# 4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting (remote · mcp.4chems.com)

Remote MCP server for 4chems hosted IUCLID, CHESAR and QSAR Toolbox: onboarding, inquiries, admin.

- Trust score: 76/100 (medium)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `mcp.4chems.com`: 76/100 (this document), [markdown](https://verifymcp.io/servers/com-4chems-platform-api/mcp.md), [page](https://verifymcp.io/servers/com-4chems-platform-api/mcp)

## Channel facts

- Endpoint: `https://mcp.4chems.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.12.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 66/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not yet verified: we couldn't confirm whether this endpoint requires it.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 62/100
  - AI-judged instruction clarity (fair).
  - Tool/resource definitions use about 2872 tokens (~89/item across 32 items; 32 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 87/100
  - Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 74/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 10% of tool parameters carry a description.
  - Structured output schemas are declared (94% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 33 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the 4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting MCP server?

4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting is a hosted endpoint at https://mcp.4chems.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-4chems-platform-api 'https://mcp.4chems.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-4chems-platform-api": {
      "url": "https://mcp.4chems.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-4chems-platform-api": {
      "type": "http",
      "url": "https://mcp.4chems.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-4chems-platform-api]
url = "https://mcp.4chems.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-4chems-platform-api": {
      "type": "remote",
      "url": "https://mcp.4chems.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-4chems-platform-api --url 'https://mcp.4chems.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-4chems-platform-api:
    url: "https://mcp.4chems.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-4chems-platform-api": {
      "Transport": "http",
      "Url": "https://mcp.4chems.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-4chems-platform-api -t streamable-http -u 'https://mcp.4chems.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-4chems-platform-api": {
      "type": "http",
      "url": "https://mcp.4chems.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-04 (score 75, 0)

- [security regression] Authorization: fail → unverified

### 2026-11-03 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-01 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-30 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-28 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-26 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-23 (score 70, +1)

No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (32)

### `get_catalog_templates` (~73 tokens)

Get Catalog Templates

Return the enabled ApplicationTemplate catalog, ordered by name. Call this to
discuss trial and template options with a prospect or customer before starting a
trial. If this doesn't answer your question, call `start_inquiry` to ask
4chems directly or request a call.

Input parameters:

- `authorization` (string)

Output parameters:

- `result` (array)

### `list_consents` (~90 tokens)

List Consents

Return the caller's own recorded consents plus the tenant-scope consents of
every tenant where the caller is at least a viewer. Call this to check which legal
documents have already been accepted before asking again. Pass `tenant_id` to
list one tenant's consents only (a caller of several tenants must).

Input parameters:

- `authorization` (string, required)
- `tenant_id` (string)

Output parameters:

- `result` (array)

### `record_consent` (~73 tokens)

Record Consent

Record acceptance of a legal document version and return the entry; call this
only after showing the user the document URL and version and receiving an
explicit affirmative answer.

Input parameters:

- `authorization` (string, required)
- `document_code` (string, required)
- `document_version` (string, required)
- `tenant_id` (string)

Output parameters:

- `document_code` (string)
- `document_version` (string)
- `granted_at` (string)
- `id` (string)
- `source` (string)
- `subject_sub` (string)
- `tenant_id`

### `start_inquiry` (~72 tokens)

Start Inquiry

Store an anonymous inquiry draft and email a 6-digit verification code.
Ask the user for the code, then call verify_inquiry with the returned
challenge_id and code — the inquiry reaches 4chems only after that
verification succeeds.

Input parameters:

- `authorization` (string)
- `body` (object)

Output parameters:

- `challenge_id` (string)
- `expires_in_seconds` (integer)
- `next_step` (string)

### `verify_inquiry` (~39 tokens)

Verify Inquiry

Verify the 6-digit code and deliver the inquiry to the helpdesk inbox.

Input parameters:

- `authorization` (string)
- `body` (object)

Output parameters:

- `inquiry_id` (string)
- `reference` (string)
- `status` (string)

### `accept_invitation` (~66 tokens)

Accept Invitation

Accept a pending invitation and grant the invitee's first role assignment.
Call this when an invitee has a valid invite link and wants to join the
tenant; single-use, consuming the token marks it accepted.

Input parameters:

- `authorization` (string, required)
- `token` (string, required)

Output parameters:

- `accepted_at`
- `billing_contact` (boolean)
- `created_at` (string)
- `email` (string)
- `expires_at` (string)
- `id` (string)
- `invited_by` (string)
- `level` (string)
- `status` (string)
- `tenant_id` (string)

### `get_my_access` (~61 tokens)

Get My Access

Return the caller's access level per related tenant. Call this to check
what the current caller is authorized to do before attempting an action
that requires a specific level, or to discover a pending invitation or
access request.

