Overview

The MCP Server for Authenticator App 2FA enables AI agents to securely request time-based one-time passwords (TOTP) and stored credentials from the Authenticator App desktop client. It implements the Model Context Protocol (MCP) so agent platforms that support MCP can integrate with a locally running Authenticator App instance to retrieve 2FA codes and optional password entries. The server is intended to assist automation scenarios—such as automated logins or agent-driven workflows—while maintaining control and auditability via a per-client access token.

The server runs alongside the Authenticator App on the same machine. Developers configure their agent client to launch or connect to the MCP server, then request specific tools (for example: fetch the current 2FA code for an account). Access is gated by a single-use/access-managed token generated inside the Authenticator App; this token must be provisioned to the agent configuration and stored securely.

Features

Exposes Authenticator App data (TOTP codes and optional password items) over MCP
Token-based authentication to control agent access
Simple CLI invocation via npx for cross-platform compatibility
Designed for local, agent-driven automation of login flows
Minimal configuration required for MCP-capable agent clients
Works with the Authenticator App · 2FA desktop releases (Windows, macOS, Linux)

Installation / Configuration

Prerequisites:

Install the Authenticator App · 2FA desktop client and enable its MCP Server in Settings (see Creating an Access Token below).
An MCP-capable agent client (example clients support an mcpServers configuration entry).

Install and run the MCP server via npx. Replace YOUR-KEY with the access token you generated in the Authenticator App.

macOS / Linux

{
  "mcpServers": {
    "Authenticator App MCP": {
      "command": "npx",
      "args": ["-y", "authenticator-mcp", "--access-token=YOUR-KEY"]
    }
  }
}

Windows (cmd)

{
  "mcpServers": {
    "Authenticator App MCP": {
      "command": "cmd",
      "args": ["/c", "npx", "-y", "authenticator-mcp", "--access-token=YOUR-KEY"]
    }
  }
}

Environment variable option (set the token in the env block)

{
  "mcpServers": {
    "Authenticator App MCP": {
      "command": "npx",
      "args": ["-y", "authenticator-mcp"],
      "env": {
        "AUTHENTICATOR_ACCESS_TOKEN": "YOUR-KEY"
      }
    }
  }
}

Notes:

The tool will attempt to connect to the Authenticator App MCP endpoint running on the same machine.
Keep the access token confidential. Treat it like a short-lived API key and rotate if compromised.

Creating an Access Token

Open the Authenticator App · 2FA desktop application.
Open Settings and locate the MCP Server or Developer section.
Enable the MCP Server toggle and generate an access token.
Copy the token immediately — the App only displays it once. Paste it into your agent client’s configuration or store it in a secure environment variable.

Available Tools

The MCP server exposes a small set of actions agents can call. Tool names and behavior may vary slightly by client implementation; typical capabilities include:

Tool name	Description
list_accounts	Returns a list of accounts stored in the Authenticator App (IDs, issuer, account name)
get_code	Returns the current TOTP code for a specified account ID
get_password	Returns a stored password item for a specified account (if passwords are stored)
get_account_details	Returns metadata for an account (issuer, period, digits, algorithm)

Agents should request only the minimum data needed for a task and respect any local usage policies.

Use Cases

Automated agent login: An agent orchestrating a multi-step login can request the current TOTP code and use it to complete MFA-protected authentication flows programmatically.
Help-desk agent assistance: A support agent running inside an MCP-enabled environment can fetch and display (or paste) recovery codes or password hints when assisting a user, without direct access to the underlying storage.
CI / local automation: Local automation scripts that require 2FA for testing or deployment can fetch current TOTP codes via an MCP-capable test agent—useful for end-to-end test scenarios where manual MFA would be disruptive.
Credential rotation and auditing: Agents can periodically read account metadata to verify the presence of accounts, report missing configurations, or assist with credential rotation workflows.

Example scenario (high level):

Configure your agent client to start the authenticator_mcp server with a token.
In the agent chat, request: “Retrieve the current 2FA code for example.com / myaccount”.
The agent issues get_code with the account ID; the MCP server returns the TOTP value, which the agent uses to complete the login flow.

Resources

GitHub repository: https://github.com/firstorderai/authenticator_mcp
Authenticator App · 2FA desktop downloads and MCP token generation are available from the app’s settings (desktop client required)
Demo video and badges: see the project README and repository for links and verification badges

Security reminders:

The access token is displayed only once; store it securely.
Run the MCP server only on trusted machines and avoid exposing it to untrusted networks.
Limit agent permissions and audit agent activity when integrating with sensitive accounts.