# ai.facesign/facesign-mcp (remote · mcp.facesign.ai)

Build and test FaceSign step-up verification flows from your AI coding tool

- Trust score: 62/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-20

## Components

- remote · `mcp.facesign.ai`: 62/100 (this document), [markdown](https://verifymcp.io/servers/ai-facesign-facesign-mcp/mcp.md), [page](https://verifymcp.io/servers/ai-facesign-facesign-mcp/mcp)

## Channel facts

- Endpoint: `https://mcp.facesign.ai/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.1.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-20.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 5 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 71/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 12722 tokens (~978/item across 13 items; 5 tools + 8 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 3/100
  - Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http ai-facesign-facesign-mcp https://mcp.facesign.ai/mcp
```

### Codex

```toml
[mcp_servers.ai-facesign-facesign-mcp]
url = "https://mcp.facesign.ai/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ai-facesign-facesign-mcp": {
      "type": "remote",
      "url": "https://mcp.facesign.ai/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ai-facesign-facesign-mcp --url https://mcp.facesign.ai/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  ai-facesign-facesign-mcp:
    url: "https://mcp.facesign.ai/mcp"
```

### Other

```json
{
  "mcpServers": {
    "ai-facesign-facesign-mcp": {
      "type": "http",
      "url": "https://mcp.facesign.ai/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-20 (score 62, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-08-19 (score 62)

First indexed and scored.

## MCP tools (5)

### `set_api_key` (~164 tokens)

Set your FaceSign API key for this session. This must be called before any other FaceSign tools. Get your API key from the FaceSign dashboard. The key starts with sk_live_... or sk_test_... Optionally override the API server URL via `serverUrl` — intended for FaceSign developers pointing the SDK at a non-production backend (e.g. a dev server). Leave unset to use the default production API.

Input parameters:

- `apiKey` (string, required): Your FaceSign API key (sk_live_... or sk_test_...)
- `serverUrl` (string): Optional FaceSign API server URL override. Only set this if the user explicitly asks to target a non-default server (e.g. a dev backend). Omit otherwise to use the production API.

### `get_session` (~50 tokens)

Retrieve detailed information about a FaceSign session including status, transcript, AI analysis, node reports, video AI analysis, and asynchronous analysis lifecycle states.

Input parameters:

- `sessionId` (string, required): The session ID to retrieve

### `list_sessions` (~153 tokens)

List FaceSign sessions with optional filtering by status, date range, and search term. Supports pagination via cursor.

Input parameters:

- `clientReferenceId` (string): Filter by client reference ID
- `cursor` (string): Pagination cursor from a previous response
- `fromDate` (number): Start of date range (Unix timestamp in ms)
- `limit` (number): Max sessions to return (1-100, default 10)
- `search` (string): Search term to filter sessions
- `sortBy` (string): Field to sort by
- `sortOrder` (string): Sort direction
- `status`: Filter by session status
- `toDate` (number): End of date range (Unix timestamp in ms)

### `launch_session_ui` (~5170 tokens)

REQUIRES set_api_key to be called first. Launch a local web page in the browser for a FaceSign session. You MUST supply `landingHtml` (the pre-session page shown before the iframe), `recapHtml` (the results page shown after the session finishes), and `uiStrings` (a per-language dictionary whose keys are invented by you to match placeholders in the HTML). The MCP server provides NO default chrome — every visible string comes from you. Each page load / refresh creates a fresh session.

Input parameters:

