# WhiteIntel — Ownership Intelligence (remote · whiteintel.dev)

UBO, sanctions & ownership graph. 23 tools, 130.7M entities, 31 registries.

- Trust score: 65/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-20

## Components

- remote · `whiteintel.dev`: 65/100 (this document), [markdown](https://verifymcp.io/servers/dev-whiteintel-whiteintel/api-mcp.md), [page](https://verifymcp.io/servers/dev-whiteintel-whiteintel/api-mcp)
- npm · `@whiteintel/mcp-server`: 67/100, [markdown](https://verifymcp.io/servers/dev-whiteintel-whiteintel/whiteintel-mcp-server.md), [page](https://verifymcp.io/servers/dev-whiteintel-whiteintel/whiteintel-mcp-server)

## Channel facts

- Endpoint: `https://whiteintel.dev/api/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.7.10`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-20.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 23 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 86/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 2608 tokens (~96/item across 27 items; 23 tools + 4 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 3/100
  - Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 73/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 20% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http dev-whiteintel-whiteintel https://whiteintel.dev/api/mcp
```

### Codex

```toml
[mcp_servers.dev-whiteintel-whiteintel]
url = "https://whiteintel.dev/api/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dev-whiteintel-whiteintel": {
      "type": "remote",
      "url": "https://whiteintel.dev/api/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dev-whiteintel-whiteintel --url https://whiteintel.dev/api/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  dev-whiteintel-whiteintel:
    url: "https://whiteintel.dev/api/mcp"
```

### Other

```json
{
  "mcpServers": {
    "dev-whiteintel-whiteintel": {
      "type": "http",
      "url": "https://whiteintel.dev/api/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-20 (score 65, 0)

- [functional regression] Schema quality: 80 → 96
- [functional improvement] Stability: unverified → 0.03
- [functional] New tool “list_asset_coverage”
- [functional] New tool “list_jurisdictions”

### 2026-08-19 (score 65)

First indexed and scored.

## MCP tools (23)

### `resolve` (~92 tokens)

Batch-resolve a list of company names or scheme:value identifiers (lei/siren/br-cnpj/gb-coh/uen/sec/ofac/eu/un/uk/krs) to canonical WhiteIntel entity ids + confidence in ONE call. Enrich a whole supplier/counterparty list without one lookup per row. Up to 25 anon / 100 keyed.

Input parameters:

- `queries` (array, required): Names or scheme:value identifiers.

### `search_entities` (~70 tokens)

Search every node in the corpus — companies AND people — by name. Returns entity ids for get_dossier / trace_ownership_path.

Input parameters:

- `juris` (string)
- `limit` (number)
- `q` (string, required)
- `risk` (string)
- `type` (string)

### `list_jurisdictions` (~319 tokens)

The WhiteIntel coverage map — every jurisdiction we hold and HOW we hold it. Read this before telling anyone a country is or is not covered, because 'covered' means three different things. Each row carries `tier`: `deep` = we loaded the country's WHOLE national registry, so a name/number search resolves ANY company registered there; `indexed` = we hold only the leak / sanctions / GLEIF subset, so the entities that surfaced in a leak or on a sanctions list are searchable but the rest of that country's companies are NOT in the corpus; `on_demand` = the registry is closed or paid, so the specific record is procured from source when a dossier is purchased. Also `scope` (full = whole registry · subset = fragment), `depth` (`ownership` = owners/beneficial owners on the record · `officers` = directors · `identity` = name/number/address/status, owners procured on request) and `registry` (our loader, for deep tiers). So a `deep`+`full`+`ownership` row (e.g. gb, lv, ua, br) means you can trace owners for any company there; a `subset` row (e.g. cn, kr, most secrecy havens) means an empty search is 'not in the held subset', NOT 'does not exist' — the full record is bought on request. No per-record price or vendor is exposed. Returns { jurisdictions, count, tiers, note }.

