mcpField
O
OTPilot

OTPilot

Local
otpilot.appSecurity0Updated 1w ago
RepositoryVisit website

About OTPilot

An MCP server for AI agents that uses OTPilot-approved accounts to sign in to websites and run commands without returning passwords or 2FA codes. Users approve accounts per agent and can set access limits in the OTPilot browser extension.

Key features

  1. 01Website login with approved accounts
  2. 02Run commands with injected secrets
  3. 03Scrub secrets from command output
  4. 04Per-agent account approval and access limits
  5. 05Request access to additional accounts

Use cases

  1. 01Logging in to a website without exposing credentials
  2. 02Running a command that needs a secret environment value
  3. 03Allowing an agent access to selected accounts

MCP support

The stdio MCP server exposes tools to list and request accounts, sign in through browser_login, run commands, and check access requests. Secret values are not returned to the agent; OTPilot removes them from command output.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "otpilot-otpilot": {
      "command": "npx",
      "args": [
        "-y",
        "@otpilot/mcp"
      ]
    }
  }
}
Run commandnpx -y @otpilot/mcp

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npm@otpilot/mcp0.2.0

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

OTPilot for AI agents (@otpilot/mcp)

Let Claude Code, Codex, Cursor or any MCP agent sign in to websites and run commands with your passwords and 2FA codes — without the agent ever seeing them. You choose which accounts each agent may use, in the OTPilot browser extension.

npx -y @otpilot/mcp@latest connect
  1. It shows a verification code and opens a page to sign in to OTPilot (a free account works).
  2. In the extension, Agents shows the agent: approve it if the code matches.
  3. Allow it some accounts (Agents → + Add account), or let it ask for them as it works.

Claude Code plugin (the MCP server plus a skill that teaches Claude to use it):

/plugin install otpilot --marketplace OTPilot/OTPilot

(Before Claude Code 2.1.275: /plugin marketplace add OTPilot/OTPilot, then /plugin install otpilot@otpilot.)

then connect it once: npx -y @otpilot/mcp@latest connect --name "Claude Code".

Or add the server to your agent yourself (connect prints these for you):

Agent
Claude Codeclaude mcp add otpilot -- npx -y @otpilot/mcp@latest
Codex~/.codex/config.toml: [mcp_servers.otpilot] command = "npx" args = ["-y", "@otpilot/mcp@latest"]
Cursor~/.cursor/mcp.json: { "mcpServers": { "otpilot": { "command": "npx", "args": ["-y", "@otpilot/mcp@latest"] } } }

For Codex and other agents that read AGENTS.md, add a line so they reach for it: "For passwords, 2FA codes, API keys or any login, use the otpilot MCP tools (list_accounts, browser_login, run); never ask me to paste a secret."

Each agent is its own identity, approved on its own: connect Claude Code and Codex separately (connect --name Codex), and add --profile <name> as connect shows.

On a server or VPS

Run it where the agent runs — your laptop, a VPS, a container. On a server without a browser, skip the opener and open the printed link on any device signed in to OTPilot, then approve it in the extension if the codes match:

npx -y @otpilot/mcp@latest connect --name VPS --no-open
npx -y @otpilot/mcp@latest --profile vps                 # what the agent runs
npx playwright install --with-deps chromium       # only for browser_login without Chrome

With no keychain (a bare Linux box) the credentials go to ~/.config/otpilot/mcp-<profile>.json (0600): the accounts you allow are opened on that machine, so connect only machines you trust — whoever has root there can use them.

Tools

ToolWhat the agent gets
list_accountsThe accounts it may use, by name and site
request_access(query, reason)Asks you for another account; you pick it in the extension
browser_login(account, url?)OTPilot signs in (username, password, 2FA — only on the account's own site) and returns a Playwright storageState file with the session
run(command, env)Runs the command with secrets in its environment ({ "PGPASSWORD": "Staging DB/password" }, …/totp for a fresh 2FA code); output comes back with every secret removed
check_request(request_id)Whether you answered a request that was still waiting

No tool returns a password, a 2FA code or any other value.

Security

  • The agent's own key. connect creates an ECDH P-256 keypair; the private key stays in your OS keychain. Each account you allow is a copy, holding only what you chose (just the 2FA code, the sign-in, or chosen fields), encrypted for that key in the extension. OTPilot's servers only see ciphertext.
  • Two approvals. Connecting an agent gives it nothing; each account is allowed per agent. The verification code is derived from the agent's public key on every side, so a swapped key shows a different code.
  • Limits you set: for a while or until revoked, "ask me every time", and "only with these commands": run then accepts only that program, called by name and resolved on the server's PATH (never from the working or temp directory), as a single command with no chaining or redirection — a guard against mistakes and simple tricks, not against an agent that can plant its own binary on your PATH.
  • Only over HTTPS (plain HTTP just for local hosts), and every secret is scrubbed from what comes back — before the output is cut, so none is left half-removed. A timeout kills the command and everything it started.
  • Only on the right site. browser_login fills only on pages the account's saved sites cover.
  • Activity and revoke in the extension's Agents view.
  • The honest limit: an agent that runs commands decides what they do and could try to reveal a secret on purpose. OTPilot scrubs secrets from what it returns; for sensitive accounts allow only the 2FA code, limit the commands, or turn on "ask me every time".

Commands

otpilot-mcp connect [--name "Claude Code"] [--profile p] [--no-open]
otpilot-mcp status [--profile p]       # name, verification code, allowed accounts
otpilot-mcp disconnect [--profile p]   # forget the credentials here (revoke it in the extension too)
otpilot-mcp [serve] [--profile p]      # the MCP server (stdio) — what your agent runs

browser_login uses your installed Google Chrome (or Edge); without one, run npx playwright install chromium. Sessions are saved to .otpilot/ in the working directory: keep it out of git.

License: GPL-3.0. Source: github.com/OTPilot/OTPilot.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.