A Model Context Protocol server that exposes MyOTP.App's OTP API to any MCP-compatible AI agent: Claude Desktop, Claude Code, Cursor, Windsurf, Codex, and anything else that speaks MCP.

Send and verify one-time passwords (SMS, WhatsApp, Telegram) directly from a chat with your agent, or from any app it builds.

What it does

Exposes 7 tools:

Tool	Purpose
`generate_otp`	Send an OTP via SMS, WhatsApp, or Telegram. Returns a `message_id`.
`verify_otp`	Verify a code submitted by an end user.
`check_otp_status`	Check delivery status / whether an OTP is still active.
`extend_otp`	Add more time to an active OTP without resending.
`get_account_info`	Sanity-check the API key and IP whitelist (calls `GET /me`).
`get_usage_report`	Paginated transaction history for a date range.
`create_account`	Programmatic onboarding (placeholder — see "Account creation" below).

All tools call the public MyOTP REST API at https://api.myotp.app. Override with the MYOTP_BASE_URL env var for staging.

Install

You don't need to install anything globally — npx will fetch and run the latest version on demand:

npx @myotp/mcp

Use the scoped name. myotp-mcp is the bin name inside the package, not a package on npm, so npx myotp-mcp does not resolve.

If you want to pin a version or install it locally:

npm install --save-dev @myotp/mcp

Get an API key

Sign up at myotp.app/sign-up/ — 15 free trial credits, no card required.
In the dashboard, generate an API key.
Add your machine's public IP (or * for testing) to the IP whitelist for that key.

Use it with Claude Desktop

Edit your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows):

{
  "mcpServers": {
    "myotp": {
      "command": "npx",
      "args": ["-y", "@myotp/mcp"],
      "env": {
        "MYOTP_API_KEY": "your-32-character-api-key"
      }
    }
  }
}

Restart Claude Desktop. Ask the agent: "Send a test OTP to my phone +1 415 555 1234." It will call generate_otp and report the message_id.

Use it with Claude Code

Add it to your project's .mcp.json:

{
  "mcpServers": {
    "myotp": {
      "command": "npx",
      "args": ["-y", "@myotp/mcp"],
      "env": {
        "MYOTP_API_KEY": "your-32-character-api-key"
      }
    }
  }
}

Or register it globally with the Claude Code CLI:

claude mcp add myotp -- npx -y @myotp/mcp
# Set the env var separately, then restart claude.

Use it with Cursor

Cursor reads the same .mcp.json format. Add to your workspace settings or .cursor/mcp.json:

{
  "mcpServers": {
    "myotp": {
      "command": "npx",
      "args": ["-y", "@myotp/mcp"],
      "env": {
        "MYOTP_API_KEY": "your-32-character-api-key"
      }
    }
  }
}

Use it with Codex CLI

Codex reads TOML, not JSON. Add to ~/.codex/config.toml:

[mcp_servers.myotp]
command = "npx"
args = ["-y", "@myotp/mcp"]

[mcp_servers.myotp.env]
MYOTP_API_KEY = "your-32-character-api-key"

Codex can also talk to the hosted server over HTTP instead of launching anything locally. It attaches the token as Authorization: Bearer, which the hosted endpoint accepts as an alias for X-API-Key:

[mcp_servers.myotp]
url = "https://mcp.myotp.app/mcp"
bearer_token_env_var = "MYOTP_API_KEY"

On older Codex builds that only pick up stdio servers, add experimental_use_rmcp_client = true above the entry.

If you use the hosted URL, add 108.61.176.199 to your API key's IP allowlist. Hosted calls reach the MyOTP API from that address rather than from your machine, and every call returns 403 until it is allowed. The stdio option above has no such requirement because the request leaves your own machine.

Use it with anything else

Any client that speaks MCP works. The stdio block is the same shape everywhere (command: npx, args: ["-y", "@myotp/mcp"], MYOTP_API_KEY in the environment), so Windsurf, Zed, Continue, OpenClaw, Hermes and Grokbot all take the JSON or TOML equivalent of the blocks above.

For a hosted client, point it at https://mcp.myotp.app/mcp and send your key as either X-API-Key or Authorization: Bearer. Use whichever one your client can actually set.

Transport modes

stdio (default — for local agent installs)

The server reads JSON-RPC messages from stdin and writes them to stdout. The API key comes from the MYOTP_API_KEY env var, set when the agent launches the server. This is the right mode for desktop apps like Claude Desktop, Claude Code, and Cursor.

MYOTP_API_KEY=sk_... npx @myotp/mcp
# or explicitly
MYOTP_API_KEY=sk_... npx @myotp/mcp --stdio

Streamable HTTP (for hosted servers)

Run an HTTP server that any MCP-compatible agent can point at. The API key is provided per-request via the X-API-Key header — so a single hosted instance can serve many tenants.

npx @myotp/mcp --http --port 3000
# or with the env switch
MYOTP_MCP_TRANSPORT=http PORT=3000 npx @myotp/mcp

The MCP endpoint is POST /mcp (also accepts GET and DELETE per the spec). Health check at GET /healthz.

This is what we host at https://mcp.myotp.app/mcp. Point your client at that URL and send X-API-Key: <your-key> on every request.

Configuration

Env var	Default	Description
`MYOTP_API_KEY`	—	Your MyOTP.App API key (required in stdio mode).
`MYOTP_BASE_URL`	`https://api.myotp.app`	API base URL. Override for staging.
`MYOTP_MCP_TRANSPORT`	`stdio`	Set to `http` to start in HTTP mode.
`PORT`	`3000`	HTTP listen port.
`HOST`	`0.0.0.0`	HTTP bind address.
`MCP_PATH`	`/mcp`	HTTP route for MCP traffic.

Example tool calls

Once the server is wired up, you can ask the agent things like:

"Send an OTP via WhatsApp to 14155551234."
"Use MyOTP to verify code 482913 for that phone number."
"Did the last OTP get delivered? Check status for message_id a1b2…."
"Show me my OTP usage for the last 7 days."
"How much credit do I have on this MyOTP account?"

Under the hood the agent will pick the right tool, validate inputs against the JSON Schema we publish, and call the MyOTP API.

Account creation

The create_account tool calls POST /v1/agent/register and currently returns a 404 with a friendly message asking the user to sign up at myotp.app/sign-up/ (~60 seconds, 15 free trial credits). The decision (2026-04-29) is to keep signup human-driven — the actual ongoing-friction unlock is autonomous USDC top-up via x402 for paid credits, not skipping the one-time signup.

A top_up_credits tool is shipping in a future release: when the agent's account exhausts paid credits mid-flow, top_up_credits returns an x402 challenge with a USDC deposit address on Base; the agent pays from a pre-funded wallet; settlement is verified via the Coinbase x402 facilitator and balance is credited in ~5-15 seconds. No human-in-the-loop after the initial wallet funding.

Develop

git clone https://github.com/broadnet/myotp-app
cd myotp-app/MyOTP.AgentKit/mcp-server
npm install
npm run build
npm run start:stdio   # or start:http

Security notes

This server never logs your API key.
In HTTP mode, the API key is only read from X-API-Key per request — there is no global key configured at startup.
The MyOTP API additionally enforces an IP whitelist; make sure the host running this server (or your end users' IPs in HTTP mode) are on the allow-list for the key in use.
Returning the OTP code in plain text (return_otp: true) is intended for testing only — never enable it in production user flows.