### `list_asset_coverage` (~284 tokens)

The WhiteIntel ASSET-ownership coverage map — who owns the plane / yacht / property, and HOW we hold that link. The companion to list_jurisdictions for physical assets. Each row is one asset class × area with a `tier`: `deep` = we ingest a bulk source that ties the asset to an OWNER (e.g. FAA US aircraft, HM Land Registry UK property) · `indexed` = held only via leaks/sanctions (e.g. a yacht reached through an offshore SPV in the ICIJ leaks) · `on_demand` = the source is closed/paid, so the record is procured from source on a paid request · `community` = SnitchBoard crowd tips. Also `links_to_owner` — CRITICAL, because many asset registries publish only the registration mark and NOT the owner: an offshore aircraft register (Isle of Man, Bermuda) names the SPV/owner-trust, not the human behind it, so `deep` there is still the SPV layer, and piercing to the beneficial owner is an `on_demand` bizjet-ownership buy. Read this before claiming we do or do not hold ownership for an aircraft/vessel/real-estate entity. No vendor or price is exposed. Returns { assets, count, classes, tiers, note }.

### `get_entity` (~29 tokens)

Full record for one entity id + its direct relationships, with provenance.

Input parameters:

- `id` (string, required)

### `get_dossier` (~101 tokens)

Structured, fully-cited dossier for one entity: cross-source identity, ownership/UBO chain, risk signals, filed financials, provenance. Pass the `token` from claim_dossier to unlock the full paid depth you purchased for this entity.

Input parameters:

- `id` (string, required)
- `token` (string): Optional dossier access token from claim_dossier — unlocks the full paid depth (UBO chain, assets, financial history) for this entity.

### `trace_ownership_path` (~39 tokens)

Walk ownership upward from a root entity to the ultimate beneficial owner(s).

Input parameters:

- `max_depth` (number)
- `root` (string, required)

### `graph_neighbourhood` (~173 tokens)

Every ownership/control edge within a bounded number of hops of one entity, in BOTH directions — who it controls, who controls it, and their neighbours. Hard-capped in the database: depth 3, 300 edges, and at most 25 edges followed per entity per direction per hop. When the edge budget runs out the response sets `truncated: true` and says so — the corpus contains single entities with more than 22,000 edges, so a truncated view is normal for hubs, not an error.

Input parameters:

- `depth` (number): Hops, 1–3 (default 2). Also capped by the caller's plan.
- `edges` (number): Edge budget, 10–300 (default 120).
- `root` (string, required): Entity uuid from search_entities / resolve.

### `graph_path` (~168 tokens)

How two entities are connected: the ordered hops of a bounded breadth-first search over ownership and control edges in both directions. ⚠️ BOUNDED, NOT EXHAUSTIVE — at most 15 edges are followed per entity, per direction, per hop, so `found: false` means NO PATH WAS FOUND WITHIN THOSE BOUNDS and is NOT evidence that the two entities are unconnected. The response always carries `exhaustive: false`; never report a negative result as a clean bill of health.

Input parameters:

- `from` (string, required): Entity uuid.
- `max_depth` (number): Hops, 1–4 (default 3). Depth 4 is measurably slower on densely connected entities — ask for it deliberately.
- `to` (string, required): Entity uuid.

### `lookup_by_identifier` (~78 tokens)

Resolve a corpus entity by a strong identifier — lei | ofac | eu | un | uk | uen | sec | krs | gb-coh | siren | br-cnpj (Brazil RFB CNPJ, 8-digit root or full 14-digit).

Input parameters:

- `scheme` (string, required)
- `value` (string, required)

### `get_sanctions` (~43 tokens)

An entity's sanctions exposure (OFAC/EU/UN/UK) for it and its resolved cluster siblings, each cited.

Input parameters:

- `id` (string, required)

### `check_offshore_exposure` (~46 tokens)

Walk the ownership chain and flag sanctioned + secrecy-jurisdiction hops — the offshore-layering lead.

Input parameters:

- `id` (string, required)
- `max_depth` (number)

### `get_company_details` (~43 tokens)

Registered profile for a company: address, status, SIC, incorporation, plus filing/compliance (overdue, charges, former names).

Input parameters:

- `id` (string, required)

### `get_financials` (~42 tokens)

Filed financials year-over-year: turnover, profit, net assets, cash, employees (Companies House iXBRL).

