Connect Metamap to ChatGPT: Automate Identity & AML Compliance

If you need to automate Know Your Customer (KYC) workflows, Anti-Money Laundering (AML) screenings, and fraud investigations, you want to connect Metamap to ChatGPT. By doing so, your AI agents can initiate background checks, validate physical documents, and assess risk scores entirely via natural language. If your team uses Claude instead, check out our guide on connecting Metamap to Claude or explore our broader architectural overview on connecting Metamap to AI Agents.

Giving a Large Language Model (LLM) read and write access to a sensitive identity platform is an engineering challenge. You either spend weeks building, hosting, and maintaining a custom Model Context Protocol (MCP) server, or you use a managed infrastructure layer that handles the boilerplate for you. This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Metamap, connect it natively to ChatGPT, and execute complex compliance workflows.

The Engineering Reality of the Metamap API

A custom MCP server acts as the translation layer between an LLM's tool calls and a vendor's REST APIs. If you decide to build a custom MCP server for Metamap, you are responsible for the entire API lifecycle. You are not just building standard CRUD endpoints - you are integrating with a complex, asynchronous identity verification engine.

Here are the specific integration challenges that make Metamap difficult to expose to AI agents natively:

Asynchronous Webhook Workflows Almost all of Metamap's specialized validation checks - GovChecks, ComplyAdvantage AML screenings, email risk checks, and phone ownership checks - operate asynchronously. The API does not return the final fraud score immediately. Instead, it returns an ID and a 202 Accepted status, firing the actual results to a callbackUrl seconds or minutes later. LLMs are inherently synchronous. If you do not engineer a system to catch that webhook and feed it back into the LLM's context window, your agent will blindly assume the check is complete and hallucinate the results.

Multipart Form Uploads and Strict Ordering To process physical identity documents, you must upload front photos, back photos, and selfies. The Metamap API requires these to be sent as multipart/form-data. More importantly, the inputs array must perfectly match the flow configuration order defined on your Metamap dashboard. If your custom server cannot translate flat JSON arguments from ChatGPT into properly ordered, binary-encoded multipart requests, the verification will fail immediately.

Binary Media Authentication Tokens If an agent needs to retrieve a submitted ID card or selfie, it cannot simply call a download endpoint. The agent must first parse a media_auth token from a Retrieve Webhook Resource Data response, pass that token to the media endpoint, and handle the resulting binary stream. Exposing binary data handling to text-based LLMs requires deliberate schema engineering.

Raw HTTP 429 Rate Limit Errors Metamap enforces rate limits to prevent abuse. It is critical to understand that Truto does not automatically retry, throttle, or apply exponential backoff on rate limit errors. When the upstream Metamap API returns an HTTP 429, Truto passes that error directly to the caller. Truto normalizes the upstream rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF specification. Your client implementation is entirely responsible for retry and backoff logic. If your agent hits a limit, it needs explicit instructions on how to handle the rejection gracefully.

Generating the Metamap MCP Server

Instead of building custom schema translations and hosting JSON-RPC servers yourself, you can generate a dynamic MCP server using Truto. Truto reads the Metamap API documentation and automatically generates strictly typed, documentation-driven tools for your LLM.

There are two ways to generate an MCP server in Truto.

Method 1: Via the Truto UI

1. Log into your Truto dashboard and navigate to the integrated account page for your connected Metamap instance.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Configure the server parameters. You can filter the server to only allow specific methods (e.g., read) or restrict tools by tags (e.g., compliance, verification).
5. Click Save. Copy the generated MCP server URL (e.g., https://api.truto.one/mcp/abc123xyz).

Method 2: Via the API

You can dynamically provision MCP servers directly from your application backend. This is ideal for assigning unique, strictly scoped MCP servers to individual user sessions.

curl -X POST https://api.truto.one/integrated-account/{integrated_account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Metamap Compliance Bot",
    "config": {
      "methods": ["read", "create"],
      "tags": ["identity", "aml"]
    },
    "expires_at": "2026-12-31T23:59:59Z"
  }'

The API returns a payload containing the secure URL:

{
  "id": "mcp_8a9b0c",
  "name": "Metamap Compliance Bot",
  "url": "https://api.truto.one/mcp/abc123xyz..."
}

Connecting Metamap to ChatGPT

Once you have your Truto MCP URL, connecting it to your AI client takes seconds. You can do this via the user interface or a manual configuration file.

Method A: Via the ChatGPT UI

1. Open ChatGPT and navigate to Settings.
2. Click on Apps and go to Advanced settings.
3. Ensure Developer mode is enabled (this unlocks MCP functionality).
4. Under MCP servers / Custom connectors, click Add a new server.
5. Enter a name (e.g., "Metamap Compliance") and paste the Truto MCP URL.
6. Click Save. ChatGPT will immediately handshake with the server and discover the available Metamap tools.

Method B: Via Manual Config File

If you are running a local desktop client (like Claude Desktop) or a custom CLI agent, you can configure the MCP server using a standard JSON config file. Point the command to the official remote server transport tool.

{
  "mcpServers": {
    "metamap": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/abc123xyz..."
      ]
    }
  }
}

Hero Tools for Metamap Compliance

Truto automatically generates tools for every documented Metamap endpoint. Here are the highest-leverage tools available for identity and fraud orchestration.

Create a Metamap Verification

create_a_metamap_verification

This tool initiates a new verification flow. It establishes the base ID that all subsequent document uploads and background checks will attach to. It requires a specific flowId configured in your Metamap dashboard.

