Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.Vortx-AI/eudr

REMOTE · EUDR.DEV · SCANNED SEP 22

Compile EUDR Annex II Due Diligence Statements from operator, supplier, and plot geolocation.

Available components

80 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security94
Transport & Reachability100
Schema Quality & AI Usability81
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2527 tokens (~157/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage95
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 82% of tool parameters carry a description.Partial
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 16 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass

Unverified: 1 category

A category scored 0 because we could not verify it: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

Install

How do I install the io.github.Vortx-AI/eudr MCP server?

io.github.Vortx-AI/eudr is a hosted endpoint at https://eudr.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · eudr.dev

# add to Claude Code
claude mcp add --transport http vortx-ai-eudr 'https://eudr.dev/mcp'
// .cursor/mcp.json
{
  "mcpServers": {
    "vortx-ai-eudr": {
      "url": "https://eudr.dev/mcp"
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "vortx-ai-eudr": {
      "type": "http",
      "url": "https://eudr.dev/mcp"
    }
  }
}
# ~/.codex/config.toml
[mcp_servers.vortx-ai-eudr]
url = "https://eudr.dev/mcp"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vortx-ai-eudr": {
      "type": "remote",
      "url": "https://eudr.dev/mcp",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add vortx-ai-eudr --url 'https://eudr.dev/mcp' --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  vortx-ai-eudr:
    url: "https://eudr.dev/mcp"
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "vortx-ai-eudr": {
      "Transport": "http",
      "Url": "https://eudr.dev/mcp"
    }
  }
}
# add to Vellum
assistant mcp add vortx-ai-eudr -t streamable-http -u 'https://eudr.dev/mcp'
// mcp.json
{
  "mcpServers": {
    "vortx-ai-eudr": {
      "type": "http",
      "url": "https://eudr.dev/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 22 Sept 26 80

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 22 Sept 2026 · Probed https://eudr.dev/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=eudr.dev CN=YE1,O=Let's Encrypt,C=US 15 Sept 2026 14 Dec 2026 ECDSA 256 ECDSA-SHA384 671377b1e62023a39d39aeb130134b58abe
SANs: eudr.dev
CN=YE1,O=Let's Encrypt,C=US (CA) CN=Root YE,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 ECDSA 384 ECDSA-SHA384 5ddd70dd31f801c85c186a7a04b80afe
CN=Root YE,O=ISRG,C=US (CA) CN=ISRG Root X2,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 ECDSA-SHA384 872165fc34b6e5fba8add5b3705fb53a
CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 SHA256-RSA 6c8f1dc727c7117f7baf853ac980f9cd

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of eudr.dev. Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
dev. present 60074 8 Verified
eudr.dev. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication Enforced and verified

The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.

Result Enforced and verified
Enforced On tool calls
HTTP status 200

WWW-Authenticate challenge Bearer scope="eudr:read", resource_metadata="https://eudr.dev/.well-known/oauth-protected-resource"

Bearer scope="eudr:read", resource_metadata="https://eudr.dev/.well-known/oauth-protected-resource"
Header Value
strict-transport-security max-age=63072000; includeSubDomains; preload
content-security-policy default-src 'self'; script-src 'self' https://www.googletagmanager.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://www.google-analytics.com; font-src 'self' data:; connect-src 'self' https://www.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com; frame-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'; object-src 'none'; report-uri /csp-report; report-to csp-endpoint
x-content-type-options nosniff
x-frame-options DENY
referrer-policy strict-origin-when-cross-origin
permissions-policy accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), bluetooth=(), browsing-topics=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), hid=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), payment=(self), publickey-credentials-get=(), screen-wake-lock=(), serial=(), sync-xhr=(self), usb=(), xr-spatial-tracking=()

Protected resource metadata

Document https://eudr.dev/.well-known/oauth-protected-resource
Retrieved Yes
Resource https://eudr.dev/mcp
Authorisation server https://eudr.dev

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://eudr.dev/mcp Verified 200
http (plaintext) http://eudr.dev/mcp HTTPS enforced 308 https://eudr.dev/mcp
MCP tools · 16 exposed · ~2,285 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
eudr_account_usage ~115

Report this organisation's credit balance, how many signed statements it will cover, and what has been spent. Checking plots, looking up references, assessing supplier gaps and reading traces cost nothing and are always available — only compiling a signed statement draws the balance down. Use this before starting a batch of compiles so the user is not surprised part-way through. The first call for an organisation writes: it opens the wallet, grants the welcome credits and records that grant as the opening ledger line. Every call after that only reads.

Input schema present but exposes no named parameters.

NameTypeReqDescription
analyses_remainingintegeryes
balance_creditsintegeryes
charged_unitstringyes
credits_per_analysisintegeryes
credits_receivedinteger
credits_spentinteger
free_of_chargearrayyes
notestring
organisationstringyes
recent_activityarray
welcome_credits_granted_atstring|null

No examples provided.

eudr_assess_evidence_gaps ~108

Check what each supplier's file is still missing against Article 9(1) of Regulation (EU) 2023/1115, the closed list of information an operator must hold before filing. Returns the unmet items with their article reference and what to request, separating items that block filing from items that merely leave the file incomplete. This is a checklist over the fields you supply; it reads no documents and judges no evidence.

