PassportIQ takes an application through ten chained verification stages, hunts for identifier reuse across every other live application, builds the fraud graph that exposes coordinated rings, scores the risk against a cited rule book — then stops, and hands a complete evidence pack to a human. The machine investigates. It never approves.
The console is the product. The /mcp endpoint exposes the same guarded tools to Claude,
Cursor, ChatGPT or any MCP client — same schemas, same guards, same audit trail.
run_verification_pipeline drives the whole chain for one application. Each stage emits an
event on the live stream and writes an attributed line to the audit trail, so the officer can see not
only the verdict but the order in which it was reached. Nine of the ten are required before a decision
is legally permitted; the guard enforces that in code, not in a comment.
document_validate
Checks every submitted document for type, expiry, legibility and tampering markers.
ocr_extract
Pulls name, DOB, passport number and address off each document with per-field confidence.
check_identity_consistency
Compares extracted identity fields against the application form and flags divergence.
check_address_consistency
Normalises and compares addresses across proofs; tolerates formatting, not substance.
detect_duplicate_signals
Searches every other live application for reused phone, email, address, passport or image hash.
build_risk_graph
Assembles the applicant cluster, traversing shared identifiers transitively to surface rings.
visual_similarity_flag
Perceptual-hash comparison of applicant photographs across the cluster.
evaluate_rules
Runs the deterministic rule book; every fired rule carries an id, weight and citation.
score_risk
Aggregates fired rules into a 0–100 score and a low / medium / high band.
explain_risk
Produces the officer-readable narrative, citing the exact rules and evidence that moved it.
officer_decide is wrapped in PipelineCompleteGuard. Call it before the
required stages have completed and it is refused with the exact list of what is still outstanding —
whether the caller is a browser, an LLM, or the autopilot. In thousands of autonomous sweeps the
agent has recorded zero decisions of its own, and the acceptance suite asserts that number stays zero.
Autopilot is the part that makes this a copilot rather than a form. It runs on a timer, chooses its own targets from the queue, drives the pipeline where stages are missing, sends the agent in on the worst cases, and leaves a queue that has already been worked before an officer sits down.
No prompt, no click. A sweep fires on its configured interval.
Reads the queue, ranks by cluster size, reuse signals and outstanding stages.
Drives the verification pipeline for applications that have not been processed.
Sends the agent in on the highest-risk cases and records the full trace.
Raises escalations, surfaces rings, and hands the queue to an officer. It decides nothing.
One page, server-streamed over SSE. Every mutating action in it goes through the real registered MCP tool — schema validation, guards, audit logging and events included. There is no second backend and no path in the UI that can write an outcome the MCP surface could not.
Totals, escalation banner, the queue at a glance, autopilot state and the live activity stream.
Triage ordered by what deserves attention, with a one-line reason each case is there.
Applicant, documents, stage timeline, cited risk summary, agent trace, evidence modal.
The applicant link graph with detected clusters and the identifier behind every edge.
Run history, full reasoning traces, sweep controls and the escalations raised.
Immutable attributed record, filterable to a single application.
The console and the MCP surface are two faces of one server. Point Claude Desktop, Cursor, ChatGPT or the raw SSE transport at the endpoint below and you get the identical tools, schemas, guards and audit trail — including the four widgets that render pipeline progress, the fraud graph, the cited risk explanation and the agent trace directly inside the client.
The agent plans its own tool calls. It reasons, acts, observes, and stops at the officer.
agent_investigateRuns a multi-step investigation on one application, choosing tools itself.agent_triage_queueSweeps the whole queue, investigates what looks worst, escalates the rest.agent_recommend_decisionProduces a recommendation with cited evidence — never a decision.get_agent_traceReturns the full reasoning trace of a run: every thought, action and observation.Ten chained stages. Each one emits an event and writes to the audit trail.
run_verification_pipelineOrchestrates all ten stages end to end for one application.document_validateDocument type, expiry, legibility and tampering checks.ocr_extractField extraction with per-field confidence.check_identity_consistencyIdentity fields vs. the application form.check_address_consistencyAddress proofs reconciled against each other.visual_similarity_flagPerceptual photo comparison across the cluster.detect_duplicate_signalsCross-application identifier reuse detection.build_risk_graphTransitive applicant link graph and ring detection.evaluate_rulesDeterministic rule book with citations.score_riskWeighted 0–100 score and risk band.explain_riskCited, officer-readable explanation of the score.Read models the officer and the agent share, so both see the same case.
list_applicationsThe application pool with status and risk.get_applicationOne application: applicant, documents, progress, risk, decision.list_applicant_clustersEvery detected cluster, largest first.get_pipeline_progressStages completed, stages outstanding, and whether a decision is permitted.The only tool that can change an outcome is guarded, and it is operated by a human.
officer_decideApprove, request clarification or reject. Blocked until the pipeline is complete.get_audit_trailImmutable, attributed record of every stage, run and decision.get_pipeline_eventsThe raw event log emitted during processing.Autopilot works the queue on a timer without being asked.
autopilot_statusSweeps run, applications investigated, escalations raised, next sweep due.autopilot_controlArm, disarm, or run a single sweep now.get_officer_queueThe triage queue, ordered by what deserves attention first.get_console_activityRecent activity as officer-readable lines.