# mcp-sift

An MCP server that wires your agent into Sift, so events, ML scores and fraud decisions happen from the chat.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 274
- Author: codespar
- License: MIT · policy=link-only · description only; the file stays with the author
- Source: https://github.com/codespar/mcp-dev-latam/tree/HEAD/packages/fraud/sift
- Updated: 2026-09-27
- HTML: https://affpapa.org/en/nevibecode/mcp/mcp-sift

## What it does

Twenty tools cover the three Sift APIs. The Events API takes every signal you care about — signup, login, order, chargeback — as a `$`-prefixed event. The Score API returns the latest ML score for a user as a float between 0 and 1, split by abuse type: `payment_abuse`, `account_abuse`, `content_abuse`, `promotion_abuse`. Decisions API v3 turns those scores into workflow outcomes such as `block_user_payment_abuse` or `approve_order_payment_abuse`.

Common events have their own wrappers: `send_login`, `send_logout`, `send_chargeback`, `send_content_status`, `link_session_to_user`, plus `send_custom_event` for merchant-defined types. You can force a rescore with `rescore_user`, and handle manual review by labelling a user or clearing the label. Decisions apply to users, orders, sessions and content items; a separate call reads the status of a workflow run.

Two variables are required: `SIFT_API_KEY` and `SIFT_ACCOUNT_ID`, the latter for every Decisions API v3 call. `SIFT_BASE_URL` is optional and falls back to `https://api.sift.com`. Pass the raw key — the server injects `$api_key` into the Events API body itself and base64-encodes it for HTTP Basic on the Score and Decisions calls, with an empty password. The package ships as `0.1.0-alpha.1`, and its endpoint paths were checked against Sift's official Ruby SDK.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `SIFT_API_KEY`, `SIFT_ACCOUNT_ID`, `SIFT_BASE_URL` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env SIFT_API_KEY=<SIFT_API_KEY> --env SIFT_ACCOUNT_ID=<SIFT_ACCOUNT_ID> --env SIFT_BASE_URL=<SIFT_BASE_URL> --transport stdio sift -- npx -y @codespar/mcp-sift
```
Replace <…> with your own values

### Codex

**Platform CLI**
```bash
codex mcp add sift --env SIFT_API_KEY=<SIFT_API_KEY> --env SIFT_ACCOUNT_ID=<SIFT_ACCOUNT_ID> --env SIFT_BASE_URL=<SIFT_BASE_URL> -- npx -y @codespar/mcp-sift
```
Replace <…> with your own values

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "sift": {
            "command": "npx",
            "args": [
                "-y",
                "@codespar/mcp-sift"
            ],
            "env": {
                "SIFT_API_KEY": "<SIFT_API_KEY>",
                "SIFT_ACCOUNT_ID": "<SIFT_ACCOUNT_ID>",
                "SIFT_BASE_URL": "<SIFT_BASE_URL>"
            }
        }
    }
}
```
Replace <…> with your own values

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "sift": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@codespar/mcp-sift"
            ],
            "env": {
                "SIFT_API_KEY": "<SIFT_API_KEY>",
                "SIFT_ACCOUNT_ID": "<SIFT_ACCOUNT_ID>",
                "SIFT_BASE_URL": "<SIFT_BASE_URL>"
            }
        }
    }
}
```
Replace <…> with your own values

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e SIFT_API_KEY=<SIFT_API_KEY> -e SIFT_ACCOUNT_ID=<SIFT_ACCOUNT_ID> -e SIFT_BASE_URL=<SIFT_BASE_URL> sift npx -y @codespar/mcp-sift
```
Replace <…> with your own values

## When to use it
- push a signup or login signal into Sift
- read a user's ML score for one abuse type
- apply a workflow decision to an order or session
- label a user as fraud after manual review
- report a confirmed chargeback as an event

## Example prompts
- Send a `$login` event to Sift for the user from the last test run
- Show me the current `payment_abuse` score for this user
- Apply the `block_user_payment_abuse` decision to this order

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

From the same set: [codespar/mcp-dev-latam](https://affpapa.org/en/nevibecode/by/codespar/mcp-dev-latam.md) — 124 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md