ottoauthMCP
Provides tools for interacting with the Ottoauth authentication service, including account creation, generic HTTP requests, and webhook event handling for automated workflows.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ottoauthMCPcreate a new account with email test@example.com"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ottoauthMCP
Standalone MCP stdio server that proxies tool calls to Ottoauth HTTP endpoints.
Features
Discovers service endpoints from
GET /api/servicesdocs.Registers dynamic MCP tools per endpoint.
Refreshes discovered tools once every hour.
Includes a generic passthrough tool:
ottoauth_http_request.Includes a built-in account creation tool:
ottoauth_create_account.Runs an Ottoauth webhook receiver and relays incoming events to an agent gateway with retries.
Related MCP server: SentinelX Core MCP
Run
npm install
OTTOAUTH_BASE_URL=http://localhost:3000 npm startWebhook receiver defaults:
host:
127.0.0.1port:
3789path:
/webhooks/ottoauth
Important env vars:
OTTOAUTH_WEBHOOK_SECRET(recommended; validatesx-ottoauth-signature)OTTOAUTH_WEBHOOK_ALLOW_UNSIGNED=1(dev only)OTTOAUTH_WEBHOOK_PORT/OTTOAUTH_WEBHOOK_HOST/OTTOAUTH_WEBHOOK_PATHAGENT_GATEWAY_URL(relay destination)AGENT_GATEWAY_AUTH_TOKEN(optional bearer token to gateway)WEBHOOK_RETRY_BASE_MS(default2000)WEBHOOK_RETRY_MAX(default8)WEBHOOK_EVENT_STORE_PATH(defaults to.ottoauth-webhook-events.jsonin cwd)
Tests
npm testTest coverage includes:
parser and normalization edge cases
timeout and forwarding behavior
webhook signature, dedupe, retries, dead-letter
MCP stdio end-to-end flow
integration test using simple demo agent script from neighboring
autoauthrepo
MCP client config example
{
"mcpServers": {
"ottoauth": {
"command": "node",
"args": ["/absolute/path/to/ottoauthMCP/src/index.mjs"],
"env": {
"OTTOAUTH_BASE_URL": "https://your-ottoauth-domain.com"
}
}
}
}Available Tools
7 toolsottoauth_create_accountOttoauth Create AccountA
Create a new Ottoauth account (agent) and return credentials, including the private key.
| Name | Required | Description | Default |
|---|---|---|---|
| username | Yes | Agent username to create (must be unique in Ottoauth). | |
| description | No | Optional short profile description for the agent. | |
| callback_url | No | Optional callback URL where Ottoauth can post account events. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It correctly states that this is a creation operation and that the response includes a private key, which is important context. However, it does not mention permission requirements, uniqueness failure behavior, or security handling of the returned private key.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one sentence with no filler. It front-loads the action, names the resource, and mentions the important output. Every word contributes useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple create operation with no output schema and no annotations, the description is adequate but not rich. It states the core action and the critical output, but it omits return format details, error behavior, and any caveats about username uniqueness or private key handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter is already documented in the input schema. The description adds no parameter-specific meaning beyond noting that credentials and a private key will be returned, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Create'), names the exact resource ('new Ottoauth account (agent)'), and states the key output ('return credentials, including the private key'). This clearly differentiates it from the sibling webhook and HTTP request tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool's use case: creating a new account. However, it does not explicitly mention when to use this tool versus an alternative, nor does it state exclusions or prerequisites. The sibling tools are domains away, so the omission is not critical, but guidance is still minimal.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ottoauth_http_requestOttoauth HTTP RequestA
Generic Ottoauth passthrough tool. Use this if no endpoint-specific tool matches your request.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON body to forward as-is to Ottoauth. | |
| path | Yes | Absolute Ottoauth path like /api/services/amazon/buy. | |
| query | No | Optional query string parameters. | |
| method | Yes | HTTP method to call. | |
| headers | No | Optional additional HTTP headers. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of disclosing behavior. It only says 'passthrough' and 'fallback', but does not mention forwarding semantics, mutating effects of non-GET methods, authentication behavior, response format, or error handling. This is a significant gap for a generic tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler, with the core purpose and usage guidance front-loaded. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a generic passthrough tool with no annotations and no output schema, the description is too terse. It omits what the response looks like, whether the request is forwarded as-is, potential side effects, and any constraints on acceptable paths beyond the schema. An agent would need to guess at behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all parameters. The description adds no additional parameter detail, which is acceptable but does not exceed the baseline for fully-covered schemas.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly identifies the tool as a generic passthrough for Ottoauth HTTP requests, which is a clear action+resource combination. It also distinguishes itself from endpoint-specific siblings by positioning itself as the fallback when no other tool matches.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit usage context: use this tool only when no endpoint-specific tool matches the request. This implies the main exclusion (prefer specific siblings) without naming each alternative, which is adequate given the sibling list is available.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
webhook_get_eventWebhook Get EventB
Get a specific webhook event by id.