Input parameters:

- `id` (string, required)

### `get_pulse` (~107 tokens)

The corpus activity feed — recent ownership-change and filed-accounts events, cited. Pass since=<next_since> to stream only new events. The default (unfiltered) feed returns only events that carry a source URL. `watchlist` (OpenSanctions PEP listings) is opt-in via kind=watchlist and is currently uncited (source-url NULL for every row).

Input parameters:

- `kind` (string)
- `limit` (number)
- `since` (string)

### `lookup_company` (~29 tokens)

UK company by Companies House number → record + ready-built ownership graph.

Input parameters:

- `number` (string, required)

### `search_companies` (~35 tokens)

Free-text UK Companies House company-name search → registration number.

Input parameters:

- `limit` (number)
- `q` (string, required)

### `semantic_search` (~141 tokens)

Meaning-based entity search (BGE-M3 vector ANN over the resolved dossier cards). Finds companies/people whose profile is semantically closest to a natural-language query even without a keyword match. Optional kind + jurisdiction filters. COVERAGE IS PARTIAL — the risk-scored subset of the corpus is embedded so far (~1.9% and growing with the backfill); a thin or empty result is NOT proof the entity is unknown, so pair with search_entities (lexical/name) before concluding an entity does not exist.

Input parameters:

- `jurisdiction` (string)
- `k` (number)
- `kind` (string)
- `query` (string, required)

### `find_similar` (~99 tokens)

Entities most similar to a given one — the nearest corpus dossier cards ('more like this') for peer discovery. Pass an entity id from search_entities / semantic_search. COVERAGE IS PARTIAL — only entities in the embedded risk-scored subset (~1.9% of the corpus and growing) return peers; an entity outside it returns empty for now, not an error.

Input parameters:

- `entity_id` (string, required)
- `k` (number)

### `get_pricing` (~91 tokens)

WhiteIntel's price list + the exact machine flow for buying access: one-off dossiers (Standard €39 / Premium €99), packs, subscriptions and the metered API. Returns how_an_agent_buys — buy_dossier opens a Stripe Checkout, claim_dossier mints the token, get_dossier with that token returns the unlocked report. Static, no network — check it before recommending a purchase.

### `buy_dossier` (~143 tokens)

Start a one-off dossier purchase via guest Stripe Checkout — no WhiteIntel account needed (Stripe collects an email for delivery). Pick a tier ('standard' €39: full UBO chain + financial history · 'premium' €99: additionally itemised assets) and optionally a bulk pack ('5'/'25'), plus the entity_id the report is for. Returns checkout_url + next_steps: open the URL to pay, then feed the session_id to claim_dossier. See get_pricing for the full list.

Input parameters:

- `entity_id` (string)
- `entity_name` (string)
- `pack` (string)
- `tier` (string, required)

### `get_payment_link` (~135 tokens)

PERMANENT, shareable Stripe payment links for the one-off dossiers — use this instead of buy_dossier when you need something you can HAND TO A HUMAN. buy_dossier mints a cs_live_ Checkout Session that is single-use and expires in 24h, so it is useless in a report or a message the human reads tomorrow; these links never expire and can be reused. Append ?client_reference_id=<entity uuid from search_entities> to bind the purchase to one company — without it the buyer gets a dossier credit, spendable on any entity later. No API key needed, no WhiteIntel account needed.

### `claim_dossier` (~98 tokens)

Redeem a paid Stripe Checkout session for a dossier access token. Pass the session_id (cs_…) from the post-payment redirect after buy_dossier. Returns { token, entity_id, tier } — pass the token to get_dossier as its `token` input. Idempotent; fails with 402 not_paid until payment completes, so wait for the human to finish Checkout then call again.

Input parameters:

- `session_id` (string, required)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/dev-whiteintel-whiteintel/api-mcp#diagnostics

## Score history

- 2026-08-20: 65
- 2026-08-19: 65

## Links

- Remote endpoint: https://whiteintel.dev/api/mcp
- Repository: https://github.com/Hei33enberg/WhiteIntel-OS
- Website: https://whiteintel.dev/
- Changelog RSS feed: https://verifymcp.io/servers/dev-whiteintel-whiteintel/api-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/dev-whiteintel-whiteintel/api-mcp.json
- HTML version of this page: https://verifymcp.io/servers/dev-whiteintel-whiteintel/api-mcp