Input parameters:

- `authorization` (string, required)

Output parameters:

- `result` (array)

### `create_access_request` (~30 tokens)

Create Access Request Endpoint

Request access to the tenant that owns the caller's verified email domain.

Input parameters:

- `authorization` (string, required)

Output parameters:

- `created_at` (string)
- `error`
- `finished_at`
- `operation_id` (string)
- `result`
- `status` (string)
- `target_id`
- `target_type`
- `type` (string)

### `approve_access_request` (~101 tokens)

Approve Access Request Endpoint

Approve a pending access request: issue a `member` invitation to the
requester and resolve the request (level `admin` or `owner` of the
request's tenant). The response carries the single-use invitation token
to hand to the requester, who accepts via `accept_invitation`. 409
\`access_request.not_pending` unless the request is pending.

Input parameters:

- `access_request_id` (string, required)
- `authorization` (string, required)

Output parameters:

- `created_at` (string)
- `id` (string)
- `invitation_id` (string)
- `status` (string)
- `tenant_id` (string)
- `token` (string)
- `updated_at` (string)

### `dismiss_access_request` (~83 tokens)

Dismiss Access Request Endpoint

Dismiss a pending access request (level `admin` or `owner` of the
request's tenant). The requester is mailed — naming the tenant, never the
dismissing admin — and may ask again. 409 `access_request.not_pending`
unless the request is pending.

Input parameters:

- `access_request_id` (string, required)
- `authorization` (string, required)

Output parameters:

- `created_at` (string)
- `id` (string)
- `status` (string)
- `tenant_id` (string)
- `updated_at` (string)

### `withdraw_access_request` (~72 tokens)

Withdraw Access Request Endpoint

Withdraw the caller's own pending access request; no notification is
sent. Any other caller gets 404 `access_request.not_found`, the same as
for an unknown id. 409 `access_request.not_pending` unless pending.

Input parameters:

- `access_request_id` (string, required)
- `authorization` (string, required)

Output parameters:

- `created_at` (string)
- `id` (string)
- `status` (string)
- `tenant_id` (string)
- `updated_at` (string)

### `enrich_domain` (~32 tokens)

Enrich Domain Endpoint

Fetch the caller's domain imprint and suggest legal-entity details (UC-057).

Input parameters:

- `authorization` (string, required)

Output parameters:

- `confidence` (number)
- `country`
- `entity_type`
- `legal_entity_name`
- `source_url`

### `start_device_login` (~123 tokens)

Start Device Login

Sign in to an existing account by device login (UC-091, RFC 8628). Anonymous,
empty body; the account must exist (start_account_registration, then set the
password through the emailed link). Show `verification_uri` (or
\`verification_uri_complete`) and `user_code` to the human, who signs in there,
then call `verify_device_login` with `challenge_id`, waiting `interval` seconds
between calls. The response never contains the Keycloak device_code or the
agent client secret.

Input parameters:

- `authorization` (string)

Output parameters:

- `challenge_id` (string)
- `expires_in` (integer)
- `interval` (integer)
- `user_code` (string)
- `verification_uri` (string)
- `verification_uri_complete` (string)

### `verify_device_login` (~153 tokens)

Verify Device Login

Poll a device login to token issuance (UC-091, RFC 8628). Anonymous. While
the human has not signed in yet it answers `{"status": "pending",
"retry_after": <seconds>}`: wait `retry_after` seconds and call again with the
same `challenge_id`. On approval it returns Keycloak's token set
(`access_token`, `refresh_token`, `expires_in`, ...) exactly once; pass the
\`access_token` as `authorization` ('Bearer <token>') to every other tool.

Input parameters:

- `authorization` (string)
- `body` (object): Request body for POST /v1/onboarding/registrations/device/verify (UC-075).

### `start_account_registration` (~141 tokens)

Start Account Registration

Start registering a 4chems account with a business email address (`email`,
\`name`, optional `company`). Anonymous. Emails a 6-digit code to the address;
no account exists yet. Ask the user for the code, then call
verify_account_registration with the returned challenge_id and code. Free-mail
addresses (gmail.com, ...) are refused: use the company address, or call
start_inquiry. The answer is the same whether or not the address already has
an account.

Input parameters:

- `authorization` (string)
- `body` (object): Request body for POST /v1/onboarding/registrations/account (UC-088).

Output parameters:

- `challenge_id` (string)
- `expires_in_seconds` (integer)
- `next_step` (string)

### `verify_account_registration` (~81 tokens)

Verify Account Registration

Verify the emailed 6-digit code (`challenge_id`, `code`) and create the
4chems account. Never guess or retry codes, and never ask the user for a
password.

Input parameters:

- `authorization` (string)
- `body` (object): Request body for POST /v1/onboarding/registrations/account/verify (UC-089).

Output parameters:

- `account` (string)
- `next_step` (string)

### `start_registration` (~33 tokens)

Start Registration (deprecated — use start_device_login)

DEPRECATED: use start_device_login. Deprecated — use start_device_login (same behaviour).

Input parameters:

- `authorization` (string)

Output parameters:

- `challenge_id` (string)
- `expires_in` (integer)
- `interval` (integer)
- `user_code` (string)
- `verification_uri` (string)
- `verification_uri_complete` (string)

### `verify_registration` (~59 tokens)

Verify Registration (deprecated — use verify_device_login)

DEPRECATED: use verify_device_login. Deprecated — use verify_device_login (same behaviour).

Input parameters:

- `authorization` (string)
- `body` (object): Request body for POST /v1/onboarding/registrations/device/verify (UC-075).

### `get_onboarding_route` (~49 tokens)

Get Onboarding Route

Return the next onboarding step. If this doesn't answer your question, call
\`start_inquiry` to ask 4chems directly or request a call.

Input parameters:

- `authorization` (string)

Output parameters:

- `action` (string)
- `next_step`
- `registration_methods`
- `registration_url`
- `subscription`
- `tenant_name`

### `create_self_service_tenant` (~211 tokens)

Create Self Service Tenant

Create a 7-day trial tenant for the caller's business email domain (UC-052).
Needs a verified email on a business domain and `attestation: true`; answers
\`auth.email_not_verified`, `tenant.attestation_required`,
\`tenant.free_mail_domain` (free-mail address), `tenant.domain_exists`
(a live trial tenant on the domain) or `trial.exists_for_domain` (the
domain already had its one trial; call `start_inquiry`). The trial lasts
exactly 7 days; `ttl` / `expires_at` in the body are ignored.

Input parameters:

- `authorization` (string, required)
- `body` (object): Request body for POST /v1/onboarding/tenants (UC-052). The domain is derived from the caller's verified token email claim (NFR-006 pt 4) — it is not a request parameter. attestation must be true; th…

Output parameters:

- `created_at` (string)
- `error`
- `finished_at`
- `operation_id` (string)
- `result`
- `status` (string)
- `target_id`
- `target_type`
- `type` (string)

### `get_my_operation` (~64 tokens)

Get My Operation

Return the status, result and error of an operation the caller started, such as
the `Location` of a `202` from `complete_billing`. Call this to poll it to completion.

Input parameters:

- `authorization` (string, required)
- `operation_id` (string, required)

Output parameters:

- `created_at` (string)
- `error`
- `finished_at`
- `operation_id` (string)
- `result`
- `status` (string)
- `target_id`
- `target_type`
- `type` (string)

### `get_legal_entity_types` (~77 tokens)

Get Legal Entity Types

Return the legal-entity types available for *country*, ordered alphabetically.
If this doesn't answer your question, call `start_inquiry` to ask 4chems directly
or request a call.

Input parameters:

- `authorization` (string)
- `country` (string, required): ISO 3166-1 alpha-2 country code

Output parameters:

- `result` (array)

### `get_billing` (~73 tokens)

Get Billing

Return the tenant's stored billing details: VAT id, invoice address, invoice
email and PO reference. Call this to check whether billing is complete; only
the owner and billing contacts may read it (`403 rbac.insufficient_level`).

Input parameters:

- `authorization` (string, required)
- `tenant_id` (string)

Output parameters:

- `address_line1`
- `address_line2`
- `billing_completed` (boolean)
- `billing_completed_at`
- `city`
- `country` (string)
- `invoice_email`
- `legal_entity_type` (string)
- `name` (string)
- `other_label`
- `po_reference`
- `postal_code`
- `vat_id`
- `vat_validated_at`

### `complete_billing` (~136 tokens)

Complete Billing

Complete the tenant's billing details: legal-entity name and type, VAT id,
invoice address, invoice email and optional PO reference. Call this when the
owner or a billing contact has the details. EU VAT ids are validated against
VIES by the worker; a failed operation with `billing.vat_check_unavailable`
can be retried by submitting again. Returns `202` with an operation to poll.

Input parameters:

- `authorization` (string, required)
- `body` (object): `complete_billing` body. `vat_id` is checked against the tenant's country in the service.
- `tenant_id` (string)

Output parameters:

- `created_at` (string)
- `error`
- `finished_at`
- `operation_id` (string)
- `result`
- `status` (string)
- `target_id`
- `target_type`
- `type` (string)

### `list_invitations` (~64 tokens)

List Invitations

List all invitations for the caller's tenant, most recent first. Call this to
show a tenant admin which invitations are pending, accepted, or revoked; the
raw token is never included.

Input parameters:

- `authorization` (string, required)
- `tenant_id` (string)

Output parameters:

- `result` (array)

### `create_invitation` (~84 tokens)

Create Invitation

Invite an email address to the caller's tenant at the specified access
level and return the invitation, including the raw single-use accept
token. Call this when a tenant admin wants to add a new member; the
invitee accepts via `accept_invitation`.

Input parameters:

- `authorization` (string, required)
- `body` (object)
- `tenant_id` (string)

Output parameters:

- `accepted_at`
- `billing_contact` (boolean)
- `created_at` (string)
- `email` (string)
- `expires_at` (string)
- `id` (string)
- `invited_by` (string)
- `level` (string)
- `status` (string)
- `tenant_id` (string)
- `token` (string)

### `revoke_invitation` (~73 tokens)

Revoke Invitation

Revoke a pending invitation so its token can no longer be accepted. Call this
when a tenant admin wants to withdraw an invite sent by mistake or no longer
needed; accepted invitations cannot be revoked.

Input parameters:

- `authorization` (string, required)
- `invitation_id` (string, required)
- `tenant_id` (string)

### `list_members` (~34 tokens)

List Members

List tenant members with their effective role x scope assignments.

Input parameters:

- `authorization` (string, required)
- `tenant_id` (string)

Output parameters:

- `members` (array)
- `tenant_id` (string)

### `grant_assignment` (~48 tokens)

Grant Assignment

Grant a role x scope assignment to a tenant member.

Input parameters:

- `authorization` (string, required)
- `body` (object)
- `sub` (string, required)
- `tenant_id` (string)

Output parameters:

- `expires_at`
- `granted_at` (string)
- `granted_by` (string)
- `id` (string)
- `role` (string)
- `scope_id` (string)
- `scope_type` (string)
- `subject` (string)
- `subject_type` (string)

### `revoke_assignment` (~49 tokens)

Revoke Assignment

Revoke a role x scope assignment from a tenant member.

Input parameters:

- `authorization` (string, required)
- `id` (string, required)
- `sub` (string, required)
- `tenant_id` (string)

### `list_tenant_services` (~53 tokens)

List Tenant Services

Return the caller's tenant's active service subscriptions. Call this before
offering to add a service, to check what is already subscribed.

Input parameters:

- `authorization` (string, required)
- `tenant_id` (string)

Output parameters:

- `result` (array)

### `add_tenant_service` (~80 tokens)

Add Tenant Service

Request a new service subscription for the caller's tenant and return its
status. Call this when a tenant admin wants to add a service (ADR 0016
code fix: requires `admin`, was `customer` realm role only).

Input parameters:

- `authorization` (string, required)
- `body` (object)
- `tenant_id` (string)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-4chems-platform-api/mcp#diagnostics

## Score history

- 2026-11-05: 76
- 2026-11-04: 75
- 2026-11-03: 75
- 2026-11-02: 74
- 2026-11-01: 74
- 2026-10-31: 73
- 2026-10-30: 73
- 2026-10-29: 72
- 2026-10-28: 72
- 2026-10-27: 71
- 2026-10-26: 71
- 2026-10-25: 70
- 2026-10-24: 70
- 2026-10-23: 70
- 2026-10-22: 69
- 2026-10-21: 69
- 2026-10-20: 68
- 2026-10-19: 68
- 2026-10-18: 67
- 2026-10-17: 67
- 2026-10-16: 66
- 2026-10-15: 66
- 2026-10-14: 65
- 2026-10-13: 65
- 2026-10-12: 64
- 2026-10-10: 63

## Common questions

### What is the 4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting MCP server?

4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting is an MCP server listed in the public MCP registry as com.4chems/platform-api. Remote MCP server for 4chems hosted IUCLID, CHESAR and QSAR Toolbox: onboarding, inquiries, admin. This page covers its hosted endpoint (https://mcp.4chems.com/mcp).

### Is the 4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting MCP server safe to use?

4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting scores 76 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the 4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting MCP server expose?

4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting exposes 32 tools: get_catalog_templates, list_consents, record_consent, start_inquiry, verify_inquiry, and 27 more. Their descriptions and schemas cost roughly 2,477 tokens of context every time the server is loaded.

### Does the 4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting MCP server require authentication?

Its publisher declares no required credentials for 4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting. We have not been able to confirm that against the live endpoint, and a server can require authorisation without declaring it here.

### Is the 4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting MCP server still maintained?

4chems Platform — IUCLID, CHESAR & QSAR Toolbox hosting is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://mcp.4chems.com/mcp
- Repository: https://github.com/4chems/mcp
- Website: https://www.4chems.com/mcp/
- Changelog RSS feed: https://verifymcp.io/servers/com-4chems-platform-api/mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-4chems-platform-api/mcp.json
- HTML version of this page: https://verifymcp.io/servers/com-4chems-platform-api/mcp