# io.github.codespar/mcp-persona (npm · @codespar/mcp-persona)

MCP server for Persona — developer-first identity verification + KYC (inquiries, accounts, reports)

- Trust score: 68/100 (medium)
- Change this week: +25
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@codespar/mcp-persona`: 68/100 (this document), [markdown](https://verifymcp.io/servers/codespar-mcp-persona/codespar-mcp-persona.md), [page](https://verifymcp.io/servers/codespar-mcp-persona/codespar-mcp-persona)

## Channel facts

- Registry: `npm`
- Package: `@codespar/mcp-persona`
- Version: `0.2.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 41 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 78/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2361 tokens (~118/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 84/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 53% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add codespar-mcp-persona -- npx -y @codespar/mcp-persona
```

### Codex

```bash
codex mcp add codespar-mcp-persona -- npx -y @codespar/mcp-persona
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-persona": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-persona"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add codespar-mcp-persona --command npx --arg -y --arg @codespar/mcp-persona
```

### Hermes

```yaml
mcp_servers:
  codespar-mcp-persona:
    command: "npx"
    args: ["-y", "@codespar/mcp-persona"]
```

### Other

```json
{
  "mcpServers": {
    "codespar-mcp-persona": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-persona"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 67, +10)

- [security regression] Install scripts: pass → unverified
- [security regression] Provenance: fail → unverified
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] License: pass → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Maintenance: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: MIT

### 2026-08-01 (score 57, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-07-31 (score 42, +23)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 19, −59)

- [security regression] Known CVEs: partial → unverified
- [security regression] Malware scan: pass → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-07-29 (score 78, +53)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: MIT

### 2026-07-28 (score 25, −18)

- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 43)

First indexed and scored.

## MCP tools (20)

### `create_inquiry` (~260 tokens)

Create a Persona inquiry — a verification session bound to an inquiry template you configured in the Persona dashboard. The template defines which verifications run (document, selfie, database, phone, etc). Returns an inquiry id and (for hosted flows) a one-time link for the end user.

Input parameters:

- `account-id` (string): Optional existing Persona account id (act_...) to attach the inquiry to.
- `fields` (object): Prefilled fields for the inquiry (e.g. { name-first, name-last, birthdate, address-street-1, address-city, address-subdivision, address-postal-code, address-country-code, email-address, phone-number…
- `inquiry-template-id` (string, required): Inquiry template id (itmpl_...) from your Persona dashboard. Defines what runs in the flow.
- `inquiry-template-version-id` (string): Optional pin to a specific template version (itmplv_...).
- `note` (string): Internal note shown in the Persona dashboard.
- `redirect-uri` (string): URL to redirect the user to after completing the flow.
- `reference-id` (string): Your internal user id. Echoed back on webhooks and filterable via list_inquiries.

### `retrieve_inquiry` (~80 tokens)

Retrieve an inquiry by id. Response includes overall status ('created' | 'pending' | 'completed' | 'expired' | 'failed' | 'needs_review' | 'approved' | 'declined') and embedded verifications / reports. Poll this to track progress.

Input parameters:

- `inquiry_id` (string, required): Persona inquiry id (inq_...).

### `list_inquiries` (~149 tokens)

List inquiries, filterable by reference-id (your internal user id) or status. Useful for reconciling state or finding a user's inquiry history.

Input parameters:

- `filter[account-id]` (string): Filter by Persona account id.
- `filter[reference-id]` (string): Filter by your internal user id passed at inquiry creation.
- `filter[status]` (string): Filter by inquiry status (e.g. 'completed', 'approved', 'declined', 'needs_review').
- `page[after]` (string): Cursor for pagination.
- `page[before]` (string): Cursor for pagination.
- `page[size]` (string): Page size (max per Persona docs).

### `approve_inquiry` (~81 tokens)

Mark an inquiry as approved. This records your final decision on the Persona inquiry — useful for dashboard reporting and Persona's feedback loop. Does NOT itself gate the user; you must still enforce the decision in your app.

