{ "data": { "similar": [ { "grade": "BB", "json": "https://www.anchorterminal.com/tools/didit.json", "name": "Didit", "score": 75, "shared": [ "kyc.identity", "kyc.documents", "kyc.screening", "kyc.business" ], "slug": "didit" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/persona.json", "name": "Persona", "score": 69.5, "shared": [ "kyc.identity", "kyc.business", "kyc.documents", "kyc.screening" ], "slug": "persona" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/sumsub.json", "name": "Sumsub", "score": 68.5, "shared": [ "kyc.identity", "kyc.business", "kyc.documents", "kyc.screening" ], "slug": "sumsub" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/complycube.json", "name": "ComplyCube", "score": 63.7, "shared": [ "kyc.identity", "kyc.documents", "kyc.screening", "kyc.business" ], "slug": "complycube" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/socure-riskos.json", "name": "Socure RiskOS", "score": 63.5, "shared": [ "kyc.identity", "kyc.documents", "kyc.screening", "kyc.business" ], "slug": "socure-riskos" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/trulioo.json", "name": "Trulioo", "score": 58.2, "shared": [ "kyc.identity", "kyc.business", "kyc.documents", "kyc.screening" ], "slug": "trulioo" } ], "tool": { "slug": "shufti", "name": "Shufti", "vendor": "Shufti Pro Limited", "vendorUrl": "https://shuftipro.com", "kind": "http-api", "category": "identity-verification", "summary": "Identity and business verification service from Shufti Pro Limited in London. One REST endpoint runs document, face, address, AML screening and KYB checks chosen in the request body, with results by callback. A hosted MCP server exposes 25 tools.", "url": "https://www.anchorterminal.com/tools/shufti", "markdownUrl": "https://www.anchorterminal.com/tools/shufti.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shufti.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shufti.json", "repo": "https://github.com/shuftipro/iOS-SDK", "license": "Proprietary service under Shufti's Terms and Conditions. The licences of the mobile capture SDKs were not checked", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.shuftipro.com", "packages": [ { "registry": "npm", "name": "shuftipro-onsite-mobilesdk" } ], "auth": "mixed", "authNotes": "Self-serve. Signing up creates a back office account, and the Client ID and Secret Key come from Settings, API Configuration, API Keys. The REST API takes them as HTTP Basic auth, or a Bearer access token from `/get/access/token` that lasts one hour. The key pair has no scopes, and the Secret Key is shown once and replaced by generating a new one. The MCP server uses OAuth 2.1 with PKCE and dynamic client registration. Its login page asks for the same Client ID and Secret Key, and it issues tokens with the scopes `knowledge:read`, `verification:read` and `verification:write`. Callback and redirect domains must be registered in the back office.", "pricing": "freemium", "pricingNotes": "Free Forever covers up to 10 verifications a month with no card, on the production environment. Essentials starts from $1.50 a verification, pay as you go with no monthly minimum, up to 20,000 verifications. Enterprise is quoted by sales and adds e-IDV, Travel Rule, video KYC and other services. The pricing page says only successful verification attempts are billed and resubmissions are free. Trial accounts accept test ID samples (https://shuftipro.com/pricing/, checked 2026-10-09).", "priceSummary": "$1.50 / tx", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs (llms-full.txt), the pricing page or the terms (checked 2026-10-09).", "endpoints": [] }, "toolCount": 25, "popularity": { "githubStars": null, "npmWeekly": 673, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://developers.shuftipro.com/docs/get_started", "llmsTxt": "https://developers.shuftipro.com/llms.txt", "capabilities": [ "kyc.identity", "kyc.documents", "kyc.business", "kyc.screening" ], "tags": [ "hosted", "api-key", "oauth", "mcp", "webhooks", "llms-txt", "free-tier", "no-card", "status-page", "sla", "soc2", "iso27001" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 57.8, "grade": "C", "agentReady": false, "rank": 538, "ranked": true, "rankOf": 842, "categoryRank": 9, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 47, "maintenance": 72, "payments": 35, "reliability": 65, "schema": 58, "security": 62, "transparency": 71 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 65, "points": 13, "reason": "Graded on the REST API with the hosted lines. A status page at status.shuftipro.com, hosted by UptimeRobot, with 90-day uptime and an update history (20). The page draws its data by script from a path its robots.txt disallows, so no incident record was read and the line takes the no-readable-history score (5). Rate limits are published at 60 requests a minute per IP address for production accounts and 20 for trial accounts (15). A 429 is in the HTTP code table. No Retry-After header, backoff guidance or idempotency key was found. Failed callbacks retry automatically and can be resent by API once an hour (5). Schedule 1 of the public terms targets 99 per cent monthly uptime on a reasonable endeavours basis, with no service credits found (10). The REST API is generally available (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 58, "points": 9.43, "reason": "No OpenAPI file or other machine-readable contract was found. Postman collections are linked from the endpoint pages, and the MCP tool schemas sit behind OAuth and were not read (5). llms.txt, a 2.9 MB llms-full.txt and a Markdown twin of every page (10). Each service has a how-it-works page and parameter tables that state purpose, and the MCP tool list gives one line a tool (12). Parameter tables give type, length limits, accepted values and required flags, though most flags are strings holding 0 or 1 and every service shares one endpoint (10). Samples in nine languages, an HTTP code table, an events table, sample responses per event and decline codes per service (13). The API has no version in its URL or headers. The revision history is dated and frequent, and its published page contains unresolved merge conflict markers (8)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 47, "points": 7.64, "reason": "REST responses can't be trimmed by field, and AML and e-IDV responses are long. The MCP server has 25 tools, a knowledge-only scope, and status answers built from a fixed list of fields (12). No endpoint lists verifications, so every read needs a stored reference. Paging was found only on Travel Rule transactions (6). Errors name the service, the key and a message, with HTTP codes and decline codes documented (15). No idempotency key. The caller's `reference` identifies a request and a 409 is listed, but the docs do not say a repeated reference is refused. The MCP delete tool asks for explicit confirmation, and tool annotations were not read (7). A request needs only a reference and one service object, and the MCP server fills defaults and reports them in `defaults_applied`. No server-side SDK in any language (7)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 62, "points": 10.85, "reason": "The REST API uses one Client ID and Secret Key pair as Basic auth, with no scopes. The secret is shown once and replaced by generating a new one, and a one-hour access token is an alternative. The MCP server adds OAuth 2.1 with PKCE, three scopes, 24-hour access tokens and rotating refresh tokens, though its login page takes the same key pair and stores the secret encrypted (22). MCP scopes are enforced when tools are listed and on every call, the delete tool needs confirmation, callback domains must be registered, and the back office has five preset roles plus custom ones. No read-only REST key (12). MCP status answers leave out extracted document data and the provider payload by design. REST responses carry text read from documents and watchlist hits, with no injection guidance found (7). Callback logs, a login history and an activity log for screening cases. MCP usage records are kept by Shufti and not shown to the operator (9). SOC 2 Type II, ISO 27001:2022, PCI DSS and Cyber Essentials Plus per the certifications page. security.txt returns 404, and no disclosure policy or bug bounty was found (12)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 35, "points": 4.38, "reason": "No x402, MPP or L402 (0). The pricing page gives $0 for Free Forever and a starting price of $1.50 a verification for Essentials, with the rate varying by volume and service and Enterprise quoted. We scored 15 of 20 because only a starting price is public (15). Free Forever covers 10 verifications a month with no card (20). Signup is a browser flow and keys come from the back office. The MCP server's Explore Shufti mode needs no account but reaches only the knowledge tools (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 72, "points": 6.3, "reason": "The revision history's newest entry is dated 6 October 2026 (30). It has 19 dated entries between 24 July and 6 October 2026 (20). Closed service with a public revision history, a tech support address and a help desk described in the terms. No public developer forum was found (9). No server appears in the official MCP registry and there is no server-side SDK. The mobile SDKs are current, with Android 3.0.8 dated 31 August 2026 (8). The npm package `shuftipro-onsite-mobilesdk` is at 1.1.2 with 673 downloads in the week to 4 October 2026. CI was not checked (5)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 71, "points": 6.21, "note": "editorial 51, provenance 90", "reason": "Closed service with public terms, version 11.1 with effect from 13 May 2026, and every earlier version linked (15). The Services Privacy Notice, version 1.2 of September 2026, sets out processor and controller roles and a retention schedule, and the terms carry a data processing schedule. The terms keep personal data for seven years after the services end where the client gives no instruction, and both documents say Shufti may act as independent controller for model training. The notice's United States section gives twelve months as the default for other verification data, which differs from the terms (22). Deprecations appear in the revision history with dates. Standard KYB was deprecated on 6 October 2026 with its pages removed the same day and no notice period, while the terms promise ten business days' written notice of non-security updates (8). Sub-processors are described by category and the list is given to clients on request. Webhook IP addresses are published for Europe and the United States (6)." } ], "assessment": { "date": "2026-10-09", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "REST responses can't be trimmed by field, and AML and e-IDV responses are long. The MCP server has 25 tools, a knowledge-only scope, and status answers built from a fixed list of fields (12). No endpoint lists verifications, so every read needs a stored reference. Paging was found only on Travel Rule transactions (6). Errors name the service, the key and a message, with HTTP codes and decline codes documented (15). No idempotency key. The caller's `reference` identifies a request and a 409 is listed, but the docs do not say a repeated reference is refused. The MCP delete tool asks for explicit confirmation, and tool annotations were not read (7). A request needs only a reference and one service object, and the MCP server fills defaults and reports them in `defaults_applied`. No server-side SDK in any language (7).", "maintenance": "The revision history's newest entry is dated 6 October 2026 (30). It has 19 dated entries between 24 July and 6 October 2026 (20). Closed service with a public revision history, a tech support address and a help desk described in the terms. No public developer forum was found (9). No server appears in the official MCP registry and there is no server-side SDK. The mobile SDKs are current, with Android 3.0.8 dated 31 August 2026 (8). The npm package `shuftipro-onsite-mobilesdk` is at 1.1.2 with 673 downloads in the week to 4 October 2026. CI was not checked (5).", "payments": "No x402, MPP or L402 (0). The pricing page gives $0 for Free Forever and a starting price of $1.50 a verification for Essentials, with the rate varying by volume and service and Enterprise quoted. We scored 15 of 20 because only a starting price is public (15). Free Forever covers 10 verifications a month with no card (20). Signup is a browser flow and keys come from the back office. The MCP server's Explore Shufti mode needs no account but reaches only the knowledge tools (0).", "reliability": "Graded on the REST API with the hosted lines. A status page at status.shuftipro.com, hosted by UptimeRobot, with 90-day uptime and an update history (20). The page draws its data by script from a path its robots.txt disallows, so no incident record was read and the line takes the no-readable-history score (5). Rate limits are published at 60 requests a minute per IP address for production accounts and 20 for trial accounts (15). A 429 is in the HTTP code table. No Retry-After header, backoff guidance or idempotency key was found. Failed callbacks retry automatically and can be resent by API once an hour (5). Schedule 1 of the public terms targets 99 per cent monthly uptime on a reasonable endeavours basis, with no service credits found (10). The REST API is generally available (10).", "schema": "No OpenAPI file or other machine-readable contract was found. Postman collections are linked from the endpoint pages, and the MCP tool schemas sit behind OAuth and were not read (5). llms.txt, a 2.9 MB llms-full.txt and a Markdown twin of every page (10). Each service has a how-it-works page and parameter tables that state purpose, and the MCP tool list gives one line a tool (12). Parameter tables give type, length limits, accepted values and required flags, though most flags are strings holding 0 or 1 and every service shares one endpoint (10). Samples in nine languages, an HTTP code table, an events table, sample responses per event and decline codes per service (13). The API has no version in its URL or headers. The revision history is dated and frequent, and its published page contains unresolved merge conflict markers (8).", "security": "The REST API uses one Client ID and Secret Key pair as Basic auth, with no scopes. The secret is shown once and replaced by generating a new one, and a one-hour access token is an alternative. The MCP server adds OAuth 2.1 with PKCE, three scopes, 24-hour access tokens and rotating refresh tokens, though its login page takes the same key pair and stores the secret encrypted (22). MCP scopes are enforced when tools are listed and on every call, the delete tool needs confirmation, callback domains must be registered, and the back office has five preset roles plus custom ones. No read-only REST key (12). MCP status answers leave out extracted document data and the provider payload by design. REST responses carry text read from documents and watchlist hits, with no injection guidance found (7). Callback logs, a login history and an activity log for screening cases. MCP usage records are kept by Shufti and not shown to the operator (9). SOC 2 Type II, ISO 27001:2022, PCI DSS and Cyber Essentials Plus per the certifications page. security.txt returns 404, and no disclosure policy or bug bounty was found (12).", "transparency": "Closed service with public terms, version 11.1 with effect from 13 May 2026, and every earlier version linked (15). The Services Privacy Notice, version 1.2 of September 2026, sets out processor and controller roles and a retention schedule, and the terms carry a data processing schedule. The terms keep personal data for seven years after the services end where the client gives no instruction, and both documents say Shufti may act as independent controller for model training. The notice's United States section gives twelve months as the default for other verification data, which differs from the terms (22). Deprecations appear in the revision history with dates. Standard KYB was deprecated on 6 October 2026 with its pages removed the same day and no notice period, while the terms promise ten business days' written notice of non-security updates (8). Sub-processors are described by category and the list is given to clients on request. Webhook IP addresses are published for Europe and the United States (6)." }, "sources": [ { "what": "developer docs index (llms.txt)", "url": "https://developers.shuftipro.com/llms.txt", "seen": "2026-10-09" }, { "what": "full developer docs (llms-full.txt)", "url": "https://developers.shuftipro.com/llms-full.txt", "seen": "2026-10-09" }, { "what": "get started and authentication", "url": "https://developers.shuftipro.com/docs/get_started", "seen": "2026-10-09" }, { "what": "endpoints (status, delete, account info, access token)", "url": "https://developers.shuftipro.com/docs/verification_endpoints/requests", "seen": "2026-10-09" }, { "what": "responses, HTTP codes, events and signature", "url": "https://developers.shuftipro.com/docs/verification_endpoints/responses", "seen": "2026-10-09" }, { "what": "callback logs and resend", "url": "https://developers.shuftipro.com/docs/verification_endpoints/callback_logs", "seen": "2026-10-09" }, { "what": "rate limits and webhook IPs", "url": "https://developers.shuftipro.com/docs/kyc/system_insights_and_request_limits/rate_limiting_and_webhook_ips", "seen": "2026-10-09" }, { "what": "revision history", "url": "https://developers.shuftipro.com/docs/revision_history", "seen": "2026-10-09" }, { "what": "MCP introduction", "url": "https://developers.shuftipro.com/docs/mcp/intro", "seen": "2026-10-09" }, { "what": "MCP tools", "url": "https://developers.shuftipro.com/docs/mcp/tools", "seen": "2026-10-09" }, { "what": "MCP privacy notice", "url": "https://developers.shuftipro.com/docs/mcp/privacy-notice", "seen": "2026-10-09" }, { "what": "MCP OAuth discovery document", "url": "https://ai.shuftipro.com/.well-known/oauth-authorization-server", "seen": "2026-10-09" }, { "what": "back office account settings and roles", "url": "https://developers.shuftipro.com/docs/backoffice/account_settings", "seen": "2026-10-09" }, { "what": "Android SDK changelog", "url": "https://developers.shuftipro.com/docs/mobile/changelog/android-changelog", "seen": "2026-10-09" }, { "what": "pricing", "url": "https://shuftipro.com/pricing/", "seen": "2026-10-09" }, { "what": "terms summary page and version list", "url": "https://shuftipro.com/terms-and-conditions/", "seen": "2026-10-09" }, { "what": "Terms and Conditions version 11.1 (PDF)", "url": "https://shuftipro.com/wp-content/uploads/Version-11.1-w.e.f.-May-13th-2026.pdf", "seen": "2026-10-09" }, { "what": "Services Privacy Notice", "url": "https://shuftipro.com/services-privacy-notice/", "seen": "2026-10-09" }, { "what": "certifications", "url": "https://shuftipro.com/certifications.md/", "seen": "2026-10-09" }, { "what": "status page", "url": "https://status.shuftipro.com/", "seen": "2026-10-09" }, { "what": "security.txt (404)", "url": "https://shuftipro.com/.well-known/security.txt", "seen": "2026-10-09" }, { "what": "npm shuftipro-onsite-mobilesdk", "url": "https://registry.npmjs.org/shuftipro-onsite-mobilesdk/latest", "seen": "2026-10-09" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0.1/servers?search=shufti", "seen": "2026-10-09" }, { "what": "RDAP for shuftipro.com", "url": "https://rdap.verisign.com/com/v1/domain/shuftipro.com", "seen": "2026-10-09" }, { "what": "lead URL, a parked domain", "url": "https://shufti.ai/", "seen": "2026-10-09" } ], "openQuestions": [ "unchecked: the incident history on status.shuftipro.com, which loads from /api/, a path its robots.txt disallows", "unchecked: the Vanta trust centre at trust.shuftipro.com, which is drawn by script, so the certification reports and any sub-processor list there were not read", "unchecked: the MCP tool definitions, annotations and input schemas, which sit behind OAuth. We did not connect to the server", "unchecked: GitHub stars and the licences of the mobile SDK repositories. The GitHub API refused us for its rate limit", "Whether clients were told in advance of the 14 September 2026 change that replaced decline code SPDR398 with SPDR370 for United States driving licences. The revision history entry carries the same date as the change, and no deduction was taken", "Whether a repeated `reference` is refused. A 409 is listed without saying when it is returned", "The Get Started page says an access token is valid for one hour and can be used once only, and the endpoint page says it applies for one hour. We did not test which holds", "Whether the Free Forever plan asks for no card at signup. The pricing page says so and we did not sign up", "The default retention period. The terms say seven years after the services end and the privacy notice's United States section says twelve months", "The lead named shufti.ai as the vendor URL. It is a parked domain for sale, and the vendor's site is shuftipro.com. The lead also did not mention the MCP server", "npmWeekly is `shuftipro-onsite-mobilesdk` (28 September to 4 October 2026), a React Native capture SDK, since no server-side package exists" ] }, "negative": 0, "verdict": "One endpoint covers document, face, address, AML and KYB checks, with a free plan of 10 verifications a month, and a hosted MCP server adds OAuth with three scopes. No OpenAPI file, server SDK or idempotency key was found, and the status page history could not be read.", "bestFor": "A team that wants document, face, address, AML and KYB checks behind one endpoint, a free plan for low volume, and an MCP server that hands the person a hosted verification link.", "strengths": [ "Free Forever plan of 10 verifications a month with no card, on the production environment, per the pricing page", "Hosted MCP server at `https://ai.shuftipro.com/mcp` with 25 tools, OAuth 2.1 with PKCE and three scopes enforced on every call", "Docs published as llms.txt, a 2.9 MB llms-full.txt and a Markdown twin of each page, with samples in nine languages", "Public terms (version 11.1, 13 May 2026) include an availability schedule targeting 99 per cent monthly uptime", "Revision history with 19 dated entries between 24 July and 6 October 2026" ], "weaknesses": [ "No OpenAPI file or other machine-readable contract was found. The reference is prose tables plus Postman collections", "The REST credential is one Client ID and Secret Key pair with no scopes, sent as Basic auth on every call", "No idempotency key, Retry-After header or backoff guidance was found for the documented 429", "No server-side SDK. Official packages cover Android, iOS, Flutter, React Native and Cordova capture only", "Standard KYB was deprecated on 6 October 2026 and its pages removed the same day, with no notice period stated", "The sub-processor list is available to clients on request only, and security.txt returns 404" ], "agentNotes": [ "POST every verification to `https://api.shuftipro.com/` with a unique `reference` of 6 to 250 characters and one object per service. Read results from `/status` with that reference", "Register the callback domain in the back office first. An unregistered `callback_url` is rejected", "Stay under 60 requests a minute per IP on a production account and 20 on a trial account", "Check the `Signature` response header. Accounts created after 15 March 2023 hash the Secret Key with SHA-256 before appending it to the raw response", "Through MCP, identity checks return a `verification_url` for the person to open. No tool accepts an image, so use the REST API for offsite proofs" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57.8 } ], "editorialScores": { "ergonomics": 47, "maintenance": 72, "payments": 35, "reliability": 65, "schema": 58, "security": 62, "transparency": 51 }, "provenanceScore": 90 }, "connect": { "http": "curl --location --request POST 'https://api.shuftipro.com' \\\n--header 'Content-Type: application/json' \\\n--header 'Authorization: Basic \u003cbase64 of CLIENT_ID:SECRET_KEY\u003e' \\\n--data-raw '{\n \"reference\" : \"1234567\",\n \"callback_url\" : \"https://yourdomain.com/profile/notifyCallback\",\n \"country\" : \"GB\",\n \"language\" : \"EN\",\n \"verification_mode\" : \"any\",\n \"face\" : {\n \"proof\" : \"\"\n }\n}'", "claudeCode": "claude mcp add --transport http shufti https://ai.shuftipro.com/mcp", "config": { "mcpServers": { "shufti": { "args": [ "mcp-remote", "https://ai.shuftipro.com/mcp" ], "command": "npx" } } } }, "letme": { "capability": "https://letme.dev/kyc.identity", "tool": "https://letme.dev/shufti" }, "notable": [ "A single endpoint, `https://api.shuftipro.com/`, serves every service, and the services wanted are sent as objects in the JSON body (https://developers.shuftipro.com/llms.txt)", "The hosted MCP server lists 25 tools, 7 for product knowledge and 18 for verification, and accepts no document image or selfie (https://developers.shuftipro.com/docs/mcp/tools)", "The MCP privacy notice, version 1.2 of 25 September 2026, says access tokens expire after 24 hours and the Secret Key is stored encrypted until the token record is deleted (https://developers.shuftipro.com/docs/mcp/privacy-notice)", "Production accounts are limited to 60 requests a minute per IP address and trial accounts to 20 (https://developers.shuftipro.com/docs/kyc/system_insights_and_request_limits/rate_limiting_and_webhook_ips)", "Free Forever covers 10 verifications a month with no card, Essentials starts from $1.50 a verification and Enterprise is quoted (https://shuftipro.com/pricing/)", "Standard KYB was deprecated on 6 October 2026 in favour of Enhanced KYB, and its pages were removed (https://developers.shuftipro.com/docs/revision_history)", "The published revision history page contains unresolved merge conflict markers around its 5 and 6 October 2026 entries (https://developers.shuftipro.com/docs/revision_history.md)", "The terms, version 11.1 with effect from 13 May 2026, target 99 per cent monthly uptime and say Shufti may act as independent controller for model training (https://shuftipro.com/terms-and-conditions/)", "The lead URL shufti.ai is a parked domain listed for sale on Spaceship and is not the vendor's site (https://shufti.ai/)", "No Shufti server appears in the official MCP registry (https://registry.modelcontextprotocol.io/v0.1/servers?search=shufti)" ], "area": "domain-data", "details": [ { "label": "Surface graded", "value": "REST API at `https://api.shuftipro.com/`, a single endpoint where each service is an object in the JSON body. The hosted MCP server is read as a second surface" }, { "label": "Endpoints", "value": "POST `/` (verification), `/status`, `/delete`, `/account/info/`, `/get/access/token`, a callback resend endpoint and a proof access URL valid for 15 minutes" }, { "label": "Services", "value": "Document, second document, face, address, consent, phone and email one-time codes, AML screening for people and businesses, Enhanced KYB, e-IDV Pro database checks, age verification, video KYC, e-signature, crypto wallet screening, Travel Rule and transaction screening" }, { "label": "MCP server", "value": "`https://ai.shuftipro.com/mcp`, Streamable HTTP, OAuth 2.1 with PKCE and dynamic client registration. 25 tools, 7 knowledge and 18 verification. Scopes `knowledge:read`, `verification:read` and `verification:write`" }, { "label": "Credentials", "value": "Client ID and Secret Key as HTTP Basic auth, or a Bearer access token from `/get/access/token` valid for one hour. The Secret Key is shown once and regenerated in the back office" }, { "label": "Rate limits", "value": "60 requests a minute per IP address on a production account, 20 a minute on a trial account. Shufti says the limits can change and can be raised on request" }, { "label": "Callbacks", "value": "Sent to a registered `callback_url` with a `Signature` header. Failed deliveries retry automatically, and a callback can be resent by API or from the back office once an hour" }, { "label": "Webhook IPs", "value": "Two in Europe and four in the United States, listed in the docs" }, { "label": "Errors", "value": "JSON with an `event` such as `request.invalid` and an `error` object naming the service, the key and a message. HTTP codes 400, 401, 402, 403, 404, 409, 429, 500, 504 and 524 are listed, and decline reasons carry codes such as SPDR370" }, { "label": "Testing", "value": "Trial accounts accept published test ID samples for face, document and address checks. The samples do not work on a production account" }, { "label": "SDKs", "value": "Capture SDKs only. Android 3.0.8 (31 August 2026), iOS 1.3.55, Flutter 1.0.33, React Native 1.1.1 and Cordova. No server-side client library" }, { "label": "Retention", "value": "Seven years after the services end where the client gives no instruction, per the terms. Records can be deleted by API with a reference and a comment" }, { "label": "Certifications", "value": "SOC 2 Type II, ISO 27001:2022, PCI DSS, Cyber Essentials Plus and iBeta PAD Level 3 per shuftipro.com/certifications. The Vanta trust centre at trust.shuftipro.com was not read" }, { "label": "Status", "value": "status.shuftipro.com, hosted by UptimeRobot, with 90-day uptime and an update history drawn by script" } ], "unitPrices": [ { "item": "Verification, Free Forever plan (document and face checks)", "unit": "tx", "usd": 0, "note": "up to 10 verifications a month, no card" }, { "item": "Verification, Essentials plan, starting price", "unit": "tx", "usd": 1.5, "note": "rate depends on volume and the services chosen, up to 20,000 verifications" } ], "provenance": { "legalEntity": "Shufti Pro Limited", "domain": "shuftipro.com", "domainRegistered": "2016-06-28", "endpointOnVendorDomain": true, "terms": "https://shuftipro.com/wp-content/uploads/Version-11.1-w.e.f.-May-13th-2026.pdf", "privacy": "https://shuftipro.com/services-privacy-notice/", "statusPage": "https://status.shuftipro.com", "changelog": "https://developers.shuftipro.com/docs/revision_history", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "The terms and the MCP privacy notice name Shufti Pro Limited, Office 408 Coppergate House, 10 Whites Row, London E1 7NF.", "The governing terms are a PDF, version 11.1, linked from shuftipro.com/terms-and-conditions/, which itself carries only a summary and links to every earlier version. The page labels the file 12 May 2026 and the file name says 13 May.", "The privacy link is the Services Privacy Notice, version 1.2, last updated September 2026, which covers verification data. A separate notice covers the website.", "shuftipro.com/.well-known/security.txt answered 502 on the first request and 404 on the second.", "RDAP for shuftipro.com gives a registration date of 2016-06-28.", "The API answers at api.shuftipro.com and the MCP server at ai.shuftipro.com. The lead's shufti.ai is a parked domain for sale and unrelated to the vendor.", "status.shuftipro.com is an UptimeRobot page whose data loads from /api/, a path its robots.txt disallows, so the incident history was not read." ], "score": 90, "checks": [ { "check": "Legal entity named", "value": "Shufti Pro Limited", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "shuftipro.com, registered 2016-06-28 (10 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.shuftipro.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.shuftipro.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://shuftipro.com/wp-content/uploads/Version-11.1-w.e.f.-May-13th-2026.pdf", "state": "not-read", "points": 10, "max": 10 }, { "kind": "privacy", "url": "https://shuftipro.com/services-privacy-notice/", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-09-01", "words": 7975, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated September 2026", "says": "Last updated 2026-09-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "California residents can also ask for the categories we collect, where we got them, why we use them, who we gave them to, and the specific pieces we hold." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "Where we do use biometric data elsewhere to improve our own systems, we keep it no more than 24 months, strip out what identifies you wherever we can, and never pass it to anyone else for that purpose.", "says": "Names a period of 24 months" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Clients are notified of any intended material changes to the sub-processor list with reasonable advance notice, providing an opportunity to object where contractually permitted." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We have not sold personal information, or shared it for cross-context behavioural advertising, at any point in the last twelve months, and we do not do so now.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "The DPO operates independently and reports to the highest level of management in accordance with Article 38 UK GDPR." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "The DPO operates independently and reports to the highest level of management in accordance with Article 38 UK GDPR.", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "EU–US Data Privacy Framework: Commission adequacy decision (Implementing Decision 2023/1795) for flows to certified US companies.", "says": "Relies on the Data Privacy Framework" } ], "toKnow": [ { "key": "training.optout", "label": "Says it may use customer content to train or improve models, and gives an opt-out", "found": true, "quote": "Shufti may also act as an independent controller where processing is necessary for model training, fraud prevention, service security and product improvement, as Shufti's Terms explicitly state." } ], "notes": [ { "date": "2026-10-08", "text": "Data that clients collect and pass to Shufti by API or back office is not used for service improvement or training unless agreed with the client in writing.", "quote": "This data is not used for service improvement and training purposes unless otherwise agreed with the client in writing." }, { "date": "2026-10-08", "text": "The one significant decision Shufti says it makes itself is blocking a session for fraud across its platform.", "quote": "The one significant decision we make ourselves is blocking a session for fraud across our platform." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shufti.json", "live": { "slug": "shufti", "probe": { "target": "https://api.shuftipro.com", "method": "get", "lastAt": "2026-10-09T09:27:04.678373332Z", "lastOk": true, "lastStatus": 200, "lastMs": 358, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 311, "p95ms24h": 342, "samples24h": 20, "samples30d": 20, "days": [ { "date": "2026-10-09", "probes": 20, "ok": 20 } ] }, "vendorStatus": { "page": "https://status.shuftipro.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-09T07:58:32.112017753Z" }, "updatedAt": "2026-10-09T09:27:04.678373332Z" } }, "verify": { "accepts": "a page on shuftipro.com or one of its subdomains, or the README of github.com/shuftipro/iOS-SDK", "badgeUrl": "https://www.anchorterminal.com/badges/shufti.svg", "body": { "slug": "shufti", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/shufti", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/shufti\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/shufti.svg\" alt=\"Shufti on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Shufti on Anchor Terminal](https://www.anchorterminal.com/badges/shufti.svg)](https://www.anchorterminal.com/tools/shufti)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/shufti\"\u003eShufti on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/shufti", "json": "https://www.anchorterminal.com/tools/shufti.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/shufti.md", "slim": "https://www.anchorterminal.com/tools/shufti.min.md" }, "markdown": "## Overview\n\n**Grade C · 57.8/100 · rank #538 of 842 · #9 in Identity \u0026 business verification · not agent-ready · confidence medium**\n\n\n## Assessment\n\nOne endpoint covers document, face, address, AML and KYB checks, with a free plan of 10 verifications a month, and a hosted MCP server adds OAuth with three scopes. No OpenAPI file, server SDK or idempotency key was found, and the status page history could not be read.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Shufti Pro Limited (https://shuftipro.com) |\n| Kind | HTTP API |\n| Category | Identity \u0026 business verification (https://www.anchorterminal.com/categories/identity-verification) |\n| Transport | HTTP, Streamable HTTP |\n| Endpoint | `https://api.shuftipro.com` |\n| Auth | OAuth or key · Self-serve. Signing up creates a back office account, and the Client ID and Secret Key come from Settings, API Configuration, API Keys. The REST API takes them as HTTP Basic auth, or a Bearer access token from `/get/access/token` that lasts one hour. The key pair has no scopes, and the Secret Key is shown once and replaced by generating a new one. The MCP server uses OAuth 2.1 with PKCE and dynamic client registration. Its login page asks for the same Client ID and Secret Key, and it issues tokens with the scopes `knowledge:read`, `verification:read` and `verification:write`. Callback and redirect domains must be registered in the back office. |\n| Pricing | Freemium ($1.50 / tx) · Free Forever covers up to 10 verifications a month with no card, on the production environment. Essentials starts from $1.50 a verification, pay as you go with no monthly minimum, up to 20,000 verifications. Enterprise is quoted by sales and adds e-IDV, Travel Rule, video KYC and other services. The pricing page says only successful verification attempts are billed and resubmissions are free. Trial accounts accept test ID samples (https://shuftipro.com/pricing/, checked 2026-10-09). |\n| x402 | No · No x402, MPP or L402 in the developer docs (llms-full.txt), the pricing page or the terms (checked 2026-10-09). |\n| Licence | Proprietary service under Shufti's Terms and Conditions. The licences of the mobile capture SDKs were not checked |\n| Tools exposed | 25 |\n| Packages | npm: `shuftipro-onsite-mobilesdk` |\n| Source | https://github.com/shuftipro/iOS-SDK |\n| Docs | https://developers.shuftipro.com/docs/get_started |\n| llms.txt | https://developers.shuftipro.com/llms.txt |\n| Last release | 2026-10-06 |\n| npm downloads / week | 673 |\n| Surface graded | REST API at `https://api.shuftipro.com/`, a single endpoint where each service is an object in the JSON body. The hosted MCP server is read as a second surface |\n| Endpoints | POST `/` (verification), `/status`, `/delete`, `/account/info/`, `/get/access/token`, a callback resend endpoint and a proof access URL valid for 15 minutes |\n| Services | Document, second document, face, address, consent, phone and email one-time codes, AML screening for people and businesses, Enhanced KYB, e-IDV Pro database checks, age verification, video KYC, e-signature, crypto wallet screening, Travel Rule and transaction screening |\n| MCP server | `https://ai.shuftipro.com/mcp`, Streamable HTTP, OAuth 2.1 with PKCE and dynamic client registration. 25 tools, 7 knowledge and 18 verification. Scopes `knowledge:read`, `verification:read` and `verification:write` |\n| Credentials | Client ID and Secret Key as HTTP Basic auth, or a Bearer access token from `/get/access/token` valid for one hour. The Secret Key is shown once and regenerated in the back office |\n| Rate limits | 60 requests a minute per IP address on a production account, 20 a minute on a trial account. Shufti says the limits can change and can be raised on request |\n| Callbacks | Sent to a registered `callback_url` with a `Signature` header. Failed deliveries retry automatically, and a callback can be resent by API or from the back office once an hour |\n| Webhook IPs | Two in Europe and four in the United States, listed in the docs |\n| Errors | JSON with an `event` such as `request.invalid` and an `error` object naming the service, the key and a message. HTTP codes 400, 401, 402, 403, 404, 409, 429, 500, 504 and 524 are listed, and decline reasons carry codes such as SPDR370 |\n| Testing | Trial accounts accept published test ID samples for face, document and address checks. The samples do not work on a production account |\n| SDKs | Capture SDKs only. Android 3.0.8 (31 August 2026), iOS 1.3.55, Flutter 1.0.33, React Native 1.1.1 and Cordova. No server-side client library |\n| Retention | Seven years after the services end where the client gives no instruction, per the terms. Records can be deleted by API with a reference and a comment |\n| Certifications | SOC 2 Type II, ISO 27001:2022, PCI DSS, Cyber Essentials Plus and iBeta PAD Level 3 per shuftipro.com/certifications. The Vanta trust centre at trust.shuftipro.com was not read |\n| Status | status.shuftipro.com, hosted by UptimeRobot, with 90-day uptime and an update history drawn by script |\n| Capabilities | kyc.identity, kyc.documents, kyc.business, kyc.screening |\n| Tags | hosted, api-key, oauth, mcp, webhooks, llms-txt, free-tier, no-card, status-page, sla, soc2, iso27001 |\n| JSON | https://www.anchorterminal.com/api/v1/tools/shufti.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-09 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 65 | 13.0 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 58 | 9.4 |\n| Agent ergonomics | 13% | 16.2 | 47 | 7.6 |\n| Security \u0026 auth | 14% | 17.5 | 62 | 10.8 |\n| Payments \u0026 pricing | 10% | 12.5 | 35 | 4.4 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 72 | 6.3 |\n| Transparency \u0026 trust (editorial 51, provenance 90) | 7% | 8.8 | 71 | 6.2 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **57.8 → C** |\n\n### Why each score\n\n- Reliability 65: Graded on the REST API with the hosted lines. A status page at status.shuftipro.com, hosted by UptimeRobot, with 90-day uptime and an update history (20). The page draws its data by script from a path its robots.txt disallows, so no incident record was read and the line takes the no-readable-history score (5). Rate limits are published at 60 requests a minute per IP address for production accounts and 20 for trial accounts (15). A 429 is in the HTTP code table. No Retry-After header, backoff guidance or idempotency key was found. Failed callbacks retry automatically and can be resent by API once an hour (5). Schedule 1 of the public terms targets 99 per cent monthly uptime on a reasonable endeavours basis, with no service credits found (10). The REST API is generally available (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 58: No OpenAPI file or other machine-readable contract was found. Postman collections are linked from the endpoint pages, and the MCP tool schemas sit behind OAuth and were not read (5). llms.txt, a 2.9 MB llms-full.txt and a Markdown twin of every page (10). Each service has a how-it-works page and parameter tables that state purpose, and the MCP tool list gives one line a tool (12). Parameter tables give type, length limits, accepted values and required flags, though most flags are strings holding 0 or 1 and every service shares one endpoint (10). Samples in nine languages, an HTTP code table, an events table, sample responses per event and decline codes per service (13). The API has no version in its URL or headers. The revision history is dated and frequent, and its published page contains unresolved merge conflict markers (8).\n- Agent ergonomics 47: REST responses can't be trimmed by field, and AML and e-IDV responses are long. The MCP server has 25 tools, a knowledge-only scope, and status answers built from a fixed list of fields (12). No endpoint lists verifications, so every read needs a stored reference. Paging was found only on Travel Rule transactions (6). Errors name the service, the key and a message, with HTTP codes and decline codes documented (15). No idempotency key. The caller's `reference` identifies a request and a 409 is listed, but the docs do not say a repeated reference is refused. The MCP delete tool asks for explicit confirmation, and tool annotations were not read (7). A request needs only a reference and one service object, and the MCP server fills defaults and reports them in `defaults_applied`. No server-side SDK in any language (7).\n- Security \u0026 auth 62: The REST API uses one Client ID and Secret Key pair as Basic auth, with no scopes. The secret is shown once and replaced by generating a new one, and a one-hour access token is an alternative. The MCP server adds OAuth 2.1 with PKCE, three scopes, 24-hour access tokens and rotating refresh tokens, though its login page takes the same key pair and stores the secret encrypted (22). MCP scopes are enforced when tools are listed and on every call, the delete tool needs confirmation, callback domains must be registered, and the back office has five preset roles plus custom ones. No read-only REST key (12). MCP status answers leave out extracted document data and the provider payload by design. REST responses carry text read from documents and watchlist hits, with no injection guidance found (7). Callback logs, a login history and an activity log for screening cases. MCP usage records are kept by Shufti and not shown to the operator (9). SOC 2 Type II, ISO 27001:2022, PCI DSS and Cyber Essentials Plus per the certifications page. security.txt returns 404, and no disclosure policy or bug bounty was found (12).\n- Payments \u0026 pricing 35: No x402, MPP or L402 (0). The pricing page gives $0 for Free Forever and a starting price of $1.50 a verification for Essentials, with the rate varying by volume and service and Enterprise quoted. We scored 15 of 20 because only a starting price is public (15). Free Forever covers 10 verifications a month with no card (20). Signup is a browser flow and keys come from the back office. The MCP server's Explore Shufti mode needs no account but reaches only the knowledge tools (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 72: The revision history's newest entry is dated 6 October 2026 (30). It has 19 dated entries between 24 July and 6 October 2026 (20). Closed service with a public revision history, a tech support address and a help desk described in the terms. No public developer forum was found (9). No server appears in the official MCP registry and there is no server-side SDK. The mobile SDKs are current, with Android 3.0.8 dated 31 August 2026 (8). The npm package `shuftipro-onsite-mobilesdk` is at 1.1.2 with 673 downloads in the week to 4 October 2026. CI was not checked (5).\n- Transparency \u0026 trust 71: Closed service with public terms, version 11.1 with effect from 13 May 2026, and every earlier version linked (15). The Services Privacy Notice, version 1.2 of September 2026, sets out processor and controller roles and a retention schedule, and the terms carry a data processing schedule. The terms keep personal data for seven years after the services end where the client gives no instruction, and both documents say Shufti may act as independent controller for model training. The notice's United States section gives twelve months as the default for other verification data, which differs from the terms (22). Deprecations appear in the revision history with dates. Standard KYB was deprecated on 6 October 2026 with its pages removed the same day and no notice period, while the terms promise ten business days' written notice of non-security updates (8). Sub-processors are described by category and the list is given to clients on request. Webhook IP addresses are published for Europe and the United States (6).