Unico

v0.2.0-alpha.1OAuth2alpha

Brazilian identity verification / KYC leader. IDCloud (CPF/CNPJ + document OCR), IDPay (face match, liveness), IDCheck (PEP, sanctions, court records). First entry in the Identity & KYC category. Alpha on npm — devcenter.unico.io is contract-gated; base URLs overridable via env.

18 tools5 env vars🇧🇷 Brazilalpha — pending validation

Install

terminal

$ npm install @codespar/mcp-unico@alpha

Quickstart

Add this entry to your claude_desktop_config.json (or any MCP-compatible client config).

claude_desktop_config.json

{
  "mcpServers": {
    "unico": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-unico@alpha"
      ],
      "env": {
        "UNICO_CLIENT_ID": "<your_unico_client_id>",
        "UNICO_CLIENT_SECRET": "<your_unico_client_secret>"
      }
    }
  }
}

After restart, your agent can call any of the 18 tools below — try validate_cpf first.

Environment variables · 5

Required to authenticate the server. Stored encrypted when using CodeSpar managed hosting.

UNICO_CLIENT_ID

required

Unico OAuth client_id

UNICO_CLIENT_SECRET

requiredsecret

Unico OAuth client_secret

UNICO_ENV

optional

Environment: 'sandbox' or 'production'. Defaults to 'sandbox'.

UNICO_BASE_URL

optional

Optional override for the IDCloud/IDPay/IDCheck API base URL. Defaults to https://api.unico.co.

UNICO_AUTH_URL

optional

Optional override for the OAuth token endpoint base URL. Defaults to https://auth.unico.co.

Available tools · 18

Each tool is independent — your agent loads only what it needs to reduce context and response time.

WRITEvalidate_cpf

IDCloud: validate a Brazilian CPF with Receita Federal. Returns { valid, status (REGULAR | SUSPENSA | TITULAR FALECIDO | CANCELADA | NULA | PENDENTE), name, situation }. Optional birthdate enables a cross-check against the CPF registry.

WRITEvalidate_cnpj

IDCloud: validate a Brazilian CNPJ with Receita Federal. Returns company status (ATIVA, BAIXADA, SUSPENSA, INAPTA), legal name, trade name, partners (QSA), address, and primary CNAE.

READextract_document

IDCloud: OCR + structured field extraction from a Brazilian ID document image. Returns typed fields (name, document number, issuer, birthdate, parents, etc.) plus extraction confidence.

READverify_document_authenticity

IDCloud: tamper / forgery detection on a document image. Returns an authenticity score (0-1), a categorical verdict (AUTHENTIC | SUSPICIOUS | FRAUDULENT), and a list of detected anomalies (e.g. font mismatch, copy-paste edits, printed-on-screen capture).

READface_match

IDPay: biometric 1:1 comparison between a live selfie and a document photo. Returns a similarity score (0-1) and a boolean match verdict at Unico's production-tuned threshold.

READliveness_check

IDPay: passive liveness detection. Confirms the captured subject is a physically present person, not a printed photo, screen replay, mask, or deepfake. Returns { is_live, score, signals[] }.

READcheck_pep

IDCheck: Politically Exposed Person screening. Pass cpf (preferred) or name; returns matches with role, jurisdiction, and source. A subject is PEP if they currently hold — or held in the last 5 years — a prominent public function per Bacen Circular 3,978/2020.

READcheck_watchlists

IDCheck: global sanctions / adverse-media screening. Covers OFAC (US Treasury), UN, EU, HMT (UK), Interpol Red Notices, and curated adverse-media sources. Pass cpf or name; returns hits with list name, entry date, and risk level.

Compatible frameworks

MCP is a protocol — any framework that speaks it can mount this server.

Claude Agent SDKAnthropic

OpenAI AgentsOpenAI

Vercel AI SDKVercel

LangChainLangChain

LlamaIndexLlamaIndex

CrewAICrewAI

MastraMastra

Any MCP clientProtocol

Frequently asked questions

All credentials are encrypted at rest in an isolated vault scoped per organization. OAuth2 tokens are automatically refreshed before expiry. Your agent code never sees raw secrets — it receives scoped, short-lived session tokens.