Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting

REMOTE · MCP.4CHEMS.COM

Remote MCP server for 4chems hosted IUCLID, CHESAR and QSAR Toolbox: onboarding, inquiries, admin.

Available components

+4 this week 76 Trust /100

Last scanned (39 minutes ago)

Scores higher than 66% of remote servers

Reachable. Last reached 5 Nov 2026.

Category Health and Science

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security66
Transport & Reachability100
Schema Quality & AI Usability62
  • AI-judged instruction clarity (fair).Partial
  • Tool/resource definitions use about 2872 tokens (~89/item across 32 items; 32 tools + 0 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
  • Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage74
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 10% of tool parameters carry a description.Partial
  • Structured output schemas are declared (94% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 33 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 4 Nov 26 0
    • Authorization: fail → unverified ▼ security
  • 3 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.

  • 1 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.

  • 30 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.

  • 28 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.

  • 26 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

  • 23 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://mcp.4chems.com/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=mcp.4chems.com CN=YR2,O=Let's Encrypt,C=US 26 Oct 2026 24 Jan 2027 RSA 4096 SHA256-RSA 68f1bc96239dbee08c2ebcef242b41e5ad5
SANs: mcp.4chems.com
CN=YR2,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA 4ebd24947e24d394802d84a52fd5b319
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC secure

Validation of mcp.4chems.com. — Secure

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
com. present 19718 13 Verified
4chems.com. present 6359 13 Verified
mcp.4chems.com. Verified address RRset verified with the apex keys
Authentication Inconclusive

We could not reach the endpoint well enough to judge its authorisation posture.

Result Inconclusive
HTTP status 503
Header Value
strict-transport-security max-age=31536000; includeSubDomains
x-content-type-options nosniff
x-frame-options DENY
referrer-policy strict-origin-when-cross-origin

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://mcp.4chems.com/mcp Verified 200
http (plaintext) http://mcp.4chems.com/mcp HTTPS enforced
MCP tools · 32 exposed · ~2,477 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
accept_invitation ~66

Accept a pending invitation and grant the invitee's first role assignment. Call this when an invitee has a valid invite link and wants to join the tenant; single-use, consuming the token marks it accepted.

NameTypeReqDescription
authorizationstringyes–
tokenstringyes–
NameTypeReqDescription
accepted_at–––
billing_contactboolean––
created_atstringyes–
emailstringyes–
expires_atstringyes–
idstringyes–
invited_bystringyes–
levelstringyes–
statusstringyes–
tenant_idstringyes–

No examples provided.

add_tenant_service ~80

Request a new service subscription for the caller's tenant and return its status. Call this when a tenant admin wants to add a service (ADR 0016 code fix: requires `admin`, was `customer` realm role only).

NameTypeReqDescription
authorizationstringyes–
bodyobject––
tenant_idstring––

Structured output declared, but exposes no named fields.

No examples provided.

approve_access_request ~101

Approve a pending access request: issue a `member` invitation to the requester and resolve the request (level `admin` or `owner` of the request's tenant). The response carries the single-use invitation token to hand to the requester, who accepts via `accept_invitation`. 409 `access_request.not_pending` unless the request is pending.

NameTypeReqDescription
access_request_idstringyes–
authorizationstringyes–
NameTypeReqDescription
created_atstringyes–
idstringyes–
invitation_idstringyes–
statusstringyes–
tenant_idstringyes–
tokenstringyes–
updated_atstringyes–

No examples provided.

complete_billing ~136

Complete the tenant's billing details: legal-entity name and type, VAT id, invoice address, invoice email and optional PO reference. Call this when the owner or a billing contact has the details. EU VAT ids are validated against VIES by the worker; a failed operation with `billing.vat_check_unavailable` can be retried by submitting again. Returns `202` with an operation to poll.

NameTypeReqDescription
authorizationstringyes–
bodyobject–`complete_billing` body. `vat_id` is checked against the tenant's country in the service.
tenant_idstring––
NameTypeReqDescription
created_atstringyes–
error–––
finished_at–––
operation_idstringyes–
result–––
statusstringyes–
target_id–––
target_type–––
typestringyes–

No examples provided.

create_access_request ~30

Request access to the tenant that owns the caller's verified email domain.

NameTypeReqDescription
authorizationstringyes–
NameTypeReqDescription
created_atstringyes–
error–––
finished_at–––
operation_idstringyes–
result–––
statusstringyes–
target_id–––
target_type–––
typestringyes–

No examples provided.

create_invitation ~84

Invite an email address to the caller's tenant at the specified access level and return the invitation, including the raw single-use accept token. Call this when a tenant admin wants to add a new member; the invitee accepts via `accept_invitation`.

NameTypeReqDescription
authorizationstringyes–
bodyobject––
tenant_idstring––
NameTypeReqDescription
accepted_at–––
billing_contactboolean––
created_atstringyes–
emailstringyes–
expires_atstringyes–
idstringyes–
invited_bystringyes–
levelstringyes–
statusstringyes–
tenant_idstringyes–
tokenstringyes–

No examples provided.

create_self_service_tenant ~211

Create a 7-day trial tenant for the caller's business email domain (UC-052). Needs a verified email on a business domain and `attestation: true`; answers `auth.email_not_verified`, `tenant.attestation_required`, `tenant.free_mail_domain` (free-mail address), `tenant.domain_exists` (a live trial tenant on the domain) or `trial.exists_for_domain` (the domain already had its one trial; call `start_inquiry`). The trial lasts exactly 7 days; `ttl` / `expires_at` in the body are ignored.

NameTypeReqDescription
authorizationstringyes–
bodyobject–Request body for POST /v1/onboarding/tenants (UC-052). The domain is derived from the caller's verified token email claim (NFR-006 pt 4) — it is not a request parameter. attestation must be true; th…
NameTypeReqDescription
created_atstringyes–
error–––
finished_at–––
operation_idstringyes–
result–––
statusstringyes–
target_id–––
target_type–––
typestringyes–

No examples provided.

dismiss_access_request ~83

Dismiss a pending access request (level `admin` or `owner` of the request's tenant). The requester is mailed — naming the tenant, never the dismissing admin — and may ask again. 409 `access_request.not_pending` unless the request is pending.

NameTypeReqDescription
access_request_idstringyes–
authorizationstringyes–
NameTypeReqDescription
created_atstringyes–
idstringyes–
statusstringyes–
tenant_idstringyes–
updated_atstringyes–

No examples provided.

enrich_domain ~32

Fetch the caller's domain imprint and suggest legal-entity details (UC-057).

NameTypeReqDescription
authorizationstringyes–
NameTypeReqDescription
confidencenumber––
country–––
entity_type–––
legal_entity_name–––
source_url–––

No examples provided.

get_billing ~73

Return the tenant's stored billing details: VAT id, invoice address, invoice email and PO reference. Call this to check whether billing is complete; only the owner and billing contacts may read it (`403 rbac.insufficient_level`).

NameTypeReqDescription
authorizationstringyes–
tenant_idstring––
NameTypeReqDescription
address_line1–––
address_line2–––
billing_completedbooleanyes–
billing_completed_at–––
city–––
countrystringyes–
invoice_email–––
legal_entity_typestringyes–
namestringyes–
other_label–––
po_reference–––
postal_code–––
vat_id–––
vat_validated_at–––

No examples provided.

get_catalog_templates ~73

Return the enabled ApplicationTemplate catalog, ordered by name. Call this to discuss trial and template options with a prospect or customer before starting a trial. If this doesn't answer your question, call `start_inquiry` to ask 4chems directly or request a call.

NameTypeReqDescription
authorizationstring––
NameTypeReqDescription
resultarrayyes–

No examples provided.

get_legal_entity_types ~77

Return the legal-entity types available for *country*, ordered alphabetically. If this doesn't answer your question, call `start_inquiry` to ask 4chems directly or request a call.

NameTypeReqDescription
authorizationstring––
countrystringyesISO 3166-1 alpha-2 country code
NameTypeReqDescription
resultarrayyes–

No examples provided.

get_my_access ~61

Return the caller's access level per related tenant. Call this to check what the current caller is authorized to do before attempting an action that requires a specific level, or to discover a pending invitation or access request.

NameTypeReqDescription
authorizationstringyes–
NameTypeReqDescription
resultarrayyes–

No examples provided.

get_my_operation ~64

Return the status, result and error of an operation the caller started, such as the `Location` of a `202` from `complete_billing`. Call this to poll it to completion.

NameTypeReqDescription
authorizationstringyes–
operation_idstringyes–
NameTypeReqDescription
created_atstringyes–
error–––
finished_at–––
operation_idstringyes–
result–––
statusstringyes–
target_id–––
target_type–––
typestringyes–

No examples provided.

get_onboarding_route ~49

Return the next onboarding step. If this doesn't answer your question, call `start_inquiry` to ask 4chems directly or request a call.

NameTypeReqDescription
authorizationstring––
NameTypeReqDescription
actionstringyes–
next_step–––
registration_methods–––
registration_url–––
subscription–––
tenant_name–––

No examples provided.

grant_assignment ~48

Grant a role x scope assignment to a tenant member.

NameTypeReqDescription
authorizationstringyes–
bodyobject––
substringyes–
tenant_idstring––
NameTypeReqDescription
expires_at–yes–
granted_atstringyes–
granted_bystringyes–
idstringyes–
rolestringyes–
scope_idstringyes–
scope_typestringyes–
subjectstringyes–
subject_typestringyes–

No examples provided.

list_consents ~90

Return the caller's own recorded consents plus the tenant-scope consents of every tenant where the caller is at least a viewer. Call this to check which legal documents have already been accepted before asking again. Pass `tenant_id` to list one tenant's consents only (a caller of several tenants must).

NameTypeReqDescription
authorizationstringyes–
tenant_idstring––
NameTypeReqDescription
resultarrayyes–

No examples provided.

list_invitations ~64

List all invitations for the caller's tenant, most recent first. Call this to show a tenant admin which invitations are pending, accepted, or revoked; the raw token is never included.

NameTypeReqDescription
authorizationstringyes–
tenant_idstring––
NameTypeReqDescription
resultarrayyes–

No examples provided.

list_members ~34

List tenant members with their effective role x scope assignments.

NameTypeReqDescription
authorizationstringyes–
tenant_idstring––
NameTypeReqDescription
membersarrayyes–
tenant_idstringyes–

No examples provided.

list_tenant_services ~53

Return the caller's tenant's active service subscriptions. Call this before offering to add a service, to check what is already subscribed.

NameTypeReqDescription
authorizationstringyes–
tenant_idstring––
NameTypeReqDescription
resultarrayyes–

No examples provided.

record_consent ~73

Record acceptance of a legal document version and return the entry; call this only after showing the user the document URL and version and receiving an explicit affirmative answer.

NameTypeReqDescription
authorizationstringyes–
document_codestringyes–
document_versionstringyes–
tenant_idstring––
NameTypeReqDescription
document_codestringyes–
document_versionstringyes–
granted_atstringyes–
idstringyes–
sourcestringyes–
subject_substringyes–
tenant_id–––

No examples provided.

revoke_assignment ~49

Revoke a role x scope assignment from a tenant member.

NameTypeReqDescription
authorizationstringyes–
idstringyes–
substringyes–
tenant_idstring––

No output schema declared.

No examples provided.

revoke_invitation ~73

Revoke a pending invitation so its token can no longer be accepted. Call this when a tenant admin wants to withdraw an invite sent by mistake or no longer needed; accepted invitations cannot be revoked.

NameTypeReqDescription
authorizationstringyes–
invitation_idstringyes–
tenant_idstring––

No output schema declared.

No examples provided.

start_account_registration ~141

Start registering a 4chems account with a business email address (`email`, `name`, optional `company`). Anonymous. Emails a 6-digit code to the address; no account exists yet. Ask the user for the code, then call verify_account_registration with the returned challenge_id and code. Free-mail addresses (gmail.com, ...) are refused: use the company address, or call start_inquiry. The answer is the same whether or not the address already has an account.

NameTypeReqDescription
authorizationstring––
bodyobject–Request body for POST /v1/onboarding/registrations/account (UC-088).
NameTypeReqDescription
challenge_idstringyes–
expires_in_secondsintegeryes–
next_stepstringyes–

No examples provided.

start_device_login ~123

Sign in to an existing account by device login (UC-091, RFC 8628). Anonymous, empty body; the account must exist (start_account_registration, then set the password through the emailed link). Show `verification_uri` (or `verification_uri_complete`) and `user_code` to the human, who signs in there, then call `verify_device_login` with `challenge_id`, waiting `interval` seconds between calls. The response never contains the Keycloak device_code or the agent client secret.

NameTypeReqDescription
authorizationstring––
NameTypeReqDescription
challenge_idstringyes–
expires_inintegeryes–
intervalintegeryes–
user_codestringyes–
verification_uristringyes–
verification_uri_completestringyes–

No examples provided.

start_inquiry ~72

Store an anonymous inquiry draft and email a 6-digit verification code. Ask the user for the code, then call verify_inquiry with the returned challenge_id and code — the inquiry reaches 4chems only after that verification succeeds.

NameTypeReqDescription
authorizationstring––
bodyobject––
NameTypeReqDescription
challenge_idstringyes–
expires_in_secondsintegeryes–
next_stepstringyes–

No examples provided.

start_registration ~33

DEPRECATED: use start_device_login. Deprecated — use start_device_login (same behaviour).

NameTypeReqDescription
authorizationstring––
NameTypeReqDescription
challenge_idstringyes–
expires_inintegeryes–
intervalintegeryes–
user_codestringyes–
verification_uristringyes–
verification_uri_completestringyes–

No examples provided.

verify_account_registration ~81

Verify the emailed 6-digit code (`challenge_id`, `code`) and create the 4chems account. Never guess or retry codes, and never ask the user for a password.

NameTypeReqDescription
authorizationstring––
bodyobject–Request body for POST /v1/onboarding/registrations/account/verify (UC-089).
NameTypeReqDescription
accountstringyes–
next_stepstringyes–

No examples provided.

verify_device_login ~153

Poll a device login to token issuance (UC-091, RFC 8628). Anonymous. While the human has not signed in yet it answers `{"status": "pending", "retry_after": <seconds>}`: wait `retry_after` seconds and call again with the same `challenge_id`. On approval it returns Keycloak's token set (`access_token`, `refresh_token`, `expires_in`, ...) exactly once; pass the `access_token` as `authorization` ('Bearer <token>') to every other tool.

NameTypeReqDescription
authorizationstring––
bodyobject–Request body for POST /v1/onboarding/registrations/device/verify (UC-075).

Structured output declared, but exposes no named fields.

No examples provided.

verify_inquiry ~39

Verify the 6-digit code and deliver the inquiry to the helpdesk inbox.

NameTypeReqDescription
authorizationstring––
bodyobject––
NameTypeReqDescription
inquiry_idstringyes–
referencestringyes–
statusstringyes–

No examples provided.

verify_registration ~59

DEPRECATED: use verify_device_login. Deprecated — use verify_device_login (same behaviour).

NameTypeReqDescription
authorizationstring––
bodyobject–Request body for POST /v1/onboarding/registrations/device/verify (UC-075).

Structured output declared, but exposes no named fields.

No examples provided.

withdraw_access_request ~72

Withdraw the caller's own pending access request; no notification is sent. Any other caller gets 404 `access_request.not_found`, the same as for an unknown id. 409 `access_request.not_pending` unless pending.

NameTypeReqDescription
access_request_idstringyes–
authorizationstringyes–
NameTypeReqDescription
created_atstringyes–
idstringyes–
statusstringyes–
tenant_idstringyes–
updated_atstringyes–

No examples provided.

Install

How do I install the 4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting MCP server?

4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting is a hosted endpoint at https://mcp.4chems.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · mcp.4chems.com

# add to Claude Code
claude mcp add --transport http com-4chems-platform-api 'https://mcp.4chems.com/mcp'
Common questions

What is the 4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting MCP server?

4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting is an MCP server listed in the public MCP registry as com.4chems/platform-api. Remote MCP server for 4chems hosted IUCLID, CHESAR and QSAR Toolbox: onboarding, inquiries, admin. This page covers its hosted endpoint (https://mcp.4chems.com/mcp).

Is the 4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting MCP server safe to use?

4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting scores 76 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the 4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting MCP server expose?

4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting exposes 32 tools: get_catalog_templates, list_consents, record_consent, start_inquiry, verify_inquiry, and 27 more. Their descriptions and schemas cost roughly 2,477 tokens of context every time the server is loaded.

Does the 4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting MCP server require authentication?

Its publisher declares no required credentials for 4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting. We have not been able to confirm that against the live endpoint, and a server can require authorisation without declaring it here.

Is the 4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting MCP server still maintained?

4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.