Licensy
REMOTE · MCP.LICENSY.AI · SCANNED AUG 3
Real-time U.S. medical license verification across all 50 states + DC.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →
Endpoint Security92
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- The endpoint enforces authorisation, advertised via RFC 9728 protected-resource metadata. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism. View diagnostics → Pass
Transport & Reachability0
- Transport blocked by authentication: the endpoint requires auth we don't have to verify streamable-http. See how to fix → View diagnostics → Unverified
Schema Quality & AI Usability0
- Schema blocked by authentication: the endpoint requires auth we don't have to read it. See how to fix → Unverified
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage0
- Tool coverage blocked by authentication: the endpoint requires auth we don't have to read its tools.Unverified
Capabilities0
- Capabilities blocked by authentication: the endpoint requires auth we don't have to read them. See how to fix → Unverified
Unverified: 5 categories
Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
remote · mcp.licensy.ai
claude mcp add --transport http ai-licensy-mcp-server https://mcp.licensy.ai/mcp
[mcp_servers.ai-licensy-mcp-server] url = "https://mcp.licensy.ai/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ai-licensy-mcp-server": {
"type": "remote",
"url": "https://mcp.licensy.ai/mcp",
"enabled": true
}
}
} openclaw mcp add ai-licensy-mcp-server --url https://mcp.licensy.ai/mcp --transport streamable-http
mcp_servers:
ai-licensy-mcp-server:
url: "https://mcp.licensy.ai/mcp" {
"mcpServers": {
"ai-licensy-mcp-server": {
"type": "http",
"url": "https://mcp.licensy.ai/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 1 Aug 26 0
- Endpoint reachability: reachable → behind authorisation ▼ security
- 31 Jul 26 +14
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 −39
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 29 Jul 26 0
- Tool “get_license_status” rewrote its description, which is the text the model reads security
- Tool “verify_license” rewrote its description, which is the text the model reads security
- Schema quality: excellent → good functional
- 28 Jul 26 +1
- Server version: 3.4.4 → 3.4.5 functional
- 27 Jul 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 60
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Probed https://mcp.licensy.ai/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=mcp.licensy.ai | CN=YE1,O=Let's Encrypt,C=US | 5 Jun 2026 | 3 Sept 2026 | ECDSA 256 | ECDSA-SHA384 | 50e12086aef297f81d2f024d4b6064cba49 |
| SANs: mcp.licensy.ai | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
DNSSEC insecure
Validation of mcp.licensy.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| licensy.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On connection |
| HTTP status | 401 |
WWW-Authenticate challenge Bearer resource_metadata="https://mcp.licensy.ai/.well-known/oauth-protected-resource"
Bearer resource_metadata="https://mcp.licensy.ai/.well-known/oauth-protected-resource" | Header | Value |
|---|---|
| www-authenticate | Bearer resource_metadata="https://mcp.licensy.ai/.well-known/oauth-protected-resource" |
Protected resource metadata
| Document | https://mcp.licensy.ai/.well-known/oauth-protected-resource |
|---|---|
| Retrieved | Yes |
| Resource | https://mcp.licensy.ai |
| Authorisation server | https://honest-node-77.authkit.app |
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.licensy.ai/mcp | Auth required | 401 | |
| http (plaintext) | http://mcp.licensy.ai/mcp | HTTPS enforced | 301 | https://mcp.licensy.ai/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
bulk_verify ~133
Verify medical licenses for many (NPI, state) pairs in a single call. Returns one result per input, in input order. Use this instead of calling verify_license in a loop — bulk_verify parallelises server-side, returns faster, and is billed as a single call. Limits: Pro tier max 100 pairs per call; Enterprise max 1000. Use this when: - Initial roster ingestion for a credentialing project - Quarterly recredentialing audit of a multi-state group - Pre-call verification of a physician list before scheduling Paid tier only (Pro or Enterprise).
| Name | Type | Req | Description |
|---|---|---|---|
| inp | object | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
get_license_history ~143
Return a physician's license status as it was on a specific past date (point-in-time / retroactive lookup). Use this when: - Insurance company asks 'was this physician licensed when they treated patient X on 2024-08-12?' - Legal discovery for a malpractice case - Retroactive credentialing audit Input: NPI + state + as_of_date (ISO 8601). Coverage caveat: full append-only license history is on the roadmap. v1 returns best-available data and a `coverage_start` date marking the earliest reliable point-in-time queries. Paid tier only (Pro or Enterprise).
