Mcp Caf

io.github.codesparPublished by GitHub account codesparv0.1.3Updated Oct 25, 2026

DEPRECATED: no live endpoint (api.caf.io does not resolve)

VerifiedSTDIODesktop onlySecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Deprecated local MCP server that would let an assistant run Brazilian KYC/KYB, biometric, document and Trust Platform identity checks through Caf, but no longer

What you can do
Run person and company identity checks (CPF and CNPJ) returning profile, restrictions, sanctions and risk data, when a working endpoint exists. Perform face authentication and passive liveness checks against a base image. Validate and OCR identity documents such as RG, CNH, passport and proof of residence. Start hosted Trust Platform onboarding flows and retrieve per-step verdicts. List enabled datasources and replay a previous check by its id.
When to use it
Only as a reference: the package is deprecated on npm and the host it calls does not resolve in DNS, so no tool reaches a service. Do not add it for live identity verification; consider it only if you have a working Caf-compatible endpoint and want to study the tool layout.
Requirements
Runs locally as an npm package over stdio, typically launched with npx. Requires the CAF_API_KEY secret, an API key from the Caf dashboard, and optionally CAF_API_BASE to override the default base URL, for example for a sandbox. Network access to a reachable Caf-compatible API is needed, and the documented default host currently does not resolve.
Before you install
The server is deprecated and its default endpoint is dead, so calls will fail. It handles sensitive personal data: CPF and CNPJ numbers, selfies and biometric liveness, and identity documents, which are sent to a third-party identity provider. The API key is a secret and should be kept out of shared configuration. The README also mentions a CAF_BASE_URL variable that differs from the declared CAF_API_BASE.

Installation

In SourceWeft

  1. Open Mcp Caf in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@codespar/mcp-caf

Deprecated: no live endpoint. Measured on 2026-09-27 against two public DNS resolvers (8.8.8.8 and 1.1.1.1): api.caf.io, the host this server calls, does not resolve in DNS. CAF's docs (now branded Certta) name api.combateafraude.com/v1 for the Core API, which they no longer recommend for new integrations, and api.us.prd.caf.io for the newer Connect API; this server was not written against either and has not been checked. No tool in this server reaches a service. The package is deprecated on npm and stays in this repository for reference only. If you have a working endpoint, point the server at it with CAF_BASE_URL. To bring the package back, open an issue in mcp-dev-latam with the provider's documented base URL.

MCP server for Caf — Brazilian identity + Trust Platform. KYC/KYB, face authentication + liveness, document validation + OCR, and orchestrated onboarding flows. Direct competitor to Unico / IDwall / Certta; their Trust Platform chains multi-step identity verifications with policy rules.

Quick Start

Claude Desktop

Add to your claude_desktop_config.json:

json
{  "mcpServers": {    "caf": {      "command": "npx",      "args": ["@codespar/mcp-caf"],      "env": {        "CAF_API_KEY": "your-api-key"      }    }  }}

Cursor / VS Code

Same config in .cursor/mcp.json.

Tools (9)

KYC / KYB

ToolCaf endpointNotes
person_checkPOST /v1/checks/personCPF → name, DOB, restrictions, risk
company_checkPOST /v1/checks/companyCNPJ → profile, QSA, sanctions

Biometrics

ToolCaf endpointNotes
face_authenticationPOST /v1/biometrics/faceSelfie vs base image + liveness
liveness_checkPOST /v1/biometrics/livenessPassive liveness only

Documents

ToolCaf endpointNotes
document_checkPOST /v1/checks/documentOCR + authenticity for RG / CNH / passport / proof of residence

Trust Platform orchestration

ToolCaf endpointNotes
trust_platform_startPOST /v1/trust/flowsHosted onboarding flow per dashboard template
trust_platform_getGET /v1/trust/flows/{flow_id}Per-step verdicts

Metadata + replay

ToolCaf endpointNotes
list_datasourcesGET /v1/datasourcesDatasources enabled on your account
get_check_resultGET /v1/checks/{check_id}Replay a previous check by id

Authentication

Standard Bearer auth:

Authorization: Bearer <CAF_API_KEY>

Issue your API key from the Caf dashboard:

Sandbox / Testing

Sandbox endpoint: https://api-sandbox.caf.io. Override via CAF_API_BASE.

Environment Variables

VariableRequiredDescription
CAF_API_KEYyesAPI key from the Caf dashboard
CAF_API_BASEnoOverride base URL (default https://api.caf.io)

Caf vs Certta vs BigDataCorp

Three BR identity rails in this catalog, each with a different specialty:

ProviderStrengthBest for
CafKYC + Trust Platform orchestrationHosted onboarding with policy rules
Certta (@codespar/mcp-certta)KYC + biometrics + ICP-Brasil signatureOnboarding with signed contracts
BigDataCorp (@codespar/mcp-bigdatacorp)Broad data enrichment + antifraudKYC + AML + credit decisioning

Enterprise

Need governance, budget limits, and audit trails for agent identity calls? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

Source: packages/identity/caf/README.md at commit d0a519a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.1.3LatestSep 27, 2026
  2. v0.1.2Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts