Can I store Aadhaar numbers?

No — do not persist raw Aadhaar numbers anywhere, including logs. Store only a masked version or an internal reference ID.

Do I need a license to call Aadhaar verification APIs?

Yes, real verification requires working through a licensed KUA (KYC User Agency) or ASA; you cannot call UIDAI systems directly without that status.

What happens if I skip the consent check?

Treat this as a hard blocker, not a soft warning: the tool should refuse to run without recorded consent. Aadhaar misuse carries serious legal exposure under the Aadhaar Act 2016 — get qualified legal advice on your specific obligations rather than relying on any general guide for exact penalty figures.

industryTechArticle

MCP Aadhaar Verification (Sandbox Patterns)

Handle Aadhaar-based identity verification from an MCP server: explicit consent, masked logging, and no storage of raw Aadhaar numbers.

Quick Answer / TL;DR

Aadhaar data is highly sensitive and tightly regulated: only integrate through an officially licensed KUA (KYC User Agency) or ASA, require explicit recorded consent before every verification call, mask the Aadhaar number in all logs down to the last four digits, and never persist the raw number.

Key Takeaways

Only a licensed KUA or ASA integration is appropriate for real Aadhaar verification — build and test against a sandbox first.
Require and log explicit consent before every verification call; refuse the call without it.
Never store a raw Aadhaar number anywhere, including logs; mask to the last four digits at most.

Consent-gated verification

Reject the call outright if consent was not explicitly given, and mask the Aadhaar number in every log line — the audit trail should prove consent was checked without itself becoming a store of sensitive numbers.

typescript

const AadhaarSchema = z.object({
  aadhaar_number: z.string().regex(/^\d{12}$/),
  consent: z.literal(true),
});

function maskAadhaar(aadhaar: string): string {
  return `XXXX-XXXX-${aadhaar.slice(8)}`;
}

server.setRequestHandler(CallToolRequestSchema, async (request) => {
  if (request.params.name === "verify_aadhaar") {
    const { aadhaar_number } = AadhaarSchema.parse(request.params.arguments);
    const verification = await kuaClient.verify(aadhaar_number);
    auditLogger.log({ event: "aadhaar_verification", aadhaar_masked: maskAadhaar(aadhaar_number) });
    return { content: [{ type: "text", text: JSON.stringify({ status: verification.status, name: verification.name }) }] };
  }
});