Mcp Legiti

io.github.codesparPublished by GitHub account codesparv0.2.0-alpha.4Updated Oct 27, 2026

DEPRECATED: no live endpoint (collection-prod.inspcdn.net does not resolve)

VerifiedSTDIODesktop onlyFinanceBusiness & Commerce

Overview

AI-generated overview

Deprecated MCP server for Legiti fraud prevention: submits orders for fraud evaluation and reports account, sale and chargeback events — but its endpoint no…

What you can do
  • Submit orders and legacy sales for synchronous fraud evaluation, returning approve, reject or manual decisions
  • Fetch the latest decision for an order and manually override or update decision status
  • Report order status changes, confirmed fraud and chargeback dispute outcomes back to Legiti
  • Send account, auth, login, logout, signup, password-recovery and profile-update events
  • Track ticketing events, event views, sales and payment-method events such as authorization, capture, refund and void
When to use it
Only if you already have a working Legiti endpoint and contract, since the default host does not resolve and the package is deprecated on npm. Otherwise it is not worth installing; it is kept for reference.
Requirements
Runs locally over stdio via the npm package (npx or npm install). Requires a Legiti API key in LEGITI_API_KEY (JWT bearer token) and optionally LEGITI_BASE_URL, which defaults to a host that currently does not resolve. A Legiti account and separate sandbox and production keys are needed.
Before you install
The server is deprecated and no tool reaches a live service with the default configuration. The API key is a bearer token granting access to a fraud-scoring account; use the sandbox key for testing, since test data sent with a production key pollutes Legiti's ML model. Tools send customer data such as CPF, payment and account details to Legiti, and some report fraud outcomes that affect future scoring.

Installation

In SourceWeft

  1. Open Mcp Legiti in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@codespar/mcp-legiti

Deprecated: no live endpoint. Measured on 2026-09-27 against two public DNS resolvers (8.8.8.8 and 1.1.1.1): collection-prod.inspcdn.net, the host this server calls, does not resolve in DNS. No tool in this server reaches a service. The package is deprecated on npm and stays in this repository for reference only. If you have a working endpoint, point the server at it with LEGITI_BASE_URL. To bring the package back, open an issue in mcp-dev-latam with the provider's documented base URL.

MCP server for Legiti — Brazilian fraud prevention, ticketing-native with a simple synchronous evaluation API.

Fourth entry in the CodeSpar fraud category, after @codespar/mcp-clearsale, @codespar/mcp-konduto, and @codespar/mcp-sift. Legiti (formerly Inspetor, São Paulo) occupies the mid-size BR tier: smaller public footprint than ClearSale, more vertical depth than Konduto for ticketing / events, and a simpler API surface than Sift.

Positioning

StrengthTypical fit
ClearSaleBR pioneer (2001), large chargeback historyDefault for large BR retail
KondutoBR, API-first, behavioral device intelDigital-native BR ecommerce
Legiti (this)BR, ticketing-native, sync evaluationBR ticketing marketplaces, mid-size retail
SiftGlobal, multi-abuse-type ML, workflowsInternational enterprise

BR merchants frequently bundle 2-3 of these for best-of-breed scoring — Legiti for its ticketing-specific signals, ClearSale or Konduto for the generalist fraud layer, Sift for cross-border flows.

Tools (18)

