Verifa MCP Server

Verifa MCP Server

Run identity verification from any MCP client — Claude Desktop, Cursor, Claude Code, or your own agent. Create verification sessions, hand the person a capture link, screen against sanctions and PEP lists, read results, and work the review queue, all as tools an agent can call.

{
  "mcpServers": {
    "verifa": {
      "command": "npx",
      "args": ["-y", "@verifasolutionsinc/mcp-server"],
      "env": { "VERIFA_API_KEY": "vk_sandbox_...", "VERIFA_ENV": "sandbox" }
    }
  }
}

That is the whole install. Get a sandbox key at app.withverifa.com → Developers → API keys (free, no card, no sales call). Sandbox keys never touch real data and can simulate every verification outcome, so you can see the full lifecycle in a few minutes — examples/id-check does exactly that.

How it works

This package is deliberately small. It opens one authenticated connection to Verifa's hosted MCP endpoint (https://api.withverifa.com/mcp, streamable HTTP) and forwards tools/list, tools/call, prompts/list and prompts/get over stdio. Nothing is reimplemented here: tool schemas, PII scrubbing, rate limits and the audit trail all live server-side, so this wrapper never drifts from the product.

If your client already speaks streamable HTTP with OAuth 2.1, you can skip this package and connect to the hosted endpoint directly — same tools, sign-in instead of an API key.

Tools

The server exposes 45 tools, grouped into toolsets. By default you get everything except destructive.

Every tool is scoped: the API key's scopes cap what the connection can do, whatever toolsets are enabled. Every call — read or write — writes an audit row that records it was made by an agent and by which key or OAuth client, so an agent's decision is never mistaken for a human's.

Narrowing the surface

Fewer tools means less context spent per request and better tool selection. Pick what the job needs:

"env": {
  "VERIFA_API_KEY": "vk_sandbox_...",
  "VERIFA_MCP_TOOLSETS": "sessions,checks",
  "VERIFA_MCP_READ_ONLY": "1"
}

Check what a given configuration exposes without opening a client:

VERIFA_API_KEY=vk_sandbox_... npx -y @verifasolutionsinc/mcp-server --check

Try it in five minutes

git clone https://github.com/Verifa-Solutions/verifa-mcp-server
cd verifa-mcp-server/examples/id-check
npm install
cp .env.example .env        # paste your sandbox key
npm start                   # approve
npm run review              # the outcome that matters: a human has to decide

The demo creates a session, generates the one-time capture link and QR code an integrator would show, simulates an outcome (no passport needed — sandbox only), and reads the result. It prints the REST calls in one column and the identical flow driven through this MCP server in the other. Add --webhooks with a public URL (cloudflared tunnel --url http://localhost:8787 works) to receive the signed webhook deliveries and see signature verification — the part most integrations get wrong.

Development

npm install
npm run build
npm test                                     # unit tests
VERIFA_API_KEY=vk_sandbox_... node dist/index.js --check   # live smoke test

Node 20+. Logs go to stderr; stdout is the MCP transport.

Security

• Use sandbox keys while evaluating. Live keys should be scoped to the toolsets the agent needs.
• The server never stores or logs the API key; it is sent only as a Bearer token to VERIFA_API_URL.
• Responses are PII-free by default — the hosted server strips applicant identifiers from tool results unless the key holds the relevant scope and the session's sensitive-data window is open.
• Report vulnerabilities via withverifa.com/security/disclosure.

License

MIT — see LICENSE.