Age Verification with Claude: Hosted Sessions vs Local Files

Key takeaways

• A hosted Claude connector cannot send a selfie or identity-document photo to didit_verify_age or didit_verify_id from the user's device. Those tools read absolute paths on the machine running the Model Context Protocol (MCP) server.
• The correct hosted path is session-based: create a session for an existing workflow, give the person the returned url, and retrieve the completed decision with didit_session_get_decision.
• A workflow can include facial age estimation, which estimates age, or document verification, which extracts the date of birth and other document fields. These are different levels of evidence.
• The file-path tools remain useful for local or self-hosted stdio deployments where the MCP server and image file are on the same machine.
• Didit's hosted MCP endpoint exposes 115 tools. The server is free, and the free tier is 500 free verifications per month.

“Verify this person's age from Claude” sounds like a single tool call. The real integration has an important boundary: where does the image live? That determines whether Claude should create a hosted verification session or call a standalone image tool.

Didit's MCP developer page and public GitHub repository describe the server that connects Claude to identity and fraud checks. For age assurance, the hosted-session route is the practical choice for a real person using Claude remotely. The standalone image-path route is designed for local or self-hosted environments with direct filesystem access.

The filesystem boundary most MCP examples miss

The standalone didit_verify_age tool accepts an absolute image_path. didit_verify_id similarly accepts an absolute front_image_path and an optional back_image_path. Inside the MCP server, those paths are validated and read from disk before the files are submitted.

That is straightforward in a local stdio deployment. If Claude Desktop and a self-hosted Didit MCP server run on the same workstation, a path such as /Users/example/checks/selfie.jpg can refer to a real file available to the server process. The same idea works on a controlled internal server when the application has already placed the file in a permitted local directory.

It does not work the same way with the hosted endpoint. When Claude calls https://mcp.didit.me/mcp, an absolute path refers to Didit's server filesystem, not the Claude user's laptop or phone. Typing a local path into hosted Claude does not upload that file. A remote user therefore cannot hand the hosted tool a selfie or document photo merely by naming a path.

This is not a limitation of age estimation itself. It is a transport and filesystem distinction. For hosted users, Didit solves the handoff with a verification session and a user-facing URL.

The hosted Claude flow that works

First, the organisation needs an existing workflow configured in the Didit Business Console. That workflow defines the checks the person will complete. An age-assurance workflow might include facial age estimation, document verification with date-of-birth extraction, or a broader Know Your Customer (KYC) sequence.

Claude then calls didit_session_create. The only required input is workflow_id; the tool does not accept an inline “workflow configuration.” Optional inputs include the exchange's or application's user reference in vendor_data, a redirect callback, and a UI language.

Use didit_session_create with:
{
  "workflow_id": "<existing-workflow-uuid>",
  "vendor_data": "user_18427",
  "callback": "https://example.com/age-check/complete",
  "language": "en"
}

Return the session URL to the user. Do not ask them for a local image path.

The response contains session_id, url, and session_token. Claude gives the person the returned url. The person opens Didit's hosted verification UI on their own device and completes the capture steps defined by the workflow. The image transfer happens in that UI rather than through a path typed into the chat.

After completion, Claude calls didit_session_get_decision with the returned session ID:

Use didit_session_get_decision with:
{
  "session_id": "<session-uuid-from-create>"
}

Summarise the session decision and only the extracted fields returned by the workflow.

The tool returns the full verification decision and all extracted data for that session. The exact data depends on the workflow. The MCP source does not document a separate Boolean shortcut for the age threshold. For document checks, the decision may include the structured document data returned by the configured verification steps; the agent should read the actual response rather than invent a convenience field.

What the local image tools actually do

In a local or self-hosted stdio setup, the standalone tools can be a direct path for batch jobs, internal review utilities, or applications that already control image ingestion.

Facial age estimation

didit_verify_age requires image_path and optionally accepts vendor_data. It estimates a person's age from a facial image and also performs a passive liveness check. An estimate is not proof of an exact date of birth or identity.

# Local or self-hosted stdio only
# The file must exist on the MCP server's filesystem.
didit_verify_age {
  "image_path": "/absolute/server/path/selfie.jpg",
  "vendor_data": "user_18427"
}

Age estimation is priced at $0.10 per check. The input is still a facial image, and the service processes that image to produce the result. Describing the method as document-free is accurate; describing it as collecting no personal data or storing nothing is not supported by the MCP tool contract.

Document-based date-of-birth extraction

didit_verify_id requires front_image_path. It can also receive back_image_path, minimum_age, and other documented options. The tool submits the identity-document image, performs optical character recognition (OCR), and returns structured document data and authenticity checks. OCR can extract the date of birth alongside other fields present on the document.

# Local or self-hosted stdio only
didit_verify_id {
  "front_image_path": "/absolute/server/path/id-front.jpg",
  "back_image_path": "/absolute/server/path/id-back.jpg",
  "minimum_age": 18,
  "vendor_data": "user_18427"
}

The source describes minimum_age as declining the check when the extracted age is below the supplied value. The agent should read the returned decision rather than expect an extra threshold-result field. ID Verification is $0.15 per check. Because the full document image is submitted and document fields are extracted, this route should not be presented as collecting only a date of birth.

Age estimation, document checks, and full KYC are not interchangeable

Route	What it establishes	Hosted Claude path	Published price
Facial age estimation	An estimated age from a facial image, plus passive liveness	Use a hosted session whose workflow includes age estimation	$0.10 per check
ID Verification	Document authenticity checks and extracted document fields, including date of birth when present	Use a hosted session whose workflow includes document verification	$0.15 per check
Full KYC	Configured identity checks combining ID Verification, Passive Liveness, Face Match, and IP Analysis	Create a session for the existing KYC workflow and hand off the URL	$0.33 per bundle

The first route estimates. The second relies on a submitted government-issued document. The third combines multiple checks into a broader identity decision. Product teams can distinguish these evidence levels without claiming that any one mechanism automatically satisfies a law or regulator.

The regulatory landscape is method-specific

Age-assurance rules differ by jurisdiction, service type, content, and risk. In the UK, Ofcom's Online Safety Act age-assurance guidance discusses several methods that can be capable of being highly effective, including facial age estimation and photo-identification matching, while evaluating effectiveness against criteria such as accuracy, resistance to circumvention, reliability, and fairness. In the European Union, the European Commission's Audiovisual Media Services Directive overview describes protection-of-minors measures that can include PINs or more sophisticated age-verification systems.

Those sources illustrate why implementation language matters: “age assurance,” “age estimation,” “document verification,” and “identity verification” are related but not synonymous. Whether a particular method fits a particular service is a jurisdiction- and context-specific assessment. The MCP integration supplies the technical routes; it does not make that assessment for the operator.

Connect Claude without blurring the boundary

Use the Didit connector deep link for hosted Claude. The endpoint uses OAuth 2.1 with Proof Key for Code Exchange (PKCE). The MCP overview, authentication guide, and tool reference cover connection and discovery.

For the broader session pattern, read KYC identity verification over MCP. For a catalogue-level view of the integration, see the Didit MCP tools reference.

The practical rule is simple: hosted Claude should create a session and hand the person its URL; local or self-hosted stdio can use absolute image paths when the server truly has those files. Keeping that boundary explicit makes age-assurance prompts accurate, runnable, and safe to reuse.