Key Takeaways
- Agentic OTP over MCP is a setup of tools that call POST /messages — not a first-party Cursor or Claude OTP plugin.
- Your verifier hashes the code. The model should only be allowed to trigger send on an allowlisted path.
- Idempotency-Key per challenge. Cap tool retries. Isolate the OTP device.
- Confirm live JSON in Developer Center. HTTP 200 is accepted.
- You bring the phone and operator credit. Platform pricing is devices plus send volume.
The agent triggers; the SIM sends
Concepts: MCP for SMS. Spec: Model Context Protocol. Product OTP: OTP verification. Live JSON: Developer Center.
Adjacent failure modes: agentic OTP failures. We meter devices and volume.
REST wrapper, not a plugin
A local or remote MCP server exposes tools. Those tools must call POST https://app.sms-gateway.app/api/v1/messages with a Bearer from the process environment. Cursor and Claude are MCP hosts. We do not ship a first-party plugin for either.
“If the agent can send to any number with a production key, you did not add MFA. You added a chat box that burns airtime.”
Setup failure modes
| Step | What goes wrong | Do |
|---|---|---|
| Tool send_otp | Open to[] | Allowlist destination or session |
| Host retry | Second code | Idempotency-Key = challenge id |
| Wait-for-OTP tool | Model stores plaintext | Hash in your app; Retriever on device |
| Shared device | Promo starves login | Named OTP deviceId |
| 200 treated as OK | User empty | DLR |
Wait on DLR, not on the model
Webhooks: webhooks. SMS Retriever is user-device UX. Pairing: setup.
Staging keys only
Auth walkthrough: MCP auth and API keys. Pricing.
Next steps
Canary a staff number from a staging key. Confirm the verifier, not the chat transcript. Operator credit stays yours.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- OTP and 2FA SMS on AndroidAuthentication flows
- SMS API documentationLive endpoint reference
- device and SMS volume pricingPlans and allowances
- device setup guidePair and go live
