MyOTP.App
REMOTE · MCP.MYOTP.APP · 2 COMPONENTS · SCANNED SEP 21
Send and verify one-time passcodes over SMS, WhatsApp and Telegram.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security60
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (top_up_credits). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability68
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2177 tokens (~217/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management60
- Stability observed for 18 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the MyOTP.App MCP server?
MyOTP.App is a hosted endpoint at https://mcp.myotp.app/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.myotp.app
claude mcp add --transport http brntech-myotp 'https://mcp.myotp.app/mcp'
{
"mcpServers": {
"brntech-myotp": {
"url": "https://mcp.myotp.app/mcp"
}
}
} {
"servers": {
"brntech-myotp": {
"type": "http",
"url": "https://mcp.myotp.app/mcp"
}
}
} [mcp_servers.brntech-myotp] url = "https://mcp.myotp.app/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"brntech-myotp": {
"type": "remote",
"url": "https://mcp.myotp.app/mcp",
"enabled": true
}
}
} openclaw mcp add brntech-myotp --url 'https://mcp.myotp.app/mcp' --transport streamable-http
mcp_servers:
brntech-myotp:
url: "https://mcp.myotp.app/mcp" {
"McpServers": {
"brntech-myotp": {
"Transport": "http",
"Url": "https://mcp.myotp.app/mcp"
}
}
} assistant mcp add brntech-myotp -t streamable-http -u 'https://mcp.myotp.app/mcp'
{
"mcpServers": {
"brntech-myotp": {
"type": "http",
"url": "https://mcp.myotp.app/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Sept 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “check_otp_status” rewrote its description, which is the text the model reads security
- Server version: 0.1.12 → 0.1.13 functional
- “generate_otp” reworded the description of “template_order” cosmetic
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 8 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 6 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Probed https://mcp.myotp.app/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=mcp.myotp.app | CN=YR1,O=Let's Encrypt,C=US | 2 Sept 2026 | 1 Dec 2026 | RSA 2048 | SHA256-RSA | 6c187c0d8359999e21f6f51b5ffaa65e605 |
| SANs: mcp.myotp.app | ||||||
| CN=YR1,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | a20253f15f2691c05dc1ce13b9bcca4e |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of mcp.myotp.app. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| app. | present | 23684 | 8 | Verified |
| myotp.app. | present | 27370 | 8 | Verified |
| mcp.myotp.app. | Verified address RRset verified with the apex keys |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.myotp.app/mcp | Verified | 200 | |
| http (plaintext) | http://mcp.myotp.app/mcp | HTTPS enforced | 301 | https://mcp.myotp.app/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_otp_status Check OTP delivery status ~188
Check whether a previously sent OTP is still active and (with DLR_ACCESS entitlement on Enterprise plan) get its delivery status. Returns `is_active` (bool) and `expires_at` (ISO timestamp) on every plan. On Enterprise plans, also returns `DLR`: 'delivered', 'sent', 'read', 'pending', or a failure as `failed.<reason>` (on WhatsApp, `failed.Undeliverable` means the number cannot receive WhatsApp and `failed.Provider` means a retry is worth it). Useful when an end user reports they didn't receive the code — you can confirm whether MyOTP delivered it before deciding to resend. Does NOT verify a code; use `verify_otp` for that.
| Name | Type | Req | Description |
|---|---|---|---|
| message_id | string | yes | The UUID returned by `generate_otp` — this identifies which OTP you want a status report on. |
| Name | Type | Req | Description |
|---|---|---|---|
| DLR | string | – | Delivery state: carrier status (ATES, DELIVRD, UNDELIV, EXPIRED, REJECTD) or sent/delivered/read/pending/failed.<reason>, a 'Pending: ...' hint, or a 'Not available ...' explanation. Absent when the… |
| DLR: | string | – | Deprecated alias of DLR. |
| Message: | string | – | Deprecated alias of message. |
| expires_at | string | – | ISO 8601 date-time the OTP expires. Absent when the message_id is unknown. |
| is_active | boolean | – | Whether the OTP can still be verified (it has not expired). |
| message | string | – | Present instead of DLR when the message_id is not found. |
No examples provided.
