MyOTP.App
Server Details
Send and verify one-time passcodes over SMS, WhatsApp and Telegram.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP
- URL
- Repository
- brntech/myotp-agentkit
- GitHub Stars
- 0
- Server Listing
- MyOTPApp
Available Tools
10 toolscheck_otp_statusCheck OTP delivery statusARead-onlyIdempotentInspect
Check whether a previously sent OTP is still active and (with DLR_ACCESS entitlement on Enterprise plan) get its delivery status. Returns is_active (bool) and expires_at (ISO timestamp) on every plan. On Enterprise plans, also returns DLR (one of 'delivered', 'sent', 'read', 'failed', 'pending'). Useful when an end user reports they didn't receive the code — you can confirm whether MyOTP delivered it before deciding to resend. Does NOT verify a code; use verify_otp for that.
| Name | Required | Description | Default |
|---|---|---|---|
| message_id | Yes | The UUID returned by `generate_otp` — this identifies which OTP you want a status report on. |
Output Schema
| Name | Required | Description |
|---|---|---|
| DLR | No | Delivery state: carrier status (ATES, DELIVRD, UNDELIV, EXPIRED, REJECTD) or sent/delivered/read/pending/failed.<reason>, a 'Pending: ...' hint, or a 'Not available ...' explanation. Absent when the message_id is unknown. |
| DLR: | No | Deprecated alias of DLR. |
| message | No | Present instead of DLR when the message_id is not found. |
| Message: | No | Deprecated alias of message. |
| is_active | No | Whether the OTP can still be verified (it has not expired). |
| expires_at | No | ISO 8601 date-time the OTP expires. Absent when the message_id is unknown. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and non-destructive behavior. The description adds useful behavioral context beyond that: plan-dependent DLR availability, the DLR_ACCESS entitlement requirement, the specific returned fields, and a clarification that it does not verify codes. This meaningfully supplements the annotation-provided safety profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core action and flows efficiently through return values, plan nuances, a real-world use case, and the explicit alternative. Every sentence contributes information; there is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read-only status tool, the description covers the return shape on all plans, the Enterprise/DLR variation, the required entitlement, and the intended decision-making use case. With annotations and an output schema also present, nothing critical is missing for correct selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already fully documents the single parameter `message_id` as the UUID returned by `generate_otp`. The description's reference to 'previously sent OTP' aligns with this but doesn't add meaningful parameter semantics beyond the schema. With 100% schema coverage, baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks whether a previously sent OTP is still active and retrieves delivery status where available. It specifies the main resource (OTP status) and explicitly differentiates from `verify_otp`, saying it does NOT verify a code. This makes its role distinct among siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides concrete usage context: use it when a user reports not receiving an OTP, to decide whether to resend. It also explicitly names `verify_otp` as the alternative for code verification, giving a clear when-not-to-use instruction. This is strong practical guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_accountCreate a MyOTP agent accountAInspect
Create a MyOTP.App agent account and return its one-time API key. No API key is required for this tool. The new account starts with zero balance; USDC top-ups work immediately, while card top-ups unlock after a human confirms the email address.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Optional account, company, or product name (maximum 64 characters). | |
| Yes | Email address for the new MyOTP.App account. |
Output Schema
| Name | Required | Description |
|---|---|---|
| docs | No | |
| Yes | ||
| topup | No | Where to buy credits. |
| status | Yes | Account status, 'active' when the key can be used. |
| api_key | Yes | The API key. Shown once, in this response only. Send it as the X-API-Key header. |
| balance | Yes | Credits on the balance. Zero at registration. |
| plan_id | Yes | |
| account_id | Yes | Account identifier, 'a' followed by 12 hex characters. |
| api_key_note | No | |
| email_verified | Yes | True once the human has confirmed the emailed link. Unlocks card top-ups. |
| verification_email_sent | No | Whether the confirmation email was queued. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond annotations by revealing the one-time API key return, the zero initial balance, and the timing difference between USDC and card top-ups. These details inform the agent about side effects and post-creation behavior that annotations do not specify.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no redundant wording. It front-loads the core purpose and then provides essential behavioral notes, making every sentence earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema available, the description need not explain return values. It covers the essential operational context: creating an account, API key requirement, starting balance, and top-up activation conditions. Nothing critical seems missing for an agent to invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters. The description does not add parameter-specific meaning beyond the schema, which matches the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action: create a MyOTP.App agent account and return its one-time API key. It distinguishes this tool from sibling tools by the verb 'create' and the resource 'account', which no other sibling covers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly notes that no API key is required for this tool, which is a clear usage condition. The description also provides context about what to expect after creation (zero balance, top-up behavior). However, it does not explicitly mention alternatives or when not to use the tool, though the distinction is obvious from sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
extend_otpExtend OTP expiryAInspect
Extend the expiry time of an active OTP without sending a new one. Useful when the end user is taking longer than expected to enter the code (e.g., switched apps, dealing with carrier delivery delay). Adds duration seconds (60-14400) to the current expires_at. Requires the EXTEND_OTP entitlement (Business or Enterprise plan). Some destination countries don't allow extensions — the API will return 403 in that case. Cheaper and less spammy than calling generate_otp again.
