Thanks! that's actually much closer to what I'm looking for.

pip install python-vipaccess looks like it'll provision new token, form which you can then use the secret in a regular TOTP app.

Wonder if that could be used to sidestep the proprietary app

https://news.ycombinator.com/item?id=27692315

looks like you can!