| Name | Required | Description | Default |
|---|---|---|---|
| event_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the operation and does not mention read-only nature, error handling for missing IDs, rate limits, or response format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence with no wasted words. The core action and target are immediately clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter get operation, the description covers the basic intent, but without an output schema or annotations it omits return-value details, possible errors, and behavioral context, leaving some ambiguity for the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the description only says 'by id', which adds minimal meaning beyond the already self-descriptive property name 'event_id'. It does not explain where the ID comes from or its format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get'), the resource ('webhook event'), and the selection criterion ('by id'), which distinguishes it from siblings like webhook_list_events and webhook_replay_event.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'by id' implies the tool is used when a specific event ID is known, but there is no explicit guidance about when to choose this over list or replay, or any mention of prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
webhook_list_eventsWebhook List EventsA
List received webhook events with optional status filtering and pagination.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| offset | No | ||
| status | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses that this is a read-style list operation with optional filtering and pagination, which conveys the core behavior. It does not mention ordering, defaults, response shape, or potential side effects, but for a list endpoint the main behavioral risks are minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler. It front-loads the primary action and appends the key modifiers. It is concise and easy to parse, though slightly under-specified for the zero-coverage schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a simple optional-parameter list operation, so a brief description is somewhat reasonable. Still, with no annotations and no output schema, the description could have provided more context about pagination behavior, default limits, or ordering. It is adequate for basic invocation but leaves some gaps for an agent to infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does mention that status filtering is optional and that pagination is supported, which maps to the status, limit, and offset parameters. However, it does not explain the meaning of limit and offset beyond what their names already imply, nor does it describe defaults or edge cases.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'List received webhook events'. It also mentions optional status filtering and pagination, which distinguishes it from sibling tools like webhook_get_event, webhook_replay_event, and webhook_status. The scope is clear and the tool's purpose is immediately identifiable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for listing received webhook events, optionally filtered by status or paginated. However, it does not explicitly state when to choose this over webhook_get_event, webhook_replay_event, or other siblings. Usage context is implied rather than explicitly guided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
webhook_replay_eventWebhook Replay EventA
Force a webhook event to be re-queued and relayed immediately to the configured gateway.
| Name | Required | Description | Default |
|---|---|---|---|
| event_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It explains the primary side effect (re-queuing and immediate relay) but does not mention idempotency, duplicate-delivery risk, behavior for unknown event IDs, or permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the action and outcome. There is no redundant phrasing or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one parameter, but with no annotations and no output schema, the description leaves gaps around failure behavior, prerequisites, and what response to expect. It is adequate for basic invocation but not fully self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema only defines event_id as a string with minLength 1, and the description adds no explicit parameter explanation. The connection between event_id and 'a webhook event' is inferable, but at 0% schema description coverage, the description should have directly identified event_id as the target event's ID.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('force a webhook event to be re-queued and relayed immediately') with a clear resource and effect. It distinguishes itself from read-oriented siblings like webhook_get_event and webhook_list_events.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied by the tool name and the phrase 're-queued and relayed,' but there is no explicit guidance on when to use this tool versus alternatives like webhook_get_event or webhook_status. No exclusions, prerequisites, or conditions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
webhook_set_gatewayWebhook Set GatewayB
Update relay destination for webhook forwarding (can override env config at runtime).