create_account Create a MyOTP agent account ~96
Create a MyOTP.App agent account and return its one-time API key. No API key is required for this tool. The new account starts with zero balance; USDC top-ups work immediately, while card top-ups unlock after a human confirms the email address.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Email address for the new MyOTP.App account. | |
| name | string | – | Optional account, company, or product name (maximum 64 characters). |
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | yes | Account identifier, 'a' followed by 12 hex characters. |
| api_key | string | yes | The API key. Shown once, in this response only. Send it as the X-API-Key header. |
| api_key_note | string | – | – |
| balance | number | yes | Credits on the balance. Zero at registration. |
| docs | string | – | – |
| string | yes | – | |
| email_verified | boolean | yes | True once the human has confirmed the emailed link. Unlocks card top-ups. |
| plan_id | integer | yes | – |
| status | string | yes | Account status, 'active' when the key can be used. |
| topup | object | – | Where to buy credits. |
| verification_email_sent | boolean | – | Whether the confirmation email was queued. |
No examples provided.
extend_otp Extend OTP expiry ~180
Extend the expiry time of an active OTP without sending a new one. Useful when the end user is taking longer than expected to enter the code (e.g., switched apps, dealing with carrier delivery delay). Adds `duration` seconds (60-14400) to the current `expires_at`. Requires the EXTEND_OTP entitlement (Business or Enterprise plan). Some destination countries don't allow extensions — the API will return 403 in that case. Cheaper and less spammy than calling `generate_otp` again.
| Name | Type | Req | Description |
|---|---|---|---|
| duration | integer | yes | Additional seconds to add to the OTP's expiry. Range 60-14400 (1 minute to 4 hours). The new expiry will be the current expiry + this duration. |
| message_id | string | yes | The UUID returned by `generate_otp` — identifies the OTP you want to extend. |
| Name | Type | Req | Description |
|---|---|---|---|
| expires_at | string | yes | The new ISO 8601 expiry date-time. |
| message | string | yes | Message describing the result. |
| status | string | yes | Status of the request. |
No examples provided.
generate_otp Send OTP ~663
Send a one-time password (OTP) to a phone number via SMS, WhatsApp, or Telegram. MyOTP.App generates the code, formats the message, picks the best carrier route, and delivers it. Returns a `message_id` (UUID) — keep it; you'll pass it to `verify_otp`, `check_otp_status`, or `extend_otp` later. Each call deducts credits from the account balance; the per-message cost varies by destination country and channel and is returned in the `cost` field. Use this whenever an app needs to verify someone's phone — signup, login 2FA, password reset, transaction confirmation, etc.
| Name | Type | Req | Description |
|---|---|---|---|
| brand | string | – | Sender brand name shown to the recipient (3-16 alphanumeric characters plus dots). Defaults to the brand registered against the API key, or 'MyOTP.App' if none. |
| channel | string | – | Delivery channel. 'sms' (default) works in 190+ countries. 'whatsapp' is best for India/Brazil/Indonesia/Mexico/Nigeria/Turkey. 'telegram' is best for privacy-focused users. Same API for all three. |
| force_send | boolean | – | If true, send a new OTP even if one is already active for this phone number. By default the API returns 409 in that case. Use sparingly — repeated sends to the same number can hit carrier-level spam… |
| otp_code | string | – | Provide your own pre-generated numeric OTP code (3-8 digits, 4-8 for telegram) instead of letting MyOTP generate one. Useful when you already have a code from another system. |
| otp_length | integer | – | Number of digits in the auto-generated OTP. Range 3-8 (4-8 for telegram). Default 6. Requires CUSTOM_OTP_LENGTH entitlement (Business plan or above). |
| otp_validity | integer | – | How long the OTP stays valid, in seconds. Range 30-14400 (30-3600 for telegram). Default 300 (5 minutes). Requires CUSTOM_OTP_EXPIRY entitlement (Business plan or above). |
| phone_number | string | yes | Destination phone number in international format with NO leading + or 0. Must be 7-15 digits and start with a non-zero digit. Example: '14155551234' for a US number, '447911123456' for a UK number. |
| return_otp | boolean | – | If true, the API response will include the generated OTP code in plain text. Useful for testing or when you want to deliver the OTP via your own channel. Defaults to false. SECURITY: never enable thi… |
| template_order | integer | – | Pick a specific message template by its order number (1-99). WhatsApp has four: 12 (English, 5-minute code), 13 (English, 10 minutes), 14 (Spanish es_MX, 5 minutes), 15 (Spanish es_MX, 10 minutes). O… |
| Name | Type | Req | Description |
|---|---|---|---|
| cost | number | yes | Credits charged for this send. |
| date_sent | string | yes | ISO 8601 date-time the OTP was sent. |
| expires_at | string | yes | ISO 8601 date-time the OTP expires. |
| message | string | yes | Message describing the status of the request. |
| message_id | string | yes | ID of the message sent. Pass it to verify_otp, check_otp_status and extend_otp. |
| otp | string | – | The OTP value, present only when return_otp was true. |
| status | string | yes | Always 'accepted' on success; delivery state comes from check_otp_status. |
No examples provided.
