I personally like golang a lot for small-ish scripting and programming. It has strong typing and few foot guns (e.g. bash with the weird way arrays are handled, implicit splitting of array items etc). Downside is it needs to be compiled up front and is basically a black box from the CI configuration’s POV (you can inspect the source of a circleci orb or GitHub action for example).
Wow, we gone full circle here. 2FA (the “protocol”, not the application mentioned in the OP) was conceived to increase security by requiring a second factor (not second secret). So we would need the password (knowledge based authentication) and the code generating hardware (possession based authentication). If we stuff all our 2FA secrets into a web service, we efficiently removed the possession factor of the authentication, making it one where two knowledge factors (password for the thing you want to login to and password for the hosted 2FA storage) are sufficient.