{"name":"io.github.OTPilot/otpilot","slug":"otpilot","title":"OTPilot","description":"Use your OTPilot accounts (passwords, 2FA codes) to sign in and run commands, without seeing them.","url":"https://mcp.market/server/otpilot","rating":null,"grade":"B","score":83,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":31,"stars":0,"forks":0,"downloads_week":341,"last_push_at":"2026-10-16T14:06:24.000Z","license":"GPL-3.0-only"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/OTPilot/OTPilot","website":"https://otpilot.app/ai-agents","version":"0.2.0","remotes":[],"packages":[{"registryType":"npm","identifier":"@otpilot/mcp","version":"0.2.0","transport":{"type":"stdio"}}],"tools":[{"name":"browser_login","description":"OTPilot signs in to the account's website itself (username, password and 2FA code, only on the account's own site) and returns the path of a Playwright storageState file with the signed-in session. Load it in your browser to continue signed in. You never get the credentials.","write_action":false,"price_micros":0,"input_schema":null},{"name":"check_request","description":"Whether the user answered a request that was still waiting (by its id).","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_accounts","description":"The accounts the user allowed this agent to use, with what each allows. Names only, never values.","write_action":false,"price_micros":0,"input_schema":null},{"name":"request_access","description":"Ask the user to let this agent use an account it doesn't have yet (e.g. \"github\", \"staging database\"). The user picks it in the OTPilot extension. Waits up to 90 s for the answer.","write_action":false,"price_micros":0,"input_schema":null},{"name":"run","description":"Runs a shell command with secrets from allowed accounts in its environment, for that process only. env values are references \"<account>/<field>\" (username, password, totp = a fresh 2FA code, notes, or a custom field's label; \"<account>/@file\" or a file field's label = the path of a private temporary copy of that file, deleted when the command ends). Returns the exit code and the output with every ","write_action":true,"price_micros":0,"input_schema":null}],"scan":{"score":83,"grade":"B","scanned_at":"2026-10-16T17:05:14.945Z","report":{"scannerVersion":"0.1.10","scannedAt":"2026-10-16T17:05:14.903Z","components":{"code":{"score":20,"max":25,"notes":["12 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 0 days ago"]},"identity":{"score":7,"max":10,"notes":["registry namespace matches repository owner"]}},"findings":[{"id":"exec.eval","severity":"medium","component":"code","title":"eval / new Function used","evidence":"dist/extension.js: …join(vendor, file), 'utf8'); return new Function(`${src}\\nreturn (${expr});`)(); } export…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"@otpilot/mcp","version":"0.2.0","found":true,"license":"GPL-3.0-only","hasInstallScripts":false,"dependencyCount":4,"publishedAt":"2026-10-16T12:49:24.511Z","repositoryUrl":"git+https://github.com/OTPilot/OTPilot.git","weeklyDownloads":341}],"repo":{"found":true,"owner":"OTPilot","repo":"OTPilot","archived":false,"pushedAt":"2026-10-16T14:06:24Z","stars":0,"forks":0,"openIssues":1,"ownerType":"Organization","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/285272195?v=4","ownerCreatedAt":"2026-05-16T18:50:48Z"},"icon":{"url":"https://avatars.githubusercontent.com/u/285272195?v=4&s=128","source":"github"},"presence":{"stars":0,"forks":0,"downloadsWeek":341,"license":"GPL-3.0-only","lastPushAt":"2026-10-16T14:06:24.000Z","score":31}}}},"grade_history":[],"reviews":[]}