Input parameters:

- `comment` (string): Optional free-text note for the approval.
- `inquiry_id` (string, required): Persona inquiry id (inq_...).

### `decline_inquiry` (~58 tokens)

Mark an inquiry as declined. Records your final reject decision on the Persona inquiry for reporting and feedback.

Input parameters:

- `comment` (string): Optional free-text reason for the decline.
- `inquiry_id` (string, required): Persona inquiry id (inq_...).

### `redact_inquiry` (~61 tokens)

Redact an inquiry (GDPR right-to-erasure). Scrubs PII, captured images, and verification detail for this inquiry on Persona's side. Irreversible.

Input parameters:

- `inquiry_id` (string, required): Persona inquiry id (inq_...) to redact.

### `create_account` (~204 tokens)

Create a persistent Persona account — a long-lived end-user record that multiple inquiries can attach to. Enables re-use of previously verified fields and longitudinal fraud signals across sessions.

Input parameters:

- `address-city` (string)
- `address-country-code` (string): ISO-3166 alpha-2, e.g. US, BR, MX.
- `address-postal-code` (string)
- `address-street-1` (string)
- `address-street-2` (string)
- `address-subdivision` (string): State / province code.
- `birthdate` (string): YYYY-MM-DD
- `email-address` (string)
- `name-first` (string)
- `name-last` (string)
- `name-middle` (string)
- `phone-number` (string)
- `reference-id` (string): Your internal user id.
- `social-security-number` (string): Sensitive. Persona stores tokenised.
- `tags` (array)

### `retrieve_account` (~41 tokens)

Retrieve a Persona account by id, including summary PII and linked inquiries / verifications.

Input parameters:

- `account_id` (string, required): Persona account id (act_...).

### `list_reports` (~115 tokens)

List reports — individual verification artifacts (e.g. watchlist, adverse media, business lookup). Filterable by account and type. Each report is a standalone verification separate from inquiry-flow verifications.

Input parameters:

- `filter[account-id]` (string): Filter by Persona account id.
- `filter[report-type]` (string): Filter by report type (e.g. 'report/watchlist', 'report/adverse-media', 'report/business').
- `page[after]` (string)
- `page[size]` (string)

### `retrieve_report` (~44 tokens)

Retrieve a single report by id — returns the full verification detail (matches, scores, raw source data).

Input parameters:

- `report_id` (string, required): Persona report id (rep_...).

### `create_case` (~147 tokens)

Open a case — a workspace for an ongoing investigation tied to one or more inquiries / accounts. Useful for manual review, periodic re-verification, or flagged users that need operator follow-up.

Input parameters:

- `assignee-id` (string): Persona user id of the assignee.
- `case-template-id` (string, required): Case template id (ctmpl_...) from your Persona dashboard.
- `fields` (object): Additional case fields (keys follow the template schema).
- `name` (string): Short human-readable case name.
- `priority` (string): Priority label (e.g. 'low', 'medium', 'high').
- `status` (string): Initial status (e.g. 'Open').

### `resume_inquiry` (~66 tokens)

Resume a paused inquiry — returns a fresh one-time session token / link so the end user can continue a flow that was abandoned or needs additional steps (e.g. after a 'pending' webhook).

Input parameters:

- `inquiry_id` (string, required): Persona inquiry id (inq_...) to resume.

### `update_account` (~174 tokens)

Patch attributes on an existing Persona account (e.g. update address, phone, tags). Use this to keep a persistent end-user record in sync with your system of record.

Input parameters:

- `account_id` (string, required): Persona account id (act_...).
- `address-city` (string)
- `address-country-code` (string)
- `address-postal-code` (string)
- `address-street-1` (string)
- `address-street-2` (string)
- `address-subdivision` (string)
- `birthdate` (string): YYYY-MM-DD
- `email-address` (string)
- `name-first` (string)
- `name-last` (string)
- `name-middle` (string)
- `phone-number` (string)
- `tags` (array)

### `list_accounts` (~117 tokens)

List Persona accounts, filterable by reference-id (your internal user id) or email. Useful for looking up a persistent end-user record before creating duplicates.

