{ "data": { "a": { "slug": "shufti", "name": "Shufti", "vendor": "Shufti Pro Limited", "vendorUrl": "https://shuftipro.com", "kind": "http-api", "category": "identity-verification", "summary": "Identity and business verification service from Shufti Pro Limited in London. One REST endpoint runs document, face, address, AML screening and KYB checks chosen in the request body, with results by callback. A hosted MCP server exposes 25 tools.", "url": "https://www.anchorterminal.com/tools/shufti", "markdownUrl": "https://www.anchorterminal.com/tools/shufti.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shufti.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shufti.json", "repo": "https://github.com/shuftipro/iOS-SDK", "license": "Proprietary service under Shufti's Terms and Conditions. The licences of the mobile capture SDKs were not checked", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.shuftipro.com", "packages": [ { "registry": "npm", "name": "shuftipro-onsite-mobilesdk" } ], "auth": "mixed", "authNotes": "Self-serve. Signing up creates a back office account, and the Client ID and Secret Key come from Settings, API Configuration, API Keys. The REST API takes them as HTTP Basic auth, or a Bearer access token from `/get/access/token` that lasts one hour. The key pair has no scopes, and the Secret Key is shown once and replaced by generating a new one. The MCP server uses OAuth 2.1 with PKCE and dynamic client registration. Its login page asks for the same Client ID and Secret Key, and it issues tokens with the scopes `knowledge:read`, `verification:read` and `verification:write`. Callback and redirect domains must be registered in the back office.", "pricing": "freemium", "pricingNotes": "Free Forever covers up to 10 verifications a month with no card, on the production environment. Essentials starts from $1.50 a verification, pay as you go with no monthly minimum, up to 20,000 verifications. Enterprise is quoted by sales and adds e-IDV, Travel Rule, video KYC and other services. The pricing page says only successful verification attempts are billed and resubmissions are free. Trial accounts accept test ID samples (https://shuftipro.com/pricing/, checked 2026-10-09).", "priceSummary": "$1.50 / tx", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs (llms-full.txt), the pricing page or the terms (checked 2026-10-09).", "endpoints": [] }, "toolCount": 25, "popularity": { "githubStars": null, "npmWeekly": 673, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://developers.shuftipro.com/docs/get_started", "llmsTxt": "https://developers.shuftipro.com/llms.txt", "capabilities": [ "kyc.identity", "kyc.documents", "kyc.business", "kyc.screening" ], "tags": [ "hosted", "api-key", "oauth", "mcp", "webhooks", "llms-txt", "free-tier", "no-card", "status-page", "sla", "soc2", "iso27001" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 57.8, "grade": "C", "agentReady": false, "rank": 538, "ranked": true, "rankOf": 842, "categoryRank": 9, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 47, "maintenance": 72, "payments": 35, "reliability": 65, "schema": 58, "security": 62, "transparency": 71 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-09" }, "negative": 0, "verdict": "One endpoint covers document, face, address, AML and KYB checks, with a free plan of 10 verifications a month, and a hosted MCP server adds OAuth with three scopes. No OpenAPI file, server SDK or idempotency key was found, and the status page history could not be read.", "bestFor": "A team that wants document, face, address, AML and KYB checks behind one endpoint, a free plan for low volume, and an MCP server that hands the person a hosted verification link.", "strengths": [ "Free Forever plan of 10 verifications a month with no card, on the production environment, per the pricing page", "Hosted MCP server at `https://ai.shuftipro.com/mcp` with 25 tools, OAuth 2.1 with PKCE and three scopes enforced on every call", "Docs published as llms.txt, a 2.9 MB llms-full.txt and a Markdown twin of each page, with samples in nine languages", "Public terms (version 11.1, 13 May 2026) include an availability schedule targeting 99 per cent monthly uptime", "Revision history with 19 dated entries between 24 July and 6 October 2026" ], "weaknesses": [ "No OpenAPI file or other machine-readable contract was found. The reference is prose tables plus Postman collections", "The REST credential is one Client ID and Secret Key