# AgentSIM

> OTP sessions for browser agents. Programmable US numbers for two jobs: running browser-agent / CI OTP workflows, and red-teaming your own SMS-OTP fraud defenses. Provision a disposable programmable US number, wait for SMS, parse the OTP, record the outcome, and release — over SDK, REST, webhooks, or MCP. For authorized testing of systems you own or are permitted to test.

## What It Does

AgentSIM provisions a temporary programmable US number, waits for the inbound SMS, runs a multi-stage OTP parser, and records a delivery outcome — without a human watching an inbox. One engine, two authorized use cases:

- **Browser-agent & CI OTP workflows.** When a browser agent or test suite hits an SMS step on an app you own, AgentSIM handles the number, the wait, and the parse so the run can continue.
- **Fraud & security testing.** Fraudsters create accounts and pass SMS verification with disposable, programmable numbers at scale. AgentSIM gives fraud, risk, and trust-&-safety teams the same numbers, under their control, so they can red-team their own ATO and signup-fraud detection.

One session = one provision, one OTP attempt, one observed outcome, one release. $0.99/session after a 10-session free tier.

## Authorized Use Only

AgentSIM is for **authorized security testing of systems you own or are permitted to test**, and for OTP workflows on auth providers you control. These are programmable (not real-SIM) numbers, so they behave like an attacker's — which is exactly what you want when simulating one.

**Not for** creating accounts on third-party services you do not own, bypassing anti-abuse systems at Google, Meta, Stripe, or banks, bulk account creation, ban evasion, or any use that violates a target service's terms or applicable law.

## Where It Works (Today)

AgentSIM is appropriate for owned/controlled OTP workflows and services empirically known to accept programmable / agent-pooled US numbers. The empirical support map is maintained in docs/supported-services.md in the repo.

**Do not assume support by default.** Current hard evidence: Google rejects the current number class. Meta/Facebook mobile reaches SMS code entry but delivery is unproven. Stripe, Render, Discord, and GitHub hit anti-abuse gates before a phone verdict in blind automation. Auth0's self-serve flow is email-first and not a useful OTP proof target.

If you are testing a strict or high-risk target, verify it first; AgentSIM may not be the right tool today.

## Quick Start

```bash
pip install agentsim-sdk
# or
npm install @agentsim/sdk
```

```python
from agentsim import AgentSIM
agentsim = AgentSIM(api_key="...")
# Authorized testing only — your own systems or staging tenants.
session = await agentsim.provision({"country": "US", "service_url": "https://staging.example.com/login"})
otp = await session.wait_for_otp(timeout=30_000)
# otp.otp_code → "847291"
# otp.sender → "CONTROLLED_AUTH"
```

## Product

- [Browser-Agent OTP QA](https://agentsim.dev/use-cases/browser-agent-otp-qa): Authorized browser-agent SMS OTP tests against owned apps and staging tenants
- [Fraud & Security Testing](https://agentsim.dev/use-cases/fraud-testing): Red-team your own ATO & signup-fraud detection, generate synthetic-fraud test data, and run continuous CI checks on your defenses — for systems you own or are permitted to test
- [Integrations](https://agentsim.dev/#integrations): Works with Claude Code, LangChain, Vercel AI SDK, Cursor, Windsurf, and LlamaIndex
- [Agent Skill](https://agentsim.dev/.well-known/agent-skills/otp-sessions/SKILL.md): AgentSIM OTP Sessions skill for compatible agent clients
- [Agent Landing Page](https://agentsim.dev/agents): Agent-facing overview of auth.md registration, scoped bearer tokens, JWT refresh, and revocation
- [How It Works](https://agentsim.dev/#how-it-works): OTP sessions, parsing, and delivery diagnostics for agents
- [Comparison](https://agentsim.dev/#compare): Compare AgentSIM with dedicated rentals, cloud phone APIs, and shared virtual numbers
- [Pricing](https://agentsim.dev/#pricing): Hobby (free, 10 sessions/mo), Builder ($0.99/session, unlimited), Enterprise (custom)
- [Sign Up](https://agentsim.dev/sign-up): 10 free sessions, no credit card

## Documentation

- [Quickstart](https://docs.agentsim.dev/quickstart): First OTP session setup
- [Concepts](https://docs.agentsim.dev/concepts): Core session model and delivery terms
- [Authentication](https://docs.agentsim.dev/authentication): API key setup and protected API calls
- [Agent Registration](https://agentsim.dev/auth.md): auth.md service_auth registration, user claim approval, short-lived agt_ bearer tokens, and JWT-bearer refresh for agents
- [API Reference](https://docs.agentsim.dev/api-reference/overview): Provision, wait, messages, release, and webhooks
- [MCP Tools](https://docs.agentsim.dev/mcp/tools): Available MCP primitives
- [TypeScript SDK](https://docs.agentsim.dev/sdk/typescript): npm install @agentsim/sdk
- [Python SDK](https://docs.agentsim.dev/sdk/python): pip install agentsim-sdk
- [MCP Server](https://docs.agentsim.dev/mcp/connect): Claude Code, Cursor, Windsurf — one command setup

## MCP Integration

AgentSIM works where agents run: Claude Code, Cursor, Windsurf, LangChain, LlamaIndex, Vercel AI SDK, Playwright, and custom browser-agent harnesses. Use MCP, SDKs, REST, or webhooks.

Add to any MCP-compatible client:

```bash
claude mcp add agentsim -- npx -y @agentsim/mcp-server
```

The MCP server exposes tools: provision_number, wait_for_otp, get_messages, list_numbers, release_number.

## GitHub

- [Source Code](https://github.com/agentsimdev/agentsim): Monorepo — API, SDKs, MCP server, dashboard, docs
- [Issues](https://github.com/agentsimdev/agentsim/issues)
- [MCP Registry](https://github.com/agentsimdev/agentsim/tree/main/mcp-registry)

## Performance

- Provision latency: ~200ms (number from warm pool)
- OTP receive-to-parse latency: ~6s p50 once SMS arrives at our gateway
- Number country: US (programmable)
- Infrastructure: Telnyx-class programmable numbers, multi-stage regex+heuristic OTP parser

## Social

- [X / Twitter](https://x.com/agentsimdev)
- [LinkedIn](https://www.linkedin.com/company/agentsim/)
- [Dev.to](https://dev.to/fathin_dosunmu)

## Legal

- [Privacy Policy](https://agentsim.dev/privacy)
- [Terms of Service](https://agentsim.dev/terms)
- [Cookie Policy](https://agentsim.dev/cookies)