@mgcrea/mcp-totp

TOTP: Status

totp_auth_status

Read-onlyIdempotent

Check MCP TOTP server readiness: verify seed store reachability, registered labels, and write access. Call first when an expected tool is missing to reveal configuration issues.

Instructions

Report what this server can and cannot do: whether a seed store is reachable, which labels are registered and where each one comes from, and whether writes are enabled. Call this first when a tool you expected is missing — an absent tool means missing configuration rather than a bug.

Note what this server is NOT: it cannot read codes out of Passwords.app. No such interface exists — Passwords.app has no scripting dictionary and no App Intents, and its keychain items sit behind an Apple-private access group. This server holds its own copy of the seed and mints codes locally; totp_import_uri can hand the same seed to Passwords.app so both stay in sync.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "totp_auth_status"
  }
}

Input Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Sep 5, 2026

TDQS

A4.9/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already state readOnlyHint, idempotentHint, and destructiveHint false, and the description adds behavior beyond those: it explains the server cannot read Passwords.app because no interface exists, and that the server mints codes locally from its own seed copy. This gives the agent critical context about system limitations without contradicting the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose in the first sentence, then moves to usage guidance and a clarifying limitation. The length is justified because it conveys essential integration context about Passwords.app that would otherwise be invisible to an agent. Every sentence earns its place and no filler is present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description enumerates exactly what the agent will learn from the call: reachability of the seed store, registered labels and their sources, and write-enable status. It also covers when to call and what the tool cannot do, making it fully self-contained for an agent to invoke and interpret correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema is empty, so there is nothing for the description to add about parameters. The baseline of 4 for a no-parameter tool applies, and the description does not need to compensate for any schema gaps since none exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: it 'reports' the server's capabilities, listing concrete output items such as seed store reachability, registered labels and their origins, and write-enable state. This is unambiguous and cannot be confused with any other operation, especially since there are no sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly instructs when to call: 'Call this first when a tool you expected is missing — an absent tool means missing configuration rather than a bug.' It also clarifies what the server is NOT and points to totp_import_uri as the relevant alternative for syncing seeds, giving the agent both a trigger condition and a related tool reference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools

totp_auth_statusA