Gocertius MCP server

Read from the package source without running it. The installed server may list more.

• case_file_createwrite action

  Creates a new case file \u2014 the top-level container for all related operations (evidence, notifications, dossiers, chats). Call this first before any other operation. Generate a UUID v4 for `id`. For `useCaseId`, use the general GoCertius use case: `063a016a-1d62-4b7b-a24f-7cf4d1d289bf` unless a specific use case is required. Returns caseFileId needed for all subsequent calls.

• case_file_deletewrite action

  Deletes a case file and everything filed inside it \u2014 evidence groups, dossiers, notifications and their certificates. Irreversible, with no confirmation step and no recycle bin. Requires: caseFileId. Returns no body (HTTP 204); confirm with case_file_list. Do not call it to 'clean up' unless the user asked for that case file to be destroyed.

• case_file_get

  Retrieves details of a specific case file. Requires: caseFileId. Use to verify a case file exists before creating evidence groups, dossiers, or notifications.

• case_file_list

  Lists all case files in your GoCertius account. Pass userId (from session_login or session_info) to scope results to your account. Returns paginated list with IDs, names, and status.

• chat_certificate_createwrite action

  Creates a certificate of a range of messages from a certified chat. Requires: chat_create \u2192 chatId, personal caseFileId, chat_get \u2192 registeredAt, and messages already present in the Telegram channel. Generate a UUID v4 for `id`. Do not use createdAt as a substitute for registeredAt; if registeredAt is missing, the chat is not ready to certify. Specify chatMessagesFrom and chatMessagesTo

• chat_certificate_get

  Retrieves a certified chat certificate including its status, message range, and PDF download URL. Prerequisites: the certificate must have been created with chat_certificate_create. Returns documentUrl when status is CERTIFIED. Example: chat_certificate_get({ caseFileId: '...', chatId: '...', id: '...' })

• chat_createwrite action

  Creates a certified chat channel (Telegram). IMPORTANT: Chats can only be created in the user's personal case file (created automatically when the GoCertius account was opened). Do not use a manually created case file \u2014 use session_info \u2192 case_file_list to find the personal case file (oldest createdAt, owned by the user). Generate a UUID v4 for `id`. Set service to Telegram. Returns imme

• chat_get

  Retrieves details of a certified chat. Requires: personal caseFileId and chat_create \u2192 chatId. Returns status, participants, and registeredAt timestamp. After chat_create, poll chat_get until status is active/registered and registeredAt is present; createdAt is not enough for certificate creation.

• chat_invitation_url

  Returns the Telegram invitation URL for a certified chat. Requires: chat_create \u2192 chatId and the personal caseFileId. Do not call while chat_get still shows status `creating`; wait until the chat is registered/active, otherwise the API can answer Chat not found. Share the returned invitationUrl with participants so they can join the certified channel.

• dossier_certify

  Certifies a DRAFT dossier, locking in all its associated evidence groups. The dossier must be in DRAFT status. After certification it transitions to CERTIFIED and a tamper-evident PDF is generated. Prerequisites: the dossier must exist (dossier_create) and have evidence groups linked. Use dossier_group_certify instead if you want to create + certify in one step from a single evidence group. Exampl

• dossier_createwrite action

  Creates a dossier to aggregate certified evidence groups into a single tamper-evident PDF. Requires: case_file_create \u2192 caseFileId. Evidence groups must be in CLOSED status before linking. Generate a UUID v4 string for `id`. Returns dossierId. After creation, link evidence with dossier_evidence_link, then certify with dossier_certify.

• dossier_deletewrite action

  Deletes a dossier. Available in DRAFT status (to discard before certification) or in CERTIFIED status (to permanently remove the certified dossier). Irreversible. Requires: caseFileId and dossierId.

• dossier_document_url

  Returns the download URL for the certified dossier PDF. Requires: dossier_certify (CERTIFIED status), caseFileId, dossierId.

• dossier_evidence_deletewrite action

  Removes an evidence item from a dossier. Only available while dossier is in DRAFT status. Requires: caseFileId, dossierId, evidenceId.

• dossier_evidence_get

  Retrieves details of a specific evidence item linked to a dossier. Requires: caseFileId, dossierId, evidenceId.

• dossier_evidence_link

  Links specific evidence items to a DRAFT dossier. Call once per case file containing evidences to link. After linking all evidences, call dossier_certify to finalize. For a single-group dossier, use dossier_group_certify instead (one step). Example: dossier_evidence_link({ caseFileId: '...', dossierId: '...', caseFileToLinkId: '...', ids: ['ev-uuid-1', 'ev-uuid-2'] })

• dossier_evidence_list

  Lists the evidence items linked to ONE evidence group of a dossier. Requires: caseFileId, dossierId AND dossierEvidenceGroupId \u2014 all three are mandatory. For every evidence item in the dossier regardless of group, use dossier_evidence_list_by_dossier instead. Supports filter, order and page.

• dossier_evidence_list_by_dossier

  Lists every evidence item linked to a dossier, across all of its evidence groups. Requires: caseFileId and dossierId. This is the dossier-wide view; dossier_evidence_list is the narrower per-group one and additionally needs a dossierEvidenceGroupId. Supports filter, order and page. Returns { data, meta.totalElements }.

• dossier_evidence_list_to_link

  Lists evidence items that are available to be linked to a dossier (CLOSED groups not yet linked). Requires: caseFileId and dossierId.

• dossier_get

  Retrieves the full details of a specific dossier including status, linked evidence, and download URLs. Use to check current state or get certificate download URLs after CERTIFIED. Requires: caseFileId and dossierId.

• dossier_group_certifywrite action

  Creates AND certifies a dossier from a single sealed evidence group in one call (express path). Requires: evidence_seal (CLOSED status), case_file_create \u2192 caseFileId, evidence_group_create \u2192 evidenceGroupId. Generate a UUID v4 string for `id`. Use when you have exactly one sealed evidence group and don't need multi-group aggregation. Returns dossierId immediately with CERTIFYING status

• dossier_list

  Lists all dossiers in a case file with their status and metadata. Use to find an existing dossierId or monitor certification progress. Requires: caseFileId. Returns paginated list with IDs, names, status, and creation dates.

• dossier_list_by_user

  Lists every dossier belonging to a user, across all of their case files. Requires: userId (from session_login or session_info). Use this when you do not know which case file a dossier is in; use dossier_list when you already have a caseFileId. Supports filter, order and page. Returns { data, meta.totalElements }.

• dossier_package_url

  Returns the download URL for the full dossier package (PDF + evidence files). Requires: dossier_certify (CERTIFIED status), caseFileId, dossierId.

• dossier_preview

  Returns an HTML preview URL of a dossier before certification. Requires: caseFileId and dossierId.

• dossier_template_list

  Lists available dossier templates. No prerequisites. Returns template IDs and their translations per language. Use the returned id as dossierTemplateId in dossier_create.

• dossier_updatewrite action

  Updates the metadata of an existing dossier (name, template fields, expiry). Requires: dossier_create \u2192 dossierId, caseFileId. Only available while dossier is in DRAFT status.

• dossier_visibilitywrite action

  Updates the visibility (public/private) of a certified dossier. Requires: dossier_certify (CERTIFIED status), caseFileId, dossierId.

• evidence_createwrite action

  Registers a NEW evidence record inside an evidence group. Requires: evidence_group_create \u2192 evidenceGroupId, case_file_create \u2192 caseFileId. Generate a UUID v4 for `id`. Compute the SHA-256 hex hash of the file BEFORE calling. Normal INTERNAL flow: call evidence_create with custodyType INTERNAL and NO fileUrl; the API returns uploadFileUrl, a presigned S3 URL. You MUST PUT the exact file

• evidence_get

  Retrieves a specific evidence record. Requires: evidence_create \u2192 evidenceId, evidence_group_create \u2192 evidenceGroupId, case_file_create \u2192 caseFileId. Returns status (COMPLETED|IN_PROCESS|ERROR), hash, and tspTimestamp when certified.

