What we tested
Probed live on 26 Sep 2026 against rubric v1.2. 1 of 5 checks passed. 2 unknown.
PROBE-VERIFIEDtier 2 of 3
What its MCP server offers
We connected, ran tools/list, and recorded what came back on 26 Sep 2026. 10 tools — the standard set for sites on wordpress.
generate_otpverify_otpcheck_otp_statusextend_otpget_account_infoget_usage_reportcreate_accountget_account_statusget_topup_quotetop_up_credits
What an agent could do here
Read from the page’s own content, with the wording each was drawn from. Inference is kept separate from tested facts — an agent completing the action is tier 3.
UNVERIFIED
buy“”https://mcp.myotp.app/mcp
quote“”https://mcp.myotp.app/mcp
Context
342 sites in the index share the category security and identity. 80 transactional sites share it.
How we grade
Three tiers. Every listing shows which one it has reached, and when. The rubric.
tier 1Declared
The site says agents are welcome in its robots.txt. A permission, not a capability.
tier 2Probe-verified
We fetched the site and tested each signal ourselves. Dated, repeatable, re-checked on a schedule.
tier 3Behaviourally verified
An agent completed the action end to end — booked, bought, submitted — and it worked.
Own this site?
2 checks did not pass when we last looked: llms.txt, API catalog. Each is a small, specific fix; the rubric says exactly what we look for.
Behavioural verification — an agent completing your booking, purchase or contact flow end to end, with the date published here — opens to a small founding cohort first. Leave an email to be in it.
Related verified sites
VigilLocal smart-home and self-monitored security software for Mac and Windows, featuring private room sensing, scenes, and optional sensor hardware, available for purchase with Stripe-verified prices and live availability.
security and identity mcp.phishunt.ioPhishunt MCP provides an API service for detecting and analyzing phishing domains and URLs, offering tools to check domains, list brand-targeted phishing sites, retrieve recent detections, and analyze URLs for phishing signals.
security and identity ScruteXScruteX offers continuous threat exposure management, attack surface monitoring, dark web and brand protection solutions via a CTEM platform, accessible online with API and OAuth support.
security and identity Sigma AuthOAuth 2.1 and OpenID Connect authorization server allowing authentication with Bitcoin (BAP) identity keys instead of passwords, supporting PKCE, device authorization grant, dynamic client registration, and AI agent capabilities.
security and identity AuthZedAuthorization infrastructure and permissions database SpiceDB for modern applications, enabling fine-grained access control, scalable and secure permission systems, with cloud and dedicated deployment options, developer tools, and AI authorization support.
security and identity Hacktron DocsAI-powered security code-review platform reviewing repositories for vulnerabilities with pull-request comments and dashboard findings, offering per-PR reviews and whitebox scans (pentests) for software security assessment.
security and identity LeakData.ioLeakData.io provides data breach intelligence and digital risk services, including verified email breach exposure checks and password hash prefix checks via API and MCP endpoints.
security and identity Agent Identity ProtocolAgent Identity Protocol provides a standard for AI agent identity attestation, enabling security controls, per-action authorization policies, identity management, revocation, and immutable audit trails for AI agents.
security and identity Record generated from a live database query. Method: about the index.
How we found this site: probe discovery. This site didn’t declare agent access — we found it by checking the open web. Everything above was tested the same way, against the same rubric, on the date shown. How we choose what to check, and how to opt out →