MCP for auth in 5 minutes: phone verification through your AI agent

Most AI coding tutorials stop at "ask the agent to write code". This one is about giving the agent a tool it can call, an MCP server, so it can send and verify one-time codes while you're still building. I work at MyOTP.App and this uses our server, so read it with that in mind.

If you're on Claude Code, Claude Desktop, Cursor, Codex or anything else that speaks MCP, this takes about five minutes.

When you ask an agent to "add phone verification" with no tool attached, it writes code against an SDK it half remembers. Sometimes that SDK doesn't exist in the version it picked. You find out at runtime.

With the MCP server attached, "send a code to my number" is a tool call. The agent sends a real message, you get a real SMS, and only then do you ask it to write the integration. The code comes after the proof.

There's nothing to install. npx

fetches it on demand.

*

while you're developing locally.

claude mcp add myotp -e MYOTP_API_KEY=your-key -- npx -y @myotp/mcp

Claude Desktop, in claude_desktop_config.json

:

{
  "mcpServers": {
    "myotp": {
      "command": "npx",
      "args": ["-y", "@myotp/mcp"],
      "env": { "MYOTP_API_KEY": "your-key" }
    }
  }
}

If your client can't launch local processes, point it at the hosted server instead: https://mcp.myotp.app/mcp

, key in the X-API-Key

header or as Authorization: Bearer

. Add 108.61.176.199

to your key's IP allowlist for that, since hosted calls reach our API from that address and not from your machine.

Ten tools. The four you'll use most:

generate_otp

sends a code over SMS, WhatsApp or Telegram and returns a transaction id.verify_otp

checks what the user typed.check_otp_status

tells you whether the message was queued, sent, delivered or failed, which is where you look first when "the code never arrived".extend_otp

gives a slow user more time without sending a new code.The rest cover the account: get_account_info

, get_account_status

, get_usage_report

, and three that exist so an agent can run without a human in the loop. create_account

registers a new account and returns a key, get_topup_quote

and top_up_credits

buy credits over HTTP 402 through Stripe, by card or USDC. An agent that runs out of credits can refill and carry on.

The MCP server is a tool for the agent, not a dependency for your app. Your application still calls the REST API from the server side with the key in the X-API-Key

header. The published examples for Next.js, Express, Flask, Django, Rails and Laravel are in the brntech/myotp-agentkit repo and are the copy-paste starting points.

IP allowlisting. A key created from your laptop is allowlisted to your laptop's public IP. When the first call from a server or from the hosted MCP endpoint comes back with a 403 that says the IP isn't allowed, that's the cause, not the key.

Disclosure again: I work at MyOTP.App. If something here is wrong, say so in the comments and I'll fix the post.