| Name | Required | Description | Default |
|---|---|---|---|
| duration | Yes | Additional seconds to add to the OTP's expiry. Range 60-14400 (1 minute to 4 hours). The new expiry will be the current expiry + this duration. | |
| message_id | Yes | The UUID returned by `generate_otp` — identifies the OTP you want to extend. |
Output Schema
| Name | Required | Description |
|---|---|---|
| status | Yes | Status of the request. |
| message | Yes | Message describing the result. |
| expires_at | Yes | The new ISO 8601 expiry date-time. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are only coarse hints (readOnlyHint=false, idempotentHint=false), so the description carries the behavioral burden — and it delivers: it discloses that no new OTP is sent, that the mutation adds `duration` to `expires_at`, that the EXTEND_OTP entitlement (Business or Enterprise) is required, and that some destination countries cause a 403. No contradiction with annotations; readOnlyHint=false aligns with the mutating behavior described.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Six sentences, each earning its place: purpose, use case, mutation semantics, entitlement requirement, failure mode, and alternative comparison. The core purpose is front-loaded in the first sentence and there is no fluff or needless repetition of schema content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 2-parameter tool with an output schema and 100% parameter coverage, the description covers everything needed for correct selection and invocation: purpose, when to use, exact mutation behavior, auth requirement, and a specific error mode. Minor gaps remain — behavior when the OTP is already expired and whether extensions can be stacked — but these do not block correct use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: both message_id (UUID from generate_otp, identifies the OTP) and duration (range, semantics of addition) are already fully documented in the schema. The description's 'Adds duration seconds (60-14400) to the current expires_at' reinforces but does not add new parameter information, so the baseline 3 for high schema coverage applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: 'Extend the expiry time of an active OTP', with the key qualifier 'without sending a new one'. The closing line explicitly differentiates it from the sibling generate_otp ('Cheaper and less spammy than calling generate_otp again'), and the purpose is distinct from verify_otp and check_otp_status. An agent can tell what this tool does and what it is not.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete when-to-use scenarios: 'end user is taking longer than expected to enter the code (e.g., switched apps, dealing with carrier delivery delay)'. Names the main alternative explicitly ('generate_otp') with a comparative reason to prefer this tool. It lacks explicit when-not-to-use exclusions, but the 'active OTP' precondition and the 403 country caveat imply the boundaries.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_otpSend OTPAInspect
Send a one-time password (OTP) to a phone number via SMS, WhatsApp, or Telegram. MyOTP.App generates the code, formats the message, picks the best carrier route, and delivers it. Returns a message_id (UUID) — keep it; you'll pass it to verify_otp, check_otp_status, or extend_otp later. Each call deducts credits from the account balance; the per-message cost varies by destination country and channel and is returned in the cost field. Use this whenever an app needs to verify someone's phone — signup, login 2FA, password reset, transaction confirmation, etc.
