MCP

KYC serves stateless Streamable HTTP at https://kyc.1above.ai/mcp. HTTP, MCP and the manual interface share Identity verification, read authorization and durable audit rules.

Connect your client

{"mcpServers":{"kyc":{"type":"http","url":"https://kyc.1above.ai/mcp"}}}

Exact configuration keys vary by client. The bearer challenge names /.well-known/oauth-protected-resource/mcp, whose resource is the MCP URL. The unsuffixed metadata path describes the base resource. Both name the deployment's Identity issuer and advertise openid, offline_access and corporates:read. Login, explicit consent, organization access and session/refresh behavior remain Identity-managed. Dynamic registration alone grants no operation access.

Codex

codex mcp add kyc --url https://kyc.1above.ai/mcp
codex mcp login kyc

Start a new Codex CLI session or restart the IDE extension after adding or changing the server, then use /mcp to verify that search_organizations is active. Codex reads the server instructions and tool descriptions during MCP initialization; an already-running session does not automatically gain updated routing metadata.

Claude Code

claude mcp add --transport http kyc https://kyc.1above.ai/mcp
claude mcp login kyc

For a team-shared project configuration, commit the JSON entry above as .mcp.json; type: "http" is required when the entry contains a URL. Claude Code asks each user to approve a project-scoped server after trusting the workspace. Use /mcp to verify that search_organizations is listed. After KYC changes its tool title, description, or server instructions, open the KYC server in /mcp and select Reconnect to discard Claude's cached discovery metadata and fetch the current tool list.

Available tools

curl 'https://kyc.1above.ai/mcp' \
  --header "Authorization: Bearer $KYC_ACCESS_TOKEN" \
  --header 'Content-Type: application/json' \
  --header 'Accept: application/json, text/event-stream' \
  --data '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_organizations","arguments":{"jurisdiction":"HK","query":{"type":"name","value":"EXAMPLE GLOBAL TRADING LIMITED"}}}}'

Search also accepts {"type":"business_registration_number","value":"12345678"} as its query. Fuzzy matching belongs inside name queries; exact BRNs reject matching options. HK English names require at least three meaningful word tokens before the legal suffix, while Chinese names require at least two Han characters. Exact BRNs remain available.

Call get_organization with {"jurisdiction":"HK","businessRegistrationNumber":"12345678"}. Get may deliver a source-faithful address only after entitlement and durable address-free audit. Search remains address-free. See the HTTP contract for result states, evidence, partial coverage and source limitations.

Tool results contain correlationId and result in structured content. Application failures set isError and carry sanitized errors. Source failures are not negative results. An audit failure withholds successful tool content.

Authorization and retirement

Discovery requires a valid credential. Known tool calls also require an operating organization and corporates:read. Missing/invalid tokens return 401; missing scope returns 403 insufficient_scope; missing organization returns 403 access_denied. Challenges include resource_metadata.

lookup_organization and enrich_organization are removed from discovery and invocation. A credentialed call receives the MCP unknown-tool error; an unauthenticated call still receives the protected-resource challenge. They are not aliases and produce no application execution audit. Existing lookup/enrichment scopes do not grant read access. Re-consent or regrant explicitly.

Both current stateless and 2025-era Streamable HTTP clients use the same endpoint. Clients should not depend on a long-lived MCP session identifier.