Credit Pull Engine — MCP Connector

An MCP connector for the Credit Pull Engine API. Gives Claude Code, Cursor, the Anthropic Agent SDK, and any other MCP-capable agent the ability to pull credit reports.

This is not a chat plugin — it's a tool surface for agents and CLI workflows.

How PII is handled — both legs

The agent acts as a courier. Neither raw applicant PII (request leg) nor the full credit report (response leg) is ever visible to the LLM provider. Two things make that work:

Outbound (request leg). Agents never receive raw SSN, DOB, or address. They pass an applicant_id reference; the bridge resolves it locally from a JSON file on your machine. The resolved PII is then encrypted with your shared key (XChaCha20-Poly1305) before leaving the machine. The model sees only the reference and the permissible purpose; the wire body contains only an opaque encrypted_payload ciphertext.

Inbound (response leg). The MCP server encrypts the bureau response with the same shared key before returning it. The bridge decrypts it locally on your machine, writes the full plaintext report to $CPE_REPORT_DIR/<applicant_id>.json, and returns only a non-PII summary (score, account count, inquiry count, derogatories count, utilization) plus the saved file path to the agent. The full report never appears in any LLM transcript.

You are responsible for keeping the local applicant store and report directory secure (file permissions, disk encryption) and for ensuring you have an FCRA permissible purpose and documented consumer authorization before each pull.

Get your token and shared key

Log in to your Credit Pull Engine dashboard and generate a CLI install command. You'll receive both a bearer token (MCP_TOKEN, starts with cpe_mcp_live_) and a shared symmetric key (CPE_SHARED_KEY, base64). They are paired — re-generating produces a fresh pair and immediately invalidates the previous one.

Install

Claude Code (CLI)

claude mcp add credit-pull-engine \
  --env MCP_TOKEN=cpe_mcp_live_PASTE_YOUR_TOKEN \
  --env CPE_SHARED_KEY=PASTE_YOUR_BASE64_KEY \
  -- npx -y @creditpullengine/mcp

That's it. Verify with claude mcp list.

Cursor

Edit ~/.cursor/mcp.json:

{
  "mcpServers": {
    "credit-pull-engine": {
      "command": "npx",
      "args": ["-y", "@creditpullengine/mcp"],
      "env": {
        "MCP_TOKEN": "cpe_mcp_live_PASTE_YOUR_TOKEN",
        "CPE_SHARED_KEY": "PASTE_YOUR_BASE64_KEY"
      }
    }
  }
}

Anthropic Agent SDK

Configure as an mcpServers entry in your agent options — same shape as the JSON above.

Local applicant store

The bridge resolves applicant_id to PII by reading a JSON file at:

$CPE_APPLICANT_DIR/<applicant_id>.json

Default CPE_APPLICANT_DIR is ~/.creditpullengine/applicants/. Each file must contain at minimum:

{
  "fname": "Jane",
  "lname": "Doe",
  "ssn": "123-45-6789",
  "dob": "1/15/1985",
  "address": "123 Main St",
  "city": "Springfield",
  "state": "IL",
  "zip": "62701"
}

Recommended setup:

mkdir -p ~/.creditpullengine/applicants
chmod 700 ~/.creditpullengine ~/.creditpullengine/applicants
# create the file with your editor of choice
chmod 600 ~/.creditpullengine/applicants/jane-doe.json

applicant_id is the file basename (no .json) and must match [A-Za-z0-9_.-]+.

Local report store

Decrypted credit reports are written to:

$CPE_REPORT_DIR/<applicant_id>.json

Default CPE_REPORT_DIR is ~/.creditpullengine/reports/. The directory is created with mode 700 and each report is written with mode 600. Your CRM ingestion can read these files directly; the agent only ever sees the file path and a small numeric summary.

What it exposes

The connector lists tools dynamically from the CPE server. Today's primary tool:

• pull_credit_report — triggers a fresh bureau pull. Required fields: applicant_id, purpose. Returns {status, report_id, saved_to, summary} to the agent; the full report lives in $CPE_REPORT_DIR/<applicant_id>.json. Incurs real cost per call.

Use in a skill

A skill or agent prompt can invoke it like any other MCP tool — without ever quoting PII or seeing raw report data:

Use the pull_credit_report tool from credit-pull-engine to pull on
applicant_id "{{ applicant_id }}" for purpose "loan_application".
Then summarize the result using only the returned summary fields.

Environment variables

| Var | Required | Default | |---|---|---| | MCP_TOKEN | yes | — | | CPE_SHARED_KEY | yes (0.6+) | — | | MCP_BASE | no | https://mcp.creditpullengine.com | | CPE_APPLICANT_DIR | no | ~/.creditpullengine/applicants | | CPE_REPORT_DIR | no | ~/.creditpullengine/reports | | CPE_KEY_VERSION | no | 1 |

Uninstall

claude mcp remove credit-pull-engine

For Cursor, remove the entry from ~/.cursor/mcp.json.

Requirements

• Node.js 18 or newer
• Claude Code, Cursor, or another MCP-capable client

License

UNLICENSED — for use with the Credit Pull Engine service.