• evidence_group_createwrite action

  Creates an evidence group inside a case file. Requires: case_file_create \u2192 caseFileId. Generate a UUID v4 for `id`. Set evidenceType to FILE, PHOTO, VIDEO, or WEB_PLUGIN. Returns evidenceGroupId. One group can contain multiple evidence records.

• evidence_group_list

  Lists all evidence groups in a case file with their current status (OPEN, CLOSING, CLOSED). Use to find an existing group or check which groups are ready for sealing. Requires: caseFileId.

• evidence_list

  Lists all evidence records in a specific evidence group. Use to review uploaded documents before sealing the group, or to find a specific evidenceId. Requires: caseFileId and evidenceGroupId. Returns paginated list with IDs, titles, status, and timestamps.

• evidence_seal

  Seal and certify an evidence group. Closes the group to new additions and triggers async timestamping. Returns immediately \u2014 the group transitions OPEN \u2192 CLOSING \u2192 CLOSED. Poll evidence_group_list until status is CLOSED before linking to a dossier.

• evidence_uploadwrite action

  Uploads a local file as evidence in one step: computes its SHA-256, registers the evidence record (custodyType INTERNAL = GoCertius stores the file), and uploads the bytes to S3 \u2014 no manual hashing or PUT needed. Internally this follows the required GoCertius sequence: create INTERNAL evidence \u2192 receive uploadFileUrl (presigned S3 URL) \u2192 PUT file bytes \u2192 return uploaded:true. R

• notification_certificate_document_url

  Returns { documentUrl } for the certificate PDF on its own, WITHOUT the attachments. Requires certificateId, receiverId, notificationRequestId and caseFileId. Wait until the certificate is CERTIFIED: generation is asynchronous and the first call can 404 or come back empty while it is still CERTIFYING, so poll a few times with a bounded retry rather than hammering it. If you want the attachments bu

• notification_certificate_getwrite action

  Creates or retrieves a PDF certificate for a specific notification receiver. Requires notification_request_send and notification_receiver_add. Generate a UUID v4 for `id` the first time and reuse that id when polling. This tool is idempotent: it first lists existing certificates for the receiver and, if `id` already exists, returns it instead of creating it again. If the certificate status is CERT

• notification_certificate_list

  Lists the delivery certificates already generated for one recipient, so you can reuse one instead of generating a duplicate. Requires receiverId, notificationRequestId and caseFileId. Returns per certificate: id, status (DRAFT, CERTIFYING, CERTIFIED), language, createdAt, certifiedAt, `partial` \u2014 whether it is an intermediate certificate issued before the recipient finished responding \u2014

• notification_certificate_package_url

  Returns { packageUrl } for a ZIP containing the certificate AND the notification's attachments \u2014 the "with annexes" form. There is no separate preview flag anywhere in the API: the package carries the annexes, the document is the certificate alone. Requires certificateId, receiverId, notificationRequestId and caseFileId. Same preconditions as notification_certificate_document_url \u2014 wait

• notification_document_add

  Attaches a document to a notification. Two steps: this call registers the file and returns { url }, a presigned upload URL, and you then PUT the raw bytes to that URL with an x-amz-checksum-sha256 header. Generate a UUID v4 for `id`, and compute the file's SHA-256 hex hash BEFORE calling \u2014 it goes in `hash`. ORDER MATTERS AND GETTING IT WRONG FAILS THE SEND: add every document BEFORE adding r

• notification_document_deletewrite action

  Removes an attachment from a notification. Requires documentId (from notification_document_list), notificationRequestId and caseFileId.

• notification_document_download_url

  Returns { downloadUrl }, a temporary link to an attachment as it was sent. Requires documentId (from notification_document_list), notificationRequestId and caseFileId. Use it to retrieve a file you attached or to verify what a recipient received. The URL is presigned and expires \u2014 fetch it when you need it rather than storing it.

• notification_document_list

  Lists the documents attached to a notification with their processing status, and it is what you poll after notification_document_add: a newly registered document starts at PENDING and reaches READY_TO_SEND in roughly 8 seconds. Calling notification_request_send while any document is still PENDING fails with 409/404 NOTIFICATION_NOT_FOUND. Poll with a bounded retry \u2014 every few seconds, a dozen

• notification_receiver_add

  Adds a recipient to a notification request. Requires: notification_request_create \u2192 notificationRequestId, case_file_create \u2192 caseFileId. The `id` can be a UUID v4 or custom string (e.g. your internal user ID). Returns receiverId \u2014 save it for notification_certificate_get. Delivery is by email always; set sendWaUrl for a WhatsApp link, sendSmsUrl for an RCS/SMS link (the channel neg

• notification_receiver_add_bulk

  Adds several recipients in one call instead of one notification_receiver_add per person. Pass `receivers` as an array; each entry needs `id` (you generate it), firstName, lastName and email, and may carry phonePrefix (with the +) and phoneNumber. Note this bulk form does NOT accept the per-recipient otpRequired, sendWaUrl or sendSmsUrl flags that the single-recipient tool does \u2014 set the defau

• notification_receiver_deletewrite action

  Removes a recipient from a notification. Requires receiverId, notificationRequestId and caseFileId. To remove every address the platform rejected in one call, use notification_receiver_invalid_purge rather than deleting them one by one.

• notification_receiver_invalid_purgewrite action

  Removes every recipient whose status is INVALID \u2014 addresses the platform rejected as malformed or duplicated \u2014 from a notification in a single call. Requires notificationRequestId and caseFileId. Recipients in any other status are left untouched. AN INVALID RECIPIENT BLOCKS THE SEND, so run this (or fix the addresses with notification_receiver_update) before notification_request_send, or

• notification_receiver_list

  Lists a notification's recipients with their individual delivery state. Returns per recipient: id, firstName, lastName, email, phonePrefix/phoneNumber, status (INVALID, READY_TO_SEND, SENT, READ, ANSWERED, ERROR), statusUpdatedAt, `answer` once they respond, emailBounced, and validationError (TAKEN, IS_DEFINED, IS_INVALID) for a rejected address. Worth calling before notification_request_send to s

• notification_receiver_updatewrite action

  Corrects a recipient's details: firstName, lastName, email, phonePrefix, phoneNumber. Requires receiverId, notificationRequestId and caseFileId. Use this to fix a mistyped address rather than deleting and re-adding, which would lose the receiverId. phonePrefix must include the + (for example +34). A phone number is required if the recipient is to receive the RCS/SMS link (sendSmsUrl), the WhatsApp

• notification_request_case_file_move

  Moves a notification to a different case file. Note the two caseFileId values: the one in the path is where the notification is NOW, and the one in the body is the destination. Notifications are grouped by case file, and this is the only way to change that grouping without duplicating.

• notification_request_createwrite action

  Creates a certified notification request. Requires: case_file_create \u2192 caseFileId. Generate a UUID v4 for `id`. Set language to en_GB or es_ES. Returns notificationRequestId. Add at least one receiver with notification_receiver_add before sending. IMPORTANT: The `content` field must be valid HTML \u2014 plain text without HTML tags will not render on the recipient landing page. Only the follo

• notification_request_deletewrite action

  Deletes a notification. Requires notificationRequestId and caseFileId. There is no undo. TESTED: once the notification has been sent the API rejects this with 403 Forbidden \u2014 a sent notification is delivery evidence and cannot be removed. If you only want it filed elsewhere, use notification_request_case_file_move instead.

