Mcp Unico

io.github.codesparPublished by GitHub account codesparv0.2.0-alpha.4Updated Oct 24, 2026

DEPRECATED: no live endpoint (api.unico.co does not resolve)

VerifiedSTDIODesktop onlySecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Deprecated MCP server for Unico identity verification (CPF/CNPJ, OCR, biometrics, screening) whose API endpoints no longer resolve.

What you can do
Wraps Unico's Brazilian identity verification products: IDCloud (CPF/CNPJ validation, document OCR, authenticity checks), IDPay (face match and liveness), and IDCheck (PEP, sanctions watchlists, court records, process status, Unico Score), plus webhook registration and a portability check. It authenticates with OAuth 2.0 client credentials and exposes 18 tools. The package is deprecated and, per its own documentation, no tool reaches a live service.
When to use it
Not recommended for new installs: the documented API and token hosts do not resolve in DNS, and the package is deprecated on npm. It is only of interest if you already have a working Unico endpoint and want to point the server at it, or if you are studying the tool surface for reference.
Requirements
Local Node.js process installed from the npm package @codespar/mcp-unico. Requires UNICO_CLIENT_ID and UNICO_CLIENT_SECRET, with optional UNICO_ENV, UNICO_BASE_URL and UNICO_AUTH_URL overrides. Unico products are separately contracted; disabled products return 403.
Before you install
Supplies OAuth credentials (UNICO_CLIENT_ID, UNICO_CLIENT_SECRET) to the configured token endpoint; the documentation says these must stay server-side. Tools handle identity documents, biometric selfies and personal data, and include write actions such as uploading documents, registering webhooks and deleting webhook subscriptions. Default endpoints are dead, so any override points credentials at a host you choose.

Installation

In SourceWeft

  1. Open Mcp Unico in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@codespar/mcp-unico

Deprecated: no live endpoint. Measured on 2026-09-27 against two public DNS resolvers (8.8.8.8 and 1.1.1.1): api.unico.co (API) and auth.unico.co (token) do not resolve in DNS. Unico's developer docs now name api.id.unico.app / api.id.uat.unico.app for the API and identity.acesso.io / identityhomolog.acesso.io for OAuth; this server's paths and auth were not written against them and have not been checked. No tool in this server reaches a service. The package is deprecated on npm and stays in this repository for reference only. If you have a working endpoint, point the server at it with UNICO_BASE_URL and UNICO_AUTH_URL. To bring the package back, open an issue in mcp-dev-latam with the provider's documented base URL.

MCP server for Unico — the Brazilian identity verification leader. CPF/CNPJ validation, document OCR, face biometrics, liveness, PEP / watchlist / court-records screening.

First entry in the CodeSpar identity category. Commerce agents onboarding sellers (marketplaces), running high-value transactions, or operating KYC-regulated flows need identity verification — Unico is the BR standard. Paired with @codespar/mcp-onfido for BR-first + global coverage.

Products

Unico sells three separately-contracted products. This server exposes tools for all three; agents should call only what's enabled on your contract (disabled products return 403).

ProductWhat it does
IDCloudCPF/CNPJ validation with Receita Federal, document OCR, authenticity
IDPayFace match + liveness for login and payment authentication
IDCheckPEP, sanctions watchlists, Brazilian court records

Tools (18)

ToolPurpose
validate_cpfIDCloud: validate a Brazilian CPF with Receita Federal.
validate_cnpjIDCloud: validate a Brazilian CNPJ with Receita Federal.
extract_documentIDCloud: OCR + structured field extraction from a Brazilian ID document image.
verify_document_authenticityIDCloud: tamper / forgery detection on a document image.
face_matchIDPay: biometric 1:1 comparison between a live selfie and a document photo.
liveness_checkIDPay: passive liveness detection.
check_pepIDCheck: Politically Exposed Person screening.
check_watchlistsIDCheck: global sanctions / adverse-media screening.
court_records_searchIDCheck: Brazilian judicial-records search.
get_process_statusIDCheck: poll the status of a verification process previously created via the Unico Web/Mobile SDK or API.
batch_get_process_statusIDCheck: batch status lookup.
upload_process_documentIDCheck: upload a captured image to a running verification process.
get_extracted_dataIDCheck: fetch the structured OCR result for a finished process — typed fields (name, document number, issu...
get_unico_scoreIDCheck: Unico Score — Brazil's identity-fraud risk score (0-1000, higher = lower risk) computed from Unico...
connect_portability_checkConnect: cross-tenant portability check.
register_webhookWebhooks: subscribe a callback URL to receive Unico process events (process.created, process.finished, proc...
list_webhooksWebhooks: list all webhook subscriptions registered for this tenant.
delete_webhookWebhooks: remove a webhook subscription.

Install

bash
npm install @codespar/mcp-unico@alpha

Environment

bash
UNICO_CLIENT_ID="..."       # OAuth client_idUNICO_CLIENT_SECRET="..."   # OAuth client_secretUNICO_ENV="sandbox"         # Optional. 'sandbox' | 'production'. Default: sandboxUNICO_BASE_URL="..."        # Optional. Default: https://api.unico.coUNICO_AUTH_URL="..."        # Optional. Default: https://auth.unico.co

Authentication

OAuth 2.0 Client Credentials. The server posts client_id:client_secret as Basic auth to Unico's token endpoint and caches the bearer token in memory until 60 s before expiry. Unico's docs require server-side integration only — never expose these credentials to a browser or mobile client.

Run

bash
# stdio (default)npx @codespar/mcp-unico
# HTTPMCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-unico

Status

Shipped as 0.1.0-alpha.1. Unico's REST contract lives behind the devcenter.unico.io portal and is gated by merchant account. Tool names and argument shapes are stable, but exact endpoint paths may shift once we validate against live credentials — override UNICO_BASE_URL / UNICO_AUTH_URL if your account is served from a different host. PRs welcome once you've seen the real payloads.

Enterprise

Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

Source: packages/identity/unico/README.md at commit d0a519a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.2.0-alpha.4LatestSep 27, 2026
  2. v0.2.0-alpha.3Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts