A Model Context Protocol server that exposes MyOTP.App's OTP API to any MCP-compatible AI agent: Claude Desktop, Claude Code, Cursor, Windsurf, Codex, and anything else that speaks MCP.

Send and verify one-time passwords (SMS, WhatsApp, Telegram) directly from a chat with your agent, or from any app it builds.

What it does

Exposes 9 tools:

Tool	Purpose
`generate_otp`	Send an OTP via SMS, WhatsApp, or Telegram. Returns a `message_id`.
`verify_otp`	Verify a code submitted by an end user.
`check_otp_status`	Check delivery status / whether an OTP is still active.
`extend_otp`	Add more time to an active OTP without resending.
`get_account_info`	Sanity-check the API key and IP whitelist (calls `GET /me`).
`get_usage_report`	Paginated transaction history for a date range.
`create_account`	Programmatic onboarding (placeholder — see "Account creation" below).
`get_topup_quote`	Quote a credit purchase and return USDC and card payment commands.
`top_up_credits`	Return an MPP payment challenge and retry details, or the credited result.

All tools call the public MyOTP REST API at https://api.myotp.app. Override with the MYOTP_BASE_URL env var for staging.

Install

You don't need to install anything globally — npx will fetch and run the latest version on demand:

npx @myotp/mcp

Use the scoped name. myotp-mcp is the bin name inside the package, not a package on npm, so npx myotp-mcp does not resolve.

If you want to pin a version or install it locally:

npm install --save-dev @myotp/mcp

Get an API key

Sign up at myotp.app/sign-up/ — 15 free trial credits, no card required.
In the dashboard, generate an API key.
Add your machine's public IP (or * for testing) to the IP whitelist for that key.

Use it with Claude Desktop

Edit your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows):

{
  "mcpServers": {
    "myotp": {
      "command": "npx",
      "args": ["-y", "@myotp/mcp"],
      "env": {
        "MYOTP_API_KEY": "your-32-character-api-key"
      }
    }
  }
}

Restart Claude Desktop. Ask the agent: "Send a test OTP to my phone +1 415 555 1234." It will call generate_otp and report the message_id.

Use it with Claude Code

Add it to your project's .mcp.json:

{
  "mcpServers": {
    "myotp": {
      "command": "npx",
      "args": ["-y", "@myotp/mcp"],
      "env": {
        "MYOTP_API_KEY": "your-32-character-api-key"
      }
    }
  }
}

Or register it globally with the Claude Code CLI:

claude mcp add myotp -- npx -y @myotp/mcp
# Set the env var separately, then restart claude.

Use it with Cursor

Cursor reads the same .mcp.json format. Add to your workspace settings or .cursor/mcp.json:

{
  "mcpServers": {
    "myotp": {
      "command": "npx",
      "args": ["-y", "@myotp/mcp"],
      "env": {
        "MYOTP_API_KEY": "your-32-character-api-key"
      }
    }
  }
}

Use it with Codex CLI

Codex reads TOML, not JSON. Add to ~/.codex/config.toml:

[mcp_servers.myotp]
command = "npx"
args = ["-y", "@myotp/mcp"]

[mcp_servers.myotp.env]
MYOTP_API_KEY = "your-32-character-api-key"

Codex can also talk to the hosted server over HTTP instead of launching anything locally. It attaches the token as Authorization: Bearer, which the hosted endpoint accepts as an alias for X-API-Key:

[mcp_servers.myotp]
url = "https://mcp.myotp.app/mcp"
bearer_token_env_var = "MYOTP_API_KEY"

On older Codex builds that only pick up stdio servers, add experimental_use_rmcp_client = true above the entry.

If you use the hosted URL, add 108.61.176.199 to your API key's IP allowlist. Hosted calls reach the MyOTP API from that address rather than from your machine, and every call returns 403 until it is allowed. The stdio option above has no such requirement because the request leaves your own machine.

Use it with anything else

Any client that speaks MCP works. The stdio block is the same shape everywhere (command: npx, args: ["-y", "@myotp/mcp"], MYOTP_API_KEY in the environment), so Windsurf, Zed, Continue, OpenClaw, Hermes and Grokbot all take the JSON or TOML equivalent of the blocks above.

For a hosted client, point it at https://mcp.myotp.app/mcp and send your key as either X-API-Key or Authorization: Bearer. Use whichever one your client can actually set.

