{ "data": { "a": { "slug": "alloy", "name": "Alloy", "vendor": "First Mile Group, Inc. (Alloy)", "vendorUrl": "https://www.alloy.com", "kind": "http-api", "category": "identity-verification", "summary": "Alloy is an identity and fraud decisioning platform for banks and fintechs. Its API runs onboarding journeys and evaluations that orchestrate identity, business, document and watchlist checks across third-party data vendors, with case management and ongoing monitoring.", "url": "https://www.anchorterminal.com/tools/alloy", "markdownUrl": "https://www.anchorterminal.com/tools/alloy.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/alloy.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/alloy.json", "license": "Proprietary service under Alloy's terms of service. The @alloyidentity/web-sdk capture package is MIT", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "@alloyidentity/web-sdk" } ], "auth": "mixed", "authNotes": "Account-level token and secret (older accounts use a workflow token and secret), sent as HTTP basic auth or exchanged at /v1/oauth/bearer for a one-hour Bearer token with client credentials. Up to five active secrets per key, rotated and revoked in the dashboard by users with key permissions. No scopes. The same keys serve sandbox and production, chosen by base URL or the `alloy-sandbox: true` header. Keys come with a customer contract (checked 2026-10-14).", "pricing": "paid", "pricingNotes": "No public prices. www.alloy.com/pricing returns 404 and the site routes buyers to a demo. Production calls invoke third-party data vendors and can incur charges, while sandbox calls don't (https://developer.alloy.com/public/docs/sandbox-vs-production, checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs index, the API reference or the website (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 20569, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://developer.alloy.com/public/docs/introduction", "llmsTxt": "https://developer.alloy.com/public/llms.txt", "capabilities": [ "kyc.identity", "kyc.business", "kyc.screening", "kyc.documents", "kyc.cases" ], "tags": [ "hosted", "enterprise", "sales-led", "api-key", "oauth", "llms-txt", "webhooks", "sandbox", "status-page", "soc2" ], "lastRelease": "2026-10-05", "graded": true, "anchor": { "graded": true, "score": 52.4, "grade": "D", "agentReady": false, "rank": 782, "ranked": true, "rankOf": 1076, "categoryRank": 16, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 52, "maintenance": 72, "payments": 0, "reliability": 59, "schema": 73, "security": 49, "transparency": 62 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-14" }, "negative": 0, "verdict": "Alloy's public docs cover journeys, evaluations, entities, documents, cases and investigations, with llms.txt, Markdown pages, OpenAPI fragments and rate-limit headers with retry-after. Access is sales-led with no public price or trial, credentials have no scopes, there is no idempotency key or server SDK, and inputs vary by each customer's workflow.", "bestFor": "Banks and fintechs that already run onboarding through Alloy and want an agent to submit journey applications, read decisions and work investigations.", "strengths": [ "Public developer docs with llms.txt (247 entries), Markdown pages and an OpenAPI fragment on each reference page", "Rate-limit headers and `retry-after` on 429, with a written guide to which codes to retry", "One API orchestrates identity, business, document and watchlist checks across many data vendors", "Up to five active secrets per key, OAuth client credentials and an IP allowlist", "Status page with separate Production API, Sandbox API, Webhooks and third-party components" ], "weaknesses": [ "No public prices, trial or self-serve sign-up. Access starts with a demo request", "Rate limits vary by account and endpoint with no published numbers", "No idempotency key and no server-side SDK", "Evaluation inputs and outputs depend on each customer's workflow, so the contract is loosely typed", "Sandbox and Production are request modes over one data store, so test and live records can collide" ], "agentNotes": [ "Get the account's base URL from the customer. Defaults are api.alloy.co and sandbox.alloy.co, and some accounts have their own hosts", "Use unique, prefixed external IDs in sandbox. Sandbox and Production share one data store", "Read `alloy-ratelimit-remaining`, and on 429 or 5xx wait for `retry-after` with exponential backoff and jitter", "Expect `running` after about 25 seconds on journey applications and wait for the webhook instead of resubmitting", "Send the workflow header with