# Our MCP Server Is Live: Phone Credit Lookups Inside Your AI Assistant

> Phone credit lookups now work inside AI assistants that support the Model Context Protocol. What the server does, the tools it offers, how sign-in replaces API keys, and the rules that came along with it.

Source: https://phonenumbercreditscore.com/blog/mcp-server-credit-lookups  
Author: Jordan Avery, Head of Content  
Published: 2025-10-29  
Topic: API & Developers  
Publisher: Phone Number Credit Score (https://phonenumbercreditscore.com/)

As of today, the Phone Number Credit Score API has a credit report MCP server. If your team uses an AI assistant that supports the Model Context Protocol, you can connect it to your account and ask it, in plain words, to look up a phone number. It runs the same soft-pull lookup our API runs and reads the result back to you: name, current address, phone details, the FICO® Score 4 and the credit profile behind it.

The address is `https://phonenumbercreditscore.com/mcp`. It's included with the API plan, and there's nothing new to install on our side or yours.

This post covers what we built and the rules that came with it. It isn't a setup tutorial. Each assistant has its own menus for adding a server, and they change often enough that we'd rather point you to their help pages than write instructions that go stale by Christmas. (Claude's, for example, is its guide to [custom connectors using remote MCP](https://support.claude.com/en/articles/11175166-getting-started-with-custom-connectors-using-remote-mcp).)

## MCP in two paragraphs

The [Model Context Protocol](https://modelcontextprotocol.io/introduction) is an open standard for connecting AI applications to outside tools and data. Anthropic [introduced it in November 2024](https://www.anthropic.com/news/model-context-protocol), and since then a long list of assistants and developer tools have added support. A server describes the tools it offers (a name, a short description, the inputs it accepts), and the assistant decides when calling one would help with what you asked.

So when you type "check the credit on the caller from (555) 555-0158, he gave us his OK," the assistant sees a tool called `lookup_phone`, fills in the number and the purpose, and calls it. Our server runs the lookup and hands back structured data. The assistant turns that into a sentence or two you can use. You never write a request, parse JSON or copy a key around.

## What our credit report MCP server does

It puts our API inside the conversation. Anything you'd do with `POST /v1/lookups` and a few `GET` calls, an assistant can now do as a tool. Here's the full set:

| Tool | What it's for |
|---|---|
| `lookup_phone` | Run a lookup: name, address, phone details, score and credit profile |
| `unlock_tradelines` | Add every account to a past lookup ($2) |
| `get_lookup` | Pull up a past lookup by its ID |
| `list_lookups` | Find recent lookups, so nobody pays twice for the same person |
| `get_usage` | Lookups and spend so far this month |
| `get_balance` | Where the account stands on spending |
| `get_account` | Plan and account details |
| `list_requests` | Recent API requests, for checking what happened |
| `sandbox_numbers` | The test numbers that act out errors |

There are also two prompts, which most assistants show as shortcuts. `prequalify_caller` takes a phone number and the offer you have in mind, and walks the assistant through a soft-pull pre-qualification. `explain_lookup` takes a past lookup and explains it in plain language. And there's one resource, `pncs://docs/guide`, a short guide the assistant can read when it wants to know how our data fits together.

A lookup through the server returns exactly what the API returns: name and current address; phone details (line type, carrier, caller ID name and a [fraud score from 0 to 100](https://phonenumbercreditscore.com/blog/phone-number-fraud-score)); FICO Score 4 by default, or VantageScore 4.0, with the key factors; the credit profile (card usage, on-time rate, length of history, accounts, total debt, available credit, inquiries, collections); debt by type; and flags for a frozen file, a thin file, an address mismatch or no file at all. It's a soft pull from TransUnion, so the person's score doesn't move. Our [step-by-step explainer](https://phonenumbercreditscore.com/blog/how-phone-number-credit-score-works) covers where each piece comes from.

When something goes wrong (a typo in the number, a rate limit, an account spending limit reached), the error comes back as a tool result rather than a crash. The model reads it and tells you what happened, which is usually more helpful than a status code.

![A man in glasses on his phone at an office desk late in the evening, a laptop open in front of him](https://phonenumbercreditscore.com/media/blog/01a13c7d-7e1f-7a9b-a2a0-da7f393349bf-1200.webp)

## Sign in, not paste a key

Plenty of MCP servers ask you to paste an API key into a config file. We didn't want that for something that can pull credit. Keys get copied into chats, screenshots and shared docs, and they don't expire on their own.

So the server uses [OAuth 2.1](https://oauth.net/2.1/) with PKCE, the sign-in method the [MCP authorization spec](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization) calls for. You add the server address to your assistant as a custom connector. The assistant registers itself with us (through dynamic client registration or a client ID metadata document, depending on the client) and sends you to our sign-in page. Nobody types or pastes a secret.

On that page you choose:

- **What it may do.** Run lookups, read past lookups, add tradelines, see usage, see logs, see account info, and stay connected between sessions. Leave a box unticked and the matching tools simply don't show up for that assistant.
- **Live or test.** A test connection is free and returns sample people.
- **How long it lasts.** 30 days, 90 days, a year, or until you disconnect it.

Only API accounts can connect, and only people on the account who are allowed to. Owners always can; for everyone else, it's the "Connect apps" permission.

Behind the scenes, access tokens last an hour. Refresh tokens rotate every time they're used and expire after 30 days of sitting idle. If an old refresh token ever shows up again, we cancel the whole connection, on the theory that someone has a copy who shouldn't. Tokens only work for the server they were issued for, and we store hashes, never the tokens themselves. Every connection is listed on API / Developer, then Apps & AI, and disconnecting one stops it immediately.

One snag worth knowing about. If your account uses an IP allow list, it applies to connected apps too, by default. AI assistants call from their providers' servers, not your office, so those calls would be refused. The consent page warns you when that's about to happen and lets an admin turn IP rules off for apps while leaving them on for API keys.

If you'd rather wire this into your own agent or script, an API key also works as a Bearer token on `/mcp`. That's handy for developers. For people in a chat window, sign-in is the better fit.

## The rules came along

An assistant is a new way to ask for a lookup. It isn't a new legal situation. Every lookup still needs a [permissible purpose under the FCRA](https://phonenumbercreditscore.com/blog/permissible-purpose-fcra), and every `lookup_phone` call is logged with one: `consent`, `credit_application` or `rental_application`. If the assistant doesn't send one, your account's default purpose is used, so set that default to the one that fits most of your lookups.

We also gave the server instructions that every connected assistant receives. In short, they tell the model to:

1. Only look someone up when you say you have a purpose, like the person's consent.
2. Never guess a purpose or invent one.
3. Tell you what a call costs before running a paid one.
4. Check `list_lookups` and `get_lookup` before paying for the same person twice.

We can't promise how any particular model behaves, and you shouldn't treat those instructions as a compliance program. They're a sensible default. Your business is still the one using the report, so your consent wording and records matter as much as they did before. Our post on [credit check consent forms](https://phonenumbercreditscore.com/blog/consumer-consent-credit-check) has wording that holds up.

Here's roughly what it looks like in practice (the person is made up):

> **You:** Imogen Castellano at (555) 555-0158 just applied for our equipment financing and signed the credit authorization. Can you check her?
>
> **Assistant:** That's a credit application, so I'll use that as the purpose. A lookup is $7.50 if she's found, free if not. Go ahead?
>
> **You:** Yes.
>
> **Assistant:** Found her in Tucson. FICO Score 4 of 702. Card usage is 31%, 98% of payments on time, no collections. The main thing holding the score back is revolving balances. The phone is a mobile line with a low fraud score.

Ask it for the same person tomorrow and it should find yesterday's lookup instead of running a new one.

## Practice in test mode first

Test connections cost nothing and return sample people for any number. More useful than that, certain endings act out the awkward cases: a number ending in 0404 comes back with no match, 0409 with an address mismatch, 0422 with a thin file, 0423 with a frozen file, 0429 as rate limited and 0503 as a service outage. Any area code works. Ask the assistant for `sandbox_numbers` and it'll list them.

We'd suggest an hour of this before anyone connects in live mode. You'll see how your assistant asks for purpose, how it explains a [thin file](https://phonenumbercreditscore.com/blog/thin-credit-file) and what it says when a file is frozen. That's a better preview than anything we could write here.

## What it costs

The server is part of the API plan: $49 a month or $149 a year. Lookups cost what they cost through the API: $7.50 when we find someone, $2 more if you want tradelines (every account on the file, explained in our [tradeline primer](https://phonenumbercreditscore.com/blog/what-is-a-tradeline)), and nothing at all for no match. There's no monthly cap.

Your account-wide spending limit applies to everything, assistants included. If you haven't set one, now is a good time. And every call an assistant makes shows in your request logs with the app's name next to it, so you can always see who did what. We also email you when anything new connects.

## What's next

This is the first version, and we built it for one person at a desk connecting their own assistant. A lot of you will want more than that: a shared assistant for a sales floor, a new hire who shouldn't be running live pulls on day one, a manager who wants a say before money moves. We're working on controls for teams, and we'll write about them here when they ship.

In the meantime, if you're new to the API itself, our [credit score API guide](https://phonenumbercreditscore.com/blog/credit-score-api-guide) explains the underlying requests, and a walkthrough of [pulling a credit report with Claude](https://phonenumbercreditscore.com/blog/pull-credit-report-with-claude) is on its way. Full details, including the server address and the list of tools, are on the [API page](https://phonenumbercreditscore.com/api).

## Frequently asked questions

### Does the MCP server cost extra?

No. It's included with the API plan ($49 a month or $149 a year). Lookups through an assistant cost the same as through the API: $7.50 when we find someone, $2 more for tradelines, and nothing when there's no match.

### Which assistants can connect?

Any client that supports remote MCP servers over streamable HTTP. That includes Claude, ChatGPT in developer mode, Cursor, VS Code and Claude Code. Each one has its own setup screen, so follow its help page for the exact steps.

### Can the assistant run a lookup without a permissible purpose?

It shouldn't. Every lookup is recorded with a purpose (consent, credit_application or rental_application), either the one the assistant sends or your account's default, and the server tells the model to ask you for one rather than guess. The responsibility for having that purpose stays with your business.

### Can I try it without being charged?

Yes. Connect in test mode and every lookup is free and returns a sample person. Numbers ending in certain digits act out errors like a frozen file or no match, so you can see how the assistant handles them.