The Identity and Fraud MCP for AI Agents

Most MCP (Model Context Protocol) servers do one thing. There are servers for calendars, for databases, for issue trackers. Identity and fraud is different: it is not one check, it is a lifecycle. A user has to be authenticated, then verified, then monitored — and businesses, wallets, and transactions each add their own layer. Didit's MCP server exposes that entire lifecycle to an AI agent through a single connection. This is the category pillar: one MCP for identity and fraud, built so an agent can run real compliance work with guardrails that keep a human in control.

Key takeaways

• Didit is infrastructure for identity and fraud — and its MCP server carries the whole lifecycle: authenticate, verify, monitor.
• One hosted endpoint, https://mcp.didit.me/mcp, exposes 130+ tools across 11 categories covering KYC, KYB, AML, transaction monitoring, and wallet screening.
• Access is role-scoped through OAuth 2.1 + PKCE — the agent inherits exactly your console permissions, no more.
• Guardrails are built in: secrets are redacted from tool output, and consequential writes ask for confirmation.
• Pricing matches the platform: KYC core flow $0.33, wallet screening $0.15/check, AML Screening $0.20, transaction monitoring $0.02/transaction, 500 free verifications/month. The MCP layer is free.
• Trusted by 1,500+ companies in production; $7.5M raised; Y Combinator W26; profitable.

Why identity and fraud belong in one MCP

Identity and fraud are two halves of the same problem, and splitting them across two servers means an agent has to stitch context together by hand. A KYB check surfaces a UBO (Ultimate Beneficial Owner); that owner needs a KYC (Know Your Customer) session; that person and the company both need AML (Anti-Money Laundering) screening; once onboarded, their transactions need monitoring. These are not separate errands — they are one closed loop.

Didit models the loop as a unified platform, so the MCP server can hand an agent the whole arc in one place. The agent can start a business verification, spawn the KYC sessions its beneficial owners require, screen everyone against sanctions / PEP (Politically Exposed Person) / adverse-media lists, and then keep watching transactions after go-live. One connection, one permission model, one billing account.

The full lifecycle, as tools

The four product lines under the identity and fraud banner all appear as MCP tools:

• User Verification (KYC) — ID Verification, document OCR, passive and active liveness, face match, and IP/device signals, composed as sessions an agent can create and read.
• Business Verification (KYB) — registry lookup, officer data, UBO extraction, entity and person AML, plus linked KYC sessions for each beneficial owner.
• Transaction Monitoring (AML) — real-time transaction monitoring with a rule engine, seeded rule bundles, and case management for fiat and crypto.
• Wallet Screening (KYT) — wallet screening for crypto addresses against sanctions and mixer exposure.

Because the agent composes these itself, the natural-language surface is simple:

"Screen this Ethereum wallet and, if it clears, monitor the counterparty's transactions against our standard AML rules."

The agent selects the wallet-screening tool, reads the result, and — only if it clears — calls the transaction-monitoring tools next.

The 11 tool categories

The 130+ tools group into eleven categories, so an agent (and you) can reason about what is available:

1. Discovery / Cross-App — orient the agent: what workflows, modules, and resources exist in this workspace.
2. Sessions (KYC / KYB) — create, read, and manage verification sessions.
3. Workflows & Questionnaires — drive the no-code Workflow Orchestrator and custom questionnaires.
4. Standalone Verification APIs — call individual modules (face, OCR, AML) directly without a full session.
5. Transaction Monitoring (AML) — rules, alerts, and case flow for real-time monitoring.
6. Vendor Users & Businesses — manage the verified users and businesses in your account.
7. Lists / Blocklist / Allowlist — maintain the deny/allow lists that gate onboarding.
8. Cases — open, review, and resolve compliance cases.
9. Reports / Audit / Alerts — pull reports, audit trails, and alerts for oversight.
10. Webhooks — register and inspect webhook destinations for downstream events.
11. Workspace / Billing — read workspace configuration and usage.

Together they cover the operational surface a compliance and engineering team already uses in the console — now reachable by an agent.

Guardrails: role-scoped, redacted, confirmed

Handing an AI agent access to compliance tooling only works if the guardrails are real. Didit's MCP server enforces three:

Role-scoped access. Authentication is OAuth 2.1 + PKCE — the "Log in with Didit" flow through business.didit.me, with no API key to leak. The agent operates under your console role (Owner, Admin, Compliance Officer, Developer, or Reader) and the didit:management and didit:verification scopes. A Reader-scoped session cannot mutate anything; a Compliance Officer can do compliance writes but not developer-only actions. The agent never exceeds the human who signed in.

Secrets redacted. Sensitive values are stripped from tool responses, so credentials do not end up in a model's context window or a chat transcript.

Confirmation on writes. Consequential actions — creating sessions, changing lists, resolving cases — are structured to keep a human in the loop rather than firing silently. The agent proposes; you approve.

Pricing stays the same, and the MCP is free

Adding an AI agent does not change the economics. A full KYC core flow is $0.33, wallet screening is $0.15/check, AML Screening is $0.20, and transaction monitoring is $0.02/transaction. Every account includes 500 free verifications per month, and inference runs in under two seconds. The MCP server itself — the layer that makes all of this callable by an agent — is free, hosted, and open-source (MIT) at github.com/didit-protocol/mcp.

Connect an agent in minutes

For Claude Code, one command wires it up:

claude mcp add --transport http didit https://mcp.didit.me/mcp

Run /mcp to complete the OAuth login. For Claude Desktop, add it under Settings → Connectors → Add custom connector. Cursor, VS Code, Windsurf, and Zed accept the same URL in their JSON config, and ChatGPT can add it as a connector by URL through OpenAI Developer Mode (an OpenAI beta).

The identity and fraud lifecycle is now something an AI agent can run safely, end to end. Read the developer overview at didit.me/developers/mcp and the docs at docs.didit.me/integration/mcp/overview. Start free at business.didit.me — 500 free verifications every month, and the MCP server costs nothing to connect.