io.github.cyanheads/sanctions-screening-mcp-server
REMOTE · SANCTIONS-SCREENING.CASEYJHAND.COM · 2 COMPONENTS · SCANNED AUG 3
Screen names against OFAC, EU, UK, UN sanctions lists; resolve entities via GLEIF. Screening aid.
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →
Endpoint Security66
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 6 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability81
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1435 tokens (~205/item across 7 items; 6 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
remote · sanctions-screening.caseyjhand.com
claude mcp add --transport http cyanheads-sanctions-screening-mcp-server https://sanctions-screening.caseyjhand.com/mcp
[mcp_servers.cyanheads-sanctions-screening-mcp-server] url = "https://sanctions-screening.caseyjhand.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"cyanheads-sanctions-screening-mcp-server": {
"type": "remote",
"url": "https://sanctions-screening.caseyjhand.com/mcp",
"enabled": true
}
}
} openclaw mcp add cyanheads-sanctions-screening-mcp-server --url https://sanctions-screening.caseyjhand.com/mcp --transport streamable-http
mcp_servers:
cyanheads-sanctions-screening-mcp-server:
url: "https://sanctions-screening.caseyjhand.com/mcp" {
"mcpServers": {
"cyanheads-sanctions-screening-mcp-server": {
"type": "http",
"url": "https://sanctions-screening.caseyjhand.com/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Jul 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 29 Jul 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Jul 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 27 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 67
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Probed https://sanctions-screening.caseyjhand.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=caseyjhand.com | CN=WE1,O=Google Trust Services,C=US | 7 Jul 2026 | 5 Oct 2026 | ECDSA 256 | ECDSA-SHA256 | 5aad900eb2055a0b0ea55912ec19680c |
| SANs: caseyjhand.com, *.caseyjhand.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
DNSSEC secure
Validation of sanctions-screening.caseyjhand.com. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| caseyjhand.com. | present | 2371 | 13 | Verified |
| sanctions-screening.caseyjhand.com. | Verified address RRset verified with the apex keys |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains; preload |
| x-content-type-options | nosniff |
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://sanctions-screening.caseyjhand.com/mcp | Verified | 200 | |
| http (plaintext) | http://sanctions-screening.caseyjhand.com/mcp | HTTPS enforced | 301 | https://sanctions-screening.caseyjhand.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
sanctions_get_designation sanctions-screening-mcp-server: get designation ~148
Fetch the full record for one sanctions designation by source list + entry ID — the drill-in after sanctions_screen_name surfaces a candidate. Returns all published aliases, identifiers (passport/national-ID/tax), addresses, dates and places of birth, nationalities, sanctioning program, legal basis, and designation date. The record reflects exactly what the source published; missing fields mean the source omitted them. This is a screening aid — the designation record supports a compliance review, it is not itself a determination.
| Name | Type | Req | Description |
|---|---|---|---|
| entryId | string | yes | The source list's own entry ID (the sourceEntryId from sanctions_screen_name). |
| source | string | yes | Which source list the entry belongs to. |
| Name | Type | Req | Description |
|---|---|---|---|
| addresses | array | yes | Published addresses. |
| aliases | array | yes | All published aliases / name variants. |
| caveat | string | yes | Decision-support caveat — this is a screening aid, not a compliance determination. |
| datesOfBirth | array | yes | Published dates and places of birth (persons). |
| designationDate | string | — | Designation date, when published. |
| entityType | string | yes | Entity classification as published. |
| identifiers | array | yes | Published identifiers (passport, national ID, tax, registration, …). |
| legalBasis | string | — | Statutory / regulatory basis, when published. |
| nationalities | array | yes | Published nationalities / citizenships. |
| primaryName | string | yes | Primary published name. |
| program | string | — | Sanctioning program / regime, when published. |
| remarks | string | — | Free-form remarks published by the source, when present. |
| source | string | yes | Source list the entry belongs to. |
| sourceEntryId | string | yes | The source list's own entry ID. |
| sourceLabel | string | yes | Human-readable name of the source list. |
No examples provided.
sanctions_get_entity sanctions-screening-mcp-server: get entity ~142
Fetch the full GLEIF Level 1 record for one LEI: legal name, other/trading names, legal and headquarters addresses, registration status, jurisdiction, registration authority and ID, and last-update date — plus any sanctions hits screened against the same legal name across all loaded watchlists. The screening cross-reference is a screening AID: a hit is a candidate to verify against the official source, and no hit is not a clearance. LEI must be a 20-character GLEIF identifier (18 alphanumerics + 2 check digits).
| Name | Type | Req | Description |
|---|---|---|---|
| lei | string | yes | The 20-character GLEIF Legal Entity Identifier to look up. |
| Name | Type | Req | Description |
|---|---|---|---|
| caveat | string | yes | Decision-support caveat — the screening cross-reference is an aid, not a determination. |
| headquartersAddress | string | — | Single-line headquarters address, when published. |
| jurisdiction | string | — | Legal jurisdiction (ISO code), when published. |
| lastUpdate | string | — | ISO 8601 last-update timestamp from the LEI record. |
| legalAddress | string | — | Single-line legal address, when published. |
| legalName | string | yes | Registered legal name. |
| lei | string | yes | The 20-character GLEIF Legal Entity Identifier. |
| otherNames | array | yes | Other / trading names published in the LEI record. |
| registrationAuthorityEntityId | string | — | The entity's ID at its registration authority, when published. |
| registrationAuthorityId | string | — | Registration authority (RA) code, when published. |
| sanctionsHits | array | yes | Sanctions screening cross-reference on the entity's legal name. |
| status | string | — | Registration status (e.g. ISSUED, LAPSED). |
No examples provided.
sanctions_list_sources sanctions-screening-mcp-server: list sources ~115
List the sanctions watchlists (OFAC SDN + Consolidated, EU, UK, UN) and GLEIF datasets currently loaded in the local mirror, each with its record count, source URL, license, and the mirror's readiness and as-of timestamp. Use this for provenance and freshness on any result — results are only as current as the last mirror refresh, and a not-ready mirror means screening cannot run yet. Attribution: UK data is under the Open Government Licence v3.0; all sources are cited here.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| leiAsOf | string | — | ISO 8601 timestamp of the last completed GLEIF sync, when available. |
| leiReady | boolean | yes | True once the GLEIF (LEI) mirror has completed at least one full sync. |
| sanctionsAsOf | string | — | ISO 8601 timestamp of the last completed sanctions sync, when available. |
| sanctionsReady | boolean | yes | True once the sanctions mirror has completed at least one full sync. |
| sources | array | yes | All loaded sources, sanctions lists then the GLEIF dataset. |
No examples provided.
sanctions_resolve_entity sanctions-screening-mcp-server: resolve entity ~277
Resolve a company or organization name (with an optional ISO 3166-1 alpha-2 jurisdiction) to candidate GLEIF Legal Entity Identifiers (LEIs), ranked. This turns a free-text counterparty name into a stable global identifier that sanctions_get_entity and sanctions_trace_ownership key off. Strict mode (default) matches exact-normalized then all-tokens-present; fuzzy mode (or auto when strict is empty) adds Jaro-Winkler scoring labeled approximate with a raw 0–1 score. Returns potential matches to confirm against the GLEIF record — name resolution is a candidate ranking, not an authoritative identification.
| Name | Type | Req | Description |
|---|---|---|---|
| jurisdiction | — | — | Optional ISO 3166-1 alpha-2 jurisdiction filter (e.g. "US", "GB"). Empty string disables it. |
| limit | integer | — | Maximum LEI candidates to return. |
| matchMode | string | — | strict (default): exact then all-tokens-present. fuzzy: also scored Jaro-Winkler. |
| minScore | number | — | Jaro-Winkler floor for fuzzy hits (0–1); defaults to the server's configured floor. |
| name | string | yes | The company / organization name to resolve to an LEI. |
| status | string | — | Registration status filter: issued (default), lapsed, or any. |
| Name | Type | Req | Description |
|---|---|---|---|
| matchModeUsed | string | yes | The match mode actually applied (strict may upgrade to fuzzy). |
| matches | array | yes | Ranked LEI candidates, highest-confidence first. |
| normalizedQuery | string | yes | The name as the server folded it for matching. |
| notice | string | — | Guidance when no LEI matched and how to broaden. |
| totalCount | number | yes | Number of LEI candidates returned. |
No examples provided.
sanctions_screen_name sanctions-screening-mcp-server: screen name ~351
Screen a name (person, company, vessel, aircraft) against all loaded sanctions watchlists at once — OFAC SDN + Consolidated, EU, UK, and UN — alias- and fuzzy-aware. Returns scored potential matches with the source list, sanctioning program, designation date, and the matched alias. Strict mode (default) matches exact-normalized then all-tokens-present; fuzzy mode (or auto when strict is empty) adds Jaro-Winkler and phonetic matching and labels hits approximate with a raw 0–1 similarity score. This is a screening AID for a human/compliance review, NOT a compliance determination: a hit means "review this candidate against the official source," and an empty result never means "cleared."
| Name | Type | Req | Description |
|---|---|---|---|
| entityType | string | — | Restrict to one entity class, or "any" (default) to screen across all. |
| limit | integer | — | Maximum number of potential matches to return. |
| matchMode | string | — | strict (default): exact-normalized then all-tokens-present. fuzzy: also scored Jaro-Winkler + phonetic. Strict auto-falls-back to fuzzy when it finds nothing. |
| minScore | number | — | Score floor for fuzzy hits (0–1), applied uniformly to every fuzzy candidate regardless of how it was matched (Jaro-Winkler, token, or phonetic). No hit below this score is returned. Applies to fuzzy… |
| name | string | yes | The name to screen (person, organization, vessel, or aircraft). |
| sources | array | — | Restrict to specific source lists. Omit to screen all loaded lists. |
| Name | Type | Req | Description |
|---|---|---|---|
| caveat | string | yes | Decision-support caveat — this is a screening aid, not a compliance determination. |
| hits | array | yes | Scored potential matches, highest-confidence first. |
| matchModeUsed | string | yes | The match mode actually applied (strict may auto-upgrade to fuzzy on empty). |
| normalizedQuery | string | yes | The name as the server folded it for matching. |
| notice | string | — | Guidance when no candidate matched — how to broaden, and what an empty result does NOT mean. |
| totalCount | number | yes | Number of potential matches returned. |
No examples provided.
sanctions_trace_ownership sanctions-screening-mcp-server: trace ownership ~223
Trace the GLEIF Level 2 corporate-ownership graph for an LEI: direct and ultimate parents and/or children, traversed breadth-first to a bounded depth, with relationship type for each edge. Set screenNodes to also screen every entity in the graph against all loaded watchlists — beneficial-ownership screening that resolves "is anyone in this ownership chain sanctioned." Each per-node screen is a screening AID: hits are candidates to verify, and an empty result for a node is not a clearance of that node. Requires a valid 20-character LEI (use sanctions_resolve_entity to obtain one).
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | — | Maximum traversal depth from the root entity (1–5). |
| direction | string | — | Walk parents (who owns it), children (what it owns), or both (default). |
| lei | string | yes | The 20-character GLEIF LEI at the root of the ownership graph. |
| screenNodes | boolean | — | When true, screen every node's legal name against all watchlists for beneficial-ownership screening. |
| Name | Type | Req | Description |
|---|---|---|---|
| caveat | string | yes | Decision-support caveat — node screening is an aid, not a determination. |
| edges | array | yes | Directed ownership edges between the nodes. |
| flaggedNodeCount | number | yes | How many screened nodes had at least one potential watchlist match. |
| nodes | array | yes | All entities reached in the traversal, including the root. |
| rootLei | string | yes | The LEI the traversal started from. |
| screenedNodeCount | number | yes | How many nodes were screened (0 when screenNodes is false). |
No examples provided.