- `avatarId` (string): Avatar ID from the facesign://catalog resource.
- `clientReferenceId` (string): Your own reference ID for this session
- `customization` (object): UI customization
- `defaultLang` (string): Optional fallback BCP-47 language code used when the end-user's browser language is not in `langs`. DEFAULT BEHAVIOUR: OMIT this parameter. The MCP server falls back to 'en' internally only as a last…
- `extractionSchema` (array): Optional schema describing fields the FaceSign backend should extract from the session transcript using an LLM. Results are populated post-session at `session.report.extractedData` as `{ [fieldName]:…
- `flow` (array, required): Array of nodes forming the session's directed graph
- `landingHtml` (string, required): REQUIRED. Raw HTML/JS for the pre-session landing page. NO CDATA, NO markdown fences. Every visible string MUST come from `uiStrings` — reference them via {{KEY}} placeholders (interpolated at inject…
- `langs` (array): Optional whitelist of BCP-47 language codes (from facesign://catalog) the session may use. DEFAULT BEHAVIOUR (recommended): OMIT this parameter entirely — the session then supports every language in…
- `metadata` (object): Arbitrary metadata to attach
- `providedData` (object): Pre-known user data
- `recapHtml` (string, required): REQUIRED. Raw HTML/JS for the results/recap page. NO CDATA, NO markdown fences. Every visible string MUST come from `uiStrings` (via {{KEY}} or window.t('KEY')). Contract: reads window.__FACESIGN_SES…
- `uiStrings` (object, required): REQUIRED. Per-language UI string dictionary: { langId: { key: translatedString } }. You invent the keys to match the {{KEY}} placeholders / window.t('KEY') calls in your landingHtml and recapHtml. Mu…
- `videoAIAnalysisEnabled` (boolean): Enable video AI fraud analysis
- `zone` (string): Data processing zone

### `export_app` (~5064 tokens)

Export the current FaceSign session configuration as a standalone, deployable Next.js application. You MUST supply `landingHtml` (pre-session page), `recapHtml` (results page), and `uiStrings` (per-language dictionary whose keys are invented by you to match placeholders in the HTML). The exported app ships NO default chrome — every visible string comes from you. Run with `npm install && npm run dev` or deploy to Vercel after setting FACESIGN_API_KEY.

Input parameters:

- `appName` (string): Name for the generated app (used in package.json, defaults to 'facesign-app')
- `avatarId` (string): Avatar ID from the facesign://catalog resource.
- `clientReferenceId` (string): Your own reference ID for this session
- `customization` (object): UI customization
- `defaultLang` (string): Optional fallback BCP-47 language code used when the end-user's browser language is not in `langs`. DEFAULT BEHAVIOUR: OMIT this parameter. When set, must be one of the codes in `langs` (if `langs` i…
- `extractionSchema` (array): Optional schema describing fields the FaceSign backend should extract from the session transcript using an LLM. Results are populated post-session at `session.report.extractedData` as `{ [fieldName]:…
- `flow` (array, required): Array of nodes forming the session's directed graph
- `flowVariants` (object): Optional additional flows declared at export time. The landing page selects one by calling window.__startSession({ flowId: 'variant-id' }); the browser never sends a graph.
- `landingHtml` (string, required): REQUIRED. Raw HTML/JS for the pre-session landing page. NO CDATA, NO markdown fences. Every visible string MUST come from `uiStrings` — reference them via {{KEY}} placeholders (interpolated at inject…
- `langs` (array): Optional whitelist of BCP-47 language codes (from facesign://catalog) the exported session may use. DEFAULT BEHAVIOUR (recommended): OMIT this parameter entirely — the app then supports every languag…
- `metadata` (object): Arbitrary metadata to attach
- `providedData` (object): Pre-known user data
- `recapHtml` (string, required): REQUIRED. Raw HTML/JS for the results/recap page. NO CDATA, NO markdown fences. Every visible string MUST come from `uiStrings` (via {{KEY}} or window.t('KEY')). Contract: reads window.__FACESIGN_SES…
- `uiStrings` (object, required): REQUIRED. Per-language UI string dictionary: { langId: { key: translatedString } }. You invent the keys to match {{KEY}} / window.t('KEY') in landingHtml and recapHtml. Must contain `en` plus every l…
- `videoAIAnalysisEnabled` (boolean): Enable video AI fraud analysis
- `zone` (string): Data processing zone

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/ai-facesign-facesign-mcp/mcp#diagnostics

## Score history

- 2026-08-20: 62
- 2026-08-19: 62

## Links

- Remote endpoint: https://mcp.facesign.ai/mcp
- Website: https://docs.facesign.ai/docs/mcp
- Changelog RSS feed: https://verifymcp.io/servers/ai-facesign-facesign-mcp/mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/ai-facesign-facesign-mcp/mcp.json
- HTML version of this page: https://verifymcp.io/servers/ai-facesign-facesign-mcp/mcp