Verifa

io.github.Verifa-SolutionsPublished by GitHub account Verifa-Solutionsv0.1.1Updated Oct 24, 2026

Identity verification, document checks, sanctions/PEP screening and case review as agent tools.

VerifiedStreamable HTTPWeb executableSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Verifa exposes identity verification, document checks, sanctions/PEP screening and case review as tools an assistant can call.

What you can do
Create, read, list and reprocess verification sessions, including sandbox simulation and capture links for applicants, and read session events and checks such as sanctions, PEP, adverse media and watchlist hits, with reruns. Search, list, get and tag identities. Work the review queue: list, get, claim, assign, comment on, approve, reject or escalate cases, and acknowledge or dismiss findings. Read and write blocklists and custom lists, list and trigger workflows and verification policies. Check organisation details such as usage stats, users and API keys, and run search and fetch for connector-style use.
When to use it
Useful when an assistant should drive a KYC or identity-verification workflow end to end: starting sessions, screening people against sanctions and PEP lists, and helping a reviewer work through cases and findings. Start with a sandbox key to see the full lifecycle before touching live data.
Requirements
A Verifa API key in VERIFA_API_KEY (sandbox or live; publishable keys are rejected), with VERIFA_ENV optionally set to sandbox or live. Runs as a local npm package over stdio with Node 20+, or as a hosted streamable HTTP endpoint that can be used directly with OAuth 2.1 sign-in. Network access to the Verifa API host.
Before you install
The key is sent as a Bearer token to the API host and grants whatever scopes it holds; use sandbox keys while evaluating and scope live keys narrowly. Tools can write: sessions, case decisions, comments, list changes and workflow triggers. Redaction tools are off by default, need the redact:write scope and a written reason, are rate-limited, and are irreversible. Every call is audited as agent-made.

Installation

In SourceWeft

  1. Open Verifa in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.Verifa-Solutions%2Fverifa/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "verifa": {
      "type": "http",
      "url": "https://api.withverifa.com/mcp"
    }
  }
}

README

Verifa MCP Server

Run identity verification from any MCP client — Claude Desktop, Cursor, Claude Code, or your own agent. Create verification sessions, hand the person a capture link, screen against sanctions and PEP lists, read results, and work the review queue, all as tools an agent can call.

json
{  "mcpServers": {    "verifa": {      "command": "npx",      "args": ["-y", "@verifasolutionsinc/mcp-server"],      "env": { "VERIFA_API_KEY": "vk_sandbox_...", "VERIFA_ENV": "sandbox" }    }  }}

That is the whole install. Get a sandbox key at app.withverifa.com → Developers → API keys (free, no card, no sales call). Sandbox keys never touch real data and can simulate every verification outcome, so you can see the full lifecycle in a few minutes — examples/id-check does exactly that.

How it works

This package is deliberately small. It opens one authenticated connection to Verifa's hosted MCP endpoint (https://api.withverifa.com/mcp, streamable HTTP) and forwards tools/list, tools/call, prompts/list and prompts/get over stdio. Nothing is reimplemented here: tool schemas, PII scrubbing, rate limits and the audit trail all live server-side, so this wrapper never drifts from the product.

If your client already speaks streamable HTTP with OAuth 2.1, you can skip this package and connect to the hosted endpoint directly — same tools, sign-in instead of an API key.

Tools

The server exposes 45 tools, grouped into toolsets. By default you get everything except destructive.

ToolsetWhat an agent can do
sessionscreate_session, get_session, list_sessions, list_session_events, simulate_session (sandbox), reprocess_session
checkslist_checks, get_check, list_check_hits, rerun_check — sanctions, PEP, adverse media, watchlists
identitiessearch_identities, list_identities, get_identity, tag / untag
caseslist_cases, get_case, claim_case, assign_case, add_case_comment, approve_case, reject_case, escalate_case …
findingslist_findings, get_finding, acknowledge_finding, dismiss_finding
listsblocklist and custom list reads and writes
workflowslist_workflows, get_workflow, trigger_workflow, list_verification_policies
orgwhoami, get_usage_stats, list_org_users, list_api_keys
searchsearch / fetch for ChatGPT-style connectors
destructiveredact_session, redact_identity, bulk_redact_sessions, … — off unless you opt in

Every tool is scoped: the API key's scopes cap what the connection can do, whatever toolsets are enabled. Every call — read or write — writes an audit row that records it was made by an agent and by which key or OAuth client, so an agent's decision is never mistaken for a human's.

Narrowing the surface

Fewer tools means less context spent per request and better tool selection. Pick what the job needs:

json
"env": {  "VERIFA_API_KEY": "vk_sandbox_...",  "VERIFA_MCP_TOOLSETS": "sessions,checks",  "VERIFA_MCP_READ_ONLY": "1"}
VariableEffect
VERIFA_API_KEYRequired. vk_sandbox_… or vk_live_…. Publishable keys (vk_pub_…) are rejected.
VERIFA_ENVsandbox or live. Inferred from the key if omitted; must match it if set.
VERIFA_MCP_TOOLSETSComma-separated toolsets to expose. Default: all except destructive.
VERIFA_MCP_READ_ONLY1 hides every tool that writes.
VERIFA_MCP_ALLOW_DESTRUCTIVE1 adds the redaction tools. Each call also needs the redact:write scope, a written reason, and is capped at 5 per hour per key. Redaction is irreversible by design.
VERIFA_API_URLOverride the API host (e.g. a staging environment).

Check what a given configuration exposes without opening a client:

sh
VERIFA_API_KEY=vk_sandbox_... npx -y @verifasolutionsinc/mcp-server --check

Try it in five minutes

sh
git clone https://github.com/Verifa-Solutions/verifa-mcp-servercd verifa-mcp-server/examples/id-checknpm installcp .env.example .env        # paste your sandbox keynpm start                   # approvenpm run review              # the outcome that matters: a human has to decide

The demo creates a session, generates the one-time capture link and QR code an integrator would show, simulates an outcome (no passport needed — sandbox only), and reads the result. It prints the REST calls in one column and the identical flow driven through this MCP server in the other. Add --webhooks with a public URL (cloudflared tunnel --url http://localhost:8787 works) to receive the signed webhook deliveries and see signature verification — the part most integrations get wrong.

Development

sh
npm installnpm run buildnpm test                                     # unit testsVERIFA_API_KEY=vk_sandbox_... node dist/index.js --check   # live smoke test

Node 20+. Logs go to stderr; stdout is the MCP transport.

Security

  • Use sandbox keys while evaluating. Live keys should be scoped to the toolsets the agent needs.
  • The server never stores or logs the API key; it is sent only as a Bearer token to VERIFA_API_URL.
  • Responses are PII-free by default — the hosted server strips applicant identifiers from tool results unless the key holds the relevant scope and the session's sensitive-data window is open.
  • Report vulnerabilities via withverifa.com/security/disclosure.

License

MIT — see LICENSE.

Source: README.md at commit 1d9f20f

Tools

0
SourceWeft has not read this server's tools yet.

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts