# Stratalize Governance (remote · www.stratalize.com)

AI governance intelligence: EU AI Act, FCA PS7/24, NIST AI RMF, OCC enforcement, and state AI laws.

- Trust score: 70/100 (medium)
- Change this week: +8
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `www.stratalize.com`: 70/100 (this document), [markdown](https://verifymcp.io/servers/com-stratalize-governance/api-mcp-public.md), [page](https://verifymcp.io/servers/com-stratalize-governance/api-mcp-public)

## Channel facts

- Endpoint: `https://www.stratalize.com/api/mcp-public?vertical=governance`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.1.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 80/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 60/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2827 tokens (~157/item across 18 items; 18 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 73/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 19% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http com-stratalize-governance https://www.stratalize.com/api/mcp-public?vertical=governance
```

### Codex

```toml
[mcp_servers.com-stratalize-governance]
url = "https://www.stratalize.com/api/mcp-public?vertical=governance"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-stratalize-governance": {
      "type": "remote",
      "url": "https://www.stratalize.com/api/mcp-public?vertical=governance",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-stratalize-governance --url https://www.stratalize.com/api/mcp-public?vertical=governance --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-stratalize-governance:
    url: "https://www.stratalize.com/api/mcp-public?vertical=governance"
```

### Other

```json
{
  "mcpServers": {
    "com-stratalize-governance": {
      "type": "http",
      "url": "https://www.stratalize.com/api/mcp-public?vertical=governance"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 70, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 69, +5)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 64, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 63, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 62, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 61)

First indexed and scored.

## MCP tools (18)

### `get_stratalize_overview` (~112 tokens)

START HERE — Returns the complete Stratalize tool catalog: governed MCP tools across finance, healthcare, governance, real estate, crypto, and intelligence. Available via public MCP (no auth) or x402 micropayments on Base ($0.02 atomic · $0.10 benchmark · $0.50 synthesis · $1.00 premium · $3.00 outcome pack). Org intelligence, agent governance, and role briefs require OAuth. Call this first to discover tools by role or vertical.

### `get_adoption_stage` (~124 tokens)

Public mode returns FS AI RMF framework reference data only — not org-specific scoring. Use when assessing an organization FS AI RMF governance maturity stage or preparing a regulatory AI roadmap presentation. Returns INITIAL, MINIMAL, EVOLVING, or EMBEDDED classification with stage criteria and remediation priorities. Example: EVOLVING stage organizations have documented AI policies but lack systematic model validation — typical gap to EMBEDDED is 18-24 months and 12-15 additional controls. Connect org MCP for org-specific scoring. Source: FS AI Risk Management Framework.

### `get_ofac_sanctions_screening` (~123 tokens)

Use when onboarding a vendor, counterparty, or individual requires OFAC sanctions screening with attested results. Screens Treasury SDN and Consolidated lists with conservative fuzzy matching, match methodology metadata, and list version binding for GSR verification. Source: Treasury OFAC synced lists. Cryptographically attested with a post-quantum signed settlement receipt. Verify at trust.stratalize.com/verify.

Input parameters:

- `alias` (string)
- `country` (string)
- `entity_name` (string, required)
- `entity_type` (string)

### `get_oig_exclusion_screening` (~105 tokens)

Use when credentialing a healthcare provider or verifying vendor eligibility against federal exclusions. Screens HHS OIG LEIE by provider name or NPI with list version and as-of date in the attested payload. Source: HHS OIG LEIE synced exclusions. Cryptographically attested with a post-quantum signed settlement receipt. Verify at trust.stratalize.com/verify.

Input parameters:

- `npi` (string)
- `provider_name` (string)

### `get_sam_exclusion_screening` (~108 tokens)

Use when verifying federal contractor or grantee eligibility against SAM.gov exclusions. Queries SAM Exclusions API by entity name, UEI, or CAGE with conservative name matching and live attestation metadata. Source: SAM.gov Exclusions API. Cryptographically attested with a post-quantum signed settlement receipt. Verify at trust.stratalize.com/verify.

Input parameters:

- `cage_code` (string)
- `entity_name` (string)
- `uei` (string)

### `get_eu_ai_act_coverage` (~118 tokens)

Use when assessing EU AI Act compliance readiness ahead of the August 2, 2026 enforcement deadline or preparing a board AI governance briefing. Returns a composite payload with framework, deadline, total_controls, controls[], hint, and query timestamp, optionally filtered by NIST function from compliance_controls reference data. Example: Filter by MAP to review mapped EU AI Act controls and implementation statuses in the returned controls array for governance planning. Source: EU AI Act mappings in compliance_controls reference data.

Input parameters:

- `nistFunction` (string)

### `get_uk_fca_coverage` (~102 tokens)

Use when assessing FCA model risk management compliance readiness or benchmarking an AI governance program against UK regulatory expectations. Returns coverage across 13 control objectives from FCA Policy Statement PS7/24. Example: PS7/24 requires documented model validation methodology, ongoing performance monitoring, and board-level model risk appetite statement — gaps in any of the three trigger supervisory concern. Source: FCA Policy Statement PS7/24.

Input parameters:

- `nistFunction` (string)

### `get_occ_enforcement_actions` (~152 tokens)

Use when assessing regulatory risk for a national bank or federal thrift before a merger, acquisition, partnership, correspondent banking relationship, or vendor engagement. Returns active and historical OCC enforcement actions — formal agreements, consent orders, cease-and-desist orders, and civil money penalties — the same records OCC examiners pull during supervisory reviews. Example: First National Bank of Springfield — formal agreement active since March 2022 requiring BSA/AML program overhaul, independent compliance consultant, and quarterly progress reports to OCC — agreement not yet terminated, elevates acquisition risk materially. Source: OCC Enforcement Actions — official supervisory records.

Input parameters:

- `institution_name` (string, required): Bank or thrift name (e.g. First National Bank of Springfield)

### `get_sba_loan_market_data` (~159 tokens)

Use when assessing small business lending opportunity in a market, benchmarking a bank's SBA production against competitors, evaluating CRA lending performance by geography, or identifying industries with unmet capital needs. Returns SBA 7(a) and 504 loan approval data — counts, amounts, average sizes, top lenders, and industry concentration by state and NAICS sector. Example: Illinois manufacturing sector — 847 SBA loans approved in 2023, $425K average, top 3 lenders holding 31% market share — 69% of market accessible to community bank competition. Source: SBA Public Loan Disclosure Data.

Input parameters:

- `industry` (string): Industry name or NAICS code
- `state` (string)
- `year` (number)

### `get_cra_performance_ratings` (~146 tokens)

Use when evaluating a bank's Community Reinvestment Act track record before a merger application, charter acquisition, branch expansion approval, or community lending partnership. CRA ratings — Outstanding, Satisfactory, Needs to Improve, Substantial Noncompliance — are a primary federal approval factor for bank mergers and acquisitions. A 'Needs to Improve' rating can delay or block merger approval by 12-24 months. Example: Heartland Community Bank — Outstanding CRA rating, 2023 FDIC exam, fourth consecutive Outstanding — maximum approval runway for pending acquisition of Gateway Savings Bank. Source: FFIEC CRA Ratings Database — the official federal record.

Input parameters:

- `institution_name` (string, required)

### `get_federal_court_cases` (~223 tokens)

Use when screening a company, executive, vendor, or counterparty for federal litigation exposure before a contract award, acquisition, investment, board appointment, or enterprise partnership. Returns active and historical federal court dockets across all US district and appellate courts — case names, docket numbers, courts, filing dates, nature of suit, and active status. Example: Acme Corp — 4 active federal cases: patent infringement N.D. Cal. (filed 2023), FLSA collective action S.D.N.Y. with 847 plaintiffs (filed 2023), FTC antitrust investigation D.D.C. (filed 2024), securities class action S.D.N.Y. (filed 2024) — aggregate litigation liability exposure estimated above $200M. Source: CourtListener, 1M+ federal court documents.

Input parameters:

- `court` (string): Court identifier e.g. ca9, scotus, dcd, nyed, ndca
- `party_name` (string, required)
- `years_back` (number)

### `get_fec_campaign_finance` (~81 tokens)

Federal campaign finance activity — PAC committees, total political disbursements, receipts, and political footprint signal. Source: FEC electronic filings. Use for political risk monitoring and PAC compliance. Cryptographically attested with a post-quantum signed settlement receipt. Verify at trust.stratalize.com/verify.

Input parameters:

- `name` (string, required)

### `get_ftc_enforcement_history` (~132 tokens)

Use when evaluating antitrust exposure, consumer protection liability, data privacy enforcement history, or deceptive practices risk for a company before an acquisition, strategic partnership, or enterprise vendor selection. FTC consent orders impose ongoing behavioral restrictions lasting 10-20 years and carry $50,000+ per day penalties for violations. Example: Tech Platform Corp — FTC consent order 2021, $150M civil penalty, 20-year restrictions on data monetization practices, biennial compliance reporting — restrictions survive acquisition and bind acquirer. Source: FTC Enforcement Cases and Proceedings.

Input parameters:

- `company_name` (string, required)

### `get_dol_labor_violations` (~172 tokens)

Use when screening an employer, vendor, or acquisition target for wage and hour compliance risk before a contract award, supply chain partnership, PE acquisition, or HR due diligence review. Returns DOL Wage and Hour Division enforcement history — FLSA overtime violations, minimum wage violations, child labor violations — with back wages assessed and employees affected. Repeat violations are a strong predictor of class action exposure. Example: Logistics Co LLC — 3 WHD investigations 2019-2023, $1.2M back wages, 891 employees affected for FLSA overtime violations — classified repeat violator, 340% higher class action probability vs first-time violators. Source: DOL WHISARD Enforcement Database.

Input parameters:

- `employer_name` (string, required)
- `state` (string)

### `get_colorado_ai_act_requirements` (~196 tokens)

Use when building an AI governance compliance roadmap, advising on high-risk AI deployment obligations in Colorado, or briefing boards on upcoming US state AI regulatory requirements. Colorado SB 205 takes effect June 30, 2026 — the first comprehensive US state AI law. Returns developer and deployer obligations, high-risk AI system criteria, consumer rights, penalty structure ($20,000 per violation, AG enforcement), and comparison to EU AI Act. Example: AI-based loan underwriting system deployed in Colorado requires algorithmic impact assessment, plain-language consumer disclosure before first use, 3-year audit trail with AG access rights, and annual compliance certification — noncompliance triggers $20,000 per violation. Source: Colorado SB 205, enacted May 17, 2024.

Input parameters:

- `system_type` (string): Type of AI system (e.g. hiring, lending, healthcare, insurance, education) for tailored obligation analysis

### `get_nist_ai_rmf_requirements` (~177 tokens)

Use when conducting an AI risk management gap assessment, building board-level AI governance documentation, preparing for a model risk examination, or aligning an AI program with federal regulatory expectations. NIST AI RMF 1.0 is the US federal standard for AI risk management — adopted by reference in the Executive Order on Safe AI and aligned with Federal Reserve SR 26-2, OCC model risk guidance, and FDIC requirements. Returns all four functions (GOVERN, MAP, MEASURE, MANAGE) with categories, subcategories, and implementation guidance. Example: GOVERN function requires board-level AI policy, documented accountability structures, and AI risk culture assessment — the first control examiners check in a model risk review. Source: NIST AI RMF 1.0.

Input parameters:

- `function_filter` (string)

### `get_us_state_ai_legislation` (~171 tokens)

Use when mapping AI regulatory compliance obligations across multiple states, advising on jurisdiction-specific AI deployment requirements, or briefing legal and compliance teams on the US state AI legislation landscape. As of May 2026, Colorado (June 30), Illinois, Texas, California, Virginia, and 9 additional states have enacted or advanced material AI legislation — creating a patchwork of obligations for multi-state AI deployments without a federal standard. Example: Financial institution deploying AI in 12 states faces 4 distinct compliance regimes with conflicting definitions of high-risk AI — multi-state compliance cost estimated $800K-$2M annually for mid-size institutions. Source: NCSL + Stratalize Regulatory Intelligence.

Input parameters:

- `state` (string): State name or 2-letter abbreviation. Omit for national summary of all states.

### `get_model_risk_management_standards` (~182 tokens)

Use when preparing for a model risk management examination, building an SR 26-2 compliant model governance program, or assessing a financial institution's MRM framework against regulatory expectations. Returns Federal Reserve SR 26-2 and OCC requirements across development, independent validation, ongoing monitoring, and governance — with exam deficiency rates showing where institutions most commonly fail. For AI and ML models, SR 26-2 explicitly requires independent validation even for vendor-supplied models and black-box systems. Example: Documentation deficiencies are the most common exam finding at 67% of reviewed institutions — inadequate conceptual soundness documentation for credit scoring models triggers immediate MRA (Matter Requiring Attention). Source: Federal Reserve SR 26-2, OCC Bulletin 2026-13, FDIC FIL-15-2026.

Input parameters:

- `institution_type` (string)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-stratalize-governance/api-mcp-public#diagnostics

## Score history

- 2026-08-03: 70
- 2026-08-02: 70
- 2026-08-01: 69
- 2026-07-31: 69
- 2026-07-30: 64
- 2026-07-29: 63
- 2026-07-28: 62
- 2026-07-27: 62
- 2026-07-26: 61

## Links

- Remote endpoint: https://www.stratalize.com/api/mcp-public?vertical=governance
- Repository: https://github.com/Stratalize/Stratalize
- Website: https://www.stratalize.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-stratalize-governance/api-mcp-public/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-stratalize-governance/api-mcp-public/changelog.json
- HTML version of this page: https://verifymcp.io/servers/com-stratalize-governance/api-mcp-public