Which Identity Vendors Have an MCP Server? 2026 Comparison

Key takeaways

• Our review of 17 identity, fraud, and compliance vendors found four with a confirmed official Model Context Protocol (MCP) implementation in this vendor set: Sumsub, TRM Labs, Prove, and Plaid.
• The implementations are not interchangeable. Sumsub exposes operational verification and configuration capabilities; TRM Labs focuses on blockchain alert work; Prove's documented surface centers on documentation search; and Plaid's two servers do not perform identity verification.
• Stripe operates an official MCP server, but Stripe Identity does not appear in its published tool set.
• For every other vendor, the accurate status is no official MCP server found in this research—not a claim that one does not exist or will not launch.
• Didit exposes 115 tools through a hosted OAuth (Open Authorization) endpoint, is free to connect, includes 500 free verifications per month, and publishes MIT-licensed code that can be self-hosted.

How to read this comparison

This is a point-in-time developer map, researched on August 3, 2026. We checked official documentation, vendor pages, launch posts, and clearly identified third-party connectors. A generic wrapper is not counted as an official vendor MCP server. Likewise, a vendor announcing AI agents or an agentic product is not treated as MCP support unless the vendor names an MCP implementation.

“No official MCP server found” means the research did not locate one on an official vendor-controlled surface. It does not prove absence. Vendor capabilities change, so verify the linked documentation before making an integration decision.

Identity and compliance vendor MCP comparison

Vendor	Finding as of August 3, 2026	Delivery	What the evidence shows
Sumsub	Confirmed official MCP	Hosted	Verification operations and compliance configuration
TRM Labs	Confirmed official MCP	Local, client-side	Blockchain alert triage and disposition
Prove	Confirmed official MCP	Hosted	Documentation search is the primary verified capability
Plaid	Confirmed official MCP, two servers	Hosted and local	Diagnostics, analytics, mock data, docs, and sandbox work; neither server performs identity verification
Stripe	Official MCP; Stripe Identity not in published tools	Hosted	Payments and billing operations plus documentation search
Veriff	no official MCP server found	Third-party wrappers found	Pipedream and Zapier connectors
Persona	no official MCP server found	Third-party wrappers found	Composio and MCP Bundles connectors
Onfido / Entrust	no official MCP server found	Unconfirmed	No official evidence located
Jumio	no official MCP server found	Unconfirmed	No official evidence located
Trulioo	no official MCP server found	Unconfirmed	An llms.txt file and an Ultimate Beneficial Owner (UBO) Discovery Agent are not an MCP server
Alloy	no official MCP server found	Unconfirmed	Name collisions with unrelated Alloy products require care
Socure	no official MCP server found	Unconfirmed	No official evidence located
ComplyAdvantage	no official MCP server found	Unconfirmed	Comply is a separate vendor and should not be conflated with ComplyAdvantage
Chainalysis	no official MCP server found	Unconfirmed	Blockchain Intelligence Agents announced; MCP not confirmed
Elliptic	no official MCP server found	Unconfirmed	Agentic product messaging found; MCP not named
Footprint	no official MCP server found	Unconfirmed	No official evidence located
Incode	no official MCP server found	Unconfirmed	No official evidence located

Confirmed official vendor MCP implementations

Sumsub

Sumsub documents an official cloud-hosted endpoint at https://api.sumsub.com/mcp/. Its published scope includes applicant management, verification-link generation, compliance timeline and moderation review, transaction-monitoring filtering, and platform configuration. Access is controlled by a role-based “Use MCP server” permission. Developers should consult Sumsub's MCP documentation for current setup and permissions.

TRM Labs

TRM Labs presents an official, client-side MCP integration for Claude, Cursor, and Visual Studio Code. Its materials describe 180+ data points and 12+ composable skills for blockchain alert triage and disposition, using existing TRM credentials and permissions with audit logging. Access is directed through the account team rather than a public endpoint. See the TRM Labs MCP page and its launch article.

Prove

Prove lists an official hosted endpoint at https://developer.prove.com/mcp. Its MCP documentation was access-code protected during direct review, so a complete tool inventory could not be verified. The available evidence identifies searchProve as the primary tool, making documentation search the clearest confirmed use case.

Plaid

Plaid documents two official servers. Dashboard MCP is hosted at https://api.dashboard.plaid.com/mcp/ and uses Streamable HTTP with OAuth scopes for production diagnostics, Item debugging, Link conversion analytics, and usage metrics. Plaid marks it as under active development with limited support. The local AI Coding Toolkit supports mock data, documentation search, and sandbox testing. Plaid's official MCP resource page does not describe either server as performing identity verification.

