WhiteIntel — Ownership Intelligence
REMOTE · WHITEINTEL.DEV · 2 COMPONENTS
UBO, sanctions & ownership graph. 23 tools, 130.7M entities, 31 registries.
Available components
Last scanned (11 hours ago)
Scores higher than 9% of remote servers
Reachable. Last reached 18 Oct 2026.
Category Finance and Payments
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not yet verified: we couldn't confirm whether this endpoint requires it. View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability0
- Transport check failed: declared streamable-http, but the endpoint returned HTTP 402. See how to fix → View diagnostics → Fail
Schema Quality & AI Usability0
- Schema not yet verified: we couldn't read the endpoint's schema, or could read only part of its tool list.Unverified
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage0
- Tool coverage not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.Unverified
Tool Safety0
- Tool safety not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.Unverified
Capabilities0
- Capabilities not yet verified: we couldn't read the endpoint's capabilities.Unverified
Unverified: 5 categories
Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 30 Sept 26 −62
- Endpoint reachability: reachable → not serving MCP ▼ security
- Authorization: partial → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Stability: pass → unverified ▼ security
- Transport: pass → fail ▼ security
- Schema quality: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- 29 Sept 26 +62
- Authorization: unverified → partial ▲ security
- Injection markers: unverified → pass ▲ security
- Stability: unverified → pass ▲ security
- Transport: fail → pass ▲ security
- Endpoint reachability: not serving MCP → reachable ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 23 Sept 26 −62
- Endpoint reachability: reachable → not serving MCP ▼ security
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Authorization: partial → unverified ▼ security
- Transport: pass → fail ▼ security
- Schema quality: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- 18 Sept 26 0
- Stability: 0.97 → pass security
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Sept 26 0
- Tool “get_pricing” rewrote its description, which is the text the model reads security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 18 Oct 2026 · Probed https://whiteintel.dev/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=whiteintel.dev | CN=YR2,O=Let's Encrypt,C=US | 21 Aug 2026 | 19 Nov 2026 | RSA 2048 | SHA256-RSA | 5cb22e494bb67fdee91be183637d94015a1 |
| SANs: whiteintel.dev | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of whiteintel.dev. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | present | 60074 | 8 | Verified |
| whiteintel.dev. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Inconclusive
We could not reach the endpoint well enough to judge its authorisation posture.
| Result | Inconclusive |
|---|---|
| HTTP status | 402 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://whiteintel.dev/api/mcp | HTTP error | 402 | |
| http (plaintext) | http://whiteintel.dev/api/mcp | HTTPS enforced | 308 | https://whiteintel.dev/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
buy_dossier ~143
Start a one-off dossier purchase via guest Stripe Checkout — no WhiteIntel account needed (Stripe collects an email for delivery). Pick a tier ('standard' €39: full UBO chain + financial history · 'premium' €99: additionally itemised assets) and optionally a bulk pack ('5'/'25'), plus the entity_id the report is for. Returns checkout_url + next_steps: open the URL to pay, then feed the session_id to claim_dossier. See get_pricing for the full list.
| Name | Type | Req | Description |
|---|---|---|---|
| entity_id | string | – | – |
| entity_name | string | – | – |
| pack | string | – | – |
| tier | string | yes | – |
No output schema declared.
No examples provided.
check_offshore_exposure ~46
Walk the ownership chain and flag sanctioned + secrecy-jurisdiction hops — the offshore-layering lead.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
| max_depth | number | – | – |
No output schema declared.
No examples provided.
claim_dossier ~98
Redeem a paid Stripe Checkout session for a dossier access token. Pass the session_id (cs_…) from the post-payment redirect after buy_dossier. Returns { token, entity_id, tier } — pass the token to get_dossier as its `token` input. Idempotent; fails with 402 not_paid until payment completes, so wait for the human to finish Checkout then call again.
| Name | Type | Req | Description |
|---|---|---|---|
| session_id | string | yes | – |
No output schema declared.
No examples provided.
find_similar ~99
Entities most similar to a given one — the nearest corpus dossier cards ('more like this') for peer discovery. Pass an entity id from search_entities / semantic_search. COVERAGE IS PARTIAL — only entities in the embedded risk-scored subset (~1.9% of the corpus and growing) return peers; an entity outside it returns empty for now, not an error.
| Name | Type | Req | Description |
|---|---|---|---|
| entity_id | string | yes | – |
| k | number | – | – |
No output schema declared.
No examples provided.
get_company_details ~43
Registered profile for a company: address, status, SIC, incorporation, plus filing/compliance (overdue, charges, former names).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
get_dossier ~101
Structured, fully-cited dossier for one entity: cross-source identity, ownership/UBO chain, risk signals, filed financials, provenance. Pass the `token` from claim_dossier to unlock the full paid depth you purchased for this entity.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
| token | string | – | Optional dossier access token from claim_dossier — unlocks the full paid depth (UBO chain, assets, financial history) for this entity. |
No output schema declared.
