Legiti

Prevenção a fraudes nativa de ticketing do BR (antiga Inspetor, São Paulo). 4ª entrada de fraude. Avaliação de pedido + Collection API pra rastreamento de eventos/contas/auth. Alpha no npm — docs públicas mais finas que ClearSale/Konduto; os formatos das tools batem com o repo docs-backend.

Descontinuado no npm: No live endpoint: collection-prod.inspcdn.net does not resolve. See https://github.com/codespar/mcp-dev-latam/tree/main/packages/fraud/legiti

MIT · descontinuado no npm

Variáveis de ambiente, nomes e descrições das ferramentas vêm do pacote npm e ficam em inglês.

Início rápido

Antes de usar.

Este pacote está descontinuado no npm, então esta página não oferece comando de instalação nem configuração de cliente. No live endpoint: collection-prod.inspcdn.net does not resolve. See https://github.com/codespar/mcp-dev-latam/tree/main/packages/fraud/legiti

Ferramentas

O que o seu agente pode chamar.

Submit an order to Legiti for real-time fraud evaluation via the v2 order endpoint. Returns a decision (approve / reject / manual) synchronously — response may take up to ~20s. Include as much context as possible: account, payment (tokenized card bin+last4), CPF, billing/shipping, and for ticketing flows the event_date_id / sale_items.

Notify Legiti of a status change on an existing order (e.g. payment captured, shipped, cancelled, refunded). Feeds the ML model — required for ongoing decision quality. Use mark_order_fraudulent for confirmed chargebacks instead.

Report a confirmed chargeback / fraud outcome back to Legiti. This is Legiti's primary ML feedback channel — unreported chargebacks degrade future decision quality for similar buyers. Call this after the issuer confirms the chargeback, not on mere suspicion.

Legacy single-shot sale evaluation via POST /evaluation. Synchronous — returns { inspetor_decision: 'approve' | 'reject' | 'manual' }. Prefer evaluate_order (v2) for new integrations; use this when you only have the minimal required fields or for feature parity with older Legiti/Inspetor integrations.

Notify Legiti of an account lifecycle event (created / updated / deleted). Legiti's ML model treats the Account as a primary entity and needs every state change to score future sales accurately.

Notify Legiti of an Event (concert, show, match, session) lifecycle change. Events are primary entities in Legiti's ticketing-native model — scoring for ticket sales depends on up-to-date event metadata (date, venue, capacity, price tiers).

Notify Legiti of a Sale state change (created / updated). For initial sale creation without asking for a decision, set request_evaluation=false on evaluate_order instead. Use this for post-creation updates that aren't status transitions (e.g. sale items added/removed before capture).

Notify Legiti of an authentication or password event (login attempt, logout, password recovery request, password reset). Login/logout and password activity are strong signals for account-takeover fraud — feed every attempt, successful or failed.

Notify Legiti of a login attempt (successful or failed). Convenience wrapper over track_auth that hard-codes action='login'. Failed logins are critical signal for ATO (account-takeover) — feed every attempt, including the ones blocked by your auth layer.

Notify Legiti of a logout event. Convenience wrapper over track_auth with action='logout'. Useful for session-duration features in ATO models.

Notify Legiti of a new account creation. Convenience wrapper over track_account with action='create'. Send this at the moment the account is provisioned — Legiti uses signup recency as a fraud signal.

Notify Legiti of an account profile change (email, phone, CPF, address). Convenience wrapper over track_account with action='update'. Pass any fields that changed — omitted fields are not interpreted as cleared.

Compatibilidade

MCP é um protocolo. Qualquer cliente que o fale pode montar este servidor.

O runtime da CodeSpar não roteia este servidor. Monte-o no seu cliente via stdio · streamable-http.

Comece em segundos.

Este pacote está descontinuado no npm; leia o aviso acima antes de usá-lo.