| Name | Required | Description | Default |
|---|---|---|---|
| brand | No | Sender brand name shown to the recipient (3-16 alphanumeric characters plus dots). Defaults to the brand registered against the API key, or 'MyOTP.App' if none. | |
| channel | No | Delivery channel. 'sms' (default) works in 190+ countries. 'whatsapp' is best for India/Brazil/Indonesia/Mexico/Nigeria/Turkey. 'telegram' is best for privacy-focused users. Same API for all three. | |
| otp_code | No | Provide your own pre-generated numeric OTP code (3-8 digits, 4-8 for telegram) instead of letting MyOTP generate one. Useful when you already have a code from another system. | |
| force_send | No | If true, send a new OTP even if one is already active for this phone number. By default the API returns 409 in that case. Use sparingly — repeated sends to the same number can hit carrier-level spam filters. | |
| otp_length | No | Number of digits in the auto-generated OTP. Range 3-8 (4-8 for telegram). Default 6. Requires CUSTOM_OTP_LENGTH entitlement (Business plan or above). | |
| return_otp | No | If true, the API response will include the generated OTP code in plain text. Useful for testing or when you want to deliver the OTP via your own channel. Defaults to false. SECURITY: never enable this in production user flows. | |
| otp_validity | No | How long the OTP stays valid, in seconds. Range 30-14400 (30-3600 for telegram). Default 300 (5 minutes). Requires CUSTOM_OTP_EXPIRY entitlement (Business plan or above). | |
| phone_number | Yes | Destination phone number in international format with NO leading + or 0. Must be 7-15 digits and start with a non-zero digit. Example: '14155551234' for a US number, '447911123456' for a UK number. | |
| template_order | No | Pick a specific message template by its order number (1-99). Requires ACCESS_TO_TEMPLATES entitlement. Not supported on telegram (Telegram generates its own message text). |
Output Schema
| Name | Required | Description |
|---|---|---|
| otp | No | The OTP value, present only when return_otp was true. |
| cost | Yes | Credits charged for this send. |
| status | Yes | Always 'accepted' on success; delivery state comes from check_otp_status. |
| message | Yes | Message describing the status of the request. |
| date_sent | Yes | ISO 8601 date-time the OTP was sent. |
| expires_at | Yes | ISO 8601 date-time the OTP expires. |
| message_id | Yes | ID of the message sent. Pass it to verify_otp, check_otp_status and extend_otp. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only indicate that the operation is non-read-only, non-idempotent, and non-destructive. The description adds valuable behavioral context: MyOTP.App generates the code, formats the message, chooses the carrier route, returns a message_id, and deducts credits per call. This goes beyond the structured fields without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, well-structured, and front-loaded with the core purpose. Every sentence earns its place: what it sends, how it behaves, what is returned, the cost side effect, and representative use cases. No fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with nine parameters, the description plus the 100%-covered schema and output schema cover what an agent needs to select and invoke it correctly. It explains the message_id lifecycle, credit deduction, and use cases. Minor gap: it does not explicitly direct agents away from using this tool when they should call verify_otp or check_otp_status instead, though the sibling names are referenced.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already thoroughly documented. The description does not add parameter-level semantics beyond general context like delivery channels and the cost field. Baseline 3 is appropriate because the schema carries the full parameter burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Send a one-time password (OTP) to a phone number via SMS, WhatsApp, or Telegram.' It distinguishes itself from the sibling flow by explaining that the returned message_id is later passed to verify_otp, check_otp_status, or extend_otp, making the send-vs-verify separation clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use the tool: 'Use this whenever an app needs to verify someone's phone — signup, login 2FA, password reset, transaction confirmation, etc.' It also references the downstream siblings by name, but it does not explicitly say 'use verify_otp instead to check a code' or give when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_account_infoGet account infoARead-onlyIdempotentInspect
Return account details for the API key in use. Always returns at least the account email; depending on plan and platform version may also return balance/credit/plan info. Use this as a sanity check when wiring up MyOTP for the first time — if this call succeeds, your API key and IP whitelist are configured correctly.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| Yes | Email address of the account the API key belongs to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds useful behavioral context beyond annotations by noting that the response always includes email and may include balance/credit/plan info depending on plan and platform version, plus the connection-check implication of a successful call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no filler. The core purpose is front-loaded, followed by return variability and a practical use-case sentence; each sentence contributes meaningful guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only tool with an output schema and strong annotations, the description is complete. It covers what the call does, what the response minimally contains, and how to interpret success, so an agent has enough to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is no parameter burden for the description to carry. The baseline of 4 applies, and the description appropriately focuses on return behavior rather than parameter syntax.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: returning account details for the API key in use. It is clear in scope, though it does not explicitly differentiate itself from the sibling get_account_status, so the purpose is clear but sibling distinction is left implicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit usage context: use as a sanity check when wiring up MyOTP for the first time, with a concrete success criterion (API key and IP whitelist are configured). It does not name alternatives or exclusion conditions, but the provided guidance is actionable and specific enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_account_statusGet agent account statusAInspect
Return email verification, balance, plan, and status for the configured MyOTP agent account. Set resend_verification to request another confirmation email first. Unverified accounts can top up with USDC, but cards stay locked.
| Name | Required | Description | Default |
|---|---|---|---|
| resend_verification | No | Send another confirmation email before returning account status. |
Output Schema
| Name | Required | Description |
|---|---|---|
| hint | Yes | What to do next: verify the email, top up, or start sending. |
| status | Yes | Account status, 'active' when the key can be used. |
| balance | Yes | Credits on the balance. |
| plan_id | Yes | |
| email_verified | Yes | True once the human has confirmed the emailed link. Unlocks card top-ups. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that resend_verification triggers another confirmation email, which is a meaningful side effect consistent with readOnlyHint=false. It also adds account-state context (USDC top-up possible, cards stay locked) that goes beyond the annotations. No contradiction with annotations found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences carry all essential information: the first defines the tool's output, the second explains the optional flag and adds a relevant account-state constraint. No redundant wording or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has only one optional parameter, a rich output schema, and no nested objects, the description covers the main purpose, the side-effect behavior, and a useful account-state nuance. It lacks explicit sibling differentiation, but overall the context is sufficiently complete for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already documents resend_verification as 'Send another confirmation email before returning account status.' The description repeats this idea in prose without adding new parameter semantics, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Return') and resource ('email verification, balance, plan, and status for the configured MyOTP agent account'), so the purpose is clear and concrete. However, it does not explicitly differentiate this from the sibling get_account_info, which may overlap in scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool by stating what it returns and includes the conditional resend_verification behavior, plus a note about unverified accounts topping up. It does not explicitly name alternatives or state when not to use this tool, so usage guidance is present but not strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_topup_quoteGet a MyOTP credit top-up quoteARead-onlyIdempotentInspect
Get the live price and payment options for buying MyOTP credits, without making a purchase. Use this when generate_otp or another send fails with HTTP 403 insufficient balance / NoBalance, or before calling top_up_credits to show the cost. Returns USDC and card client commands and never exposes the configured API key.
| Name | Required | Description | Default |
|---|---|---|---|
| credits | No | Number of credits to quote. Integer from 25 to 50,000; defaults to 100. |
Output Schema
| Name | Required | Description |
|---|---|---|
| rules | Yes | Top-up limits: unit price, minimum, maximum and the card cap. |
| credits | Yes | The number of credits priced. |
| methods | Yes | Human-readable list of the accepted payment methods. |
| currency | Yes | Always 'usd'. |
| amount_usd | Yes | Total price in US dollars, as a decimal string. |
| how_to_pay | Yes | Ready-to-run client commands for this amount. |
| max_credits | Yes | |
| min_credits | Yes | |
| price_per_credit_usd | Yes | Unit price. Currently 0.02. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint=false. The description adds meaningful behavioral context beyond those: it performs no purchase, returns live pricing and payment options, and 'never exposes the configured API key' — a critical safety guarantee for the agent. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tightly written sentences, each earning its place: what it does, when to use it, and what it returns. The most important scoping statement ('without making a purchase') is front-loaded, and there is zero redundant wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter, read-only quote tool with a full output schema, the description is complete. It covers purpose, triggers, safety, and return characteristics. The output schema handles return-value details, so nothing critical is missing for an agent to invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for the sole 'credits' parameter, including type, range, default, and meaning, so the schema already carries the full burden. The description