MCP for auth in 5 minutes: phone verification through your AI agent

MyOTP.App has introduced an MCP server that lets AI agents send and verify one-time codes via SMS, WhatsApp, or Telegram during development. The server exposes ten tools, including generate_otp, verify_otp, and account management functions, and can be added to clients like Claude Code or Cursor in about five minutes. The tool is designed to let agents handle phone verification without human intervention, including the ability to top up credits automatically.

Most AI coding tutorials stop at "ask the agent to write code". This one is about giving the agent a tool it can call, an MCP server, so it can send and verify one-time codes while you're still building. I work at MyOTP.App and this uses our server, so read it with that in mind. If you're on Claude Code, Claude Desktop, Cursor, Codex or anything else that speaks MCP, this takes about five minutes. When you ask an agent to "add phone verification" with no tool attached, it writes code against an SDK it half remembers. Sometimes that SDK doesn't exist in the version it picked. You find out at runtime. With the MCP server attached, "send a code to my number" is a tool call. The agent sends a real message, you get a real SMS, and only then do you ask it to write the integration. The code comes after the proof. There's nothing to install. npx fetches it on demand. while you're developing locally. claude mcp add myotp -e MYOTP API KEY=your-key -- npx -y @myotp/mcp Claude Desktop, in claude desktop config.json : { "mcpServers": { "myotp": { "command": "npx", "args": "-y", "@myotp/mcp" , "env": { "MYOTP API KEY": "your-key" } } } } If your client can't launch local processes, point it at the hosted server instead: https://mcp.myotp.app/mcp , key in the X-API-Key header or as Authorization: Bearer . Add 108.61.176.199 to your key's IP allowlist for that, since hosted calls reach our API from that address and not from your machine. Ten tools. The four you'll use most: generate otp sends a code over SMS, WhatsApp or Telegram and returns a transaction id. verify otp checks what the user typed. check otp status tells you whether the message was queued, sent, delivered or failed, which is where you look first when "the code never arrived". extend otp gives a slow user more time without sending a new code.The rest cover the account: get account info , get account status , get usage report , and three that exist so an agent can run without a human in the loop. create account registers a new account and returns a key, get topup quote and top up credits buy credits over HTTP 402 through Stripe, by card or USDC. An agent that runs out of credits can refill and carry on. The MCP server is a tool for the agent, not a dependency for your app. Your application still calls the REST API from the server side with the key in the X-API-Key header. The published examples for Next.js, Express, Flask, Django, Rails and Laravel are in the brntech/myotp-agentkit repo and are the copy-paste starting points. IP allowlisting. A key created from your laptop is allowlisted to your laptop's public IP. When the first call from a server or from the hosted MCP endpoint comes back with a 403 that says the IP isn't allowed, that's the cause, not the key. Disclosure again: I work at MyOTP.App. If something here is wrong, say so in the comments and I'll fix the post.