pair with no scopes, sent as Basic auth on every call", "No idempotency key, Retry-After header or backoff guidance was found for the documented 429", "No server-side SDK. Official packages cover Android, iOS, Flutter, React Native and Cordova capture only", "Standard KYB was deprecated on 6 October 2026 and its pages removed the same day, with no notice period stated", "The sub-processor list is available to clients on request only, and security.txt returns 404" ], "agentNotes": [ "POST every verification to `https://api.shuftipro.com/` with a unique `reference` of 6 to 250 characters and one object per service. Read results from `/status` with that reference", "Register the callback domain in the back office first. An unregistered `callback_url` is rejected", "Stay under 60 requests a minute per IP on a production account and 20 on a trial account", "Check the `Signature` response header. Accounts created after 15 March 2023 hash the Secret Key with SHA-256 before appending it to the raw response", "Through MCP, identity checks return a `verification_url` for the person to open. No tool accepts an image, so use the REST API for offsite proofs" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57.8 } ], "editorialScores": { "ergonomics": 47, "maintenance": 72, "payments": 35, "reliability": 65, "schema": 58, "security": 62, "transparency": 51 }, "provenanceScore": 90 }, "connect": { "http": "curl --location --request POST 'https://api.shuftipro.com' \\\n--header 'Content-Type: application/json' \\\n--header 'Authorization: Basic \u003cbase64 of CLIENT_ID:SECRET_KEY\u003e' \\\n--data-raw '{\n \"reference\" : \"1234567\",\n \"callback_url\" : \"https://yourdomain.com/profile/notifyCallback\",\n \"country\" : \"GB\",\n \"language\" : \"EN\",\n \"verification_mode\" : \"any\",\n \"face\" : {\n \"proof\" : \"\"\n }\n}'", "claudeCode": "claude mcp add --transport http shufti https://ai.shuftipro.com/mcp", "config": { "mcpServers": { "shufti": { "args": [ "mcp-remote", "https://ai.shuftipro.com/mcp" ], "command": "npx" } } } }, "letme": { "capability": "https://letme.dev/kyc.identity", "tool": "https://letme.dev/shufti" }, "area": "domain-data", "unitPrices": [ { "item": "Verification, Free Forever plan (document and face checks)", "unit": "tx", "usd": 0, "note": "up to 10 verifications a month, no card" }, { "item": "Verification, Essentials plan, starting price", "unit": "tx", "usd": 1.5, "note": "rate depends on volume and the services chosen, up to 20,000 verifications" } ], "provenance": { "legalEntity": "Shufti Pro Limited", "domain": "shuftipro.com", "domainRegistered": "2016-06-28", "endpointOnVendorDomain": true, "terms": "https://shuftipro.com/wp-content/uploads/Version-11.1-w.e.f.-May-13th-2026.pdf", "privacy": "https://shuftipro.com/services-privacy-notice/", "statusPage": "https://status.shuftipro.com", "changelog": "https://developers.shuftipro.com/docs/revision_history", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "The terms and the MCP privacy notice name Shufti Pro Limited, Office 408 Coppergate House, 10 Whites Row, London E1 7NF.", "The governing terms are a PDF, version 11.1, linked from shuftipro.com/terms-and-conditions/, which itself carries only a summary and links to every earlier version. The page labels the file 12 May 2026 and the file name says 13 May.", "The privacy link is the Services Privacy Notice, version 1.2, last updated September 2026, which covers verification data. A separate notice covers the website.", "shuftipro.com/.well-known/security.txt answered 502 on the first request and 404 on the second.", "RDAP for shuftipro.com gives a registration date of 2016-06-28.", "The API answers at api.shuftipro.com and the MCP server at ai.shuftipro.com. The lead's shufti.ai is a parked domain for sale and unrelated to the vendor.", "status.shuftipro.com is an UptimeRobot page whose data loads from /api/, a path its robots.txt disallows, so the incident history was not read." ], "score": 90 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shufti.json", "live": { "slug": "shufti", "probe": { "target": "https://api.shuftipro.com", "method": "get", "lastAt": "2026-10-09T11:46:40.498968542Z", "lastOk": true, "lastStatus": 200, "lastMs": 347, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 321, "p95ms24h": 367, "samples24h": 44, "samples30d": 44, "days": [ { "date": "2026-10-09", "probes": 44, "ok": 44 } ] }, "vendorStatus": { "page": "https://status.shuftipro.