| Name | Type | Req | Description |
|---|---|---|---|
| inp | object | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
get_license_status ~212
Return only the license status string for a single physician in a single state. The minimal-output companion to verify_license: optimized for agents that need only a yes/no decision and want to minimize tokens in the LLM context. Use this when: - You need a one-word answer for routing logic (active vs anything else) - You're checking a license inside a tight inner loop - You want to minimize tokens spent on auxiliary fields Use verify_license instead when you need expiration date, license_active boolean, or any other field. Input: NPI (10 digits), state. Output: a single status from the controlled vocabulary: active | expired | lapsed | inactive | suspended | revoked | surrendered | pending | not_found | verification_unavailable. Note: 'not_found' is a confirmed absence (no record on file). 'verification_unavailable' means the state board could not be reached, so licensure could not be confirmed — retry rather than treating it as unlicensed.
| Name | Type | Req | Description |
|---|---|---|---|
| inp | object | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
get_screenshot_url ~145
Return an audit-grade screenshot of the state medical board page used to verify a physician's license. The URL is signed and valid for 15 minutes. Use this when: - You need primary-source evidence for an audit, credentialing file, or insurance contract - The end user asks 'where did this come from?' - You're generating a credentialing PDF that needs proof attachments Identify the license by: NPI + state, OR by `license_id` if you already fetched it via verify_license / list_physician_licenses. Free-tier callers receive a structured tier_upgrade_required response. Paid tier (Pro / Enterprise) only.
| Name | Type | Req | Description |
|---|---|---|---|
| inp | object | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
list_physician_licenses ~172
List all U.S. medical licenses Licensy has on file for a single physician (by NPI), one per state. Each entry shows current status and expiration date. Use this when: - Surveying a physician's multi-state license portfolio - Recredentialing across multiple states at once - Checking which states a physician is licensed in Do NOT use this for: - A single-state yes/no — use get_license_status (cheaper) - Bulk verification across multiple NPIs — use bulk_verify Input: NPI (10 digits). Optional include_inactive flag (default false). Output: array of {status, state, expiration_date, license_active}. Free tier returns these summary fields. Paid tier callers receive the full license record per state.
| Name | Type | Req | Description |
|---|---|---|---|
| inp | object | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
search_disciplinary_actions ~148
Search for known disciplinary actions against a physician (suspension, revocation, surrender, probation). Sourced from state medical board status text. Use this when: - Pre-employment screening - Recredentialing — required by most insurance contracts - Investigating a referral source Input: NPI (preferred) OR full name. Optional state filter. Output: array of {state, action_type, date, source_url}. Action types: suspension | revocation | surrender | probation | reprimand | other. Coverage note: this surfaces board-status-level signal. Underlying PDF documents are on the roadmap. Paid tier only (Pro or Enterprise).
| Name | Type | Req | Description |
|---|---|---|---|
| inp | object | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
subscribe_to_changes ~125
Subscribe a webhook URL to license-change events for one or more NPIs. Licensy POSTs a signed JSON payload to your URL when a subscribed event fires. Events: status_change — license status changes (active → expired, etc.) expiration_warning_60d — license expires in 60 days new_disciplinary_action — new sanction added Status: webhook delivery is on the roadmap. This tool records the subscription intent today; deliveries will begin once the dispatcher ships. Paid tier only (Pro or Enterprise).
| Name | Type | Req | Description |
|---|---|---|---|
| inp | object | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
unsubscribe ~103
Cancel a webhook subscription you previously created via subscribe_to_changes. Paid tier only (Pro or Enterprise). Use this when the agent's workflow that wanted the events has completed, or the customer wants to stop receiving change-notifications for a set of NPIs. Input: subscription_id (string, returned from subscribe_to_changes). Output: {success: true} on cancellation. Idempotent — repeat calls with the same id return success without error.
| Name | Type | Req | Description |
|---|---|---|---|
| inp | object | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
verify_license ~268
Verify a U.S. physician's medical license status in a specific state. Returns current status (active/expired/suspended/etc.), expiration date, and a confidence indicator. Use this when: - Confirming a physician is currently licensed before scheduling care - Validating credentials during onboarding or recredentialing - Answering 'is Dr. X licensed in [state]?' questions Do NOT use this for: - Bulk verification of >1 NPI — use bulk_verify instead (paid tier) - Historical 'was this physician licensed on date X' — use get_license_history instead (paid tier) Input: NPI (preferred) OR (license_number + state), plus state. State accepts either 2-letter code ('CA') or full name ('California'). A 'not_found' status is a confirmed absence; 'verification_unavailable' means the state board was unreachable (retry — do not treat as unlicensed). Output: status, state, expiration_date, license_active. Paid tiers additionally receive license_number, issuance_date, board_source, last_refreshed_at, screenshot_url for audit-grade primary-source verification. Data is sourced directly from state medical boards and refreshed every 24 hours. Licensy covers all 50 states + DC.
| Name | Type | Req | Description |
|---|---|---|---|
| inp | object | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.