No examples provided.
get_entity ~29
Full record for one entity id + its direct relationships, with provenance.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
get_financials ~42
Filed financials year-over-year: turnover, profit, net assets, cash, employees (Companies House iXBRL).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
get_payment_link ~135
PERMANENT, shareable Stripe payment links for the one-off dossiers — use this instead of buy_dossier when you need something you can HAND TO A HUMAN. buy_dossier mints a cs_live_ Checkout Session that is single-use and expires in 24h, so it is useless in a report or a message the human reads tomorrow; these links never expire and can be reused. Append ?client_reference_id=<entity uuid from search_entities> to bind the purchase to one company — without it the buyer gets a dossier credit, spendable on any entity later. No API key needed, no WhiteIntel account needed.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_pricing ~99
WhiteIntel's price list + the exact machine flow for buying access: one verified dossier (€29, one price, everything), subscriptions (Pro €99/mo, Scale €499/mo) and the metered API. Returns how_an_agent_buys — buy_dossier opens a Stripe Checkout, claim_dossier mints the token, get_dossier with that token returns the unlocked report. Static, no network — check it before recommending a purchase.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_pulse ~107
The corpus activity feed — recent ownership-change and filed-accounts events, cited. Pass since=<next_since> to stream only new events. The default (unfiltered) feed returns only events that carry a source URL. `watchlist` (OpenSanctions PEP listings) is opt-in via kind=watchlist and is currently uncited (source-url NULL for every row).
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | – | – |
| limit | number | – | – |
| since | string | – | – |
No output schema declared.
No examples provided.
get_sanctions ~43
An entity's sanctions exposure (OFAC/EU/UN/UK) for it and its resolved cluster siblings, each cited.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
graph_neighbourhood ~173
Every ownership/control edge within a bounded number of hops of one entity, in BOTH directions — who it controls, who controls it, and their neighbours. Hard-capped in the database: depth 3, 300 edges, and at most 25 edges followed per entity per direction per hop. When the edge budget runs out the response sets `truncated: true` and says so — the corpus contains single entities with more than 22,000 edges, so a truncated view is normal for hubs, not an error.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | number | – | Hops, 1–3 (default 2). Also capped by the caller's plan. |
| edges | number | – | Edge budget, 10–300 (default 120). |
| root | string | yes | Entity uuid from search_entities / resolve. |
No output schema declared.
No examples provided.
graph_path ~168
How two entities are connected: the ordered hops of a bounded breadth-first search over ownership and control edges in both directions. ⚠️ BOUNDED, NOT EXHAUSTIVE — at most 15 edges are followed per entity, per direction, per hop, so `found: false` means NO PATH WAS FOUND WITHIN THOSE BOUNDS and is NOT evidence that the two entities are unconnected. The response always carries `exhaustive: false`; never report a negative result as a clean bill of health.
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | yes | Entity uuid. |
| max_depth | number | – | Hops, 1–4 (default 3). Depth 4 is measurably slower on densely connected entities — ask for it deliberately. |
| to | string | yes | Entity uuid. |
No output schema declared.
No examples provided.
list_asset_coverage ~284
The WhiteIntel ASSET-ownership coverage map — who owns the plane / yacht / property, and HOW we hold that link. The companion to list_jurisdictions for physical assets. Each row is one asset class × area with a `tier`: `deep` = we ingest a bulk source that ties the asset to an OWNER (e.g. FAA US aircraft, HM Land Registry UK property) · `indexed` = held only via leaks/sanctions (e.g. a yacht reached through an offshore SPV in the ICIJ leaks) · `on_demand` = the source is closed/paid, so the record is procured from source on a paid request · `community` = SnitchBoard crowd tips. Also `links_to_owner` — CRITICAL, because many asset registries publish only the registration mark and NOT the owner: an offshore aircraft register (Isle of Man, Bermuda) names the SPV/owner-trust, not the human behind it, so `deep` there is still the SPV layer, and piercing to the beneficial owner is an `on_demand` bizjet-ownership buy. Read this before claiming we do or do not hold ownership for an aircraft/vessel/real-estate entity. No vendor or price is exposed. Returns { assets, count, classes, tiers, note }.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_jurisdictions ~319
The WhiteIntel coverage map — every jurisdiction we hold and HOW we hold it. Read this before telling anyone a country is or is not covered, because 'covered' means three different things. Each row carries `tier`: `deep` = we loaded the country's WHOLE national registry, so a name/number search resolves ANY company registered there; `indexed` = we hold only the leak / sanctions / GLEIF subset, so the entities that surfaced in a leak or on a sanctions list are searchable but the rest of that country's companies are NOT in the corpus; `on_demand` = the registry is closed or paid, so the specific record is procured from source when a dossier is purchased. Also `scope` (full = whole registry · subset = fragment), `depth` (`ownership` = owners/beneficial owners on the record · `officers` = directors · `identity` = name/number/address/status, owners procured on request) and `registry` (our loader, for deep tiers). So a `deep`+`full`+`ownership` row (e.g. gb, lv, ua, br) means you can trace owners for any company there; a `subset` row (e.g. cn, kr, most secrecy havens) means an empty search is 'not in the held subset', NOT 'does not exist' — the full record is bought on request. No per-record price or vendor is exposed. Returns { jurisdictions, count, tiers, note }.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
lookup_by_identifier ~78
Resolve a corpus entity by a strong identifier — lei | ofac | eu | un | uk | uen | sec | krs | gb-coh | siren | br-cnpj (Brazil RFB CNPJ, 8-digit root or full 14-digit).
| Name | Type | Req | Description |
|---|---|---|---|
| scheme | string | yes | – |
| value | string | yes | – |
No output schema declared.
No examples provided.
lookup_company ~29
UK company by Companies House number → record + ready-built ownership graph.
| Name | Type | Req | Description |
|---|---|---|---|
| number | string | yes | – |
No output schema declared.
No examples provided.
purchase_dossier ~200
BUY the full dossier for one entity programmatically — no browser, no Stripe Checkout. Debits your prepaid wallet €2 and returns the complete premium dossier (full UBO chain, filed financials, itemised assets, provenance) in the SAME response. Requires a funded API key (Authorization: Bearer wi_…). Idempotent per (buyer, entity): buying the same entity again returns it with NO second charge, so a retry is safe. If the wallet balance is too low the call returns HTTP 402 with a machine-readable payment requirement + a top-up URL — hand the top-up to a human once, then retry; the agent spends from the balance thereafter with no browser in the loop. Get the id from search_entities / resolve. This is the AGENT-NATIVE purchase path; buy_dossier is the human/browser (Stripe Checkout) path.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Entity id (uuid) from search_entities / resolve. |
No output schema declared.
No examples provided.
resolve ~92
Batch-resolve a list of company names or scheme:value identifiers (lei/siren/br-cnpj/gb-coh/uen/sec/ofac/eu/un/uk/krs) to canonical WhiteIntel entity ids + confidence in ONE call. Enrich a whole supplier/counterparty list without one lookup per row. Up to 25 anon / 100 keyed.
| Name | Type | Req | Description |
|---|---|---|---|
| queries | array | yes | Names or scheme:value identifiers. |
No output schema declared.
No examples provided.
search_companies ~35
Free-text UK Companies House company-name search → registration number.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | – |
| q | string | yes | – |
No output schema declared.
No examples provided.
search_entities ~70
Search every node in the corpus — companies AND people — by name. Returns entity ids for get_dossier / trace_ownership_path.
| Name | Type | Req | Description |
|---|---|---|---|
| juris | string | – | – |
| limit | number | – | – |
| q | string | yes | – |
| risk | string | – | – |
| type | string | – | – |
No output schema declared.
No examples provided.
semantic_search ~141
Meaning-based entity search (BGE-M3 vector ANN over the resolved dossier cards). Finds companies/people whose profile is semantically closest to a natural-language query even without a keyword match. Optional kind + jurisdiction filters. COVERAGE IS PARTIAL — the risk-scored subset of the corpus is embedded so far (~1.9% and growing with the backfill); a thin or empty result is NOT proof the entity is unknown, so pair with search_entities (lexical/name) before concluding an entity does not exist.
| Name | Type | Req | Description |
|---|---|---|---|
| jurisdiction | string | – | – |
| k | number | – | – |
| kind | string | – | – |
| query | string | yes | – |
No output schema declared.
No examples provided.
trace_ownership_path ~39
Walk ownership upward from a root entity to the ultimate beneficial owner(s).
| Name | Type | Req | Description |
|---|---|---|---|
| max_depth | number | – | – |
| root | string | yes | – |
No output schema declared.
No examples provided.
How do I install the WhiteIntel — Ownership Intelligence MCP server?
WhiteIntel — Ownership Intelligence is a hosted endpoint at https://whiteintel.dev/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · whiteintel.dev
claude mcp add --transport http dev-whiteintel-whiteintel 'https://whiteintel.dev/api/mcp'
What is the WhiteIntel — Ownership Intelligence MCP server?
WhiteIntel — Ownership Intelligence is an MCP server listed in the public MCP registry as dev.whiteintel/whiteintel. UBO, sanctions & ownership graph. 23 tools, 130.7M entities, 31 registries. This page covers its hosted endpoint (https://whiteintel.dev/api/mcp).
Is the WhiteIntel — Ownership Intelligence MCP server safe to use?
WhiteIntel — Ownership Intelligence scores 25 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the WhiteIntel — Ownership Intelligence MCP server expose?
WhiteIntel — Ownership Intelligence exposes 24 tools: resolve, search_entities, list_jurisdictions, list_asset_coverage, get_entity, and 19 more. Their descriptions and schemas cost roughly 2,613 tokens of context every time the server is loaded.
Does the WhiteIntel — Ownership Intelligence MCP server require authentication?
Its publisher declares no required credentials for WhiteIntel — Ownership Intelligence. We have not been able to confirm that against the live endpoint, and a server can require authorisation without declaring it here.
Is the WhiteIntel — Ownership Intelligence MCP server still maintained?
WhiteIntel — Ownership Intelligence is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.