Onfido

v0.2.0API Key

Global KYC leader (Entrust-owned). Applicants, document upload, live photos, checks (document + facial + watchlist + known-faces), reports. Pairs with Unico (BR-first) for global coverage when commerce touches non-LatAm users.

20 tools2 env vars🌐 GLOBALstable on npm

Install

terminal

$ npm install @codespar/mcp-onfido

Quickstart

Add this entry to your claude_desktop_config.json (or any MCP-compatible client config).

claude_desktop_config.json

{
  "mcpServers": {
    "onfido": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-onfido"
      ],
      "env": {
        "ONFIDO_API_TOKEN": "<your_onfido_api_token>"
      }
    }
  }
}

After restart, your agent can call any of the 20 tools below — try create_applicant first.

Environment variables · 2

Required to authenticate the server. Stored encrypted when using CodeSpar managed hosting.

ONFIDO_API_TOKEN

requiredsecret

Onfido API token. Sent as 'Authorization: Token token=<value>'.

ONFIDO_REGION

optional

Region for the API host: 'eu' (api.eu.onfido.com), 'us' (api.us.onfido.com), 'ca' (api.ca.onfido.com). Defaults to api.onfido.com when unset.

Available tools · 20

Each tool is independent — your agent loads only what it needs to reduce context and response time.

WRITEcreate_applicant

Create an Onfido applicant — the person record that documents, live photos, and checks attach to. Required before any verification.

READretrieve_applicant

Retrieve an applicant by id.

WRITEupdate_applicant

Update fields on an existing applicant. Send only the fields you want to change.

READupload_document

Upload an identity document image for an applicant. Sent as multipart/form-data. Pass file as base64-encoded bytes plus file_name and content_type (image/jpeg, image/png, application/pdf).

READretrieve_document

Retrieve document metadata by id.

READupload_live_photo

Upload a live photo (selfie) for an applicant, used by facial_similarity_photo reports. Sent as multipart/form-data. NOTE: Onfido recommends capturing live photos via their SDK; direct API upload may be restricted on some accounts.

READretrieve_live_photo

Retrieve a live photo record by id.

WRITEcreate_check

Run a verification check on an applicant. A check is a bundle of one or more reports (document, facial_similarity_photo, watchlist, etc). This is the step that actually triggers the verification.

Compatible frameworks

MCP is a protocol — any framework that speaks it can mount this server.

Claude Agent SDKAnthropic

OpenAI AgentsOpenAI

Vercel AI SDKVercel

LangChainLangChain

LlamaIndexLlamaIndex

CrewAICrewAI

MastraMastra

Any MCP clientProtocol

Frequently asked questions

All credentials are encrypted at rest in an isolated vault scoped per organization. OAuth2 tokens are automatically refreshed before expiry. Your agent code never sees raw secrets — it receives scoped, short-lived session tokens.