Didit MCP Server

Didit MCP Server

The official Model Context Protocol server for Didit — bring KYC, KYB, AML screening, transaction monitoring, biometrics, and full workspace operations to Claude, Cursor, VS Code, Windsurf, Zed, and any MCP client.

• 130+ tools across sessions, workflows, vendor users/businesses, transactions, the standalone verification APIs, lists, cases, reports, webhooks, and billing.
• Auth is "Log in with Didit" (OAuth 2.1 + PKCE) — the MCP acts as the signed-in user with their role's permissions. There is no API-key mode: every tool calls the user-scoped console endpoints, which only accept a Bearer token.
• Every tool calls a single Didit REST endpoint and returns the JSON verbatim.

Full documentation: https://docs.didit.me/integration/mcp/overview

Quick start

Hosted (recommended)

No install, no API key — point your client at the hosted URL and sign in via the browser:

https://mcp.didit.me/mcp

Claude Code

claude mcp add --transport http didit https://mcp.didit.me/mcp

Cursor (~/.cursor/mcp.json)

{ "mcpServers": { "didit": { "url": "https://mcp.didit.me/mcp" } } }

Windsurf / Zed (via the mcp-remote bridge)

{ "mcpServers": { "didit": { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://mcp.didit.me/mcp"] } } }

See per-client setup for Claude Desktop and VS Code.

Cursor plugin

This repository includes a Cursor plugin manifest at .cursor-plugin/plugin.json. The plugin uses the hosted OAuth server configured in .mcp.json, the existing Didit rule in rules/, and the icon in assets/. No local server, API key, or environment variables are required. Sign in with your Didit account when Cursor requests authorization. The connection uses your existing organization roles and permissions.

Example requests:

• "Show my Didit organizations and applications."
• "List my verification workflows."
• "Create a sandbox verification link using my selected workflow."
• "Show verification analytics for the last seven days."
• "List the webhooks configured for my application."

Tool results may contain customer and verification data from the workspace you authorize. Only request information you are authorized to access and share with your AI client. Review proposed changes before approving write or destructive actions. Disconnect Didit in your client's MCP settings when you no longer need the connection.

See the Privacy Policy and legal terms. For support, contact hello@didit.me or open a GitHub issue.

The presence of this package does not imply marketplace approval. Publishers can submit the public repository through Cursor's publishing form.

Authentication

The MCP is an OAuth 2.1 resource server; the Didit console (business.didit.me) is the authorization server. On first connect your client opens a browser, you Log in with Didit and approve the scopes, and the MCP then acts as you — across every organization you belong to, with your role's permissions. Tokens are short-lived and refreshed automatically.

Scopes: didit:management (workspace operations) and didit:verification (running checks). Your console role is enforced server-side on every call.

There is no API-key mode. Every tool targets the user-scoped console endpoints (/organization/{org}/application/{app}/…), which authorize a Bearer token with per-role privileges and reject x-api-key. (For raw REST access with an application API key — e.g. creating sessions from your backend — use the REST API directly, not this server.)

See Authentication.

Shortened. The full README is on GitHub.