adds no additional parameter-specific guidance, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description has a specific verb ('Get'), a specific resource ('live price and payment options for buying MyOTP credits'), and explicitly distinguishes itself from purchase actions: 'without making a purchase.' It also names its sibling relationship by referencing top_up_credits and generate_otp failures, leaving no ambiguity about what this tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete trigger conditions: use it when generate_otp or another send fails with HTTP 403 insufficient balance / NoBalance, or before calling top_up_credits to show the cost. This is explicit, actionable guidance that tells an agent exactly when to select this tool over alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_usage_reportGet usage reportARead-onlyIdempotentInspect
Fetch a paginated list of OTP transactions for a date range. Each transaction includes message_id, timestamp, phone_number, channel, country, cost, status, and the originating client IP. Date range cannot exceed 31 days. Defaults: last 7 days, page 1, 10 per page. Requires the API_REPORTING entitlement (Business or Enterprise plan). Use this to: audit recent activity, build internal dashboards, reconcile billing, or debug delivery issues across many recipients.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Page number for paginated results, starting at 1. Default 1. | |
| end_date | No | End date in YYYY-MM-DD format (UTC). If omitted, defaults to today. The range start_date..end_date cannot exceed 31 days. | |
| per_page | No | Results per page, 1-100. Default 10. | |
| start_date | No | Start date in YYYY-MM-DD format (UTC). If omitted, defaults to 7 days before today. The range start_date..end_date cannot exceed 31 days. |
Output Schema
| Name | Required | Description |
|---|---|---|
| message | No | Present when the endpoint has no data for the range. |
| per_page | No | Rows per page. |
| total_count | No | Total transactions matching the date range. |
| total_pages | No | Number of pages at the requested per_page. |
| current_page | No | The page returned. |
| transactions | No | Transaction rows for the page. May be empty or absent when there is no data. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it read-only, idempotent, and non-destructive; the description adds meaningful behavioral constraints: max 31-day range, default page/per_page/date window, and the API_REPORTING entitlement requirement. This gives the agent a clear picture of side-effect-free paginated retrieval.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, each serving a purpose: purpose, payload fields, constraints/defaults, and use cases. The most decision-relevant information (what it fetches) is front-loaded, and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the 4 optional parameters, full schema coverage, read-only annotations, and output schema presence, the description is sufficient for an agent to invoke correctly. It covers entitlement, defaults, constraints, and intended use without redundancy.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already fully documents each parameter, including defaults and the 31-day limit. The description repeats those defaults rather than adding new parameter-level semantics, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Fetch a paginated list of OTP transactions for a date range.' It enumerates returned fields and states the scope, distinguishing it from sibling OTP lifecycle tools like generate_otp or verify_otp.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly lists intended use cases: audit recent activity, build internal dashboards, reconcile billing, or debug delivery issues across many recipients. It does not name alternative tools directly, but the sibling list and the use-case framing make the reporting-versus-operational distinction clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
top_up_creditsBuy MyOTP creditsADestructiveInspect
Prepare or complete an autonomous MyOTP credit purchase with USDC or card through Machine Payments Protocol (MPP). Use this when generate_otp or another send fails with HTTP 403 insufficient balance / NoBalance. The tool quotes first, then returns a structured 402 challenge and exact retry details for the agent's own MPP client; if fetch is already wrapped by a credential-carrying MPP runtime, it returns the credited response directly.