account-level keys, since inputs depend on the workflow configured" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 52.4 } ], "editorialScores": { "ergonomics": 52, "maintenance": 72, "payments": 0, "reliability": 59, "schema": 73, "security": 49, "transparency": 38 }, "provenanceScore": 86 }, "connect": { "http": "curl -X POST https://sandbox.alloy.co/v1/oauth/bearer \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Basic \u003cbasic_token\u003e\" \\\n -d '{\n \"grant_type\": \"client_credentials\"\n }'" }, "letme": { "capability": "https://letme.dev/kyc.identity", "tool": "https://letme.dev/alloy" }, "area": "domain-data", "provenance": { "legalEntity": "First Mile Group, Inc.", "domain": "alloy.com", "domainRegistered": "1999-02-25", "endpointOnVendorDomain": true, "terms": "https://www.alloy.com/tos", "privacy": "https://www.alloy.com/privacy-policy", "statusPage": "https://status.alloy.com", "changelog": "https://www.alloy.com/product-updates", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The privacy policy (29 August 2025) names First Mile Group, Inc. d/b/a/ Alloy.", "The default API hosts are on alloy.co (api.alloy.co, sandbox.alloy.co), and account-specific hosts on alloy.com. status.alloy.co redirects to status.alloy.com.", "www.alloy.com/.well-known/security.txt and alloy.co/.well-known/security.txt return 404.", "RDAP for alloy.com gives a registration date of 1999-02-25, before Alloy was founded in 2015." ], "score": 86 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/alloy.json", "live": { "slug": "alloy", "vendorStatus": { "page": "https://status.alloy.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:38:51.209484803Z" }, "mcpTools": { "url": "https://api.alloy.cx/mcp", "checkedAt": "2026-10-02T22:09:59.902886223Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-10-02T22:09:59.902886223Z" }, "updatedAt": "2026-10-14T09:38:51.209484803Z" } }, "answer": "Shufti scores 57.8 (C) on agent readiness against Alloy's 52.4 (D), and leads in 4 of 7 scored categories. Alloy leads on schema \u0026 documentation and agent ergonomics.", "b": { "slug": "shufti", "name": "Shufti", "vendor": "Shufti Pro Limited", "vendorUrl": "https://shuftipro.com", "kind": "http-api", "category": "identity-verification", "summary": "Identity and business verification service from Shufti Pro Limited in London. One REST endpoint runs document, face, address, AML screening and KYB checks chosen in the request body, with results by callback. A hosted MCP server exposes 25 tools.", "url": "https://www.anchorterminal.com/tools/shufti", "markdownUrl": "https://www.anchorterminal.com/tools/shufti.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shufti.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shufti.json", "repo": "https://github.com/shuftipro/iOS-SDK", "license": "Proprietary service under Shufti's Terms and Conditions. The licences of the mobile capture SDKs were not checked", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.shuftipro.com", "packages": [ { "registry": "npm", "name": "shuftipro-onsite-mobilesdk" } ], "auth": "mixed", "authNotes": "Self-serve. Signing up creates a back office account, and the Client ID and Secret Key come from Settings, API Configuration, API Keys. The REST API takes them as HTTP Basic auth, or a Bearer access token from `/get/access/token` that lasts one hour. The key pair has no scopes, and the Secret Key is shown once and replaced by generating a new one. The MCP server uses OAuth 2.1 with PKCE and dynamic client registration. Its login page asks for the same Client ID and Secret Key, and it issues tokens with the scopes `knowledge:read`, `verification:read` and `verification:write`. Callback and redirect domains must be registered in the back office.", "pricing": "freemium", "pricingNotes": "Free Forever covers up to 10 verifications a month with no card, on the production environment. Essentials starts from $1.50 a verification, pay as you go with no monthly minimum, up to 20,000 verifications. Enterprise is quoted by sales and adds e-IDV, Travel Rule, video KYC and other services. The pricing page says only successful verification attempts are billed and resubmissions are free. Trial accounts accept test ID samples (https://shuftipro.com/pricing/, checked 2026-10-09).", "priceSummary": "$1.50 / tx", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs (llms-full.txt), the pricing page or the terms (checked 2026-10-09).", "endpoints": [] }, "toolCount": 25, "popularity": { "githubStars": null, "npmWeekly": 673, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://developers.shuftipro.com/docs/get_started", "llmsTxt": "https://developers.shuftipro.com/llms.txt", "capabilities": [ "kyc.identity", "kyc.documents", "kyc.business", "kyc.screening" ], "tags": [ "hosted", "api-key", "oauth", "mcp", "webhooks", "llms-txt", "free-tier", "no-card", "status-page", "sla", "soc2", "iso27001" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 57.8, "grade": "C", "agentReady": false, "rank": 631, "ranked": true, "rankOf": 1076, "categoryRank": 12, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 47, "maintenance": 72, "payments": 35, "reliability": 65, "schema": 58, "security": 62, "transparency": 71 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-09" }, "negative": 0, "verdict": "One endpoint covers document, face, address, AML and KYB checks, with a free plan of 10 verifications a month, and a hosted MCP server adds OAuth with three scopes. No OpenAPI file, server SDK or idempotency key was found, and the status page history could not be read.", "bestFor": "A team that wants document, face, address, AML and KYB checks behind one endpoint, a free plan for low volume, and an MCP server that hands the person a hosted verification link.", "strengths": [ "Free Forever plan of 10 verifications a month with no card, on the production environment, per the pricing page", "Hosted MCP server at `https://ai.shuftipro.com/mcp` with 25 tools, OAuth 2.1 with PKCE and three scopes enforced on every call", "Docs published as llms.txt, a 2.9 MB llms-full.txt and a Markdown twin of each page, with samples in nine languages", "Public terms (version 11.1, 13 May 2026) include an availability schedule targeting 99 per cent monthly uptime", "Revision history with 19 dated entries between 24 July and 6 October 2026" ], "weaknesses": [ "No OpenAPI file or other machine-readable contract was found. The reference is prose tables plus Postman collections", "The REST credential is one Client ID and Secret Key pair with no scopes, sent as Basic auth on every call", "No idempotency key, Retry-After header or backoff guidance was found for the documented 429", "No server-side SDK. Official packages cover Android, iOS, Flutter, React Native and Cordova capture only", "Standard KYB was deprecated on 6 October 2026 and its pages removed the same day, with no notice period stated", "The sub-processor list is available to clients on request only, and security.txt returns 404" ], "agentNotes": [ "POST every verification to `https://api.shuftipro.com/` with a unique `reference` of 6 to 250 characters and one object per service. Read results from `/status` with that reference", "Register the callback domain in the back office first. An unregistered `callback_url` is rejected", "Stay under 60 requests a minute per IP on a production account and 20 on a trial account", "Check the `Signature` response header. Accounts created after 15 March 2023 hash the Secret Key with SHA-256 before appending it to the raw response", "Through MCP, identity checks return a `verification_url` for the person to open. No tool accepts an image, so use the REST API for offsite proofs" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57.8 } ], "editorialScores": { "ergonomics": 47, "maintenance": 72, "payments": 35, "reliability": 65, "schema": 58, "security": 62, "transparency": 51 }, "provenanceScore": 90 }, "connect": { "http": "curl --location --request POST 'https://api.shuftipro.com' \\\n--header 'Content-Type: application/json' \\\n--header 'Authorization: Basic \u003cbase64 of CLIENT_ID:SECRET_KEY\u003e' \\\n--data-raw '{\n \"reference\" : \"1234567\",\n \"callback_url\" : \"https://yourdomain.com/profile/notifyCallback\",\n \"country\" : \"GB\",\n \"language\" : \"EN\",\n \"verification_mode\" : \"any\",\n \"face\" : {\n \"proof\" : \"\"\n }\n}'", "claudeCode": "claude mcp add --transport http shufti https://ai.shuftipro.com/mcp", "config": { "mcpServers": { "shufti": { "args": [ "mcp-remote", "https://ai.shuftipro.com/mcp" ], "command": "npx" } } } }, "letme": { "capability": "https://letme.dev/kyc.identity", "tool": "https://letme.dev/shufti" }, "area": "domain-data", "unitPrices": [ { "item": "Verification, Free Forever plan (document and face checks)", "unit": "tx", "usd": 0, "note": "up to 10 verifications a month, no card" }, { "item": "Verification, Essentials plan, starting price", "unit": "tx", "usd": 1.5, "note": "rate depends on volume and the services chosen, up to 20,000 verifications" } ], "provenance": { "legalEntity": "Shufti Pro Limited", "domain": "shuftipro.com", "domainRegistered": "2016-06-28", "endpointOnVendorDomain": true, "terms": "https://shuftipro.com/wp-content/uploads/Version-11.1-w.e.f.