Adjacent official MCP: Stripe

Stripe

Stripe's hosted server at https://mcp.stripe.com is official and covers payment-related operations such as customers, products and prices, invoices, payment links, refunds, disputes, subscriptions, and documentation search. Stripe Identity does not appear in the published tool set reviewed for this comparison. That makes Stripe's MCP documentation useful as an implementation reference, but not evidence of MCP-based Stripe Identity support.

Vendors where no official MCP server was found

Veriff

no official MCP server found. The research located a Pipedream connector and a Zapier connector. These are generic third-party integration surfaces, not evidence of a Veriff-built server.

Persona

no official MCP server found. The surfaced options were third-party products from Composio and MCP Bundles. Composio states that it hosts the server and manages the customer's Persona API credentials. Repositories using “persona” to mean an AI character or role are unrelated to Persona the identity company.

Onfido / Entrust

no official MCP server found. The evidence review found no vendor-controlled MCP documentation or launch surface, so the status remains unconfirmed.

Jumio

no official MCP server found. No official evidence was located in the reviewed sources; this is an unconfirmed finding rather than a statement of absence.

Trulioo

no official MCP server found. Trulioo publishes an llms.txt file and has described a UBO Discovery Agent, but the reviewed material did not identify either as an MCP server.

Alloy

no official MCP server found. Search results include MCP products from usealloy.ai and alloy.app, but those are unrelated to the fraud and Know Your Customer (KYC) decisioning vendor at alloy.com. The matching company name is not sufficient evidence.

Socure

no official MCP server found. The reviewed evidence did not locate an official Socure MCP surface, leaving its status unconfirmed.

ComplyAdvantage

no official MCP server found. Comply's MCP announcement concerns a different RegTech company, not ComplyAdvantage. The names should not be conflated.

Chainalysis

no official MCP server found. Chainalysis has announced Blockchain Intelligence Agents, but the reviewed vendor material did not confirm MCP as their integration mechanism.

Elliptic

no official MCP server found. The research found agentic copilot and roadmap messaging, but no official material naming an MCP server.

Footprint

no official MCP server found. No official evidence was located in this review, so the finding remains unconfirmed.

Incode

no official MCP server found. No vendor-controlled MCP documentation or announcement was located in the reviewed evidence; this should be rechecked as products evolve.

What Didit's MCP server does

Didit is infrastructure for identity and fraud. Its hosted, stateless endpoint at https://mcp.didit.me/mcp uses Streamable HTTP, accepts POST requests, and exposes 115 tools. Authentication uses OAuth 2.1, Proof Key for Code Exchange (PKCE), and Dynamic Client Registration through https://business.didit.me; the hosted server does not require an API key in a client configuration file.

The surface spans identity and operational work, including session creation and decisions, identity document checks, Anti-Money Laundering (AML) screening, Know Your Business (KYB) searches, face matching, passive liveness, workflow editing, webhooks, analytics, transaction work, case work, and Know Your Transaction (KYT) wallet screening. The server is free, and accounts include 500 free verifications per month.

Developers can add Didit as a Claude connector, review the MIT-licensed GitHub repository, or self-host the published code. Start with the MCP overview, then follow the installation guide and authentication guide. The developer page provides the product-level summary.

For deeper examples, read how the MCP connects to identity verification workflows, explore the Didit MCP tools reference, or see the operational pattern for transaction monitoring.

What to evaluate in any vendor MCP server

• Hosted versus local: A hosted endpoint reduces installation and upgrade work. A local server can offer tighter environmental control but shifts runtime, update, and credential handling to your team.
• OAuth versus an API key in configuration: OAuth can support scoped authorization, revocation, and user consent. A long-lived key placed in a client file needs careful storage, rotation, and access controls.
• Read-only versus write access: Documentation search and diagnostics have a different risk profile from creating sessions, changing configurations, or resolving cases. Inventory actual tools and permissions rather than relying on an “MCP available” label.
• Confirmation for destructive actions: Check whether deletes, irreversible state changes, or high-impact writes require explicit human confirmation and whether that behavior is enforced server-side.
• Secret redaction: Confirm that logs, tool results, errors, and model-visible context do not expose tokens, personal data, or raw credentials.
• Open source and auditability: Published source and a clear license make it easier to inspect authentication, data flow, tool definitions, dependency risk, and release history. If the implementation is closed, ask for equivalent security documentation and an independent review path.

The practical choice is not simply which vendor can say it supports MCP. It is which server exposes the operations you need, with an authentication and permission model your security team can verify.