Transport modes

stdio (default — for local agent installs)

The server reads JSON-RPC messages from stdin and writes them to stdout. The API key comes from the MYOTP_API_KEY env var, set when the agent launches the server. This is the right mode for desktop apps like Claude Desktop, Claude Code, and Cursor.

MYOTP_API_KEY=sk_... npx @myotp/mcp
# or explicitly
MYOTP_API_KEY=sk_... npx @myotp/mcp --stdio

Streamable HTTP (for hosted servers)

Run an HTTP server that any MCP-compatible agent can point at. The API key is provided per-request via the X-API-Key header — so a single hosted instance can serve many tenants.

npx @myotp/mcp --http --port 3000
# or with the env switch
MYOTP_MCP_TRANSPORT=http PORT=3000 npx @myotp/mcp

The MCP endpoint is POST /mcp (also accepts GET and DELETE per the spec). Health check at GET /healthz.

This is what we host at https://mcp.myotp.app/mcp. Point your client at that URL and send X-API-Key: <your-key> on every request.

Configuration

Env var	Default	Description
`MYOTP_API_KEY`	—	Your MyOTP.App API key (required in stdio mode).
`MYOTP_BASE_URL`	`https://api.myotp.app`	API base URL. Override for staging.
`MYOTP_MCP_TRANSPORT`	`stdio`	Set to `http` to start in HTTP mode.
`PORT`	`3000`	HTTP listen port.
`HOST`	`0.0.0.0`	HTTP bind address.
`MCP_PATH`	`/mcp`	HTTP route for MCP traffic.

Example tool calls

Once the server is wired up, you can ask the agent things like:

"Send an OTP via WhatsApp to 14155551234."
"Use MyOTP to verify code 482913 for that phone number."
"Did the last OTP get delivered? Check status for message_id a1b2…."
"Show me my OTP usage for the last 7 days."
"How much credit do I have on this MyOTP account?"
"Quote 500 more MyOTP credits."
"That send failed with NoBalance. Top up 100 credits."

Under the hood the agent will pick the right tool, validate inputs against the JSON Schema we publish, and call the MyOTP API.

Buying credits as an agent

Agents can buy MyOTP credits by themselves: one 402, one payment, no checkout page, no card form. Credits cost $0.02 each, with a 25-credit ($0.50) minimum and a 50,000-credit maximum per call. Card top-ups are capped at $100 per account per rolling 24 hours; USDC is uncapped. A trial account moves to the Starter pay-as-you-go pricing table on its first top-up, without creating a subscription.

When an OTP send returns HTTP 403 insufficient balance or NoBalance, call get_topup_quote to inspect the price or call top_up_credits to start the purchase. top_up_credits fetches the quote first, then posts to /v1/topup with the configured API key and no payment credential. The expected 402 response contains MPP offers for USDC on Tempo and, while the card cap permits, card or Link through Stripe. The tool returns the decoded offers, challenge ID, exact retry URL and body, and headers with credential placeholders.

The MCP server cannot hold the agent's wallet. Run one of the returned commands with your MyOTP API key replaced locally; the MPP client pays and retries the same request with its payment credential. That retry credits the account. If the runtime already wraps fetch with an MPP credential provider, the tool can receive and return the successful credited response directly.

USDC wallet (creating an mppx account makes a wallet, and testnet auto-funds):

npx -y mppx@0.9.2 https://api.myotp.app/v1/topup -X POST -H "x-api-key: your MyOTP API key" -H "content-type: application/json" -d "{\"credits\":100}"

Card or Link wallet (run npx @stripe/link-cli auth login once first):

npx -y @stripe/link-cli mpp pay https://api.myotp.app/v1/topup -X POST -d "{\"credits\":100}" -H "x-api-key: your MyOTP API key" --context "MyOTP credits"

Account creation

The create_account tool calls POST /v1/agent/register and currently returns a 404 with a friendly message asking the user to sign up at myotp.app/sign-up/ (~60 seconds, 15 free trial credits). Signup remains human-driven. After the user supplies the API key, paid top-up is live through top_up_credits with USDC or card.

Develop

git clone https://github.com/broadnet/myotp-app
cd myotp-app/MyOTP.AgentKit/mcp-server
npm install
npm run build
npm run start:stdio   # or start:http

Security notes

This server never logs your API key.
In HTTP mode, the API key is only read from X-API-Key per request — there is no global key configured at startup.
The MyOTP API additionally enforces an IP whitelist; make sure the host running this server (or your end users' IPs in HTTP mode) are on the allow-list for the key in use.
Returning the OTP code in plain text (return_otp: true) is intended for testing only — never enable it in production user flows.