Skip to main content
Glama

Palmyr

by ai.palmyr

Wait for SMS verification code (OTP)

wait_for_otp

Wait for an SMS verification code / OTP to arrive on a Palmyr phone number you own, and return the parsed code. Blocks up to timeout_s (default 60, max 90) checking every ~2s — one call replaces hand-rolled polling of phone_read_messages during account signups and 2FA flows. Messages that arrived up to lookback_s seconds (default 10) BEFORE the call also match, so a code that landed early is not missed — pass lookback_s=0 when reusing a number across signups so a stale code can't be re-served. Default extraction handles standalone 4-8 digit codes, 'code is/code:' tokens, and Google-style G-XXXXXX; pass pattern to override (max 256 chars; a pattern that blows its per-match budget is dropped mid-wait and pattern_timeout: true is reported). Returns { found: true, code, message_text } on a hit or { found: false, waited_s } on timeout (not an error — just call again). Costs 0.02 USDC, paid per-action via x402.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
patternNoCustom extraction regex overriding the default OTP formats (first capture group wins, else the full match; max 256 chars)
paymentNobase64 x402 payment payload (X-PAYMENT); omit on first call to receive payment instructions
number_idYesPhone number id returned by phone_buy_number
timeout_sNoSeconds to block waiting (default 60, max 90)
lookback_sNoAlso match messages received up to this many seconds before the call (default 10; use 0 for reused numbers)

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description fully discloses behavior: blocking behavior, timeout defaults, polling interval, lookback behavior, extraction logic, pattern failure handling, and cost (0.02 USDC). It also clarifies that a timeout returns found:false and is not an error. This is comprehensive behavioral transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense paragraph, but every sentence serves a purpose: purpose, behavior, lookback semantics, pattern override, return format, and cost. It is front-loaded with the primary function and efficiently covers all necessary details without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 parameters, no output schema), the description is remarkably complete. It explains return values (found/code/message_text vs found/waited_s), error semantics, timeout limits, cost, and edge cases. No significant behavioral aspect is left unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 100%, the description adds significant semantic value beyond the schema: it explains parameter defaults, the meaning of lookback_s (early arrival matching), the impact of pattern failures (pattern_timeout), and the payment flow. This contextualizes parameters in a way the schema alone cannot.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool waits for an SMS OTP and returns the parsed code, distinguishing it from sibling phone_read_messages by framing it as a replacement for hand-rolled polling. The verb ('wait'), resource ('SMS verification code'), and outcome ('return the parsed code') are all specific and clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: 'during account signups and 2FA flows,' and identifies the alternative (phone_read_messages). It also gives concrete usage nuances for lookback_s and pattern overriding, including edge-case handling for reused numbers. This goes beyond general context to actionable direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Palmyr toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.1/5.0
Disambiguation5/5

Each tool targets a distinct resource and action, clearly separated by domain prefixes (card_, email_, phone_, tiktok_). The only potential overlap is phone_read_messages vs wait_for_otp, but wait_for_otp is specifically for OTP extraction and is described as a replacement for hand-rolled polling, making the boundary clear. Status pollers are also domain-specific (card_status, tiktok_connect_status, tiktok_operation_status) and not ambiguous.

Naming Consistency5/5

All tool names follow a consistent snake_case convention with domain-first prefixes (e.g., card_buy, email_send, tiktok_post, phone_temp_number). Even less common names like wait_for_otp and i402_plan are descriptive and stylistically consistent. There are no mixed conventions or vague verbs.

Tool Count4/5

33 tools is above the typical 3-15 range, but the server covers a broad multi-domain purpose (cards, compute, domains, email, phone, TikTok, Twitter, orchestration). Each domain has a focused and coherent set, so the count feels justified rather than bloated. It is slightly high, but not excessively so.

Completeness3/5

Coverage is solid for email, phone, and TikTok, with full lifecycle operations (create, read, extend, delete/cancel where applicable). However, there are notable gaps: compute has only deploy (no list/stop/delete), domains have only check/register (no list/delete), and Twitter has only post (no read/manage). These gaps could force agents to work around missing resource management.

Resources