CorroborateMe

Install

Works with Claude Code, VS Code, Cursor, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install connector/cnrcode-com-corroborateme

About

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list, install config and code. Checked Oct 26, 2026.

Tools

4 read · 8 write · 2 delete

Secrets

1 (API keys, tokens or passwords)

Install scripts

Nothing to install (hosted)

Runs as

Hosted (remote endpoint)

Tools (14)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

• agent_bootstrapBootstrap company (email OTP)

  Start zero-human company onboarding from a contact email. Does not charge or create a company. Step 1: call with contact_email. The result has verificationRequired=true and a 6-digit code is emailed (10 minutes, single use). Step 2: call again with contact_email and code. Returns bootstrapToken, expiresIn (~15 minutes), and next billing paths. When you have no aa_ key yet, use REST POST /api/agents/bootstrap instead: MCP requires Authorization Bearer aa_... or an MCP OAuth access token before any tool runs. After bootstrap, POST /api/billing/machine-pay (or billing_machine_pay / billing_checko…

• billing_checkoutStart Pro checkout

  Create a Stripe Checkout session for the authenticated company so a human can subscribe to Pro. Requires a company API key (aa_...) or an MCP OAuth access token. It does not accept a console session or a bootstrap token, and it does not mint a company or an aa_ secret. Returns url. Creating the session does not charge a card; the human pays on the Stripe page. When local billing bypass is enabled, there is no Stripe call and no charge: Pro is granted immediately with no period end, and url is the console success URL (/console?billing=ok), not a Stripe Checkout URL. If Stripe is not configured …

• billing_machine_payShow prepaid Pro instructionsread-only

  Return prepaid Pro purchase instructions. This tool does not charge a card, grant Pro, or return an aa_ secret. MCP requires a company API key (aa_...) or an MCP OAuth access token; a bootstrap token is not accepted on this call. Optional sku defaults to pro_prepaid_30d. On success, returns sku, amount (the live price), currency, periodDays, mppConfigured, action (POST /api/billing/machine-pay), agentSkus, and instructions. If MPP is not configured and local billing bypass is off, returns an error with code mpp_not_configured and does not grant Pro. An unknown sku returns invalid_sku. The REST…

• billing_portalCreate billing portal URL

  Create a billing portal URL for the authenticated company. Use this when a human needs to update a payment method, view invoices, or change an existing subscription. Requires a company API key (aa_...) or an MCP OAuth access token. Returns url when Stripe is configured and the company has a Stripe customer. The call itself does not change the plan or charge a card. When local billing bypass is enabled, Stripe is not called and url is the console URL. If Stripe is not configured or the company has no Stripe customer, the JSON includes error stripe_not_configured. To buy Pro, use billing_checkou…

• budget_getRead company budgetread-only

  Read remaining quotas and plan entitlement for the authenticated company. Call this when you need to know whether an active plan is in effect before registering OIDC clients or creating login links. Minting an API key does not require an active plan. Requires a company API key (aa_...) or an MCP OAuth access token. Returns planId, planStatus, periodYm, included, used, remaining, and hardCap. It does not change billing or charge a card. To start a human Pro checkout, use billing_checkout. billing_machine_pay only returns prepaid REST instructions. To manage an existing Stripe subscription, use …

• create_login_linkCreate login link

  Mint a one-time human login URL and session id so you can prove an end user. Call webhook_allowlist_add first when using webhook, redirect, or form_post. Requires a company API key (aa_...) or an MCP OAuth access token and an active plan. A missing subscription returns an error result with code subscription_required (meter status 402). Exhausted quota returns code quota_exceeded (meter status 429). Too many creates can return code rate_limited. Returns ok, sessionId, loginUrl, expiresAt, methods, alwaysOn, and forceReauth. poll and sse are always included. Optional methods are webhook, redirec…

• get_login_statusPoll login statusread-only

  Poll one login-link session until the human finishes, and read any notify errors. Use this after create_login_link, passing that call's sessionId as session_id. Requires a company API key (aa_...) or an MCP OAuth access token. Returns id, status, state, user_id, email, claims, expires_at, completed_at, force_reauth, reuse_session, methods, notify_result, errors, poll, sse, and events_url. status is pending, completed, consumed, or expired. There is no done status. user_id (cu_...) and email are present when the person has finished and null while pending. A missing session returns null. It does…

• integration_listList integrationsread-only

  List this company's stored integrations. Use this to see which providers are configured before calling integration_upsert. Requires a company API key (aa_...) or an MCP OAuth access token. Returns a JSON array of id, provider, label, secret_prefix, meta, created_at, and rotated_at. Full secrets are never included. The call does not modify stored secrets.