get_account_info Get account info ~75
Return account details for the API key in use. Always returns at least the account `email`; depending on plan and platform version may also return balance/credit/plan info. Use this as a sanity check when wiring up MyOTP for the first time — if this call succeeds, your API key and IP whitelist are configured correctly.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Email address of the account the API key belongs to. |
No examples provided.
get_account_status Get agent account status ~70
Return email verification, balance, plan, and status for the configured MyOTP agent account. Set resend_verification to request another confirmation email first. Unverified accounts can top up with USDC, but cards stay locked.
| Name | Type | Req | Description |
|---|---|---|---|
| resend_verification | boolean | – | Send another confirmation email before returning account status. |
| Name | Type | Req | Description |
|---|---|---|---|
| balance | number | yes | Credits on the balance. |
| email_verified | boolean | yes | True once the human has confirmed the emailed link. Unlocks card top-ups. |
| hint | string | yes | What to do next: verify the email, top up, or start sending. |
| plan_id | integer | yes | – |
| status | string | yes | Account status, 'active' when the key can be used. |
No examples provided.
get_topup_quote Get a MyOTP credit top-up quote ~104
Get the live price and payment options for buying MyOTP credits, without making a purchase. Use this when generate_otp or another send fails with HTTP 403 insufficient balance / NoBalance, or before calling `top_up_credits` to show the cost. Returns USDC and card client commands and never exposes the configured API key.
| Name | Type | Req | Description |
|---|---|---|---|
| credits | integer | – | Number of credits to quote. Integer from 25 to 50,000; defaults to 100. |
| Name | Type | Req | Description |
|---|---|---|---|
| amount_usd | string | yes | Total price in US dollars, as a decimal string. |
| credits | integer | yes | The number of credits priced. |
| currency | string | yes | Always 'usd'. |
| how_to_pay | object | yes | Ready-to-run client commands for this amount. |
| max_credits | integer | yes | – |
| methods | array | yes | Human-readable list of the accepted payment methods. |
| min_credits | integer | yes | – |
| price_per_credit_usd | number | yes | Unit price. Currently 0.02. |
| rules | string | yes | Top-up limits: unit price, minimum, maximum and the card cap. |
No examples provided.
get_usage_report Get usage report ~226
Fetch a paginated list of OTP transactions for a date range. Each transaction includes message_id, timestamp, phone_number, channel, country, cost, status, and the originating client IP. Date range cannot exceed 31 days. Defaults: last 7 days, page 1, 10 per page. Requires the API_REPORTING entitlement (Business or Enterprise plan). Use this to: audit recent activity, build internal dashboards, reconcile billing, or debug delivery issues across many recipients.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | string | – | End date in YYYY-MM-DD format (UTC). If omitted, defaults to today. The range start_date..end_date cannot exceed 31 days. |
| page | integer | – | Page number for paginated results, starting at 1. Default 1. |
| per_page | integer | – | Results per page, 1-100. Default 10. |
| start_date | string | – | Start date in YYYY-MM-DD format (UTC). If omitted, defaults to 7 days before today. The range start_date..end_date cannot exceed 31 days. |
| Name | Type | Req | Description |
|---|---|---|---|
| current_page | integer | – | The page returned. |
| message | string | – | Present when the endpoint has no data for the range. |
| per_page | integer | – | Rows per page. |
| total_count | integer | – | Total transactions matching the date range. |
| total_pages | integer | – | Number of pages at the requested per_page. |
| transactions | array | – | Transaction rows for the page. May be empty or absent when there is no data. |
No examples provided.
top_up_credits Buy MyOTP credits ~142
Prepare or complete an autonomous MyOTP credit purchase with USDC or card through Machine Payments Protocol (MPP). Use this when generate_otp or another send fails with HTTP 403 insufficient balance / NoBalance. The tool quotes first, then returns a structured 402 challenge and exact retry details for the agent's own MPP client; if fetch is already wrapped by a credential-carrying MPP runtime, it returns the credited response directly.
| Name | Type | Req | Description |
|---|---|---|---|
| credits | integer | yes | Number of credits to buy. Integer from 25 to 50,000. |
| dry_run | boolean | – | If true, return only the quote and explanation without requesting a payment challenge. |
| Name | Type | Req | Description |
|---|---|---|---|
| amount_usd | string | – | Amount paid in US dollars (settled result). |
| balance | number | – | Account balance in credits after the top-up (settled result). |
| challengeId | string | – | The MPP challenge id from the 402 response. |
| credits | integer | – | Credits bought in this call (settled result). |
| currency | string | – | – |
| explanation | string | – | What happened and what the caller must do next (dry run and 402 results). |
| how_to_pay | object | – | Ready-to-run client commands (402 result). |
| offers | array | – | Decoded Payment offers from the WWW-Authenticate challenge (402 result). |
| payment | object | – | Payment method and reference (settled result). |
| plan_id | integer | – | – |
| quote | object | – | The quote for the requested credits (dry run and 402 results). |
| retry | object | – | The request to replay with a payment credential (402 result). |
| status | string | – | 'credited' or 'already_credited' (settled result). |
No examples provided.
verify_otp Verify OTP ~238
Verify a code submitted by an end user against the OTP MyOTP delivered. Returns `{status: 'success'}` if the code matches and the OTP hasn't expired — at that point the OTP is consumed and cannot be reused. Returns `{status: 'failed', reason: 'invalid' | 'expired' | 'not found'}` otherwise. You MUST pass either `phone_number` or `message_id` to identify which OTP you're verifying against. Call this after collecting the code from the user (login form, signup screen, etc.).
| Name | Type | Req | Description |
|---|---|---|---|
| message_id | string | – | The UUID returned by `generate_otp`. Provide either this OR `phone_number`. Prefer this when you have it — it disambiguates if the same number got multiple OTPs. |
| otp | string | yes | The OTP code the end user typed in (3-8 numeric digits). This is the code you're trying to verify against what was sent. |
| phone_number | string | – | Phone number the OTP was originally sent to, in international format without + or leading 0. Provide either this OR `message_id` — `message_id` is more precise. |
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | yes | Message describing the verification result. |
| reason | string | – | Why verification failed: 'invalid', 'expired' or 'not found'. Absent on success. |
| status | string | yes | 'success' when the code matched and the OTP was consumed, otherwise 'failed' (or 'expired'). |
No examples provided.
What is the MyOTP.App MCP server?
MyOTP.App is an MCP server listed in the public MCP registry as io.github.brntech/myotp. Send and verify one-time passcodes over SMS, WhatsApp and Telegram. This page covers its hosted endpoint (https://mcp.myotp.app/mcp).
Is the MyOTP.App MCP server safe to use?
MyOTP.App scores 73 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the MyOTP.App MCP server expose?
MyOTP.App exposes 10 tools: generate_otp, verify_otp, check_otp_status, extend_otp, get_account_info, and 5 more. Their descriptions and schemas cost roughly 1,982 tokens of context every time the server is loaded.
Does the MyOTP.App MCP server require authentication?
No. We connected to MyOTP.App without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the MyOTP.App MCP server still maintained?
MyOTP.App is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.