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-09T07:58:32.112017753Z" }, "updatedAt": "2026-10-09T11:46:40.498968542Z" } }, "answer": "Sumsub scores 68.5 (B) on agent readiness against Shufti's 57.8 (C), and leads in 6 of 7 scored categories. Shufti leads on payments \u0026 pricing.", "b": { "slug": "sumsub", "name": "Sumsub", "vendor": "Sum and Substance Ltd", "vendorUrl": "https://sumsub.com", "kind": "http-api", "category": "identity-verification", "summary": "Sumsub verifies people from identity documents and a liveness check, verifies businesses against registries, and screens both against sanctions and watchlists. Agents reach it through a signed REST API and a hosted MCP server.", "url": "https://www.anchorterminal.com/tools/sumsub", "markdownUrl": "https://www.anchorterminal.com/tools/sumsub.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/sumsub.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/sumsub.json", "repo": "https://github.com/sumsub/agent-skills", "license": "Proprietary service under Sumsub's terms and conditions. The agent skills repository and the @sumsub/websdk npm package are MIT", "transports": [ "http" ], "remoteUrl": "https://api.sumsub.com", "packages": [ { "registry": "npm", "name": "@sumsub/websdk" } ], "auth": "mixed", "authNotes": "The REST API takes an app token generated in the Dashboard by a signed-in team member. Each request carries `X-App-Token`, `X-App-Access-Ts` and `X-App-Access-Sig`, an HMAC-SHA256 signature made with the token's secret key over the timestamp, method, path and body. A token has its own permissions, an optional IP allowlist, an optional expiry date and optional source keys that limit it to a group of applicants, and it can be disabled or deleted but not edited. Sandbox and production tokens are separate. The MCP server at https://api.sumsub.com/mcp/ uses OAuth with PKCE and dynamic client registration, signs the user in with Sumsub, and needs the Use MCP server role permission. Production mode opens after Sumsub verifies the integration (https://docs.sumsub.com/reference/about-sumsub-api).", "pricing": "usage", "pricingNotes": "Basic is $1.35 per verification with a $149 monthly minimum, and Compliance is $1.85 with a $299 minimum and adds AML screening and address checks. Business verification, transaction monitoring and fraud prevention are on a custom plan through sales. Only completed checks are charged. Sandbox mode is free in any account, limited to 500 new applicants and 1,000 transactions per 24 hours. The 14-day trial of 50 real checks asks for bank card details (https://sumsub.com/pricing/, https://docs.sumsub.com/docs/self-service, checked 2026-10-08).", "priceSummary": "$1.35 / tx", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API reference, the OpenAPI spec or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 172226, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://docs.sumsub.com", "llmsTxt": "https://docs.sumsub.com/llms.txt", "openapi": "https://api.sumsub.com/openapi.json", "capabilities": [ "kyc.identity", "kyc.business", "kyc.documents", "kyc.screening", "kyc.cases" ], "tags": [ "hosted", "usage-based", "sandbox", "api-key", "oauth", "mcp", "openapi", "llms-txt", "webhooks", "status-page", "sla", "bug-bounty", "soc2", "iso27001" ], "lastRelease": "2026-10-03", "graded": true, "anchor": { "graded": true, "score": 68.5, "grade": "B", "agentReady": false, "rank": 200, "ranked": true, "rankOf": 842, "categoryRank": 3, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 60, "maintenance": 74, "payments": 25, "reliability": 80, "schema": 78, "security": 80, "transparency": 74 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": 0, "verdict": "Per-token permissions, an IP allowlist, HMAC-signed requests and a public OpenAPI spec with Markdown docs suit an agent working on verification cases. No idempotency keys or Retry-After guidance were found, there is no server SDK, and production access needs a browser signup, a bank card and Sumsub's review of the integration.", "bestFor": "An agent that starts verifications, sends links, reads results and AML cases, and works case queues for a regulated business, with one token limited to those permissions.", "strengths": [ "App tokens carry per-token permissions, an optional IP allowlist and expiry date, and can be disabled with a recorded reason", "Requests are signed with HMAC-SHA256 over timestamp, method, path and body, so the secret key never travels", "Public OpenAPI 3.0.1 spec with 157 operations, llms.txt, and every docs page served as Markdown", "Hosted MCP server with OAuth, PKCE and dynamic client registration, gated by a Use MCP server role permission", "Terms publish a 99.5 per cent monthly uptime commitment, and the status page lists API, WebSDK and MobileSDK for three regions" ], "weaknesses": [ "No idempotency keys and no Retry-After or backoff guidance found in the reviewed documentation", "Only 24 of 157 operations in the OpenAPI spec carry a summary or description, and 154 declare only a default response", "No official server-side SDK. Sumsub publishes request-signing examples in seven languages instead", "The 14-day trial of 50 real checks needs a bank card, and production opens after Sumsub checks the integration", "Terms clause 6.9 permits Sumsub to use customers' personal data to develop fraud detection, including machine learning models", "The subprocessor list is published in the Dashboard, not on a public page" ], "agentNotes": [ "Sign every request. X-App-Access-Sig is the lowercase hex HMAC-SHA256 of timestamp, uppercase method, path with query and raw body, and the timestamp must be within one minute of server time", "Use a sandbox token (prefix sbx) for agent work. Sandbox and production tokens are separate, and Sumsub's own skills refuse any other prefix", "Stay under 300 GET and 50 POST requests per 5 seconds, and under 500 new applicants per 24 hours in Sandbox", "Token permissions can't be edited after creation. Generate a new token with the narrower set and delete the old one", "Subscribe to the applicantReviewed webhook for results and verify x-payload-digest against the raw body before trusting it" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 68.5 } ], "editorialScores": { "ergonomics": 60, "maintenance": 74, "payments": 25, "reliability": 80, "schema": 78, "security": 80, "transparency": 52 }, "provenanceScore": 96 }, "connect": { "install": "npx skills add sumsub/agent-skills --all -g", "http": "curl -X GET \\\n 'https://api.sumsub.com/resources/auditTrailEvents/list?from=2024-06-01+00:00:00\u0026to=2024-06-30+23:59:59\u0026limit=100' \\\n -H 'X-App-Token: \u003cyour-app-token\u003e' \\\n -H 'X-App-Access-Sig: \u003cyour-signature\u003e' \\\n -H 'X-App-Access-Ts: \u003cunix-timestamp\u003e'", "claudeCode": "claude mcp add --transport http sumsub https://api.sumsub.com/mcp/", "config": { "mcpServers": { "sumsub": { "args": [ "mcp-remote", "https://api.sumsub.com/mcp/" ], "command": "npx" } } } }, "letme": { "capability": "https://letme.dev/kyc.identity", "tool": "https://letme.dev/sumsub" }, "area": "domain-data", "unitPrices": [ { "item": "Basic plan, user verification", "unit": "tx", "usd": 1.35, "note": "per completed verification; $149 monthly minimum" }, { "item": "Compliance plan, user verification with AML screening and address check", "unit": "tx", "usd": 1.85, "note": "per completed verification; $299 monthly minimum" } ], "provenance": { "legalEntity": "Sum and Substance Ltd", "domain": "sumsub.com", "domainRegistered": "2015-05-01", "endpointOnVendorDomain": true, "terms": "https://sumsub.com/terms-and-conditions/", "privacy": "https://sumsub.com/privacy-notice-service/", "statusPage": "https://status.sumsub.com", "changelog": "https://docs.sumsub.com/changelog", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The terms (version of 21 May 2026) name Sum and Substance Ltd, England, company number 09688671, 30 St. Mary Axe, London EC3A 8BF, with contracting entities in the UAE, Delaware, Singapore and Cyprus depending on where the customer is registered.", "The API and the MCP server answer at api.sumsub.com, and the Dashboard and OAuth issuer at cockpit.sumsub.com.", "sumsub.com/.well-known/security.txt gives security@sumsub.com and a Bugcrowd engagement as contacts and expires on 2027-12-31.", "The service privacy notice was last updated on 19 March 2026. The data processing agreement is Annex 3 of the terms.", "RDAP for sumsub.com gives a registration date of 2015-05-01." ], "score": 96 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/sumsub.json", "live": { "slug": "sumsub", "probe": { "target": "https://api.sumsub.com", "method": "get", "lastAt": "2026-10-09T11:46:41.99457637Z", "lastOk": true, "lastStatus": 200, "lastMs": 148, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 163, "p95ms24h": 260, "samples24h": 218, "samples30d": 218, "days": [ { "date": "2026-10-08", "probes": 93, "ok": 93 }, { "date": "2026-10-09", "probes": 125, "ok": 125 } ] }, "vendorStatus": { "page": "https://status.sumsub.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-09T11:40:59.008733831Z" }, "versions": [ { "registry": "npm", "name": "@sumsub/websdk", "version": "2.9.0", "seenAt": "2026-10-08T16:31:00.353997894Z" } ], "githubStars": 7, "npmWeekly": 172226, "securityTxt": { "url": "https://sumsub.com/.well-known/security.txt", "state": "valid", "expires": "2027-12-31T11:59:00Z", "checkedAt": "2026-10-08T15:38:36.412722848Z" }, "pages": [ { "url": "https://docs.sumsub.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:19:32.69717252Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "24fd7917e5f9" }, { "url": "https://sumsub.com/pricing/", "kind": "pricing", "status": 200, "checkedAt": "2026-10-08T18:24:56.017931789Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8df9176ba407" }, { "url": "https://sumsub.com/privacy-notice-service/", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:24:58.191382748Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "676c31f026df" }, { "url": "https://sumsub.com/terms-and-conditions/", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:25:00.198690776Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "63e133a2d160" } ], "updatedAt": "2026-10-09T11:46:41.99457637Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Shufti Pro Limited", "b": "Sum and Substance Ltd", "name": "Vendor" }, { "a": "https://api.shuftipro.com", "b": "https://api.sumsub.com", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Pay per use", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service under Shufti's Terms and Conditions. The licences of the mobile capture SDKs were not checked", "b": "Proprietary service under Sumsub's terms and conditions. The agent skills repository and the @sumsub/websdk npm package are MIT", "name": "Licence" }, { "a": "25", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-06", "b": "2026-10-03", "name": "Last release" }, { "a": "", "b": "2026-05-21", "name": "Terms last updated" }, { "a": "2026-09-01", "b": "2026-03-19", "name": "Privacy policy last updated" }, { "a": "yes, with an opt-out", "b": "yes", "name": "Customer content may train models" }, { "a": "", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "673 npm/wk", "b": "172k npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Sumsub scores 68.5 (B) on agent readiness against Shufti's 57.8 (C), and leads in 6 of 7 scored categories. Shufti leads on payments \u0026 pricing.", "question": "Which is better for AI agents, Shufti or Sumsub?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do Shufti and Sumsub need an API key?" }, { "answer": "Yes. Shufti has a hosted endpoint at https://api.shuftipro.com and Sumsub at https://api.sumsub.com.", "question": "Can an agent call Shufti and Sumsub without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Payments \u0026 pricing, 35 against 25" ], "also": [ "Free to start without a card" ], "goodFor": "A team that wants document, face, address, AML and KYB checks behind one endpoint, a free plan for low volume, and an MCP server that hands the person a hosted verification link.", "slug": "shufti", "watchFor": "No OpenAPI file or other machine-readable contract was found. The reference is prose tables plus Postman collections" }, { "aheadOn": [ "Reliability, 80 against 65", "Schema \u0026 documentation, 78 against 58", "Agent ergonomics, 60 against 47", "Security \u0026 auth, 80 against 62" ], "also": null, "goodFor": "An agent that starts verifications, sends links, reads results and AML cases, and works case queues for a regulated business, with one token limited to those permissions.", "slug": "sumsub", "watchFor": "No idempotency keys and no Retry-After or backoff guidance found in the reviewed documentation" } ], "job": { "capability": "kyc.identity", "name": "Kyc identity" }, "others": [ { "json": "https://www.anchorterminal.com/compare/complycube-vs-shufti.json", "title": "ComplyCube vs Shufti", "url": "https://www.anchorterminal.com/compare/complycube-vs-shufti" }, { "json": "https://www.anchorterminal.com/compare/complycube-vs-sumsub.json", "title": "ComplyCube vs Sumsub", "url": "https://www.anchorterminal.com/compare/complycube-vs-sumsub" }, { "json": "https://www.anchorterminal.com/compare/didit-vs-shufti.json", "title": "Didit vs Shufti", "url": "https://www.anchorterminal.com/compare/didit-vs-shufti" }, { "json": "https://www.anchorterminal.com/compare/didit-vs-sumsub.json", "title": "Didit vs Sumsub", "url": "https://www.anchorterminal.com/compare/didit-vs-sumsub" }, { "json": "https://www.anchorterminal.com/compare/jumio-vs-shufti.json", "title": "Jumio vs Shufti", "url": "https://www.anchorterminal.com/compare/jumio-vs-shufti" }, { "json": "https://www.anchorterminal.com/compare/jumio-vs-sumsub.json", "title": "Jumio vs Sumsub", "url": "https://www.anchorterminal.com/compare/jumio-vs-sumsub" }, { "json": "https://www.anchorterminal.com/compare/persona-vs-shufti.json", "title": "Persona vs Shufti", "url": "https://www.anchorterminal.com/compare/persona-vs-shufti" }, { "json": "https://www.anchorterminal.com/compare/persona-vs-sumsub.json", "title": "Persona vs Sumsub", "url": "https://www.anchorterminal.com/compare/persona-vs-sumsub" }, { "json": "https://www.anchorterminal.com/compare/shufti-vs-socure-riskos.json", "title": "Shufti vs Socure RiskOS", "url": "https://www.anchorterminal.com/compare/shufti-vs-socure-riskos" }, { "json": "https://www.anchorterminal.com/compare/shufti-vs-trulioo.json", "title": "Shufti vs Trulioo", "url": "https://www.anchorterminal.com/compare/shufti-vs-trulioo" }, { "json": "https://www.anchorterminal.com/compare/shufti-vs-veriff.json", "title": "Shufti vs Veriff", "url": "https://www.anchorterminal.com/compare/shufti-vs-veriff" }, { "json": "https://www.anchorterminal.com/compare/socure-riskos-vs-sumsub.json", "title": "Socure RiskOS vs Sumsub", "url": "https://www.anchorterminal.com/compare/socure-riskos-vs-sumsub" }, { "json": "https://www.anchorterminal.com/compare/sumsub-vs-trulioo.json", "title": "Sumsub vs Trulioo", "url": "https://www.anchorterminal.com/compare/sumsub-vs-trulioo" }, { "json": "https://www.anchorterminal.com/compare/sumsub-vs-veriff.json", "title": "Sumsub vs Veriff", "url": "https://www.anchorterminal.com/compare/sumsub-vs-veriff" }, { "json": "https://www.anchorterminal.com/compare/complyadvantage-vs-shufti.json", "title": "ComplyAdvantage vs Shufti", "url": "https://www.anchorterminal.com/compare/complyadvantage-vs-shufti" }, { "json": "https://www.anchorterminal.com/compare/complyadvantage-vs-sumsub.json", "title": "ComplyAdvantage vs Sumsub", "url": "https://www.anchorterminal.com/compare/complyadvantage-vs-sumsub" }, { "json": "https://www.anchorterminal.com/compare/middesk-vs-shufti.json", "title": "Middesk vs Shufti", "url": "https://www.anchorterminal.com/compare/middesk-vs-shufti" }, { "json": "https://www.anchorterminal.com/compare/middesk-vs-sumsub.json", "title": "Middesk vs Sumsub", "url": "https://www.anchorterminal.com/compare/middesk-vs-sumsub" } ], "scores": [ { "by": 15, "edge": "sumsub", "key": "reliability", "name": "Reliability", "shufti": 65, "sumsub": 80, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 20, "edge": "sumsub", "key": "schema", "name": "Schema \u0026 documentation", "shufti": 58, "sumsub": 78, "weight": 13 }, { "by": 13, "edge": "sumsub", "key": "ergonomics", "name": "Agent ergonomics", "shufti": 47, "sumsub": 60, "weight": 13 }, { "by": 18, "edge": "sumsub", "key": "security", "name": "Security \u0026 auth", "shufti": 62, "sumsub": 80, "weight": 14 }, { "by": 10, "edge": "shufti", "key": "payments", "name": "Payments \u0026 pricing", "shufti": 35, "sumsub": 25, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 2, "edge": "sumsub", "key": "maintenance", "name": "Maintenance \u0026 community", "shufti": 72, "sumsub": 74, "weight": 7 }, { "by": 3, "edge": "sumsub", "key": "transparency", "name": "Transparency \u0026 trust", "shufti": 71, "sumsub": 74, "weight": 7 } ], "summary": "Sumsub scores 68.5 (B) on agent readiness against Shufti's 57.8 (C), and leads in 6 of 7 scored categories. Shufti leads on payments \u0026 pricing. Both do kyc identity.", "verdicts": { "shufti": "One endpoint covers document, face, address, AML and KYB checks, with a free plan of 10 verifications a month, and a hosted MCP server adds OAuth with three scopes. No OpenAPI file, server SDK or idempotency key was found, and the status page history could not be read.", "sumsub": "Per-token permissions, an IP allowlist, HMAC-signed requests and a public OpenAPI spec with Markdown docs suit an agent working on verification cases. No idempotency keys or Retry-After guidance were found, there is no server SDK, and production access needs a browser signup, a bank card and Sumsub's review of the integration." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/shufti-vs-sumsub", "json": "https://www.anchorterminal.com/compare/shufti-vs-sumsub.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/shufti-vs-sumsub.md", "slim": "https://www.anchorterminal.com/compare/shufti-vs-sumsub.min.md" }, "markdown": "Sumsub scores 68.5 (B) on agent readiness against Shufti's 57.8 (C), and leads in 6 of 7 scored categories. Shufti leads on payments \u0026 pricing. Both do kyc identity.\n\n- Shufti: grade C, 57.8/100, rank #538 of 842. Markdown https://www.anchorterminal.com/tools/shufti.md · JSON https://www.anchorterminal.com/api/v1/tools/shufti.json\n- Sumsub: grade B, 68.5/100, rank #200 of 842. Markdown https://www.anchorterminal.com/tools/sumsub.md · JSON https://www.anchorterminal.com/api/v1/tools/sumsub.json\n\n## Which one, for what\n\n### Shufti (C)\n\nGood for: A team that wants document, face, address, AML and KYB checks behind one endpoint, a free plan for low volume, and an MCP server that hands the person a hosted verification link.\n\nAhead on:\n- Payments \u0026 pricing, 35 against 25\n\nAlso in its favour:\n- Free to start without a card\n\nWatch for: No OpenAPI file or other machine-readable contract was found. The reference is prose tables plus Postman collections\n\n### Sumsub (B)\n\nGood for: An agent that starts verifications, sends links, reads results and AML cases, and works case queues for a regulated business, with one token limited to those permissions.\n\nAhead on:\n- Reliability, 80 against 65\n- Schema \u0026 documentation, 78 against 58\n- Agent ergonomics, 60 against 47\n- Security \u0026 auth, 80 against 62\n\nWatch for: No idempotency keys and no Retry-After or backoff guidance found in the reviewed documentation\n\n\n## Score by category\n\n| Category | Weight | Shufti | Sumsub | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 65 | 80 | Sumsub +15 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 58 | 78 | Sumsub +20 |\n| Agent ergonomics | 13% (16.2 this run) | 47 | 60 | Sumsub +13 |\n| Security \u0026 auth | 14% (17.5 this run) | 62 | 80 | Sumsub +18 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 35 | 25 | Shufti +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 72 | 74 | Sumsub +2 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 71 | 74 | Sumsub +3 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **57.8 · C** | **68.5 · B** | |\n\n## Facts side by side\n\n| Fact | Shufti | Sumsub |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Shufti Pro Limited | Sum and Substance Ltd |\n| Hosted endpoint | `https://api.shuftipro.com` | `https://api.sumsub.com` |\n| Transports | HTTP, Streamable HTTP | HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Pay per use |\n| x402 | no | no |\n| Licence | Proprietary service under Shufti's Terms and Conditions. The licences of the mobile capture SDKs were not checked | Proprietary service under Sumsub's terms and conditions. The agent skills repository and the @sumsub/websdk npm package are MIT |\n| Tools exposed | 25 | none |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-10-06 | 2026-10-03 |\n| Terms last updated | | 2026-05-21 |\n| Privacy policy last updated | 2026-09-01 | 2026-03-19 |\n| Customer content may train models | yes, with an opt-out | yes |\n| Terms restrict automated access | | not found in the text |\n| Terms restrict benchmarking | | not found in the text |\n| Terms or service can change without notice | | yes |\n| Arbitration or class-action waiver | | yes |\n| Popularity | 673 npm/wk | 172k npm/wk |\n\n## Verdicts\n\n**Shufti.** One endpoint covers document, face, address, AML and KYB checks, with a free plan of 10 verifications a month, and a hosted MCP server adds OAuth with three scopes. No OpenAPI file, server SDK or idempotency key was found, and the status page history could not be read.\n\n**Sumsub.** Per-token permissions, an IP allowlist, HMAC-signed requests and a public OpenAPI spec with Markdown docs suit an agent working on verification cases. No idempotency keys or Retry-After guidance were found, there is no server SDK, and production access needs a browser signup, a bank card and Sumsub's review of the integration.