Mcp Onfido

io.github.codesparPublished by GitHub account codesparv0.2.2Updated Oct 24, 2026

MCP server for Onfido — global identity verification + KYC: applicants, documents, checks, workflows

VerifiedSTDIODesktop onlySecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Local MCP server for Onfido identity verification and KYC, letting an assistant create applicants, upload documents and selfies, run checks and read reports.

What you can do
Create, retrieve, update and soft-delete applicants, the person records everything else attaches to. Upload identity documents and live photos, list them, retrieve metadata and download raw document files. Run verification checks, list and resume them, and retrieve individual reports and report lists. Start and retrieve Onfido Studio workflow runs. Mint short-lived SDK tokens for embedding Onfido web and mobile SDKs.
When to use it
Use it when an assistant should drive an Onfido KYC flow end to end: onboarding applicants, submitting documents and selfies, running checks and pulling report details, especially for users outside Latin America or global, regulated onboarding.
Requirements
Runs locally over stdio via the npm package, so Node.js is needed. Requires an Onfido API token in ONFIDO_API_TOKEN. Optionally set ONFIDO_REGION to eu, us or ca; otherwise the default host is used. Network access to the Onfido API is required.
Before you install
The Onfido API token is a secret granting access to identity verification data; keep it out of logs and shared configs. The server handles sensitive personal data such as identity documents and selfies, which are sent to Onfido. Tools create, update, resume and soft-delete records and start workflow runs, so changes affect real verification state. Direct live photo upload may be restricted on some accounts.

Installation

In SourceWeft

  1. Open Mcp Onfido in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@codespar/mcp-onfido

MCP server for Onfido — global identity verification and KYC.

Onfido is the identity verification layer behind Revolut, N26, Uber, and hundreds of regulated fintechs. One API covers 195+ countries and the full KYC flow: applicant → document → live photo → check (runs verification) → reports.

Second entry in CodeSpar's identity category alongside Unico (BR-first KYC). Pair them: Unico for Brazilian users (CPF + Receita Federal biometric pool), Onfido when the flow touches non-LatAm users.

Tools (20)

ToolPurpose
create_applicantCreate an Onfido applicant — the person record that documents, live photos, and checks attach to.
retrieve_applicantRetrieve an applicant by id.
update_applicantUpdate fields on an existing applicant.
upload_documentUpload an identity document image for an applicant.
retrieve_documentRetrieve document metadata by id.
upload_live_photoUpload a live photo (selfie) for an applicant, used by facial_similarity_photo reports.
retrieve_live_photoRetrieve a live photo record by id.
create_checkRun a verification check on an applicant.
retrieve_checkRetrieve a check by id.
list_checksList all checks for a given applicant.
retrieve_reportRetrieve an individual report by id.
delete_applicantSoft-delete an applicant.
list_documentsList all documents uploaded for a given applicant.
download_documentDownload the raw binary of an uploaded document.
list_live_photosList all live photos (selfies) uploaded for a given applicant.
resume_checkResume a check that was paused (typically awaiting_applicant or paused states).
list_reportsList the reports contained within a given check.
create_workflow_runStart an Onfido Studio workflow run.
retrieve_workflow_runRetrieve a workflow run by id.
generate_sdk_tokenMint a short-lived SDK token for embedding the Onfido Web / iOS / Android SDKs in your frontend.

Flow

create_applicant    -> upload_document  (front, and back if driving_licence / national_identity_card)    -> upload_live_photo    -> create_check      report_names=["document","facial_similarity_photo","watchlist_standard"]    -> retrieve_check    (poll until status = complete)    -> retrieve_report   (for each report id to get the detailed breakdown)

Install

bash
npm install @codespar/mcp-onfido

Environment

bash
ONFIDO_API_TOKEN="..."    # API token (required, secret)ONFIDO_REGION="eu"        # Optional. 'eu' | 'us' | 'ca'. Defaults to api.onfido.com.

Authentication

Onfido uses a non-Bearer header format:

Authorization: Token token=<ONFIDO_API_TOKEN>

The server handles this automatically.

Regional hosts

RegionHost
Defaulthttps://api.onfido.com
EUhttps://api.eu.onfido.com
UShttps://api.us.onfido.com
CAhttps://api.ca.onfido.com

All requests target API version v3.6 (current stable).

Multipart uploads

upload_document and upload_live_photo accept files as base64-encoded strings. Pass the bytes in file, with file_name and content_type:

json
{  "applicant_id": "a1b2c3...",  "type": "passport",  "file": "<base64-encoded bytes>",  "file_name": "passport.jpg",  "content_type": "image/jpeg"}

The server wraps it as multipart/form-data before sending.

Note: Onfido increasingly recommends capturing live photos via their SDK rather than API upload. Direct /live_photos upload may be restricted on some accounts — use the SDK flow when in doubt.

Run

bash
# stdio (default — for Claude Desktop, Cursor, etc)npx @codespar/mcp-onfido
# HTTP (for server-to-server testing)MCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-onfido

When to pick Onfido vs Unico

SignalPick
User is Brazilian, need CPF validation + biometric match against Receita FederalUnico
User is outside LatAm, or flow is globalOnfido
Regulated fintech needing AML watchlist + PEP screening globallyOnfido
Travel / gig marketplace onboarding across 20+ countriesOnfido

Enterprise

Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

Source: packages/identity/onfido/README.md at commit d0a519a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts