Use Comms.ID from an AI agent with MCP

https://mcp.comms.id is a hosted Model Context Protocol server. It gives an agent one tool for each hosted operation, named <product>.<operation> (for example address.suggest, abn.lookup, sanctions.screen). A tool has the same input, reply and errors as the operation in the product’s API. https://mcp.comms.id/test is the same server for the TEST service (synthetic replies, development keys).

Credentials

Each tool call runs as your registered app, with your app’s own key. The server holds no key and keeps no session. The MCP client sends one header for each product, X-Comms-ID-Token-<product>, with a token that your key signed for that product. npx comms-id token mcp prints these headers as one JSON object; each token lasts ten minutes at most. Reconnect the client to get new tokens. A call without the product’s header returns the tool error UNAUTHORIZED, before Comms.ID calls the product.

The calls count against your app’s fair-use ceiling for each product, as direct calls do.

Connect Claude Code

Put this file in your project as .mcp.json. The development key in .env.local (from npx comms-id init) signs the tokens:

{
  "mcpServers": {
    "comms-id": {
      "type": "http",
      "url": "https://mcp.comms.id/test",
      "headersHelper": "npx comms-id token mcp --env test"
    }
  }
}

For LIVE, change the URL to https://mcp.comms.id and remove --env test. Run it where the production key is available; the production key never goes in .env.local.

Another MCP client that can send fixed headers can use the output of npx comms-id token mcp, but it must replace the headers before they expire.

Limits

The server is Streamable HTTP without sessions: one JSON-RPC message for each POST and one JSON reply. It does not open an event stream (a GET returns 405).
A request from a web page (with an Origin header) is refused with 403, because the tokens are in the headers.
A message is at most 64 KB. A call that gets no answer from the product in 30 seconds returns the tool error UNAVAILABLE.
Only the hosted read operations are tools. Local functions (for example ABN checksum validation) are in the npm packages and the CLI.