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (19 items): https://www.anchorterminal.com/fixes/shufti.md (JSON https://www.anchorterminal.com/fixes/shufti.json)\n\n### What we couldn't check\n\n- unchecked: the incident history on status.shuftipro.com, which loads from /api/, a path its robots.txt disallows\n- unchecked: the Vanta trust centre at trust.shuftipro.com, which is drawn by script, so the certification reports and any sub-processor list there were not read\n- unchecked: the MCP tool definitions, annotations and input schemas, which sit behind OAuth. We did not connect to the server\n- unchecked: GitHub stars and the licences of the mobile SDK repositories. The GitHub API refused us for its rate limit\n- Whether clients were told in advance of the 14 September 2026 change that replaced decline code SPDR398 with SPDR370 for United States driving licences. The revision history entry carries the same date as the change, and no deduction was taken\n- Whether a repeated `reference` is refused. A 409 is listed without saying when it is returned\n- The Get Started page says an access token is valid for one hour and can be used once only, and the endpoint page says it applies for one hour. We did not test which holds\n- Whether the Free Forever plan asks for no card at signup. The pricing page says so and we did not sign up\n- The default retention period. The terms say seven years after the services end and the privacy notice's United States section says twelve months\n- The lead named shufti.ai as the vendor URL. It is a parked domain for sale, and the vendor's site is shuftipro.com. The lead also did not mention the MCP server\n- npmWeekly is `shuftipro-onsite-mobilesdk` (28 September to 4 October 2026), a React Native capture SDK, since no server-side package exists\n\n### Sources\n\n- developer docs index (llms.txt): \u003chttps://developers.shuftipro.com/llms.txt\u003e (seen 2026-10-09)\n- full developer docs (llms-full.txt): \u003chttps://developers.shuftipro.com/llms-full.txt\u003e (seen 2026-10-09)\n- get started and authentication: \u003chttps://developers.shuftipro.com/docs/get_started\u003e (seen 2026-10-09)\n- endpoints (status, delete, account info, access token): \u003chttps://developers.shuftipro.com/docs/verification_endpoints/requests\u003e (seen 2026-10-09)\n- responses, HTTP codes, events and signature: \u003chttps://developers.shuftipro.com/docs/verification_endpoints/responses\u003e (seen 2026-10-09)\n- callback logs and resend: \u003chttps://developers.shuftipro.com/docs/verification_endpoints/callback_logs\u003e (seen 2026-10-09)\n- rate limits and webhook IPs: \u003chttps://developers.shuftipro.com/docs/kyc/system_insights_and_request_limits/rate_limiting_and_webhook_ips\u003e (seen 2026-10-09)\n- revision history: \u003chttps://developers.shuftipro.com/docs/revision_history\u003e (seen 2026-10-09)\n- MCP introduction: \u003chttps://developers.shuftipro.com/docs/mcp/intro\u003e (seen 2026-10-09)\n- MCP tools: \u003chttps://developers.shuftipro.com/docs/mcp/tools\u003e (seen 2026-10-09)\n- MCP privacy notice: \u003chttps://developers.shuftipro.com/docs/mcp/privacy-notice\u003e (seen 2026-10-09)\n- MCP OAuth discovery document: \u003chttps://ai.shuftipro.com/.well-known/oauth-authorization-server\u003e (seen 2026-10-09)\n- back office account settings and roles: \u003chttps://developers.shuftipro.com/docs/backoffice/account_settings\u003e (seen 2026-10-09)\n- Android SDK changelog: \u003chttps://developers.shuftipro.com/docs/mobile/changelog/android-changelog\u003e (seen 2026-10-09)\n- pricing: \u003chttps://shuftipro.com/pricing/\u003e (seen 2026-10-09)\n- terms summary page and version list: \u003chttps://shuftipro.com/terms-and-conditions/\u003e (seen 2026-10-09)\n- Terms and Conditions version 11.1 (PDF): \u003chttps://shuftipro.com/wp-content/uploads/Version-11.1-w.e.f.-May-13th-2026.pdf\u003e (seen 2026-10-09)\n- Services Privacy Notice: \u003chttps://shuftipro.com/services-privacy-notice/\u003e (seen 2026-10-09)\n- certifications: \u003chttps://shuftipro.com/certifications.md/\u003e (seen 2026-10-09)\n- status page: \u003chttps://status.shuftipro.com/\u003e (seen 2026-10-09)\n- security.txt (404): \u003chttps://shuftipro.com/.well-known/security.txt\u003e (seen 2026-10-09)\n- npm shuftipro-onsite-mobilesdk: \u003chttps://registry.npmjs.org/shuftipro-onsite-mobilesdk/latest\u003e (seen 2026-10-09)\n- official MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0.1/servers?search=shufti\u003e (seen 2026-10-09)\n- RDAP for shuftipro.com: \u003chttps://rdap.verisign.com/com/v1/domain/shuftipro.com\u003e (seen 2026-10-09)\n- lead URL, a parked domain: \u003chttps://shufti.ai/\u003e (seen 2026-10-09)\n\n## Who's behind it (provenance 90/100, checked 2026-10-09)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Shufti Pro Limited | 20/20 |\n| Domain age | shuftipro.com, registered 2016-06-28 (10 years) | 15/15 |\n| Endpoint on the vendor's domain | api.shuftipro.com | 15/15 |\n| Terms of service | published | 10/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 |\n| Status page | status.shuftipro.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n\nThe terms and the MCP privacy notice name Shufti Pro Limited, Office 408 Coppergate House, 10 Whites Row, London E1 7NF.\n\nThe governing terms are a PDF, version 11.1, linked from shuftipro.com/terms-and-conditions/, which itself carries only a summary and links to every earlier version. The page labels the file 12 May 2026 and the file name says 13 May.\n\nThe privacy link is the Services Privacy Notice, version 1.2, last updated September 2026, which covers verification data. A separate notice covers the website.\n\nshuftipro.com/.well-known/security.txt answered 502 on the first request and 404 on the second.\n\nRDAP for shuftipro.com gives a registration date of 2016-06-28.\n\nThe API answers at api.shuftipro.com and the MCP server at ai.shuftipro.com. The lead's shufti.ai is a parked domain for sale and unrelated to the vendor.\n\nstatus.shuftipro.com is an UptimeRobot page whose data loads from /api/, a path its robots.txt disallows, so the incident history was not read.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://shuftipro.com/wp-content/uploads/Version-11.1-w.e.f.-May-13th-2026.pdf), not read yet.\n\n\n**Privacy policy** (https://shuftipro.com/services-privacy-notice/), read 2026-10-08, dated 2026-09-01, states 8 of the 8 things a reader expects.\n\n- To know. Says it may use customer content to train or improve models, and gives an opt-out. \"Shufti may also act as an independent controller where processing is necessary for model training, fraud prevention, service security and product improvement, as Shufti's Terms explicitly state.\"\n- Gives the date it was last updated. Last updated 2026-09-01.\n- Says how long data is kept. Names a period of 24 months.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Gives a privacy contact. Names a data protection officer.\n- Says where data is transferred or stored. Relies on the Data Privacy Framework.\n- Also in the text (2026-10-08). Data that clients collect and pass to Shufti by API or back office is not used for service improvement or training unless agreed with the client in writing. \"This data is not used for service improvement and training purposes unless otherwise agreed with the client in writing.\"\n- Also in the text (2026-10-08). The one significant decision Shufti says it makes itself is blocking a session for fraud across its platform. \"The one significant decision we make ourselves is blocking a session for fraud across our platform.\"\n\n## Live (updated 2026-10-09 09:27 UTC)\n\n- Right now: up, HTTP 200, 358 ms, checked 2026-10-09 09:27 UTC (get on `https://api.shuftipro.com`)\n- Uptime 24h 100.0% (20 probes) · 30 days 100.0% (20 probes) · p50 311 ms · p95 342 ms\n- Vendor status page: unknown, no machine-readable status found\n- Always current: https://www.anchorterminal.com/api/v1/live/shufti.