| Name | Required | Description | Default |
|---|---|---|---|
| gateway_url | No | ||
| gateway_auth_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations available, the description carries the full burden of behavioral disclosure. It does reveal one meaningful behavior—that the call can override environment configuration at runtime—but it does not disclose side effects, persistence, whether the change is reversible, or any security implications of setting a gateway auth token.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, tight sentence with no filler. The core action is front-loaded, and the important runtime-override caveat is included efficiently. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool that mutates webhook forwarding configuration, the description omits important context such as when this should be called, what the consequences of changing the destination are, and what happens to existing in-flight or future webhook deliveries. The absence of annotations and output schema makes these omissions more significant.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for both parameters. It adds meaning for gateway_url by calling it a 'relay destination,' but it never explains gateway_auth_token or how the two parameters interact with the runtime override behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Update relay destination for webhook forwarding.' This clearly distinguishes it from sibling tools like webhook_list_events, webhook_get_event, and webhook_status, which are read-oriented, and webhook_replay_event, which deals with replay rather than configuration.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives, and no exclusions or prerequisites are mentioned. The phrase 'can override env config at runtime' hints at a use case, but it does not tell the agent when this override is appropriate or when to prefer another configuration path.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
webhook_statusWebhook StatusA
Get webhook receiver and relay status, including configured gateway and event counts.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of conveying behavior. The verb 'Get' and the word 'status' imply a read-only, non-mutating operation, but the description does not explicitly state that it has no side effects or prerequisites. It provides useful content detail but leaves some safety inference to the agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that starts with the action and object, then concisely adds the two key data categories. No filler, redundancy, or unnecessary explanation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter status tool with no output schema, the description gives the essential information: what status is returned and the included details. It does not specify the response shape, but the simplicity of a status read and the explicit content list make this sufficient for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is nothing for the description to explain about inputs. The empty schema already covers 100% of parameters, and the baseline for zero-parameter tools is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Get') and resource ('webhook receiver and relay status'), and adds concrete detail about the returned data (configured gateway, event counts). This clearly differentiates it from sibling tools like webhook_list_events, webhook_get_event, and webhook_set_gateway.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Get webhook receiver and relay status' makes the primary use case obvious: checking the current state of webhook infrastructure. It does not explicitly name alternatives or state when not to use it, but the context is clear enough that an agent can select it appropriately among the event-focused siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.1.0- First observed
ottoauth_create_account - First observed
ottoauth_http_request - First observed
webhook_get_event - First observed
webhook_list_events - First observed
webhook_replay_event - First observed
webhook_set_gateway - First observed
webhook_status
TDQS
Scored across 7 tools
The webhook-specific tools are clearly distinct in purpose, and the generic passthrough tool explicitly defers to endpoint-specific tools. However, webhook_status and webhook_list_events both involve event counts/status, which could cause some initial confusion.
Most tools use snake_case with a domain prefix, but the pattern is inconsistent: some are verb-first (ottoauth_create_account), some are noun-phrases (webhook_status), and ottoauth_http_request breaks the verb_noun convention. The mixed prefixes make the set feel less uniform.
Seven tools is a well-scoped size for this server. Each tool covers a meaningful operation without redundancy, and the generic passthrough fills edge cases without bloating the surface.
The webhook event lifecycle is well covered with list, get, replay, and gateway configuration, plus account creation. Minor gaps exist such as no explicit account deletion or webhook clearing, but the generic HTTP passthrough mitigates dead ends.
Maintenance
Related MCP Connectors
MCP server for progressive tool usage at any scale (see https://klavis.ai)
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceMCP server for toolhouse.ai. This does not rely on an external llm unlike the official server.4MIT
- AlicenseNot gradedqualityFmaintenanceAn MCP server that proxies tool calls to a running SentinelX Core instance with OIDC/OAuth authentication. It enables secure integration of SentinelX Core's HTTP agent capabilities through the MCP protocol.1MIT
- AlicenseNot gradedqualityDmaintenanceA production-grade MCP server designed for multi-tenant, authenticated, and observable AI agent systems, enabling secure tool execution across heterogeneous data sources.64MIT
- FlicenseNot gradedqualityDmaintenanceA standalone MCP server that exposes API endpoints as tools for AI assistants, using SSE transport.-