BR ticketing-native fraud prevention (formerly Inspetor, São Paulo). 4th fraud entry. Order evaluation + Collection API for events/accounts/auth tracking. Alpha on npm — public docs thinner than ClearSale/Konduto; tool shapes match docs-backend repo.
Legiti gives your agent 18 tools it calls directly — pick the ones it needs, in Claude, Cursor, or any MCP client.
evaluate_order — Submit an order to Legiti for real-time fraud evaluation via the v2 order endpoint. Returns a decision (approve / reject / manual) synchronously — response may take up to ~20s. Include as much context as possible: account, payment (tokenized card bin+last4), CPF, billing/shipping, and for ticketing flows the event_date_id / sale_items.update_order — Notify Legiti of a status change on an existing order (e.g. payment captured, shipped, cancelled, refunded). Feeds the ML model — required for ongoing decision quality. Use mark_order_fraudulent for confirmed chargebacks instead.mark_order_fraudulent — Report a confirmed chargeback / fraud outcome back to Legiti. This is Legiti's primary ML feedback channel — unreported chargebacks degrade future decision quality for similar buyers. Call this after the issuer confirms the chargeback, not on mere suspicion.// Your agent calls a tool directly — no glue code.
// CodeSpar's managed tier handles OAuth2, token rotation and rate limits.
const result = await session.call("evaluate_order", { /* ... */ });$ npm install @codespar/mcp-legiti@alphaAdd this entry to your claude_desktop_config.json (or any MCP-compatible client config).
{
"mcpServers": {
"legiti": {
"command": "npx",
"args": [
"-y",
"@codespar/mcp-legiti@alpha"
],
"env": {
"LEGITI_API_KEY": "<your_legiti_api_key>"
}
}
}
}After restart, your agent can call any of the 18 tools below — try evaluate_order first.
Required to authenticate the server. Stored encrypted when using CodeSpar managed hosting.
LEGITI_API_KEYLegiti API key (JWT-format bearer token). Use the sandbox key while testing — Legiti trains its ML models on every request, so test data hitting a production key pollutes the model.
LEGITI_BASE_URLLegiti API base URL. Defaults to https://collection-prod.inspcdn.net. Legiti issues customer-specific base URLs — override per contract.
Each tool is independent — your agent loads only what it needs to reduce context and response time.
evaluate_orderupdate_ordermark_order_fraudulentevaluate_saletrack_accounttrack_eventtrack_saletrack_authMCP is a protocol — any framework that speaks it can mount this server.