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Verification, Free Forever plan (document and face checks) | free | per transaction | up to 10 verifications a month, no card |\n| Verification, Essentials plan, starting price | $1.50 | per transaction | rate depends on volume and the services chosen, up to 20,000 verifications |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Free Forever plan of 10 verifications a month with no card, on the production environment, per the pricing page\n- Hosted MCP server at `https://ai.shuftipro.com/mcp` with 25 tools, OAuth 2.1 with PKCE and three scopes enforced on every call\n- Docs published as llms.txt, a 2.9 MB llms-full.txt and a Markdown twin of each page, with samples in nine languages\n- Public terms (version 11.1, 13 May 2026) include an availability schedule targeting 99 per cent monthly uptime\n- Revision history with 19 dated entries between 24 July and 6 October 2026\n\n## Weaknesses\n\n- No OpenAPI file or other machine-readable contract was found. The reference is prose tables plus Postman collections\n- The REST credential is one Client ID and Secret Key pair with no scopes, sent as Basic auth on every call\n- No idempotency key, Retry-After header or backoff guidance was found for the documented 429\n- No server-side SDK. Official packages cover Android, iOS, Flutter, React Native and Cordova capture only\n- Standard KYB was deprecated on 6 October 2026 and its pages removed the same day, with no notice period stated\n- The sub-processor list is available to clients on request only, and security.txt returns 404\n\n## Before you call it (notes for agents)\n\n1. POST every verification to `https://api.shuftipro.com/` with a unique `reference` of 6 to 250 characters and one object per service. Read results from `/status` with that reference\n2. Register the callback domain in the back office first. An unregistered `callback_url` is rejected\n3. Stay under 60 requests a minute per IP on a production account and 20 on a trial account\n4. Check the `Signature` response header. Accounts created after 15 March 2023 hash the Secret Key with SHA-256 before appending it to the raw response\n5. Through MCP, identity checks return a `verification_url` for the person to open. No tool accepts an image, so use the REST API for offsite proofs\n\n## Connect\n\nFirst request:\n\n```bash\ncurl --location --request POST 'https://api.shuftipro.com' \\\n--header 'Content-Type: application/json' \\\n--header 'Authorization: Basic \u003cbase64 of CLIENT_ID:SECRET_KEY\u003e' \\\n--data-raw '{\n \"reference\" : \"1234567\",\n \"callback_url\" : \"https://yourdomain.com/profile/notifyCallback\",\n \"country\" : \"GB\",\n \"language\" : \"EN\",\n \"verification_mode\" : \"any\",\n \"face\" : {\n \"proof\" : \"\"\n }\n}'\n```\n\nClaude Code:\n\n```bash\nclaude mcp add --transport http shufti https://ai.shuftipro.com/mcp\n```\n\nMCP client configuration:\n\n```json\n{\n \"mcpServers\": {\n \"shufti\": {\n \"args\": [\n \"mcp-remote\",\n \"https://ai.shuftipro.com/mcp\"\n ],\n \"command\": \"npx\"\n }\n }\n}\n```\n\nThrough letme (picks today, calling later): https://letme.dev/shufti. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Didit | BB | 75 | 60 | kyc.identity, kyc.documents, kyc.screening, kyc.business | no | https://www.anchorterminal.com/tools/didit.md |\n| Persona | B | 69.5 | 176 | kyc.identity, kyc.business, kyc.documents, kyc.screening | no | https://www.anchorterminal.com/tools/persona.md |\n| Sumsub | B | 68.5 | 200 | kyc.identity, kyc.business, kyc.documents, kyc.screening | no | https://www.anchorterminal.com/tools/sumsub.md |\n| ComplyCube | B | 63.7 | 343 | kyc.identity, kyc.documents, kyc.screening, kyc.business | no | https://www.anchorterminal.com/tools/complycube.md |\n| Socure RiskOS | B | 63.5 | 357 | kyc.identity, kyc.documents, kyc.screening, kyc.business | no | https://www.anchorterminal.com/tools/socure-riskos.md |\n| Trulioo | C | 58.2 | 530 | kyc.identity, kyc.business, kyc.documents, kyc.screening | no | https://www.anchorterminal.com/tools/trulioo.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- A single endpoint, `https://api.shuftipro.com/`, serves every service, and the services wanted are sent as objects in the JSON body (source: \u003chttps://developers.shuftipro.com/llms.txt\u003e)\n- The hosted MCP server lists 25 tools, 7 for product knowledge and 18 for verification, and accepts no document image or selfie (source: \u003chttps://developers.shuftipro.com/docs/mcp/tools\u003e)\n- The MCP privacy notice, version 1.2 of 25 September 2026, says access tokens expire after 24 hours and the Secret Key is stored encrypted until the token record is deleted (source: \u003chttps://developers.shuftipro.com/docs/mcp/privacy-notice\u003e)\n- Production accounts are limited to 60 requests a minute per IP address and trial accounts to 20 (source: \u003chttps://developers.shuftipro.com/docs/kyc/system_insights_and_request_limits/rate_limiting_and_webhook_ips\u003e)\n- Free Forever covers 10 verifications a month with no card, Essentials starts from $1.50 a verification and Enterprise is quoted (source: \u003chttps://shuftipro.com/pricing/\u003e)\n- Standard KYB was deprecated on 6 October 2026 in favour of Enhanced KYB, and its pages were removed (source: \u003chttps://developers.shuftipro.com/docs/revision_history\u003e)\n- The published revision history page contains unresolved merge conflict markers around its 5 and 6 October 2026 entries (source: \u003chttps://developers.shuftipro.com/docs/revision_history.md\u003e)\n- The terms, version 11.1 with effect from 13 May 2026, target 99 per cent monthly uptime and say Shufti may act as independent controller for model training (source: \u003chttps://shuftipro.com/terms-and-conditions/\u003e)\n- The lead URL shufti.ai is a parked domain listed for sale on Spaceship and is not the vendor's site (source: \u003chttps://shufti.ai/\u003e)\n- No Shufti server appears in the official MCP registry (source: \u003chttps://registry.modelcontextprotocol.io/v0.1/servers?search=shufti\u003e)\n\n## Compare\n\n- [ComplyCube vs Shufti](https://www.anchorterminal.com/compare/complycube-vs-shufti.md): B 63.7 vs C 57.8\n- [Didit vs Shufti](https://www.anchorterminal.com/compare/didit-vs-shufti.md): BB 75 vs C 57.8\n- [Jumio vs Shufti](https://www.anchorterminal.com/compare/jumio-vs-shufti.md): C 55 vs C 57.8\n- [Persona vs Shufti](https://www.anchorterminal.com/compare/persona-vs-shufti.md): B 69.5 vs C 57.8\n- [Shufti vs Socure RiskOS](https://www.anchorterminal.com/compare/shufti-vs-socure-riskos.md): C 57.8 vs B 63.5\n- [Shufti vs Sumsub](https://www.anchorterminal.com/compare/shufti-vs-sumsub.md): C 57.8 vs B 68.5\n- [Shufti vs Trulioo](https://www.anchorterminal.com/compare/shufti-vs-trulioo.md): C 57.8 vs C 58.2\n- [Shufti vs Veriff](https://www.anchorterminal.com/compare/shufti-vs-veriff.md): C 57.8 vs C 61.1\n- [ComplyAdvantage vs Shufti](https://www.anchorterminal.com/compare/complyadvantage-vs-shufti.md): D 52.6 vs C 57.8\n- [Middesk vs Shufti](https://www.anchorterminal.com/compare/middesk-vs-shufti.md): C 59 vs C 57.8\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on shuftipro.com or one of its subdomains, or the README of github.com/shuftipro/iOS-SDK. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"shufti\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/shufti\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/shufti.svg\" alt=\"Shufti on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Shufti on Anchor Terminal](https://www.anchorterminal.com/badges/shufti.svg)](https://www.anchorterminal.com/tools/shufti)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/shufti\"\u003eShufti on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Shufti is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/shufti-dark.png\n- Light: https://www.anchorterminal.com/assets/share/shufti-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Identity \u0026 business verification", "url": "https://www.anchorterminal.com/categories/identity-verification" }, { "name": "Shufti", "url": "" } ], "description": "Identity and business verification service from Shufti Pro Limited in London. One REST endpoint runs document, face, address, AML screening and KYB checks chosen in the request body, with results by callback. A hosted MCP server exposes 25 tools.", "facts": [ "rank #538 of 842", "OAuth or key auth", "0 desk reviews" ], "h1": "Shufti", "image": "https://www.anchorterminal.com/assets/og/tools-shufti.png", "path": "/tools/shufti", "published": "2026-10-01", "section": "tools", "title": "Shufti review for AI agents, grade C (57.8/100) | Anchor Terminal", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/tools/shufti" }, "tokens": { "markdown": 7750, "slim": 1930 }, "version": 1 }