ToolPurpose
evaluate_orderSubmit an order to Legiti for real-time fraud evaluation via the v2 order endpoint.
update_orderNotify Legiti of a status change on an existing order (e.g.
mark_order_fraudulentReport a confirmed chargeback / fraud outcome back to Legiti.
evaluate_saleLegacy single-shot sale evaluation via POST /evaluation.
track_accountNotify Legiti of an account lifecycle event (created / updated / deleted).
track_eventNotify Legiti of an Event (concert, show, match, session) lifecycle change.
track_saleNotify Legiti of a Sale state change (created / updated).
track_authNotify Legiti of an authentication or password event (login attempt, logout, password recovery request, pas...
track_loginNotify Legiti of a login attempt (successful or failed).
track_logoutNotify Legiti of a logout event.
track_signupNotify Legiti of a new account creation.
track_account_updateNotify Legiti of an account profile change (email, phone, CPF, address).
track_password_recoveryNotify Legiti of a password recovery request (the 'forgot password' click).
track_event_viewNotify Legiti that a user viewed an event/show page.
track_paymentNotify Legiti of a payment-method-level event (authorization attempt, capture, refund, void).
get_decisionFetch the latest Legiti decision for an order.
update_decision_statusManually override Legiti's decision for an order — typically used to accept or decline a sale that landed i...
mark_dispute_resolutionReport the outcome of a chargeback dispute back to Legiti — i.e.

Install

bash
npm install @codespar/mcp-legiti@alpha

Environment

bash
LEGITI_API_KEY="eyJhbGciOi..."   # JWT bearer token; requiredLEGITI_BASE_URL="..."             # optional; defaults to https://collection-prod.inspcdn.net

Authentication

Bearer token (JWT-format):

Authorization: Bearer <LEGITI_API_KEY>

Legiti issues separate sandbox and production keys. The sandbox key tags every request as test data so it does NOT train the ML model. Always develop and run integration tests with the sandbox key — hitting production with test data pollutes the model.

Decision values

evaluate_order and evaluate_sale return one of three decisions:

  • approve — ship it
  • reject — block the sale
  • manual — route to manual review

Evaluation is synchronous; the response may take up to ~20 seconds.

Typical flow (ticketing)

  1. At signup / login, call track_account (create/update) and track_auth (login/logout, password_recovery, password_reset). Every auth attempt — successful or failed — is valuable signal for account-takeover detection.
  2. When a new event (concert, show, match) is published on the platform, call track_event (create). Update on price/capacity/date changes.
  3. At checkout, call evaluate_order with the sale, account, payment, CPF, and the primary event_date_id. Act on the returned decision: approve → ship, reject → block, manual → human review.
  4. As the order progresses (paid, shipped, delivered, cancelled, refunded), call update_order.
  5. When a chargeback is confirmed by the issuer, call mark_order_fraudulent. This is Legiti's primary ML feedback channel — unreported chargebacks degrade future decision quality for similar buyers.

Typical flow (non-ticketing ecommerce)

Skip track_event. The event_date_id fields become optional in evaluate_order — Legiti will still evaluate on account + sale + payment signal, though ticketing-vertical features will be unused.

Alpha note

Shipped as 0.1.0-alpha.1. Legiti's public documentation is tighter than ClearSale's or Konduto's:

  • Documented in open-source github.com/legiti/docs-backend: POST /evaluation, plus the Collection API (account, event, sale, transfer, auth, password) shape and the Authorization: Bearer scheme.
  • Documented on docs.legiti.com integration guides: the v2 order family (POST /v2/order, PUT /v2/order, POST /v2/order/mark_fraudulent).
  • Dropped from the original category spec: create_rule / list_rules / update_rule / delete_rule — no public custom-rules surface exists on Legiti. If a customer contract exposes one, promote to 0.2.0.

Promote to 0.1.0 once the v2 order payload schema is confirmed in production.

Run

bash
# stdio (default — for Claude Desktop, Cursor, etc)npx @codespar/mcp-legiti
# HTTP (for server-to-server testing)MCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-legiti

Category

fraud — fourth server in this CodeSpar category alongside ClearSale, Konduto, and Sift. Fraud servers share a common shape (analyze → decide → feedback) distinct from payments, which makes cross-provider swaps (ClearSale ↔ Konduto ↔ Legiti) more straightforward than cross-acquirer swaps.

Enterprise

Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

Source: packages/fraud/legiti/README.md at commit d0a519a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.2.0-alpha.4LatestSep 27, 2026
  2. v0.2.0-alpha.3Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts