There are currently 3, this plugin requires at least one addon to function:
TOTP addon here
Yubico OTP addon here
Authy addon here
To install addons just move the jar file inside the ~/plugins/Securegrid/Addons, restart the server and modify any values in the ~/plugins/Securegrid/config.yml, as most addons will not work without somekind of API keys

Is available here along with its javadocs

Drag and drop the JAR file into your ~/plugins folder and restart the server, then drop any addons you wish into ~/plugins/Securegird/Addons and restart the server again and configure the addons in config.yml

Install the plugin on all your spigot servers as well as your bungeecord proxy, connect all servers to the same mongo database (provide the same connection url to all servers in config.yml) Now modify any other values in messages and config and copy them, as well as all the authentication services you want to use across all your servers (do not copy the same config to the Securegrid folder in your bungeecord proxy plugins, as that one generates a different config)
make sure to set mode in config yml to "bridge"

Now you need to reserve one server as your authentication server, inside it's config set the value for mode "auth", set value for route_to_server_after_authentication under multi_auth to the name of a server to which the player will be redirected to after they authenticate, and both boolean vaules under multi_auth to true, now inside the config.yml of Securegrid installed on your bungeecord proxy, make sure to set authentication_server_name to the name of your authentication server, and the server_after_authentication to the same value
as route_to_server_after_authentication inside your authentication server's config file, if you have ip trusting disabled on all of your spigot servers, also set ip_trusting to false inside the config on your proxy

If you'd prefer to use MySQL instead of MongoDB, do the following, in your spigot installs, make sure that the field "enabled" under mysql is to true and under mongodb set to false (this is importat, because if mongodb.enabled is set to true, the plugin will try to connect to the mongDB database), and under your bungee install, make sure that mysql.override is set to true, also supply the same credentials in all config files.

/2fa is the main plugin command, requires securegrid.2fa
/scadmin is the command mainly used to reset player's who have lost access to their 2FA credentials, requires securegrid.admin
Players given the securegrid.force permission will be forced to setup 2FA, when they join the server.

Securegrid currently registeres two placeholders:

THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.