"Start a new onboarding verification for user ID 8912 using flow ID 'flw_compliance_tier_1'. Return the verification ID and current status."

Upload Verification Inputs

create_a_metamap_verification_input

This tool uploads physical proof to an active verification. It accepts multipart form data to process document front photos, selfies, and custom documents. The input payload must exactly match the expected order defined in your workflow.

"Take the base64 encoded passport image I just parsed, format it as a multipart input array, and submit it to verification ID '64b1c9...' under the identity document slot."

Run ComplyAdvantage AML Screening

create_a_metamap_comply_advantage

This tool creates a screening against ComplyAdvantage to check if a person or company appears on international AML watchlists, sanctions lists, or Politically Exposed Persons (PEP) registries.

"Run an AML watchlist screening for 'John Doe'. Use our standard compliance webhook URL for the callback and set monitoring to true."

Check Email Risk Score

create_a_metamap_email_risk_check

This tool assesses an email address for fraud. It returns granular attributes indicating if the address is disposable, newly created, linked to abuse, or acting as a spam trap.

"Run an email risk check on 'johndoe123@tempmail.com'. I need to know the overall fraud score, whether it is a disposable domain, and its deliverability status."

Get Verification by ID

get_single_metamap_verification_by_id

This tool retrieves the complete state of a verification. It is heavily used by agents checking up on asynchronous workflows to see if the user has passed their biometric and document checks.

"Check the status of verification ID '64b1c9...'. If it is completed, extract the computed name, date of birth, and document expiration date from the result."

Download Verification Media

list_all_metamap_verification_media

This tool uses a media_auth token to download the actual image files (selfies, ID cards, liveness videos) submitted by the user. The media URLs expire after 30 days.

"Use the media_auth token from the webhook payload to download the user's liveness video. Let me know if the download is successful."

To view the complete inventory of available API operations and exact schema definitions, visit the Metamap integration page.

Workflows in Action

Connecting an LLM to Metamap enables complex, autonomous risk orchestration. Here are two concrete examples of how specialized personas use these tools.

Scenario 1: Automated KYC Intake

A compliance officer wants to fully automate the initial intake of a new enterprise customer, initiating the tracking and kicking off standard AML checks before human review.

"Start a new verification flow using flow ID 'enterprise_onboarding'. Once you have the verification ID, trigger a ComplyAdvantage check for the company 'Acme Corp' using our internal webhook URL. Output a summary table with the verification ID and the ComplyAdvantage request ID."

Step-by-step execution:

1. The agent calls create_a_metamap_verification passing the flowId.
2. Metamap returns the new verification ID and initial status.
3. The agent calls create_a_metamap_comply_advantage passing the company name and webhook URL.
4. Metamap returns a 202 Accepted with the screening request ID.
5. The agent formats the final output as a markdown table.

sequenceDiagram
    participant User
    participant Agent as ChatGPT
    participant Truto as Truto MCP Server
    participant API as Metamap API

    User->>Agent: "Start a new verification flow..."
    Agent->>Truto: call tool create_a_metamap_verification
    Truto->>API: POST /v2/verifications
    API-->>Truto: { "id": "ver_123", "status": "pending" }
    Truto-->>Agent: JSON Result
    Agent->>Truto: call tool create_a_metamap_comply_advantage
    Truto->>API: POST /v2/comply-advantage
    API-->>Truto: { "id": "scr_456", "status": "processing" }
    Truto-->>Agent: JSON Result
    Agent-->>User: Markdown Table with ver_123 and scr_456

Scenario 2: Fraud Analyst Manual Review

A risk operations analyst suspects an account takeover and wants to aggressively audit the user's provided identifiers before escalating the ticket.

"I am investigating account #4992. Run an email risk check on 'suspicious_actor@example.com'. Then, check the final status of their previous verification ID 'ver_8819'. If the verification passed but the email risk score is over 80, flag the account for manual lockdown."

Step-by-step execution:

1. The agent calls create_a_metamap_email_risk_check to initiate the check.
2. The agent parses the returned payload to extract the overall_score and disposable flags.
3. The agent calls get_single_metamap_verification_by_id passing 'ver_8819'.
4. The agent reviews the verification status.
5. The agent evaluates the conditional logic (Score > 80) and outputs a written recommendation for the risk analyst, explicitly detailing why the account requires lockdown.

Security and Access Control

Giving an AI agent access to identity documents and AML tooling requires strict governance. Truto's MCP servers provide several architectural safeguards:

• Method Filtering: Enforce read-only access by passing methods: ["read"] during server creation. This prevents the agent from creating arbitrary verifications or submitting spoofed inputs.
• Tag Filtering: Restrict tools to specific functional areas (e.g., tags: ["email_risk"]) so an agent built for fraud analysis cannot access core document download endpoints.
• Time-to-Live Expiry: Use the expires_at field to generate ephemeral MCP servers. Once the timestamp passes, the server automatically degrades, blocking all subsequent access.
• Secondary Authentication: Enable require_api_token_auth to force the connecting client to pass a valid Truto API token in the Authorization header. This guarantees that even if the MCP URL is leaked, unauthorized users cannot execute tools.

Strategic Wrap-Up

Connecting ChatGPT to Metamap fundamentally shifts how your organization processes risk and compliance. Instead of forcing analysts to pivot between dashboards to run manual GovChecks or download CSVs of AML alerts, you can orchestrate identity intelligence entirely through conversational interfaces. By relying on a managed MCP infrastructure to handle API tokens, dynamic tool schemas, and rate limit exposure, your engineering team can stay focused on building core product logic instead of maintaining brittle integration wrappers.