Every change Wellknown observed on this MCP server, newest first, with what it was before and what it became. Tool-surface changes carry the definition diff. Nothing here is edited after the fact.
Added "kya_person_agents", "kya_principal_match" and "kya_sign_link"; changed the definition of "kya_check_action" and "kya_register" (12 tools before, 15 now)
Signed verdict: is this action (action, amount, currency, counterparty, payment instrument) inside the agent's mandate and is the ⟨14 unchanged words⟩
⟨76 unchanged words⟩ "maxLength":12,"type":"string"},"payment_network":{"description":"Payment network or rail of this operation: visa, mastercard, elo, pix, ...","maxLength":32,"type":"string"},"payment_ref_sha256":{"description":"SHA-256 hex of the payment token reference or PAR used (never a card number); checked against mandate.payment_instruments.","pattern":"^[0-9a-fA-F]{64}$","type":"string"},"spent_today":{"description":"What this agent already ⟨18 unchanged words⟩
⟨75 unchanged words⟩ ,"cnpj":{"description":"The company's CNPJ,with(companyoragents).withoutLeavepunctuation.out with principal \"person\".","maxLength":18,"minLength":14,"type" ⟨20 unchanged words⟩ type":"string"},"type":"object"}},"requiredprincipal":[{"description":"\"person\": the agent acts for a natural person who signs with an e-CPF (no CNPJ; no name or CPF is ever published).","cnpjenum":["company","person"],"type":"string"}},"required":["agent","mandate"],"type":"object"}
Free, person only: every live credential behind your e-CPF and every CPF check made against each one. Sign "KYA Brasil: my agents\nat: <ISO time>" with the e-CPF (valid 10 minutes).
Signed answer ($0.01) for a person's agent (principal.kind person): does the CPF you already have match the e-CPF holder behind it? On a match, a subject_ref of your own for that person (stable for you, different for every verifier). The CPF is never stored, published or revealed; 3 non-matching answers per credential stop your checks. The person sees every check.
Free. Link for whoever holds the company's e-CNPJ (owner, accountant): give challenge_id and the agent's signature, get the /sign URL. They see agent, company and mandate and sign in the browser (A1 .pfx) or with any ICP-Brasil signer (A3 token, cloud), or run kya-sign (npm @kya-brasil/agent-tools) with the link. The issuer never sees the certificate.
Certificate recorded, valid to 2026-12-13
Authorization not required
Changed the definition of "kya_verify"
⟨6 unchanged words⟩ agent's current credential: principal company, mandate,informative KYB snapshot,status (active, suspended, revoked, expired) and ⟨5 unchanged words⟩
Added "kya_company_agents" and "kya_company_webhook"; removed "kya_act", "kya_act_text", "kya_acts_export" and 1 more; changed the definition of "kya_prove", "kya_register", "kya_renew" and 2 more (14 tools before, 12 now)
⟨12 unchanged words⟩ against ICP-Brasil roots, the CNPJ must match,KYBtheBrasilcertificate mustclearnot be revoked (CRL) and thecompany;company must be ATIVA; then the credential is issued (90 days, Ed25519-signed).
Unknown → Live
First tool surface recorded: 14 tools (server version 0.3.0)
https://kya-br-agents.marcelfons.workers.dev/mcp (mcp_streamable_http) — from mcp_registry, with the record
Showing the latest 8 events. The API returns up to 500 and filters by kind: ?kind=tool_surface_changed
⟨42 unchanged words⟩ its e-CNPJ (CMS/PKCS#7). Price covers theKYB checkchecks at issuance.
Re-issue the credential for 90 moredaysdays.ifTheKYBcompanyBrasilsignsstilltheclearsrenewalthechallengecompany.withTheancompanye-CNPJsignsin force (not revoked); therenewalcompanychallengemustwithstillitsbee-CNPJ.ATIVA at the Receita.
⟨12 unchanged words⟩ the credential is re-issued for 90 days ifKYBtheBrasile-CNPJstillisclearsnot revoked and thecompany.company is still ATIVA.
⟨6 unchanged words⟩ agent's current credential: principal company, mandate, informative KYB snapshot, status (active, suspended, revoked, ⟨7 unchanged words⟩
Free, company only. Every credential ever registered for your CNPJ, any status, whoever held the certificate (an accountant, another employee). Request signed with your e-CNPJ over "KYA Brasil: agents <cnpj>" + "at: <ISO time>".
Free, company only. Sets the https URL that receives signed events about your agents: credential issued, renewed, suspended, reinstated, revoked. Request signed with your e-CNPJ; url "-" removes it.
Free. A registered act and its signed receipt, by act_id (the receipt holder has it).
Free. The exact text an agent signs to show it intended an act (optional agent_signature of kya_register_act).
Free. The company's trail of everything registered for one of its agents (default 30 days). The request is signed with the company's e-CNPJ, so only the principal reads it.
Register what the agent did (action, amount, currency, counterparty, reference, optional document hash and agent signature), usually by the party that accepted it. The issuer checks it against the mandate, adding what was already registered today, and returns a signed receipt. Denied acts are recorded too. The receipt is the proof of what the agent could and did do at that moment.