# Use Comms.ID from an AI agent with MCP

`https://mcp.comms.id` is a hosted [Model Context Protocol](https://modelcontextprotocol.io) server. It gives an agent one tool for each hosted operation, named `<product>.<operation>` (for example `address.suggest`, `abn.lookup`, `sanctions.screen`). A tool has the same input, reply and errors as the operation in the product's API. `https://mcp.comms.id/test` is the same server for the TEST service (synthetic replies, development keys).

## Credentials

Each tool call runs as your registered app, with your app's own key. The server holds no key and keeps no session. The MCP client sends one header for each product, `X-Comms-ID-Token-<product>`, with a token that your key signed for that product. `npx comms-id token mcp` prints these headers as one JSON object; each token lasts ten minutes at most. Reconnect the client to get new tokens. A call without the product's header returns the tool error `UNAUTHORIZED`, before Comms.ID calls the product.

The calls count against your app's fair-use ceiling for each product, as direct calls do.

## Connect Claude Code

Put this file in your project as `.mcp.json`. The development key in `.env.local` (from `npx comms-id init`) signs the tokens:

```json
{
  "mcpServers": {
    "comms-id": {
      "type": "http",
      "url": "https://mcp.comms.id/test",
      "headersHelper": "npx comms-id token mcp --env test"
    }
  }
}
```

For LIVE, change the URL to `https://mcp.comms.id` and remove `--env test`. Run it where the production key is available; the production key never goes in `.env.local`.

Another MCP client that can send fixed headers can use the output of `npx comms-id token mcp`, but it must replace the headers before they expire.

## Limits

- The server is Streamable HTTP without sessions: one JSON-RPC message for each POST and one JSON reply. It does not open an event stream (a `GET` returns `405`).
- A request from a web page (with an `Origin` header) is refused with `403`, because the tokens are in the headers.
- A message is at most 64 KB. A call that gets no answer from the product in 30 seconds returns the tool error `UNAVAILABLE`.
- Only the hosted read operations are tools. Local functions (for example ABN checksum validation) are in the npm packages and the CLI.