Resources & prompts
The four MCP resources the model can pull as context for free, and the five packaged prompt workflows — morning triage, send and track, chase stalled, monthly compliance report, and investigate case.
Tools do work. Resources are context the model can read without spending a tool call, and prompts are the operating procedure an experienced compliance officer would follow, packaged so the model does not have to invent one.
Resources
Four are registered. Three are static or catalogue-shaped; one is a template addressed by request ID.
| URI | What it is | Reach for it when |
|---|---|---|
certivant://vocabulary | The exact enum values the platform uses — verification statuses (including EXPIRED and PENDING_SECOND_REVIEW), request types, scorer decisions, check types and statuses, risk bands, form-delivery states, and API-key scopes, each with its meaning. | Always, before filtering or describing a case. It is why an assistant says PENDING_SECOND_REVIEW instead of inventing "awaiting approval" — and why a filter value is accepted rather than 400'd. |
certivant://policies | How verifications are decided: policy versioning, the approve/escalate/reject actions, tier-1 disqualifier and document-date gates, fail-closed sanctions screening, four-eyes dual approval, and expiry. | Explaining how the system decides, as opposed to what it decided in one case. It states plainly which per-tenant values it cannot see, so configured thresholds are never guessed at. |
certivant://forms | Every verification form in the organization, marked with which are published and therefore sendable. | Picking a form before sending. Same data as list_verification_forms, available as context rather than a call. |
certivant://verification/{id} | One request as addressable context: status, scorer decision, score, expiry, and whether structured reasoning was recorded. Verdict-shaped, no personal data. | Attaching a specific case to a conversation. Needs an exact request ID — deliberately not listable, so an assistant cannot enumerate your book of business through it. Use find_verification if you only have a name. |
Prompts
Five workflows. Each one fixes an order of operations, because the sequence is usually the difference between a useful answer and a rate-limited data dump.
morning_triage
Walks the queue and groups every case by what it needs — needs a human
decision now, needs a nudge, needs nothing, needs a diary entry — rather than by
status. Optional stalled_days argument, default 7.
Explicitly read-only: it proposes reminders, it does not send them. It also
instructs the model to write "reasoning not recorded" wherever
reasoningAvailable is false rather than inferring a rationale.
send_and_track
Picks the right form, sends it to a named customer, and reports where every
recipient of that form now stands. Optional recipient argument; leave it empty
to only report on existing sends.
This one sends real email. The workflow confirms first — it states the exact form name, recipient address, and recipient name and waits for a clear yes, because a typo in an address sends someone else's verification link to a stranger.
It splits the result into "responded", "sent and silent", and "undeliverable", which are three different actions.
chase_stalled
Everyone stuck beyond N days (optional days argument), with reminders drafted
and sent after confirmation. The useful part is that it names the specific
outstanding document — "we still need the back of your driving licence" gets
done where "please complete your verification" gets ignored.
monthly_compliance_report
Board-ready: the metrics, the themes, and the notable cases for a period
(optional period argument). Bounded by what get_compliance_metrics actually
produces — check-failure rates, not a ranked list of rejection reasons.
investigate_case
One review note for a single case (optional request_id; if you have only a
name, it is told to use find_verification rather than guess an ID). It pulls
the decision, the documents, and — for a business — the registry diff, reading
the disagreement rather than the registry record.
Where the scorer's decision and the recorded status diverge, it reports both and names the human who decided, instead of reconciling them into one tidy narrative. The divergence is the finding.
Tool reference
All 26 Certivant MCP tools grouped by the job they do — queue triage, sending and tracking forms, lifecycle actions, decision explanation and network risk, live ID verification sessions, KYB registry checks, and reporting — with what each returns and what it deliberately does not.
Safety & limits
How the Certivant MCP server tiers PII, wraps applicant-controlled text in an untrusted envelope, throttles reminders at 24 hours, and shares your 120/min per-tenant rate limit — plus the audit gap you must not paper over.