• integration_upsertStore integration secretcan change or delete data

  Store or replace an encrypted integration secret for a provider such as Google or Apple. Use this before login-link social sign-in needs that provider's credentials. Requires a company API key (aa_...) or an MCP OAuth access token and an active plan. Returns id and prefix (first four and last four characters of the secret). The full secret is not returned. The value is encrypted at rest. A later upsert with the same provider and the same label replaces that stored secret. A different label inserts another row. Each successful call consumes integration quota, including a repeat with the same se…

• keys_createMint API key

  Mint an additional company API key. The full secret is returned once (only a hash is stored) and cannot be fetched again. An active plan is not required. Requires a company API key (aa_...) or an MCP OAuth access token. Returns id, secret, and prefix. Creating a key can be rate limited. Optional name is only a label. When name is omitted, the stored label is mcp.

• oauth_client_createRegister OIDC client

  Register an OIDC relying-party client that uses CorroborateMe as the identity provider, with RP-initiated logout enabled. Use this for your app's own OIDC login. MCP hosts connect through protected-resource metadata and dynamic client registration, not this tool. Requires a company API key (aa_...) or an MCP OAuth access token and an active plan. Returns clientId and, for a confidential client, clientSecret once (the secret prefix is aas_, not aa_). A missing subscription fails the tool with message subscription_required. Exhausted quota fails with message quota_exceeded. Too many registration…

• oauth_client_revokeRevoke OIDC clientcan change or delete data

  Soft-revoke an OIDC relying-party client for the authenticated company. Use this when an app should no longer authorize or refresh tokens. Sets revoked_at, disables the Better Auth oauthClient, and stamps outstanding access/refresh tokens revoked. Requires a company API key (aa_...) or an MCP OAuth access token. Returns ok true when the client was revoked. Missing or already-revoked clients return an error result with code not_found. This does not delete the row; list via REST GET /api/oidc/clients still shows revoked clients. REST equivalent: POST /api/oidc/clients/{clientId}/revoke.

• retry_login_webhookRetry login webhook

  Send the signed login webhook again for a session that already used the webhook method. A prior delivery failure is not required. The session must be completed or consumed. Delivery already tries up to 3 times (immediately, then after 500ms, then after 2000ms) on HTTP 408, 429, 5xx, and network errors, and it does not retry other 4xx responses. Call this for a further attempt. Requires a company API key (aa_...) or an MCP OAuth access token. Pass the sessionId from create_login_link as session_id. It POSTs the signed JSON again to the session webhook URL. The hex SHA-256 HMAC of the raw body i…

• webhook_allowlist_addAllowlist callback prefix

  Allow a callback URL prefix for later login-link notify. Call this before create_login_link when methods include webhook, redirect, or form_post. Requires a company API key (aa_...) or an MCP OAuth access token. Pass url_prefix, at least 4 characters, for example https://hooks.example.com/ or cursor://. Returns ok true. Adding the same prefix again has no further effect. A shorter prefix returns ok false with code invalid_prefix. Callbacks outside an allowlisted prefix make create_login_link return an error with code not_allowlisted, or allowlist_empty when no prefix is stored. This call does …

Signals

Stars

1

Forks

0

Open issues

1

Last commit

Oct 22, 2026 (7 days ago)

Last release

Oct 22, 2026 (7 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name

com.cnrcode/corroborateme

Version

0.1.4

Auth

Bearer token

License

MIT

Repository

github.com/CNR-Consulting/corroborate-me

Website

corroborateme.com

First seen

Oct 24, 2026

Last checked

Oct 25, 2026

Source

Official MCP Registrygithub-graphql