MCP
AI-assisted fraud & geo-compliance investigations
A day’s worth of investigations, answered in minutes.
Connect your AI tools to the GeoComply signals already firing in your stack, and your team investigates with the reach of a whole data team behind them. Then, just ask. Get a verdict, the evidence behind it, and the method that got there.
Map the network around this device, two hops deep.
One ring, not two clusters.
Network mapped8 accounts across 2 devices. USER-1 bridges both, which is what joins them into a single network.
Investigate device 20003 over the last 90 days. Is it shared, and is it blocked?
Critical risk, high confidence.
BlockedThe device is blocked, shared across 6 accounts, and all 165 checks in the window failed.
Here are 9 flagged accounts. Check each for device sharing and flag anything blocked.
All 9 came back in one pass.
2 surfacedSix share a single blocked device, and two accounts you did not submit were pulled in because they share a device with the set. The ring is bigger than your list.
What can you ask it?
From one question to a decision you can defend.
Close a case with one question.
Investigate this user over the last 90 days.
High risk, high confidence. The account is not blocked on its own, but it sits on a device shared with 7 other accounts, one device in its history is already blocked, and all 400 of its checks failed. The risk is the company it keeps.
- high 0.65
- device shared x7
- 1 blocked device
- 400 of 400 failed
Are these accounts one ring, or a coincidence?
Three separate devices, each on its own account, all three currently blocked. No shared device between them in 90 days, so this reads as three flagged accounts, not one ring.
- 3 devices
- 3 blocked
- no shared device
Pull the numbers without opening a dashboard.
Break down why non-compliant checks failed this month.
2,362 failures, ranked by reason. Device integrity leads at 28%, followed by outside allowed area and missing location data, with location jumping (impossible travel) fourth. Ordered by how often each fired.
- 2,362 failures
- device integrity 28%
- ranked
Were there any high-risk location (FATF) attempts in the last 7 days?
214 attempts from FATF-listed zones in the last 7 days, from 63 users on 71 devices. GeoComply blocked all 214, and none passed inside a zone.
- 214 of 214 blocked
- 0 passed in-zone
- spike Sep 24
Answer "why did this fail" without raising a ticket.
Why did this check fail? It fired proxy, boundary, and mocked location.
Three rules fired, all user-fixable, none need escalation. Each comes back with the cause and the exact fix.
- 3 rules
- all user-fixable
- no escalation
A customer is stuck at verification. What happened on their identity checks?
The knowledge-based questions failed, but the check failed over to document verification and cleared. Verified overall, with the KBA failure worth noting.
- KBA failed
- failover passed
- verified overall
Not every question is a fraud question.
How does game day change activity around our venues?
Geolocation activity around venues climbs sharply on game day, roughly 8x more checks than a quiet period, concentrated around kickoff. Useful for planning coverage when volume spikes.
- ~8x checks
- game-day peak
- plan for volume
How does activity compare across the areas we cover?
Activity concentrates where you have a local presence and is lighter elsewhere. Knowing where volume sits helps you see where checks cluster.
- activity by area
- coverage planning
- where volume sits
Watch the GeoComply MCP and Claude work a fraud case, start to finish.
Book a demoWhat teams are asking
Every desk gets an answer.
Analysts, support reps, and leadership just ask.
- Investigate this user and show me everything connected to them.
- Is this device on a VPN, or is the location actually being spoofed?
- Has this device been blocked before, and why?
- Give me a daily fraud briefing.
- What are the top failure reasons our users hit in the last two weeks?
- Pass rates by operator for the last 7 days.
- Why did this check fail?
- What does this error code mean?
- Show me every account that touched this device in the last 60 days.
- Which users were active inside this geohash last month?
- Map the network around this device, two hops deep.
- Here are 50 usernames. Check each for device sharing and flag anything blocked.
- What happened on this customer's identity checks?
- How many checks landed inside our exclusion zones last week?
- Compare these two users. Do they share anything?
- Which playbooks do I have access to?
- Break down our compliance failures for this month.
- Summarize this investigation into a report I can hand off.
- Walk me through an account takeover investigation on this user.
- Pull the full transaction profile for this transaction ID.
- Investigate this user and show me everything connected to them.
- Why did this check fail?
Inside the GeoComply MCP
One connection. Serious investigation horsepower.
Steer the analysis in plain language. Open a category to see the tools under the hood.
Is AI fraud investigation explainable?
The decision always stays yours.
What your analyst can defend
-
Signals in, decisions yours
The MCP reports state, it does not change it.
-
Same baseline every time
The same scoring runs every time.
-
Shows its working and its limits
Each verdict arrives with the signals behind it.
What stays separate
-
Your own credentials, enforced twice
Every call is signed with your organization's own credential.
-
Permissions you already set
Analysts inherit the grant they already hold, through single sign-on.
-
Nothing new without your sign-off
Per-organization tool allowlists cap the set any caller can reach.
Ready to put it in front of your analysts?
Book a demoFAQ
-
The GeoComply MCP is a remote server that connects an AI assistant to your GeoComply location, device, and identity data, so your team can run fraud and compliance investigations by asking in plain language. MCP, or Model Context Protocol, is an open standard from Anthropic that lets an assistant use an outside system as a tool. Ask a question, and the investigation comes back assembled: linked accounts, failed checks, and a scored verdict with the evidence behind it.
-
Claude, ChatGPT, Copilot, and other AI assistants your team already uses. It is built on an open standard, so any assistant that speaks MCP can connect, and your own agent can reach the same endpoint machine to machine. Bring the AI you already have.
-
Yes, and it is enforced in two places, not one. Every call is scoped to the operators your organization is entitled to, and the platform underneath enforces that scope again using your organization's own credential. An organization without a credential record gets nothing rather than borrowing another organization's access.
-
Every call is attributed to the analyst or agent that made it, and an agent's activity is distinguishable from a person's. Requests are scoped to your existing permissions on the way in, so the record shows who asked, what they asked, and which operators they were entitled to see.
-
No. The verdicts and the spoofing analysis come from GeoComply's own models, not the assistant's reasoning. The assistant calls a tool and returns what came back, with the evidence attached, and it says when a verdict is resting on thin evidence rather than filling the gap.
-
Neither. It reads and reports, it does not act. A verdict is evidence for your analyst, and case actions still happen wherever you manage cases today.
-
Location, device, and behavioural signals, the account's own check history, and the accounts and devices connected to it. No single input decides a verdict on its own, and a low-risk result means nothing was found in what was examined, which is not the same as nothing being there.
-
Point your agent at the endpoint and it authenticates as itself, machine to machine. It can also run as a named analyst, scoped to that person's own permissions rather than your organization's full reach. Either way the call is scoped and attributed the same way an analyst session is.
-
Minutes on your side, once we have provisioned your organization. Your org admin adds the connector in your AI platform and signs in once with single sign-on, with no software to deploy. Moving your own data between platform providers, if that is part of your setup, is separate work and usually the longer part.
-
The API gives you the data. What the MCP adds is the scored verdicts, the investigation methods that assemble a case, and the permission and audit layer already enforced on every request. You would be rebuilding the interpretation and the governance, not just the access.
-
Start narrow. Two of the three connection paths exist for this: a scheduled machine-to-machine job with no user-facing surface, or the named-analyst mode where each person's own permissions apply. Use of AI features is covered by GeoComply's published AI Features Addendum, so for most operators this is a pointer to existing terms, not a new contract.