TwoFactorGuide

TwoFactorGuide — connector documentation

• MCP endpoint: https://twofactorguide.connectorbay.com/mcp
• REST API: POST https://twofactorguide.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://twofactorguide.connectorbay.com/openapi.json
• Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
• Authentication: none required. An optional Authorization: Bearer <key> raises rate limits.
• Health: https://twofactorguide.connectorbay.com/health · Tool schemas: https://twofactorguide.connectorbay.com/tools.json
• Publisher: Unify Dynamics LLC · connectorbay.com/twofactorguide · agent@connectorbay.com

What TwoFactorGuide is for

Setting up two-factor authentication raises real questions: which method should you actually use, how does that rotating 6-digit code even work, where should backup codes live, and what happens if you lose the phone your codes come from. TwoFactorGuide answers all of that, and also computes real TOTP codes so you can see the algorithm work.

The TOTP generator and validator are stateless and single-call-only. Any secret you supply is used only in memory to compute one response for that one call — it is never stored, logged, cached, or transmitted anywhere else.

What it does

compare_2fa_methods compares SMS, authenticator-app (TOTP), hardware security keys, and passkeys with real security tradeoffs — SMS is vulnerable to SIM-swapping; hardware keys and passkeys resist the real-time phishing that SMS and TOTP codes do not. totp_concept_explainer explains how the 30-second rotating code actually works: the shared secret exchanged once at setup, the time-derived counter, the HMAC and dynamic-truncation steps, and why it depends on clock sync between your device and the server. generate_totp computes the real, currently-valid RFC 6238 TOTP code for a given base32 secret — genuine HMAC-SHA1/SHA256/ SHA512 dynamic truncation, verified against the RFC's own published test vectors. validate_totp checks a supplied code against a secret, tolerating a small amount of clock drift by also checking neighboring time windows, exactly as real authenticator verification does. backup_codes_guide covers storing single-use recovery codes safely. lost_device_recovery_checklist covers what to do — and what to set up in advance — if you lose the device or key holding your 2FA.

What it is not

TwoFactorGuide is not a replacement for your actual authenticator app — generate_totp and validate_totp exist to help you understand and verify the algorithm, not to manage your real accounts' live credentials, and you should never paste a real production account's secret into a shared or logged environment. It is not account-recovery or identity-verification service — if you're actually locked out of an account, use that service's own recovery flow (see lost_device_recovery_checklist for the general approach). And nothing here recommends a specific product or brand of authenticator app or hardware key.

Tools

Method comparison

compare_2fa_methods — Compares SMS, authenticator-app TOTP, hardware security keys, and passkeys: how each works, real pros and cons, a strength tier, and a recommendation.

TOTP concept and real cryptography

totp_concept_explainer — Explains how TOTP actually works: shared secret, time-derived counter, HMAC, dynamic truncation, and the clock-sync dependency.

generate_totp — Computes the real, currently-valid RFC 6238 TOTP code for a base32 secret. Stateless, single-call-only; the secret is never stored, logged, or transmitted. Args: secret, digits, algorithm, period, for_time.

validate_totp — Checks a supplied code against a secret, tolerating clock drift via a configurable window of neighboring time-steps. Args: secret, code, digits, algorithm, period, window, for_time.

Backup & recovery

backup_codes_guide — Best practices for storing single-use 2FA backup/recovery codes.

lost_device_recovery_checklist — What to do if you lose your 2FA device, and what to set up in advance.

Conventions

• Read-only / stateless. Every tool reads bundled reference data or computes from arguments; nothing is written anywhere, and no secret passed to generate_totp or validate_totp is ever stored, logged, cached, or transmitted beyond the single call that used it.
• Result envelope. ok: true with data, or ok: false with a structured error (bad_input).
• Rate limits. Free tier 60 tool calls/minute and 300/day per user (keyed on the user identifier supplied by the host agent, else client IP); Pro keys raise this. Over-limit calls return HTTP 429 with Retry-After. initialize and tools/list are never counted.

Support

agent@connectorbay.com · connectorbay.com/twofactorguide/support

TwoFactorGuide — Privacy Policy

Effective 28 September 2026. Unify Dynamics LLC ("we", "us"), Menlo Park, California.

What TwoFactorGuide is. TwoFactorGuide is a connector (an MCP server and REST API) that AI assistants and personal agents call on your behalf for 2FA/authenticator education, and to compute or check RFC 6238 TOTP codes. You interact with your assistant; the assistant sends us only the arguments needed for that one call.

The TOTP secret you provide is never stored, logged, cached, or transmitted anywhere beyond the single computation that used it. generate_totp and validate_totp hold the secret only in process memory for the duration of that one request, compute the result, and discard it immediately afterward. It is never written to disk, never logged (including in error messages, which never include the secret's value), never cached, and never sent to any third party — there is no upstream call in this connector at all.

What we receive. The arguments of each tool call — for example, a base32 secret and a code to check, or no arguments at all for a reference guide — the technical headers needed to serve the request (an IP address or a client identifier supplied by the assistant, and a Pro API key if you have one), and standard server logs. Server logs never include the body of a generate_totp or validate_totp request.

Everything is computed in memory for a single request and nothing about that computation is stored. Each request is answered independently; nothing carries over between requests, and TwoFactorGuide never builds a profile of which accounts, secrets, or codes anyone has used it with (because it never retains any of them in the first place).

What we do not receive or store. We do not receive your conversation with the assistant, your name, or any of your actual account credentials beyond the single argument used for that one call, which is discarded immediately. Rate-limit counters (a client identifier and timestamps) are held in memory for at most 24 hours. Hosting-provider access logs, which contain IP addresses and request paths but not request bodies, are retained for up to 30 days for security and abuse prevention.

Sub-processors. None — every response is computed locally from your arguments or from a bundled reference file. Hosting: Vercel (United States regions).

Legal bases and your rights. Our processing is necessary to provide the service you request through your assistant. Because we store no personal data or secrets beyond short-lived logs (which never include secret values), requests to access, correct, or delete personal data are usually satisfied automatically; you can still contact agent@connectorbay.com and we will respond within 30 days. We do not sell or share personal information and do not use your data to train models.

A practical note on real secrets. Even though TwoFactorGuide itself discards the secret immediately, any text you send through an AI assistant may be visible in that assistant's own conversation history or logs, which we do not control. Avoid pasting a real, currently-active production account's TOTP secret into any chat context, including this one — use this tool to learn and verify the algorithm with a test secret instead.

Changes. We will post changes here with a new effective date.

TwoFactorGuide — Terms of Service

Effective 28 September 2026. These terms govern use of the TwoFactorGuide connector ("the Service") operated by Unify Dynamics LLC ("we", "us").

1. The Service. TwoFactorGuide returns hand-curated 2FA/authenticator education — a method comparison, a TOTP concept explainer, backup-code practices, and a lost-device recovery checklist — and computes or validates RFC 6238 TOTP codes from a secret you supply, entirely at request time.
2. Not a credential manager. TwoFactorGuide does not store, vault, sync, or manage your accounts' actual 2FA secrets or codes. generate_totp and validate_totp are stateless, single-call computations: the secret is used only in memory for that one call and is never stored, logged, cached, or transmitted afterward. This is an educational and verification tool for understanding the TOTP algorithm, not a substitute for your real authenticator app or password manager.
3. Use test secrets, not live production secrets, where practical. Because any text you send through an AI assistant may be visible in that assistant's own conversation history outside our control, avoid pasting a real, currently active account's TOTP secret into a chat context. We are not responsible for how an assistant or its host retains or displays your input before it reaches us.
4. Not security advice tailored to your situation. The method comparison and guides describe general, widely known tradeoffs among 2FA methods. They are not a personalized security assessment and cannot account for a specific account's threat model, an organization's specific compliance requirements, or an individual's specific circumstances.
5. No product recommendations. Nothing in this Service names or endorses a specific authenticator app, password manager, or hardware key brand.
6. Acceptable use. Automated use within the published rate limits is welcome. Do not use this Service to generate or validate codes for accounts you do not own or are not authorized to access.
7. Availability. The Service is provided "as is" without warranty of any kind. We may change, limit, or discontinue it at any time.
8. Data. Our Privacy Policy describes what we process. In short: TOTP secrets are used only in memory for a single call and never stored, logged, or transmitted; reference guides are answered from a bundled file.
9. Pro keys. Optional Pro API keys are issued at our discretion, are personal to the holder, and may be revoked for abuse.
10. Liability. To the fullest extent permitted by law, Unify Dynamics LLC is not liable for any loss — including loss of account access — arising from use of or reliance on the Service, including from pasting a real secret into a context outside our control, or from relying on this Service in place of a real authenticator app or an account's own recovery process. Our total liability is limited to US $100.
11. Governing law. California law; venue in San Mateo County, California.
12. Contact. Unify Dynamics LLC · agent@connectorbay.com · https://connectorbay.com/twofactorguide

TwoFactorGuide support

Email agent@connectorbay.com. We answer within two business days.

• MCP endpoint: https://twofactorguide.connectorbay.com/mcp
• REST API: https://twofactorguide.connectorbay.com/openapi.json
• Live status: https://twofactorguide.connectorbay.com/health

When you report a problem, include the question you asked your agent, roughly when, and which agent you used (for example Claude, ChatGPT or Gemini). Never send us passwords, account numbers or ID numbers. TwoFactorGuide never asks for them.