Input parameters:

- `filter[email-address]` (string): Filter by email.
- `filter[phone-number]` (string): Filter by phone number (E.164).
- `filter[reference-id]` (string): Filter by your internal user id.
- `page[after]` (string)
- `page[before]` (string)
- `page[size]` (string)

### `run_report` (~289 tokens)

Create and run a standalone Persona report — not tied to an inquiry flow. Use for ad-hoc watchlist screening, adverse media, business (KYB) lookups, address verification, or profile checks against a known identity. Pass the appropriate `report-type` plus the query fields the report needs.

Input parameters:

- `account-id` (string): Optional Persona account id (act_...) to attach the report to.
- `address-city` (string)
- `address-postal-code` (string)
- `address-street-1` (string)
- `address-street-2` (string)
- `address-subdivision` (string)
- `birthdate` (string): YYYY-MM-DD (for profile / watchlist).
- `business-name` (string): Legal business name (for KYB / report/business).
- `country-code` (string): ISO-3166 alpha-2 country code.
- `email-address` (string)
- `name-first` (string)
- `name-last` (string)
- `name-middle` (string)
- `phone-number` (string)
- `report-type` (string, required): Report type identifier, e.g. 'report/watchlist', 'report/adverse-media', 'report/business', 'report/address', 'report/profile'.
- `tax-identification-number` (string): SSN / EIN / tax id, depending on jurisdiction.

### `retrieve_case` (~46 tokens)

Retrieve a case by id — full detail including status, assignee, linked objects, attached fields, and tags.

Input parameters:

- `case_id` (string, required): Persona case id (case_...).

### `list_cases` (~125 tokens)

List investigation cases, filterable by status, assignee, or priority. Useful for operator dashboards or batch automation over the review queue.

Input parameters:

- `filter[assignee-id]` (string): Filter by assignee Persona user id.
- `filter[priority]` (string): Filter by priority label.
- `filter[status]` (string): Filter by case status (e.g. 'Open', 'Waiting on Customer', 'Closed').
- `page[after]` (string)
- `page[before]` (string)
- `page[size]` (string)

### `add_case_tag` (~85 tokens)

Add a tag to a case. Tags are operator-facing labels useful for grouping / filtering investigations (e.g. 'high-risk', 'manual-review', 'compliance-2026-q2').

Input parameters:

- `case_id` (string, required): Persona case id (case_...).
- `tag-name` (string, required): Tag name to add. Created on-the-fly if it doesn't exist.

### `list_templates` (~74 tokens)

List inquiry templates configured in your Persona dashboard — returns each template's id (itmpl_...), name, and active version. Use this to discover available templates before calling create_inquiry.

Input parameters:

- `page[after]` (string)
- `page[before]` (string)
- `page[size]` (string)

### `list_webhooks` (~78 tokens)

List configured webhook subscriptions (Persona calls them 'Webhook subscriptions'). Each entry shows the URL, subscribed event types, and enabled state. Use this to audit delivery endpoints for inquiry / verification / case events.

Input parameters:

- `page[after]` (string)
- `page[before]` (string)
- `page[size]` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/codespar-mcp-persona/codespar-mcp-persona#diagnostics

## Score history

- 2026-08-03: 68
- 2026-08-02: 67
- 2026-08-01: 57
- 2026-07-31: 42
- 2026-07-30: 19
- 2026-07-29: 78
- 2026-07-28: 25
- 2026-07-27: 43

## Links

- npm package: https://www.npmjs.com/package/@codespar/mcp-persona
- Socket report: https://socket.dev/npm/package/@codespar/mcp-persona
- Repository: https://github.com/codespar/mcp-dev-latam
- Changelog RSS feed: https://verifymcp.io/servers/codespar-mcp-persona/codespar-mcp-persona/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/codespar-mcp-persona/codespar-mcp-persona/changelog.json
- HTML version of this page: https://verifymcp.io/servers/codespar-mcp-persona/codespar-mcp-persona