-May-13th-2026.pdf", "privacy": "https://shuftipro.com/services-privacy-notice/", "statusPage": "https://status.shuftipro.com", "changelog": "https://developers.shuftipro.com/docs/revision_history", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "The terms and the MCP privacy notice name Shufti Pro Limited, Office 408 Coppergate House, 10 Whites Row, London E1 7NF.", "The governing terms are a PDF, version 11.1, linked from shuftipro.com/terms-and-conditions/, which itself carries only a summary and links to every earlier version. The page labels the file 12 May 2026 and the file name says 13 May.", "The privacy link is the Services Privacy Notice, version 1.2, last updated September 2026, which covers verification data. A separate notice covers the website.", "shuftipro.com/.well-known/security.txt answered 502 on the first request and 404 on the second.", "RDAP for shuftipro.com gives a registration date of 2016-06-28.", "The API answers at api.shuftipro.com and the MCP server at ai.shuftipro.com. The lead's shufti.ai is a parked domain for sale and unrelated to the vendor.", "status.shuftipro.com is an UptimeRobot page whose data loads from /api/, a path its robots.txt disallows, so the incident history was not read." ], "score": 90 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shufti.json", "live": { "slug": "shufti", "probe": { "target": "https://api.shuftipro.com", "method": "get", "lastAt": "2026-10-14T09:42:07.259458069Z", "lastOk": true, "lastStatus": 200, "lastMs": 391, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 316, "p95ms24h": 418, "samples24h": 248, "samples30d": 1258, "days": [ { "date": "2026-10-09", "probes": 169, "ok": 169 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 100, "ok": 100 } ] }, "vendorStatus": { "page": "https://status.shuftipro.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:53:55.897732357Z" }, "versions": [ { "registry": "github", "name": "shuftipro/iOS-SDK", "version": "3.6.0", "released": "2023-07-25", "seenAt": "2026-10-13T23:24:32.018892654Z" }, { "registry": "npm", "name": "shuftipro-onsite-mobilesdk", "version": "1.1.2", "seenAt": "2026-10-13T23:24:31.153977856Z" } ], "githubStars": 13, "npmWeekly": 264, "securityTxt": { "url": "https://shuftipro.com/.well-known/security.txt", "state": "unknown", "checkedAt": "2026-10-13T15:45:53.468373373Z" }, "llmsTxt": { "url": "https://developers.shuftipro.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-13T14:12:33.536092196Z" }, "domain": { "domain": "shuftipro.com", "registered": "2016-06-28", "source": "https://rdap.verisign.com/com/v1/domain/shuftipro.com", "checkedAt": "2026-10-11T13:13:21.385938571Z" }, "pages": [ { "url": "https://developers.shuftipro.com/docs/revision_history", "kind": "changelog", "status": 200, "checkedAt": "2026-10-13T20:13:41.253235246Z", "changedAt": "2026-10-13T20:13:41.253235246Z", "fingerprint": "dc6cece4b80e" }, { "url": "https://shuftipro.com/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-10-13T20:23:06.746835684Z", "changedAt": "2026-10-13T20:23:06.746835684Z", "fingerprint": "c1066f033e45" }, { "url": "https://shuftipro.com/services-privacy-notice/", "kind": "privacy", "status": 200, "checkedAt": "2026-10-13T20:23:09.026573958Z", "changedAt": "2026-10-13T20:23:09.026573958Z", "fingerprint": "5f64840666c9" } ], "updatedAt": "2026-10-14T09:42:07.259458069Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "First Mile Group, Inc. (Alloy)", "b": "Shufti Pro Limited", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.shuftipro.com", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Paid", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service under Alloy's terms of service. The @alloyidentity/web-sdk capture package is MIT", "b": "Proprietary service under Shufti's Terms and Conditions. The licences of the mobile capture SDKs were not checked", "name": "Licence" }, { "a": "none", "b": "25", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-05", "b": "2026-10-06", "name": "Last release" }, { "a": "2026-03-12", "b": "", "name": "Terms last updated" }, { "a": "no date given", "b": "2026-09-01", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "yes, with an opt-out", "name": "Customer content may train models" }, { "a": "yes", "b": "", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "", "name": "Arbitration or class-action waiver" }, { "a": "21k npm/wk", "b": "673 npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Shufti scores 57.8 (C) on agent readiness against Alloy's 52.4 (D), and leads in 4 of 7 scored categories. Alloy leads on schema \u0026 documentation and agent ergonomics.", "question": "Which is better for AI agents, Alloy or Shufti?