mcp-caf

Name: mcp-caf
Author: codespar

Local

github.com/codesparSecurity275Updated 4w ago

Repository

About mcp-caf

mcp-caf is a deprecated MCP server for the Caf identity platform, covering KYC/KYB checks, face authentication, liveness, document OCR and onboarding flow orchestration. The host it calls does not resolve in DNS, so none of its tools can reach a service. It is kept in the repository for reference and needs a working base URL to be used.

Key features

01KYC and KYB checks by CPF or CNPJ
02Face authentication and passive liveness
03Document OCR and authenticity validation
04Multi-step onboarding flow orchestration
05Check result replay and datasource listing

Use cases

01Referencing the Caf tool layout when designing an identity verification server
02Brazilian user onboarding checks once a working endpoint is provided

MCP support

This project is an MCP server that originally exposed 9 identity verification tools to MCP clients, but none currently reach a live service.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config

{
  "mcpServers": {
    "codespar-mcp-caf": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-caf"
      ],
      "env": {
        "CAF_API_KEY": "<CAF_API_KEY>",
        "CAF_API_BASE": "<CAF_API_BASE>"
      }
    }
  }
}

Run commandnpx -y @codespar/mcp-caf

Environment variables to set

CAF_API_KEYSecretAPI key from the Caf dashboard

CAF_API_BASEAPI base URL — defaults to Caf production. Override for sandbox.

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages

npm@codespar/mcp-caf0.1.3stdio

Tools

Saved tool list · updated 2w ago

Parameter	Type	Required	Description
cpf	string	Yes	CPF (with or without punctuation)
datasource_ids	array	No	Optional datasources (Receita, SPC, Serasa, OFAC, ...)

Details

From the project README

@codespar/mcp-caf

Deprecated: no live endpoint. Measured on 2026-09-27 against two public DNS resolvers (8.8.8.8 and 1.1.1.1): api.caf.io, the host this server calls, does not resolve in DNS. CAF's docs (now branded Certta) name api.combateafraude.com/v1 for the Core API, which they no longer recommend for new integrations, and api.us.prd.caf.io for the newer Connect API; this server was not written against either and has not been checked. No tool in this server reaches a service. The package is deprecated on npm and stays in this repository for reference only. If you have a working endpoint, point the server at it with CAF_BASE_URL. To bring the package back, open an issue in mcp-dev-latam with the provider's documented base URL.

MCP server for Caf — Brazilian identity + Trust Platform. KYC/KYB, face authentication + liveness, document validation + OCR, and orchestrated onboarding flows. Direct competitor to Unico / IDwall / Certta; their Trust Platform chains multi-step identity verifications with policy rules.

Quick Start

Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "caf": {
      "command": "npx",
      "args": ["@codespar/mcp-caf"],
      "env": {
        "CAF_API_KEY": "your-api-key"
      }
    }
  }
}

Cursor / VS Code

Same config in .cursor/mcp.json.

Tools (9)

KYC / KYB

Tool	Caf endpoint	Notes
`person_check`	`POST /v1/checks/person`	CPF → name, DOB, restrictions, risk
`company_check`	`POST /v1/checks/company`	CNPJ → profile, QSA, sanctions

Biometrics

Tool	Caf endpoint	Notes
`face_authentication`	`POST /v1/biometrics/face`	Selfie vs base image + liveness
`liveness_check`	`POST /v1/biometrics/liveness`	Passive liveness only

Documents

Tool	Caf endpoint	Notes
`document_check`	`POST /v1/checks/document`	OCR + authenticity for RG / CNH / passport / proof of residence

Trust Platform orchestration

Tool	Caf endpoint	Notes
`trust_platform_start`	`POST /v1/trust/flows`	Hosted onboarding flow per dashboard template
`trust_platform_get`	`GET /v1/trust/flows/{flow_id}`	Per-step verdicts

Metadata + replay

Tool	Caf endpoint	Notes
`list_datasources`	`GET /v1/datasources`	Datasources enabled on your account
`get_check_result`	`GET /v1/checks/{check_id}`	Replay a previous check by id

Authentication

Standard Bearer auth:

Authorization: Bearer <CAF_API_KEY>

Issue your API key from the Caf dashboard:

Production: https://caf.io
Docs: https://docs.caf.io

Sandbox / Testing

Sandbox endpoint: https://api-sandbox.caf.io. Override via CAF_API_BASE.

Environment Variables

Variable	Required	Description
`CAF_API_KEY`	yes	API key from the Caf dashboard
`CAF_API_BASE`	no	Override base URL (default `https://api.caf.io`)

Caf vs Certta vs BigDataCorp

Three BR identity rails in this catalog, each with a different specialty:

Provider	Strength	Best for
Caf	KYC + Trust Platform orchestration	Hosted onboarding with policy rules
Certta (`@codespar/mcp-certta`)	KYC + biometrics + ICP-Brasil signature	Onboarding with signed contracts
BigDataCorp (`@codespar/mcp-bigdatacorp`)	Broad data enrichment + antifraud	KYC + AML + credit decisioning

Enterprise

Need governance, budget limits, and audit trails for agent identity calls? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

Read the getting-started guide

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.