• notification_request_duplicatewrite action

  Creates a new DRAFT notification from an existing one, copying its content, its recipients and its attachments. Works whatever state the original is in, so this is how you resend to the same people or reuse a sent notification as a template. Generate a UUID v4 for `id` and supply a new `subject`; pass `caseFileId` in the body to place the copy in a different case file, or omit it to keep it alongs

• notification_request_list

  Lists the certified notifications visible to a user. Requires userId (from session_login, session_info or profile_get) \u2014 this listing is user-scoped, not case-file-scoped, so it spans every case file unless you filter. Use this to recover a notificationRequestId you no longer have; it is the only way to find one. Returns per notification: id, code, subject, status, type, sentAt, receiverStats

• notification_request_sendwrite action

  Trigger delivery of a certified notification to all added recipients. Returns immediately \u2014 delivery is async. Poll notification_request_status until status is DELIVERED before retrieving certificates.

• notification_request_status

  Checks the delivery status of a certified notification. Requires: notificationRequestId, caseFileId. Returns status (CREATING|DRAFT|IN_PROCESS|SENT|PARTIALLY_READ|FULLY_READ|PARTIALLY_ANSWERED|FULLY_ANSWERED). Poll until status is SENT or beyond. Do not call notification_certificate_get while status is CREATING, DRAFT, or IN_PROCESS.

• notification_request_updatewrite action

  Edits a notification that has not been sent: subject, content, type and language. Requires notificationRequestId and caseFileId. `content` must be valid HTML \u2014 plain text is accepted by the API but does NOT render on the recipient landing page. Supported tags only: <p>, <strong>, <em>, <ul><li>, <ol><li>; no other tags and no CSS. Keep `subject` to plain ASCII (no em dashes, no smart quotes),

• notification_sendwrite action

  Sends a certified notification to one or more recipients in a single call: creates the notification request, adds every recipient, and sends it. Generates every UUID itself \u2014 do not pass any id. Requires case_file_create \u2192 caseFileId. `content` MUST be HTML: plain text is accepted by the API and reports SENT but does not render on the recipient's landing page. Supported tags only: <p>, <

• notification_send_with_attachmentswrite action

  Sends a certified notification WITH one or more attached documents to one or more recipients, in a single call. Use notification_send instead when there are no attachments. This tool exists separately because attachments impose an ordering rule the API enforces and does not forgive: documents must be registered and fully uploaded BEFORE any recipient is added, and every document must reach READY_T

• profile_get

  Returns the authenticated user's own profile. It identifies the caller from the session token alone \u2014 no email or any other input needed \u2014 so it works on every deployment, including a per-request Bearer one. Its `id` field IS your userId (UUID): the value required by case_file_list and every /users/{userId}/... operation. Prefer this over session_info when you need the userId: it is the

• session_info

  Returns the authenticated user's session info. `type` is how this MCP session authenticated \u2014 always 'UserKey', the server's only auth flow. `accountLoginType` is a different fact: how the underlying GoCertius account itself signs in ('Password' or 'OpenId'), reported from GET /profile, null if the API omits it. Use this to retrieve the userId (UUID) required by case_file_list and other user-

• session_login

  Force the GoCertius MCP server to re-authenticate. Takes no parameters and accepts no credentials: the server re-exchanges the user key it was configured with (MCP_AUTH_USER_KEY) for a fresh session token, and this tool reports the resulting userId and expiry. The server manages authentication automatically \u2014 call this only to force a re-login or after a 401.

• Code scan3 source files scanned20/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitystatic API keys via environment variables6/15
• Maintenancelast push 11 days ago15/15
• Maintainer identityregistry namespace matches repository owner7/10

Gocertius: common questions

Is Gocertius MCP server safe?

Mostly: it is graded B (74/100). Read the Gocertius safety report

How do I install Gocertius?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does Gocertius need an API key?

Yes. The registry entry asks for MCP_AUTH_USER_KEY, MCP_SVC_CLIENT_SECRET.

Is Gocertius maintained?

The last commit was 12 days ago (2026-09-08). The latest release is v2.0.0.