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do Alloy and Shufti need an API key?" }, { "answer": "No hosted endpoint is listed for Alloy. Shufti has a hosted endpoint at https://api.shuftipro.com.", "question": "Can an agent call Alloy and Shufti without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 73 against 58", "Agent ergonomics, 52 against 47" ], "also": null, "goodFor": "Banks and fintechs that already run onboarding through Alloy and want an agent to submit journey applications, read decisions and work investigations.", "slug": "alloy", "watchFor": "No public prices, trial or self-serve sign-up. Access starts with a demo request" }, { "aheadOn": [ "Reliability, 65 against 59", "Security \u0026 auth, 62 against 49", "Payments \u0026 pricing, 35 against 0", "Transparency \u0026 trust, 71 against 62" ], "also": [ "A hosted endpoint, with nothing to install", "Free to start without a card" ], "goodFor": "A team that wants document, face, address, AML and KYB checks behind one endpoint, a free plan for low volume, and an MCP server that hands the person a hosted verification link.", "slug": "shufti", "watchFor": "No OpenAPI file or other machine-readable contract was found. The reference is prose tables plus Postman collections" } ], "job": { "capability": "kyc.identity", "name": "Identity verification" }, "others": [ { "json": "https://www.anchorterminal.com/compare/alloy-vs-complycube.json", "title": "Alloy vs ComplyCube", "url": "https://www.anchorterminal.com/compare/alloy-vs-complycube" }, { "json": "https://www.anchorterminal.com/compare/alloy-vs-didit.json", "title": "Alloy vs Didit", "url": "https://www.anchorterminal.com/compare/alloy-vs-didit" }, { "json": "https://www.anchorterminal.com/compare/alloy-vs-entrust-identity-verification.json", "title": "Alloy vs Entrust Identity Verification (formerly Onfido)", "url": "https://www.anchorterminal.com/compare/alloy-vs-entrust-identity-verification" }, { "json": "https://www.anchorterminal.com/compare/alloy-vs-jumio.json", "title": "Alloy vs Jumio", "url": "https://www.anchorterminal.com/compare/alloy-vs-jumio" }, { "json": "https://www.anchorterminal.com/compare/alloy-vs-middesk.json", "title": "Alloy vs Middesk", "url": "https://www.anchorterminal.com/compare/alloy-vs-middesk" }, { "json": "https://www.anchorterminal.com/compare/alloy-vs-persona.json", "title": "Alloy vs Persona", "url": "https://www.anchorterminal.com/compare/alloy-vs-persona" }, { "json": "https://www.anchorterminal.com/compare/alloy-vs-plaid-identity-verification.json", "title": "Alloy vs Plaid Identity Verification", "url": "https://www.anchorterminal.com/compare/alloy-vs-plaid-identity-verification" }, { "json": "https://www.anchorterminal.com/compare/alloy-vs-socure-riskos.json", "title": "Alloy vs Socure RiskOS", "url": "https://www.anchorterminal.com/compare/alloy-vs-socure-riskos" }, { "json": "https://www.anchorterminal.com/compare/alloy-vs-stripe-identity.json", "title": "Alloy vs Stripe Identity", "url": "https://www.anchorterminal.com/compare/alloy-vs-stripe-identity" }, { "json": "https://www.anchorterminal.com/compare/alloy-vs-sumsub.json", "title": "Alloy vs Sumsub", "url": "https://www.anchorterminal.com/compare/alloy-vs-sumsub" }, { "json": "https://www.anchorterminal.com/compare/alloy-vs-trulioo.json", "title": "Alloy vs Trulioo", "url": "https://www.anchorterminal.com/compare/alloy-vs-trulioo" }, { "json": "https://www.anchorterminal.com/compare/alloy-vs-veriff.json", "title": "Alloy vs Veriff", "url": "https://www.anchorterminal.com/compare/alloy-vs-veriff" }, { "json": "https://www.anchorterminal.com/compare/alloy-vs-vouched.json", "title": "Alloy vs Vouched", "url": "https://www.anchorterminal.com/compare/alloy-vs-vouched" }, { "json": "https://www.anchorterminal.com/compare/complycube-vs-shufti.json", "title": "ComplyCube vs Shufti", "url": "https://www.anchorterminal.com/compare/complycube-vs-shufti" }, { "json": "https://www.anchorterminal.com/compare/didit-vs-shufti.json", "title": "Didit vs Shufti", "url": "https://www.anchorterminal.com/compare/didit-vs-shufti" }, { "json": "https://www.anchorterminal.com/compare/entrust-identity-verification-vs-shufti.json", "title": "Entrust Identity Verification (formerly Onfido) vs Shufti", "url": "https://www.anchorterminal.com/compare/entrust-identity-verification-vs-shufti" }, { "json": "https://www.anchorterminal.com/compare/jumio-vs-shufti.json", "title": "Jumio vs Shufti", "url": "https://www.anchorterminal.com/compare/jumio-vs-shufti" }, { "json": "https://www.anchorterminal.com/compare/persona-vs-shufti.json", "title": "Persona vs Shufti", "url": "https://www.anchorterminal.com/compare/persona-vs-shufti" }, { "json": "https://www.anchorterminal.com/compare/plaid-identity-verification-vs-shufti.json", "title": "Plaid Identity Verification vs Shufti", "url": "https://www.anchorterminal.com/compare/plaid-identity-verification-vs-shufti" }, { "json": "https://www.anchorterminal.com/compare/shufti-vs-socure-riskos.json", "title": "Shufti vs Socure RiskOS", "url": "https://www.anchorterminal.com/compare/shufti-vs-socure-riskos" }, { "json": "https://www.anchorterminal.com/compare/shufti-vs-stripe-identity.json", "title": "Shufti vs Stripe Identity", "url": "https://www.anchorterminal.com/compare/shufti-vs-stripe-identity" }, { "json": "https://www.anchorterminal.com/compare/shufti-vs-sumsub.json", "title": "Shufti vs Sumsub", "url": "https://www.anchorterminal.com/compare/shufti-vs-sumsub" }, { "json": "https://www.anchorterminal.com/compare/shufti-vs-trulioo.json", "title": "Shufti vs Trulioo", "url": "https://www.anchorterminal.com/compare/shufti-vs-trulioo" }, { "json": "https://www.anchorterminal.com/compare/shufti-vs-veriff.json", "title": "Shufti vs Veriff", "url": "https://www.anchorterminal.com/compare/shufti-vs-veriff" }, { "json": "https://www.anchorterminal.com/compare/shufti-vs-vouched.json", "title": "Shufti vs Vouched", "url": "https://www.anchorterminal.com/compare/shufti-vs-vouched" }, { "json": "https://www.anchorterminal.com/compare/alloy-vs-complyadvantage.json", "title": "Alloy vs ComplyAdvantage", "url": "https://www.anchorterminal.com/compare/alloy-vs-complyadvantage" }, { "json": "https://www.anchorterminal.com/compare/complyadvantage-vs-shufti.json", "title": "ComplyAdvantage vs Shufti", "url": "https://www.anchorterminal.com/compare/complyadvantage-vs-shufti" }, { "json": "https://www.anchorterminal.com/compare/middesk-vs-shufti.json", "title": "Middesk vs Shufti", "url": "https://www.anchorterminal.com/compare/middesk-vs-shufti" } ], "scores": [ { "alloy": 59, "by": 6, "edge": "shufti", "key": "reliability", "name": "Reliability", "shufti": 65, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "alloy": 73, "by": 15, "edge": "alloy", "key": "schema", "name": "Schema \u0026 documentation", "shufti": 58, "weight": 13 }, { "alloy": 52, "by": 5, "edge": "alloy", "key": "ergonomics", "name": "Agent ergonomics", "shufti": 47, "weight": 13 }, { "alloy": 49, "by": 13, "edge": "shufti", "key": "security", "name": "Security \u0026 auth", "shufti": 62, "weight": 14 }, { "alloy": 0, "by": 35, "edge": "shufti", "key": "payments", "name": "Payments \u0026 pricing", "shufti": 35, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "alloy": 72, "by": 0, "edge": "", "key": "maintenance", "name": "Maintenance \u0026 community", "shufti": 72, "weight": 7 }, { "alloy": 62, "by": 9, "edge": "shufti", "key": "transparency", "name": "Transparency \u0026 trust", "shufti": 71, "weight": 7 } ], "summary": "Shufti scores 57.8 (C) on agent readiness against Alloy's 52.4 (D), and leads in 4 of 7 scored categories. Alloy leads on schema \u0026 documentation and agent ergonomics. Both do identity verification.", "verdicts": { "alloy": "Alloy's public docs cover journeys, evaluations, entities, documents, cases and investigations, with llms.txt, Markdown pages, OpenAPI fragments and rate-limit headers with retry-after. Access is sales-led with no public price or trial, credentials have no scopes, there is no idempotency key or server SDK, and inputs vary by each customer's workflow.", "shufti": "One endpoint covers document, face, address, AML and KYB checks, with a free plan of 10 verifications a month, and a hosted MCP server adds OAuth with three scopes. No OpenAPI file, server SDK or idempotency key was found, and the status page history could not be read." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/alloy-vs-shufti", "json": "https://www.anchorterminal.com/compare/alloy-vs-shufti.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/alloy-vs-shufti.md", "slim": "https://www.anchorterminal.com/compare/alloy-vs-shufti.min.md" }, "markdown": "Shufti scores 57.8 (C) on agent readiness against Alloy's 52.4 (D), and leads in 4 of 7 scored categories. Alloy leads on schema \u0026 documentation and agent ergonomics. Both do identity verification.\n\n- Alloy: grade D, 52.4/100, rank #782 of 1076. Markdown https://www.anchorterminal.com/tools/alloy.md · JSON https://www.anchorterminal.com/api/v1/tools/alloy.json\n- Shufti: grade C, 57.8/100, rank #631 of 1076. Markdown https://www.anchorterminal.com/tools/shufti.md · JSON https://www.anchorterminal.com/api/v1/tools/shufti.json\n- Best identity and business verification APIs for AI agents: https://www.anchorterminal.com/best/identity-verification/index.md\n- All 119 verification comparisons: https://www.anchorterminal.com/compare/identity-verification/index.md\n\n## Which one, for what\n\n### Alloy (D)\n\nGood for: Banks and fintechs that already run onboarding through Alloy and want an agent to submit journey applications, read decisions and work investigations.\n\nAhead on:\n- Schema \u0026 documentation, 73 against 58\n- Agent ergonomics, 52 against 47\n\nWatch for: No public prices, trial or self-serve sign-up. Access starts with a demo request\n\n### Shufti (C)\n\nGood for: A team that wants document, face, address, AML and KYB checks behind one endpoint, a free plan for low volume, and an MCP server that hands the person a hosted verification link.\n\nAhead on:\n- Reliability, 65 against 59\n- Security \u0026 auth, 62 against 49\n- Payments \u0026 pricing, 35 against 0\n- Transparency \u0026 trust, 71 against 62\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Free to start without a card\n\nWatch for: No OpenAPI file or other machine-readable contract was found. The reference is prose tables plus Postman collections\n\n\n## Score by category\n\n| Category | Weight | Alloy | Shufti | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 59 | 65 | Shufti +6 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 73 | 58 | Alloy +15 |\n| Agent ergonomics | 13% (16.2 this run) | 52 | 47 | Alloy +5 |\n| Security \u0026 auth | 14% (17.5 this run) | 49 | 62 | Shufti +13 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 0 | 35 | Shufti +35 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 72 | 72 | even |\n| Transparency \u0026 trust | 7% (8.8 this run) | 62 | 71 | Shufti +9 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **52.4 · D** | **57.8 · C** | |\n\n## Facts side by side\n\n| Fact | Alloy | Shufti |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | First Mile Group, Inc. (Alloy) | Shufti Pro Limited |\n| Hosted endpoint | no (local only) | `https://api.shuftipro.com` |\n| Transports | HTTP | HTTP, Streamable HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | Proprietary service under Alloy's terms of service. The @alloyidentity/web-sdk capture package is MIT | Proprietary service under Shufti's Terms and Conditions. The licences of the mobile capture SDKs were not checked |\n| Tools exposed | none | 25 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-05 | 2026-10-06 |\n| Terms last updated | 2026-03-12 | |\n| Privacy policy last updated | no date given | 2026-09-01 |\n| Customer content may train models | not found in the text | yes, with an opt-out |\n| Terms restrict automated access | yes | |\n| Terms restrict benchmarking | not found in the text | |\n| Terms or service can change without notice | not found in the text | |\n| Arbitration or class-action waiver | yes | |\n| Popularity | 21k npm/wk | 673 npm/wk |\n\n## Verdicts\n\n**Alloy.** Alloy's public docs cover journeys, evaluations, entities, documents, cases and investigations, with llms.txt, Markdown pages, OpenAPI fragments and rate-limit headers with retry-after. Access is sales-led with no public price or trial, credentials have no scopes, there is no idempotency key or server SDK, and inputs vary by each customer's workflow.\n\n**Shufti.** One endpoint covers document, face, address, AML and KYB checks, with a free plan of 10 verifications a month, and a hosted MCP server adds OAuth with three scopes. No OpenAPI file, server SDK or idempotency key was found, and the status page history could not be read.\n\n## Before you call either\n\n### Alloy\n\n1. Get the account's base URL from the customer. Defaults are api.alloy.co and sandbox.alloy.co, and some accounts have their own hosts\n2. Use unique, prefixed external IDs in sandbox. Sandbox and Production share one data store\n3. Read `alloy-ratelimit-remaining`, and on 429 or 5xx wait for `retry-after` with exponential backoff and jitter\n4. Expect `running` after about 25 seconds on journey applications and wait for the webhook instead of resubmitting\n5. Send the workflow header with account-level keys, since inputs depend on the workflow configured\n\n### Shufti\n\n1. POST every verification to `https://api.shuftipro.com/` with a unique `reference` of 6 to 250 characters and one object per service. Read results from `/status` with that reference\n2. Register the callback domain in the back office first. An unregistered `callback_url` is rejected\n3. Stay under 60 requests a minute per IP on a production account and 20 on a trial account\n4. Check the `Signature` response header. Accounts created after 15 March 2023 hash the Secret Key with SHA-256 before appending it to the raw response\n5. Through MCP, identity checks return a `verification_url` for the person to open. No tool accepts an image, so use the REST API for offsite proofs\n\n## Questions\n\n### Which is better for AI agents, Alloy or Shufti?\n\nShufti scores 57.8 (C) on agent readiness against Alloy's 52.4 (D), and leads in 4 of 7 scored categories. Alloy leads on schema \u0026 documentation and agent ergonomics.\n\n### Do Alloy and Shufti need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call Alloy and Shufti without installing anything?\n\nNo hosted endpoint is listed for Alloy. Shufti has a hosted endpoint at https://api.shuftipro.com.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/alloy-vs-shufti.json, and with the fewest tokens: https://www.anchorterminal.com/compare/alloy-vs-shufti.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"alloy\", \"b\": \"shufti\"}`. From a terminal: `anchor compare alloy shufti`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/alloy.json and https://www.anchorterminal.com/api/v1/tools/shufti.json\n\n## Other comparisons with Alloy or Shufti\n\n- [Alloy vs ComplyCube](https://www.anchorterminal.com/compare/alloy-vs-complycube.md)\n- [Alloy vs Didit](https://www.anchorterminal.com/compare/alloy-vs-didit.md)\n- [Alloy vs Entrust Identity Verification (formerly Onfido)](https://www.anchorterminal.com/compare/alloy-vs-entrust-identity-verification.md)\n- [Alloy vs Jumio](https://www.anchorterminal.com/compare/alloy-vs-jumio.md)\n- [Alloy vs Middesk](https://www.anchorterminal.com/compare/alloy-vs-middesk.md)\n- [Alloy vs Persona](https://www.anchorterminal.com/compare/alloy-vs-persona.md)\n- [Alloy vs Plaid Identity Verification](https://www.anchorterminal.com/compare/alloy-vs-plaid-identity-verification.md)\n- [Alloy vs Socure RiskOS](https://www.anchorterminal.com/compare/alloy-vs-socure-riskos.md)\n- [Alloy vs Stripe Identity](https://www.anchorterminal.com/compare/alloy-vs-stripe-identity.md)\n- [Alloy vs Sumsub](https://www.anchorterminal.com/compare/alloy-vs-sumsub.md)\n- [Alloy vs Trulioo](https://www.anchorterminal.com/compare/alloy-vs-trulioo.md)\n- [Alloy vs Veriff](https://www.anchorterminal.com/compare/alloy-vs-veriff.md)\n- [Alloy vs Vouched](https://www.anchorterminal.com/compare/alloy-vs-vouched.md)\n- [ComplyCube vs Shufti](https://www.anchorterminal.com/compare/complycube-vs-shufti.md)\n- [Didit vs Shufti](https://www.anchorterminal.com/compare/didit-vs-shufti.md)\n- [Entrust Identity Verification (formerly Onfido) vs Shufti](https://www.anchorterminal.com/compare/entrust-identity-verification-vs-shufti.md)\n- [Jumio vs Shufti](https://www.anchorterminal.com/compare/jumio-vs-shufti.md)\n- [Persona vs Shufti](https://www.anchorterminal.com/compare/persona-vs-shufti.md)\n- [Plaid Identity Verification vs Shufti](https://www.anchorterminal.com/compare/plaid-identity-verification-vs-shufti.md)\n- [Shufti vs Socure RiskOS](https://www.anchorterminal.com/compare/shufti-vs-socure-riskos.md)\n- [Shufti vs Stripe Identity](https://www.anchorterminal.com/compare/shufti-vs-stripe-identity.md)\n- [Shufti vs Sumsub](https://www.anchorterminal.com/compare/shufti-vs-sumsub.md)\n- [Shufti vs Trulioo](https://www.anchorterminal.com/compare/shufti-vs-trulioo.md)\n- [Shufti vs Veriff](https://www.anchorterminal.com/compare/shufti-vs-veriff.md)\n- [Shufti vs Vouched](https://www.anchorterminal.com/compare/shufti-vs-vouched.md)\n- [Alloy vs ComplyAdvantage](https://www.anchorterminal.com/compare/alloy-vs-complyadvantage.md)\n- [ComplyAdvantage vs Shufti](https://www.anchorterminal.com/compare/complyadvantage-vs-shufti.md)\n- [Middesk vs Shufti](https://www.anchorterminal.com/compare/middesk-vs-shufti.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Alloy vs Shufti", "url": "" } ], "description": "Shufti scores 57.8 (C) to Alloy's 52.4 (D) for identity verification. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Alloy D 52.4", "Shufti C 57.8", "scores" ], "h1": "Alloy vs Shufti", "image": "https://www.anchorterminal.com/assets/og/compare-alloy-vs-shufti.png", "path": "/compare/alloy-vs-shufti", "published": "2026-10-01", "section": "tools", "title": "Alloy vs Shufti for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-10-14", "url": "https://www.anchorterminal.com/compare/alloy-vs-shufti" }, "tokens": { "markdown": 2500, "slim": 730 }, "version": 1 }