\n\n## Before you call either\n\n### Shufti\n\n1. POST every verification to `https://api.shuftipro.com/` with a unique `reference` of 6 to 250 characters and one object per service. Read results from `/status` with that reference\n2. Register the callback domain in the back office first. An unregistered `callback_url` is rejected\n3. Stay under 60 requests a minute per IP on a production account and 20 on a trial account\n4. Check the `Signature` response header. Accounts created after 15 March 2023 hash the Secret Key with SHA-256 before appending it to the raw response\n5. Through MCP, identity checks return a `verification_url` for the person to open. No tool accepts an image, so use the REST API for offsite proofs\n\n### Sumsub\n\n1. Sign every request. X-App-Access-Sig is the lowercase hex HMAC-SHA256 of timestamp, uppercase method, path with query and raw body, and the timestamp must be within one minute of server time\n2. Use a sandbox token (prefix sbx) for agent work. Sandbox and production tokens are separate, and Sumsub's own skills refuse any other prefix\n3. Stay under 300 GET and 50 POST requests per 5 seconds, and under 500 new applicants per 24 hours in Sandbox\n4. Token permissions can't be edited after creation. Generate a new token with the narrower set and delete the old one\n5. Subscribe to the applicantReviewed webhook for results and verify x-payload-digest against the raw body before trusting it\n\n## Questions\n\n### Which is better for AI agents, Shufti or Sumsub?\n\nSumsub scores 68.5 (B) on agent readiness against Shufti's 57.8 (C), and leads in 6 of 7 scored categories. Shufti leads on payments \u0026 pricing.\n\n### Do Shufti and Sumsub need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call Shufti and Sumsub without installing anything?\n\nYes. Shufti has a hosted endpoint at https://api.shuftipro.com and Sumsub at https://api.sumsub.com.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/shufti-vs-sumsub.json, and with the fewest tokens: https://www.anchorterminal.com/compare/shufti-vs-sumsub.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"shufti\", \"b\": \"sumsub\"}`. From a terminal: `anchor compare shufti sumsub`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/shufti.json and https://www.anchorterminal.com/api/v1/tools/sumsub.json\n\n## Other comparisons with Shufti or Sumsub\n\n- [ComplyCube vs Shufti](https://www.anchorterminal.com/compare/complycube-vs-shufti.md)\n- [ComplyCube vs Sumsub](https://www.anchorterminal.com/compare/complycube-vs-sumsub.md)\n- [Didit vs Shufti](https://www.anchorterminal.com/compare/didit-vs-shufti.md)\n- [Didit vs Sumsub](https://www.anchorterminal.com/compare/didit-vs-sumsub.md)\n- [Jumio vs Shufti](https://www.anchorterminal.com/compare/jumio-vs-shufti.md)\n- [Jumio vs Sumsub](https://www.anchorterminal.com/compare/jumio-vs-sumsub.md)\n- [Persona vs Shufti](https://www.anchorterminal.com/compare/persona-vs-shufti.md)\n- [Persona vs Sumsub](https://www.anchorterminal.com/compare/persona-vs-sumsub.md)\n- [Shufti vs Socure RiskOS](https://www.anchorterminal.com/compare/shufti-vs-socure-riskos.md)\n- [Shufti vs Trulioo](https://www.anchorterminal.com/compare/shufti-vs-trulioo.md)\n- [Shufti vs Veriff](https://www.anchorterminal.com/compare/shufti-vs-veriff.md)\n- [Socure RiskOS vs Sumsub](https://www.anchorterminal.com/compare/socure-riskos-vs-sumsub.md)\n- [Sumsub vs Trulioo](https://www.anchorterminal.com/compare/sumsub-vs-trulioo.md)\n- [Sumsub vs Veriff](https://www.anchorterminal.com/compare/sumsub-vs-veriff.md)\n- [ComplyAdvantage vs Shufti](https://www.anchorterminal.com/compare/complyadvantage-vs-shufti.md)\n- [ComplyAdvantage vs Sumsub](https://www.anchorterminal.com/compare/complyadvantage-vs-sumsub.md)\n- [Middesk vs Shufti](https://www.anchorterminal.com/compare/middesk-vs-shufti.md)\n- [Middesk vs Sumsub](https://www.anchorterminal.com/compare/middesk-vs-sumsub.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Shufti vs Sumsub", "url": "" } ], "description": "Sumsub scores 68.5 (B) on agent readiness against Shufti's 57.8 (C), and leads in 6 of 7 scored categories. Shufti leads on payments \u0026 pricing. Both do kyc identity. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Shufti C 57.8", "Sumsub B 68.5", "scores" ], "h1": "Shufti vs Sumsub", "image": "https://www.anchorterminal.com/assets/og/compare-shufti-vs-sumsub.png", "path": "/compare/shufti-vs-sumsub", "published": "2026-10-01", "section": "tools", "title": "Shufti vs Sumsub for AI agents, C 57.8 vs B 68.5 | Anchor Terminal", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/compare/shufti-vs-sumsub" }, "tokens": { "markdown": 2200, "slim": 730 }, "version": 1 }