| Name | Required | Description | Default |
|---|---|---|---|
| credits | Yes | Number of credits to buy. Integer from 25 to 50,000. | |
| dry_run | No | If true, return only the quote and explanation without requesting a payment challenge. |
Output Schema
| Name | Required | Description |
|---|---|---|
| quote | No | The quote for the requested credits (dry run and 402 results). |
| retry | No | The request to replay with a payment credential (402 result). |
| offers | No | Decoded Payment offers from the WWW-Authenticate challenge (402 result). |
| status | No | 'credited' or 'already_credited' (settled result). |
| balance | No | Account balance in credits after the top-up (settled result). |
| credits | No | Credits bought in this call (settled result). |
| payment | No | Payment method and reference (settled result). |
| plan_id | No | |
| currency | No | |
| amount_usd | No | Amount paid in US dollars (settled result). |
| how_to_pay | No | Ready-to-run client commands (402 result). |
| challengeId | No | The MPP challenge id from the 402 response. |
| explanation | No | What happened and what the caller must do next (dry run and 402 results). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description clearly explains the two-mode behavior: quote-first with a 402 challenge plus retry details, or direct credited response when an MPP runtime wraps the fetch. The destructiveHint=true annotation is surprising for a top-up, but the description's mention of completing a purchase is consistent with side-effecting financial behavior, not a contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the purpose and trigger condition. Every sentence contributes essential behavioral or routing information, with no repetition or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a financial side-effecting tool with output schema, annotations, and full parameter documentation, the description covers the trigger, workflow, and conditional behavior sufficiently. Nothing critical is missing for an agent to decide whether and how to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameter details are already fully documented. The description does not add additional meaning about credits or dry_run beyond what the schema provides, making the baseline score of 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource: prepare or complete a MyOTP credit purchase using USDC/card through MPP. It also differentiates itself from siblings by describing both the quoting and payment-completion workflow, making it distinct from get_topup_quote.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a concrete trigger: use when generate_otp or another send fails with HTTP 403 insufficient balance / NoBalance. It does not explicitly name alternatives or state when not to use this tool, but the triggering condition is clear and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_otpVerify OTPAInspect
Verify a code submitted by an end user against the OTP MyOTP delivered. Returns {status: 'success'} if the code matches and the OTP hasn't expired — at that point the OTP is consumed and cannot be reused. Returns {status: 'failed', reason: 'invalid' | 'expired' | 'not found'} otherwise. You MUST pass either phone_number or message_id to identify which OTP you're verifying against. Call this after collecting the code from the user (login form, signup screen, etc.).
| Name | Required | Description | Default |
|---|---|---|---|
| otp | Yes | The OTP code the end user typed in (3-8 numeric digits). This is the code you're trying to verify against what was sent. | |
| message_id | No | The UUID returned by `generate_otp`. Provide either this OR `phone_number`. Prefer this when you have it — it disambiguates if the same number got multiple OTPs. | |
| phone_number | No | Phone number the OTP was originally sent to, in international format without + or leading 0. Provide either this OR `message_id` — `message_id` is more precise. |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | No | Why verification failed: 'invalid', 'expired' or 'not found'. Absent on success. |
| status | Yes | 'success' when the code matched and the OTP was consumed, otherwise 'failed' (or 'expired'). |
| message | Yes | Message describing the verification result. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description clearly discloses that a successful verification consumes the OTP so it cannot be reused, and that expired codes fail. It also enumerates the exact failure reasons ('invalid' | 'expired' | 'not found'), adding meaningful behavioral detail beyond the readOnlyHint=false annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Every sentence adds necessary information: what it does, success/failure behavior, consumption side effect, required identifier selection, and when to call. It is compact but complete, well-structured, and free of filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema and the strong input schema, the description covers the essential operational context: the verification flow, required identifier, expiring/consumption behavior, and expected return statuses. An agent has enough information to call this tool correctly without ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema already provides 100% coverage with detailed descriptions for each parameter. The description adds crucial usage semantics not fully captured by the schema: you must pass either phone_number or message_id, and message_id is preferred because it disambiguates multiple OTPs for the same number.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific verb ('Verify'), the exact resource ('the OTP MyOTP delivered'), and the intended context (end-user code submission). The stated outcomes—success or failure with reasons—clearly differentiate it from a plain status check like check_otp_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says when to call: 'Call this after collecting the code from the user (login form, signup screen, etc.)'. It also clarifies the required identifying parameter, prefers message_id over phone_number, and explains why. It does not name alternative tools or explicitly say when not to use them, but the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
10 tool updates
- First observed
check_otp_status - First observed
create_account - First observed
extend_otp - First observed
generate_otp - First observed
get_account_info - First observed
get_account_status - First observed
get_topup_quote - First observed
get_usage_report - First observed
top_up_credits - First observed
verify_otp
Frequently Asked Questions
Claiming proves that you control a remote MCP connector. It does not move, proxy, or interrupt the server.
Open the connector listing, choose Claim ownership, and sign in to Glama.
Complete one verification method:
GitHub identity — fastest for official registry listings. For a namespace such as
io.github.alice/server, link the matching GitHub user, then choose Claim with GitHub. An organization namespace such asio.github.acme/serveralso needs that organization to have installed the Glama AI GitHub App and approved its permissions, because GitHub discloses organization membership only to apps it has installed. Use HTTP or DNS when it has not.HTTP challenge — works when you can deploy a public file. Generate a token, publish the exact JSON Glama shows at
/.well-known/glama.jsonon the same origin as the connector, then choose Check HTTP challenge.DNS challenge — works when you control DNS but cannot change the server. Generate a token, create the exact TXT record Glama shows, wait for it to propagate, then choose Check DNS challenge.
After verification, Glama sends a confirmation email and gives you access to listing details, thumbnails, health checks, and analytics. Keep the HTTP file or DNS record in place: Glama periodically checks it and ownership remains verified while the token is discoverable.
The HTTP ownership file has this structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"claim": "glama_claim_..."
}Claim tokens are opaque, stable, and bound to the signed-in Glama account. They contain no email address or other personal information. If Glama can no longer discover a verified HTTP or DNS token, it starts a seven-day grace period before removing claim-based access. Restore the same token during that period to keep ownership verified. Never publish an email address, Glama session token, GitHub token, or connector credential as ownership proof.
If verification fails, confirm that you copied the current token exactly. The HTTP file must be public, return valid JSON with a successful HTTP response, and stay on the connector's origin. DNS changes may need more time to propagate. A claim cannot transfer to a different origin or hostname: if the connector target changes, Glama starts the grace period and the new target must be claimed separately after the previous claim is released.
For a connector linked to the official MCP Registry, registry updates continue to replace its name, description, and URL by default. After claiming, open Manage connector and enable Use Glama listing details as the source of truth if edits made on Glama should be preserved. Categories and thumbnails are always managed on Glama; registry linkage and technical connection settings continue to sync.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
To improve your MCP server's ranking:
Claim ownership of the server listing
Complete the server profile with an accurate description and thumbnail
Provide a test profile so Glama can connect to and evaluate the server
Keep tool definitions clear and complete to earn a high Tool Definition Quality Score (TDQS)
Route real usage through the Glama Gateway; more recorded successful server uses also improve the ranking
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
Discussions
No comments yet. Be the first to start the discussion!
Related MCP Connectors
SMS Verify: SMS Verify API is a secure and easy-to-integrate service that sends verification codes.
Send SMS/WhatsApp and verify OTP codes in Morocco (+212) and worldwide. Direct carrier routing.
Send and schedule SMS and WhatsApp messages, manage contacts and templates, and track delivery.
Signup sessions, browser continuity, email, SMS, and OTP/TOTP infrastructure for AI agents.
Related MCP Servers
AlicenseAqualityBmaintenanceEnables any MCP-compatible AI agent to send WhatsApp messages, SMS, OTP codes, and email through a single REST API.18MIT- AlicenseAqualityDmaintenanceCreate disposable email inboxes, extract OTP codes in 15 languages, and receive webhooks — all from your AI agent. One call: create inbox → wait for email → get the verification code. Supports 7 domains, email forwarding, and HMAC-signed webhooks with OTP included in payload. Free tier available.816MIT
- AlicenseNot gradedqualityCmaintenanceAccess your team's 2FA codes from AI agents without sharing secrets. List accounts, generate TOTP codes, and maintain full audit trails. Built for DevOps, CI/CD pipelines, and automated workflows that need to authenticate to protected services.30MIT
- AlicenseBqualityDmaintenanceEnables sending SMS, making calls, retrieving call recordings, managing phone numbers, and sending Viber messages through the MTS Exolve API.851MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.
TDQS
OTP operations are clearly separated: generate, verify, check status, and extend each have distinct responsibilities, and the descriptions explicitly differentiate check_otp_status from verify_otp. The only real ambiguity is between get_account_info and get_account_status, which both return similar account/balance/plan details with somewhat fuzzy boundaries.
All tools use consistent snake_case verb_noun naming, with get_ prefixed for read operations and action-specific verbs like generate, verify, extend, and top_up for state-changing operations. There are no mixed conventions or vague generic names.
Ten tools is well-scoped for an OTP service covering account lifecycle, OTP operations, billing/top-up, and reporting. Each tool maps to a distinct workflow step, and none feel redundant or unnecessary.
The OTP lifecycle is fully covered from generation through verification, status checking, and extension, with supporting account, top-up, and usage-reporting tools. There are no obvious dead ends for typical OTP verification and billing workflows.