Mcp Certta

io.github.codesparPublished by GitHub account codesparv0.1.3Updated Oct 27, 2026

DEPRECATED: no live endpoint (api.certta.com.br does not resolve)

VerifiedSTDIODesktop onlySecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Deprecated MCP server for Certta, a Brazilian identity and signature platform; its API host no longer resolves, so no tool reaches a service.

What you can do
  • Look up CPF and CNPJ identity and company data (KYC/KYB)
  • Run face match and passive liveness checks on selfies
  • OCR identity documents such as RG, CNH, CRLV and passports, and score antifraud risk
  • Create ICP-Brasil and electronic signature envelopes and read their status
  • Create and inspect onboarding processes that chain KYC, biometrics and signature
  • Note: the README states no tool in this server reaches a service because the default API host does not resolve.
When to use it
Only as reference material, for example when studying how a Brazilian KYC, biometrics and signature MCP server is structured. It is not suitable for real identity checks or signatures, since the package is deprecated and its endpoint is dead.
Requirements
Runs locally via npx from the npm package @codespar/mcp-certta. Requires the CERTTA_API_KEY environment variable (an API key from the Certta dashboard) and optionally CERTTA_API_BASE to override the base URL. The README also mentions CERTTA_BASE_URL for pointing at a working endpoint, which differs from the declared variable name.
Before you install
The package is deprecated and the default API host does not resolve, so calls will fail. The server handles sensitive personal data (CPF, CNPJ, biometrics, documents) and creates signature envelopes, which are consequential actions if it is ever pointed at a live endpoint. The README's endpoint override name conflicts with the declared CERTTA_API_BASE, so verify configuration before use.

Installation

In SourceWeft

  1. Open Mcp Certta in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@codespar/mcp-certta

Deprecated: no live endpoint. Measured on 2026-09-27 against two public DNS resolvers (8.8.8.8 and 1.1.1.1): api.certta.com.br, the host this server calls, does not resolve in DNS. docs.certta.ai redirects to CAF's documentation (Certta is CAF's current brand), which names api.combateafraude.com/v1 (Core API, not recommended for new integrations) and api.us.prd.caf.io (Connect API); this server was not written against either and has not been checked. See also @codespar/mcp-caf. No tool in this server reaches a service. The package is deprecated on npm and stays in this repository for reference only. If you have a working endpoint, point the server at it with CERTTA_BASE_URL. To bring the package back, open an issue in mcp-dev-latam with the provider's documented base URL.

MCP server for Certta — Brazilian identity + signature platform. KYC/KYB (CPF / CNPJ via Receita Federal + SPC / Serasa), face match + liveness, OCR of RG / CNH / comprovantes, antifraud score, ICP-Brasil digital signature + GoCertta electronic signature, and orchestrated onboarding pipelines that chain KYC + biometrics + signature in one process.

Quick Start

Claude Desktop

Add to your claude_desktop_config.json:

json
{  "mcpServers": {    "certta": {      "command": "npx",      "args": ["@codespar/mcp-certta"],      "env": {        "CERTTA_API_KEY": "your-api-key"      }    }  }}

Cursor / VS Code

Same config in .cursor/mcp.json.

Tools (11)

KYC / KYB

ToolCertta endpointNotes
kyc_lookup_cpfPOST /v1/kyc/cpfCPF → name, DOB, regularity, restrictions, risk score
kyb_lookup_cnpjPOST /v1/kyb/cnpjCNPJ → corporate profile, QSA, CNAE, capital

Biometrics

ToolCertta endpointNotes
biometrics_face_matchPOST /v1/biometrics/face-matchSelfie vs document photo + liveness
biometrics_livenessPOST /v1/biometrics/livenessPassive liveness on a selfie

Documents + antifraud

ToolCertta endpointNotes
documents_ocrPOST /v1/documents/ocrOCR RG / CNH / CRLV / proof of residence / passport
antifraud_scorePOST /v1/antifraud/scoreComposite risk score (0..100)

Signature

ToolCertta endpointNotes
signature_icp_createPOST /v1/signature/icp/envelopesICP-Brasil digital signature envelope
signature_electronic_createPOST /v1/signature/electronic/envelopesGoCertta electronic signature envelope
signature_get_envelopeGET /v1/signature/envelopes/{envelope_id}Status + signer responses

Onboarding pipelines

ToolCertta endpointNotes
onboarding_process_createPOST /v1/onboarding/processesOrchestrate KYC + biometrics + signature in one flow
onboarding_process_getGET /v1/onboarding/processes/{process_id}Per-step verdicts

Authentication

Standard Bearer auth:

Authorization: Bearer <CERTTA_API_KEY>

Issue your API key from the Certta dashboard:

Sandbox / Testing

Sandbox endpoint: https://api-sandbox.certta.com.br. Override via CERTTA_API_BASE.

Environment Variables

VariableRequiredDescription
CERTTA_API_KEYyesAPI key from the Certta dashboard
CERTTA_API_BASEnoOverride base URL (default https://api.certta.com.br)

Certta vs Caf vs BigDataCorp

Three BR identity rails in this catalog, each with a different specialty:

ProviderStrengthBest for
CerttaKYC + biometrics + ICP-Brasil signatureOnboarding with signed contracts
Caf (@codespar/mcp-caf)KYC + Trust Platform orchestrationHosted onboarding with policy rules
BigDataCorp (@codespar/mcp-bigdatacorp)Broad data enrichment + antifraudKYC + AML + credit decisioning

Enterprise

Need governance, budget limits, and audit trails for agent identity calls? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

Source: packages/identity/certta/README.md at commit d0a519a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.1.3LatestSep 27, 2026
  2. v0.1.2Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts