Legiti

BR ticketing-native fraud prevention (formerly Inspetor, São Paulo). 4th fraud entry. Order evaluation + Collection API for events/accounts/auth tracking. Alpha on npm — public docs thinner than ClearSale/Konduto; tool shapes match docs-backend repo.

Deprecated on npm: No live endpoint: collection-prod.inspcdn.net does not resolve. See https://github.com/codespar/mcp-dev-latam/tree/main/packages/fraud/legiti

MIT · deprecated on npm

Quickstart

Before you use it.

This package is deprecated on npm, so this page offers no install command or client config. No live endpoint: collection-prod.inspcdn.net does not resolve. See https://github.com/codespar/mcp-dev-latam/tree/main/packages/fraud/legiti

Tools

What your agent can call.

Submit an order to Legiti for real-time fraud evaluation via the v2 order endpoint. Returns a decision (approve / reject / manual) synchronously — response may take up to ~20s. Include as much context as possible: account, payment (tokenized card bin+last4), CPF, billing/shipping, and for ticketing flows the event_date_id / sale_items.

Notify Legiti of a status change on an existing order (e.g. payment captured, shipped, cancelled, refunded). Feeds the ML model — required for ongoing decision quality. Use mark_order_fraudulent for confirmed chargebacks instead.

Report a confirmed chargeback / fraud outcome back to Legiti. This is Legiti's primary ML feedback channel — unreported chargebacks degrade future decision quality for similar buyers. Call this after the issuer confirms the chargeback, not on mere suspicion.

Legacy single-shot sale evaluation via POST /evaluation. Synchronous — returns { inspetor_decision: 'approve' | 'reject' | 'manual' }. Prefer evaluate_order (v2) for new integrations; use this when you only have the minimal required fields or for feature parity with older Legiti/Inspetor integrations.

Notify Legiti of an account lifecycle event (created / updated / deleted). Legiti's ML model treats the Account as a primary entity and needs every state change to score future sales accurately.

Notify Legiti of an Event (concert, show, match, session) lifecycle change. Events are primary entities in Legiti's ticketing-native model — scoring for ticket sales depends on up-to-date event metadata (date, venue, capacity, price tiers).

Notify Legiti of a Sale state change (created / updated). For initial sale creation without asking for a decision, set request_evaluation=false on evaluate_order instead. Use this for post-creation updates that aren't status transitions (e.g. sale items added/removed before capture).

Notify Legiti of an authentication or password event (login attempt, logout, password recovery request, password reset). Login/logout and password activity are strong signals for account-takeover fraud — feed every attempt, successful or failed.

Notify Legiti of a login attempt (successful or failed). Convenience wrapper over track_auth that hard-codes action='login'. Failed logins are critical signal for ATO (account-takeover) — feed every attempt, including the ones blocked by your auth layer.

Notify Legiti of a logout event. Convenience wrapper over track_auth with action='logout'. Useful for session-duration features in ATO models.

Notify Legiti of a new account creation. Convenience wrapper over track_account with action='create'. Send this at the moment the account is provisioned — Legiti uses signup recency as a fraud signal.

Notify Legiti of an account profile change (email, phone, CPF, address). Convenience wrapper over track_account with action='update'. Pass any fields that changed — omitted fields are not interpreted as cleared.

Compatibility

MCP is a protocol. Any client that speaks it can mount this server.

The CodeSpar runtime does not route this server. Mount it in your client over stdio · streamable-http.

Start in seconds.

This package is deprecated on npm; read the notice above before using it.