restart claude.

Use it with Cursor

Cursor reads the same .mcp.json format. Add to your workspace settings or .cursor/mcp.json:

json
{  "mcpServers": {    "myotp": {      "command": "npx",      "args": ["-y", "@myotp/mcp"],      "env": {        "MYOTP_API_KEY": "your-32-character-api-key"      }    }  }}

Gateways that pass config in the URL

Some MCP gateways deliver per-user settings as query parameters rather than headers. The hosted server accepts ?apiKey=<key> (also ?api_key=, or a base64url ?config= JSON blob with an apiKey field) as a fallback. A key in the X-API-Key or Authorization: Bearer header always wins over one in the URL. On Smithery, the config schema maps the key to the x-api-key header, so no URL parameter is needed there.

Use it with Codex CLI

Codex reads TOML, not JSON. Add to ~/.codex/config.toml:

toml
[mcp_servers.myotp]command = "npx"args = ["-y", "@myotp/mcp"]
[mcp_servers.myotp.env]MYOTP_API_KEY = "your-32-character-api-key"

Codex can also talk to the hosted server over HTTP instead of launching anything locally. It attaches the token as Authorization: Bearer, which the hosted endpoint accepts as an alias for X-API-Key:

toml
[mcp_servers.myotp]url = "https://mcp.myotp.app/mcp"bearer_token_env_var = "MYOTP_API_KEY"

On older Codex builds that only pick up stdio servers, add experimental_use_rmcp_client = true above the entry.

If you use the hosted URL, add 108.61.176.199 to your API key's IP allowlist. Hosted calls reach the MyOTP API from that address rather than from your machine, and every call returns 403 until it is allowed. The stdio option above has no such requirement because the request leaves your own machine.

Use it with anything else

Any client that speaks MCP works. The stdio block is the same shape everywhere (command: npx, args: ["-y", "@myotp/mcp"], MYOTP_API_KEY in the environment), so Windsurf, Zed, Continue, OpenClaw, Hermes and Grokbot all take the JSON or TOML equivalent of the blocks above.

For a hosted client, point it at https://mcp.myotp.app/mcp and send your key as either X-API-Key or Authorization: Bearer. Use whichever one your client can actually set.

Transport modes

stdio (default — for local agent installs)

The server reads JSON-RPC messages from stdin and writes them to stdout. The API key comes from the MYOTP_API_KEY env var, set when the agent launches the server. This is the right mode for desktop apps like Claude Desktop, Claude Code, and Cursor.

bash
MYOTP_API_KEY=sk_... npx @myotp/mcp# or explicitlyMYOTP_API_KEY=sk_... npx @myotp/mcp --stdio

Streamable HTTP (for hosted servers)

Run an HTTP server that any MCP-compatible agent can point at. Authenticated tools receive the API key per request via X-API-Key, so one hosted instance can serve many tenants; anonymous tools do not require the header.

bash
npx @myotp/mcp --http --port 3000# or with the env switchMYOTP_MCP_TRANSPORT=http PORT=3000 npx @myotp/mcp

The MCP endpoint is POST /mcp (also accepts GET and DELETE per the spec). Health check at GET /healthz.

This is what we host at https://mcp.myotp.app/mcp. Point your client at that URL and send X-API-Key: <your-key> on authenticated tool requests.

Configuration

Env varDefaultDescription
MYOTP_API_KEY—Your MyOTP.App API key. Required for authenticated tools; create_account and get_topup_quote work without it.
MYOTP_BASE_URLhttps://api.myotp.appAPI base URL. Override for a mock server.
MYOTP_MCP_TRANSPORTstdioSet to http to start in HTTP mode.
PORT3000HTTP listen port.
HOST0.0.0.0HTTP bind address.
MCP_PATH/mcpHTTP route for MCP traffic.
MCP_SESSION_IDLE_MS1800000HTTP mode: close a session after this long with no requests. The client gets 404 and re-initializes.
MCP_SESSION_BUSY_MS3600000HTTP mode: close a session whose open request (such as an SSE stream) started longer ago than this.
MCP_MAX_SESSIONS1000HTTP mode: most sessions held at once; a new session closes the least recently used one, idle sessions first.

Example tool calls

Once the server is wired up, you can ask the agent things like:

  • "Send an OTP via WhatsApp to 14155550123."
  • "Use MyOTP to verify code 482913 for that phone number."
  • "Did the last OTP get delivered? Check status for message_id a1b2…."
  • "Show me my OTP usage for the last 7 days."
  • "How much credit do I have on this MyOTP account?"
  • "Create a MyOTP agent account for [email protected]."
  • "Check whether my agent account email is verified, and resend the email if needed."
  • "Quote 500 more MyOTP credits."
  • "That send failed with NoBalance. Top up 100 credits."

Under the hood the agent will pick the right tool, validate inputs against the JSON Schema we publish, and call the MyOTP API.

Buying credits as an agent

Agents can buy MyOTP credits by themselves: one 402, one payment, no checkout page, no card form. Credits cost $0.02 each, with a 25-credit ($0.50) minimum and a 50,000-credit maximum per call. Card top-ups are capped at $100 per account per rolling 24 hours; USDC is uncapped. A trial account moves to the Starter pay-as-you-go pricing table on its first top-up, without creating a subscription.

When an OTP send returns HTTP 403 insufficient balance or NoBalance, call get_topup_quote to inspect the price or call top_up_credits to start the purchase. top_up_credits fetches the quote first, then posts to /v1/topup with the configured API key and no payment credential. The expected 402 response contains MPP offers for USDC on Tempo and, while the card cap permits, card or Link through Stripe. The tool returns the decoded offers, challenge ID, exact retry URL and body, and headers with credential placeholders.

The MCP server cannot hold the agent's wallet. Run one of the returned commands with your MyOTP API key replaced locally; the MPP client pays and retries the same request with its payment credential. That retry credits the account. If the runtime already wraps fetch with an MPP credential provider, the tool can receive and return the successful credited response directly.

USDC wallet (creating an mppx account makes a wallet, and testnet auto-funds):

bash
npx -y [email protected] https://api.myotp.app/v1/topup -X POST -H "x-api-key: your MyOTP API key" -H "content-type: application/json" -d "{\"credits\":100}"

Card or Link wallet (run npx @stripe/link-cli auth login once first):

bash
npx -y @stripe/link-cli mpp pay https://api.myotp.app/v1/topup -X POST -d "{\"credits\":100}" -H "x-api-key: your MyOTP API key" --context "Buying MyOTP.App credits to send one-time passcodes over SMS, WhatsApp and Telegram for phone verification in my app."

Account creation

The create_account tool calls the live unauthenticated POST /v1/agent/register endpoint with an email and optional name. The response contains the full account record and a 32-character API key that is shown once. Save it immediately and set MYOTP_API_KEY (or configure the hosted client to send it). Agent accounts have an open IP allowlist, need no phone verification, and start with balance 0 and the Starter pay-as-you-go plan.

A confirmation email is sent to the supplied address. A human must click the link within 24 hours to unlock card top-ups; USDC top-ups work immediately. Use get_account_status to check email_verified, balance, plan, and account status, or call it with resend_verification: true to send another email. Then use get_topup_quote or top_up_credits to fund the account before sending an OTP.

Develop

bash
git clone https://github.com/brntech/myotp-agentkitcd myotp-agentkit/mcp-servernpm installnpm run buildnpm run start:stdio   # or start:http

Security notes

  • This server never logs your API key.
  • In HTTP mode, the API key is only read from X-API-Key per request — there is no global key configured at startup.
  • The MyOTP API additionally enforces an IP whitelist; make sure the host running this server (or your end users' IPs in HTTP mode) are on the allow-list for the key in use.
  • Returning the OTP code in plain text (return_otp: true) is intended for testing only — never enable it in production user flows.

License

MIT — see LICENSE.

Built by BroadNet Technologies. Questions? [email protected].

Source: mcp-server/README.md at commit 1842171

Tools

10

generate_otp

Send OTP

Send a one-time password (OTP) to a phone number via SMS, WhatsApp, or Telegram. MyOTP.App generates the code, formats the message, picks the best carrier route, and delivers it. Returns a `message_id` (UUID) — keep it; you'll pass it to `verify_otp`, `check_otp_status`, or `extend_otp` later. Each call deducts credits from the account balance; the per-message cost varies by destination country and channel and is returned in the `cost` field. Use this whenever an app needs to verify someone's phone — signup, login 2FA, password reset, transaction confirmation, etc.

Parametersbrandchannelotp_codeforce_sendotp_lengthreturn_otpotp_validityphone_numberrequiredtemplate_order

verify_otp

Verify OTP

Verify a code submitted by an end user against the OTP MyOTP delivered. Returns `{status: 'success'}` if the code matches and the OTP hasn't expired — at that point the OTP is consumed and cannot be reused. Returns `{status: 'failed', reason: 'invalid' | 'expired' | 'not found'}` otherwise. You MUST pass either `phone_number` or `message_id` to identify which OTP you're verifying against. Call this after collecting the code from the user (login form, signup screen, etc.).

Parametersotprequiredmessage_idphone_number

check_otp_status

Check OTP delivery status

Check whether a previously sent OTP is still active and (with DLR_ACCESS entitlement on Enterprise plan) get its delivery status. Returns `is_active` (bool) and `expires_at` (ISO timestamp) on every plan. On Enterprise plans, also returns `DLR`: 'delivered', 'sent', 'read', 'pending', or a failure as `failed.<reason>` (on WhatsApp, `failed.Undeliverable` means the number cannot receive WhatsApp and `failed.Provider` means a retry is worth it). Useful when an end user reports they didn't receive the code — you can confirm whether MyOTP delivered it before deciding to resend. Does NOT verify a code; use `verify_otp` for that.

Parametersmessage_idrequired

extend_otp

Extend OTP expiry

Extend the expiry time of an active OTP without sending a new one. Useful when the end user is taking longer than expected to enter the code (e.g., switched apps, dealing with carrier delivery delay). Adds `duration` seconds (60-14400) to the current `expires_at`. Requires the EXTEND_OTP entitlement (Business or Enterprise plan). Some destination countries don't allow extensions — the API will return 403 in that case. Cheaper and less spammy than calling `generate_otp` again.

Parametersdurationrequiredmessage_idrequired

get_account_info

Get account info

Return account details for the API key in use. Always returns at least the account `email`; depending on plan and platform version may also return balance/credit/plan info. Use this as a sanity check when wiring up MyOTP for the first time — if this call succeeds, your API key and IP whitelist are configured correctly.

Takes no parameters.

get_usage_report

Get usage report

Fetch a paginated list of OTP transactions for a date range. Each transaction includes message_id, timestamp, phone_number, channel, country, cost, status, and the originating client IP. Date range cannot exceed 31 days. Defaults: last 7 days, page 1, 10 per page. Requires the API_REPORTING entitlement (Business or Enterprise plan). Use this to: audit recent activity, build internal dashboards, reconcile billing, or debug delivery issues across many recipients.

Parameterspageend_dateper_pagestart_date

create_account

Create a MyOTP agent account

Create a MyOTP.App agent account and return its one-time API key. No API key is required for this tool. The new account starts with zero balance; USDC top-ups work immediately, while card top-ups unlock after a human confirms the email address.

Parametersnameemailrequired

get_account_status

Get agent account status

Return email verification, balance, plan, and status for the configured MyOTP agent account. Set resend_verification to request another confirmation email first. Unverified accounts can top up with USDC, but cards stay locked.

Parametersresend_verification

get_topup_quote

Get a MyOTP credit top-up quote

Get the live price and payment options for buying MyOTP credits, without making a purchase. Use this when generate_otp or another send fails with HTTP 403 insufficient balance / NoBalance, or before calling `top_up_credits` to show the cost. Returns USDC and card client commands and never exposes the configured API key.

Parameterscredits

top_up_credits

Buy MyOTP credits

Prepare or complete an autonomous MyOTP credit purchase with USDC or card through Machine Payments Protocol (MPP). Use this when generate_otp or another send fails with HTTP 403 insufficient balance / NoBalance. The tool quotes first, then returns a structured 402 challenge and exact retry details for the agent's own MPP client; if fetch is already wrapped by a credential-carrying MPP runtime, it returns the credited response directly.

Parameterscreditsrequireddry_run

Version history

3
  1. v0.1.14LatestOct 13, 2026
  2. v0.1.13Sep 21, 2026
  3. v0.1.12Sep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Mobilevalidate integrations

MobileValidate

com.mobilevalidateOfficial publisher

MobileValidate lets an AI assistant check phone numbers (WhatsApp, Telegram, carrier, spam reputation) and e-mail addresses through a paid validation API.

Streamable HTTPWeb executableAuth
Communication & CollaborationCredential requiredOct 24, 2026