Key Takeaways
- MCP send_otp and verify_otp tools wrap your app’s OTP workflow plus gateway REST — they must not print codes into the agent chat.
- Send is not verify; verify is not delivery; DLR is a separate signal.
- Keys in ENV; idempotent send; short TTL; isolated OTP devices.
- Priced by devices and SMS send volume. You use your own phone and operator SMS credit. Free is 300 SMS lifetime — failed loops still spend airtime.
- MCP is a REST/tool facade, not a Complete SDK.
- Confirm live send fields in Developer Center.
Summary
This setup walkthrough covers send OTP and verify OTP MCP tools for an Android SMS gateway. Keep codes out of the model context. Priced by devices and SMS send volume. You use your own phone and operator SMS credit.
If verify_otp reads the code from the same tool result that sent it, you built a self-approving backdoor — not two-factor auth.
Send vs verify tools
send_otp creates a challenge, stores a hash, and calls gateway REST to SMS the user.verify_otp checks the user-supplied code against your store. Only send talks to the handset.
Tool contract table
| Tool | Inputs | Returns to agent | Must not return |
|---|---|---|---|
| send_otp | user id / destination ref | status, message id, expiry | plaintext OTP |
| verify_otp | user id, code attempt | ok / fail / locked | expected code |
Setup walkthrough
- Implement OTP store (hash, TTL, attempt counter) in your app.
- Wire send_otp → REST send with ENV key + idempotency — fields in SMS API documentation.
- Wire verify_otp to the store only.
- Rate-limit both tools; isolate OTP devices.
- Canary with staff numbers; confirm last-seen.
Never echo OTP
Strip message bodies from MCP tool results and logs. Support macros must not paste codes into tickets. See OTP verification.
Cost
Free is 300 SMS lifetime. Retries spend airtime. See pricing.
Checklist
- Send/verify split; no plaintext OTP in tool output.
- ENV secrets; idempotency; TTL; attempt limits.
- OTP pool isolated; canary passed.
Next steps
Complete setup and keep MCP as a thin REST wrapper with redaction.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- OTP and 2FA SMS on AndroidAuthentication flows
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- device setup guidePair and go live