NameTypeReqDescription
suppliersarrayyes
NameTypeReqDescription
basisstringyes
blocked_from_filingintegeryes
checkedintegeryes
incompleteintegeryes
scope_notestringyes
summarystringyes
suppliersarrayyesOne row per supplier: status, gaps with their article limb and the request to send, blocking_gaps, held limbs, country tier.

No examples provided.

eudr_check_plots ~388

Check up to eight production plots for forest loss after 31 December 2020, the cut-off in Regulation (EU) 2023/1115. Takes GeoJSON boundaries, the commodity, and the country of production. Returns a per-plot verdict, the loss years observed, how much of each plot was inspected, and a handle for the underlying satellite evidence. This answers Article 3(a) only: it does not check land tenure, permits, consent, or chain of custody, and it lists those gaps on every response. This has side effects, though it writes nothing to the organisation's records and costs no credits: every call asks emem.dev to make freshly signed measurements, so repeating a check returns the same finding under new signatures, and mints a short-lived evidence handle held on this server for 24 hours, which eudr_fetch_evidence resolves and which a later check will not reproduce.

NameTypeReqDescription
commoditystringyesThe Annex I commodity produced on the plot.
countrystringyesISO-3166-1 alpha-2 code of the country of production. It sets the benchmark risk tier.
geojsonobjectOne plot, as a GeoJSON Polygon, MultiPolygon or Point in WGS84 (EPSG:4326). Article 2(28) requires six decimal places. A Point is admissible only for a plot under four hectares that is not forest. Su…
hs_codestringOptional HS code, 2 to 8 digits. Overrides the commodity-to-Annex-I mapping.
plotsarraySeveral plots checked together, each keeping its own verdict. Use this when a consignment draws on more than one plot.
quantity_kgnumberOptional net mass of the consignment. It does not affect the verdict.
NameTypeReqDescription
country_risk_tierstring
coverageobjectyes
cut_off_datestringyes
deforestation_freebooleanyes
enginestringyes
evidenceobjectyesfact_count is always present. It is a count of facts that exist, not of facts shipped: the conversational surface carries the address rather than the list.
findingstringyes
next_actionstringyes
observedobjectyes
per_plotarrayyes
risk_scorenumber|null
scope_notestringyes
unresolved_checksarrayyes
verdictstringyes

No examples provided.

eudr_compliance_status ~72

Summarise the signed-in organisation's position: how many statements are filable, how many are blocked by a non-negligible verdict, how many are unresolved, broken down by commodity and country, plus outstanding supplier evidence requests. Answers "where do we stand" without enumerating every record.

Input schema present but exposes no named parameters.

NameTypeReqDescription
by_commodityarrayyes
by_countryarrayyes
next_actionstringyes
organisationstringyes
scope_notestringyes
supplier_requestsobjectyes
totalsobjectyes

No examples provided.

eudr_execution_trace ~112

The complete derivation chain behind a compiled statement, in order: polygon to grid addresses, signed measurements, the algorithm and the registries it was pinned against, cell verdicts to a consignment verdict, citations, and which of three independent keys signed what. A stage whose evidence is absent is reported as absent with its reason. Use it when someone asks how a result was reached rather than what it was.

NameTypeReqDescription
task_idstringyesThe task_id of a compile that has produced a statement.
NameTypeReqDescription
full_statementstring
generated_atstring
not_establishedarrayyes
schemastringyes
signing_partiesobjectyes
stepsarrayyesA step either ran (stage, what, consumed, produced, signed_by, reproduce) or did not, in which case it carries present:false and why_absent. An absent stage is emitted, never omitted.
task_idstringyes
verdictstring|null
verifystring

No examples provided.

eudr_export_statement ~169

Export a compiled statement as TRACES NT submission XML, signed Annex II JSON, or plot boundaries as GeoJSON. Exporting is not filing: nothing is submitted to any authority. TRACES export is refused for a non-negligible verdict, because Article 4(1) bars placing those goods and a non-filable assessment must not be handed out as a submission document.

NameTypeReqDescription
activitystringTRACES activity type. Defaults to the activity the statement was compiled with.
formatstringyes`traces_xml` for the EUDR Information System submission shape, `annex_ii_json` for the signed statement, `plots_geojson` for the boundaries as a FeatureCollection.
task_idstringyesThe task_id of a completed compile.
NameTypeReqDescription
activitystring
dds_referencestring|null
documentyesThe exported document. A string for traces_xml, an object for the other two.
download_urlstring
filed_with_any_authorityboolean
formatstringyes
next_actionstring
receipt_cidstring|null
signer_pubkey_b32string
task_idstringyes
verify_atstring

No examples provided.

eudr_fetch_evidence ~137

Retrieve the signed satellite facts behind a completed check, a page at a time, using the `evidence_cid` that check returned. Each entry is a content address that resolves at emem.dev and verifies offline against the responder's key. Use this when someone needs to audit or cite the evidence, not to summarise a result.

NameTypeReqDescription
evidence_cidstringyesThe handle returned by eudr_check_plots.
limitintegerHow many facts to return, up to 200. Defaults to 50.
offsetintegerIndex to start from. Defaults to 0.
NameTypeReqDescription
algorithmstring|null
evidence_cidstringyes
fact_cidsarrayyes
minted_atstring
next_offsetinteger|null
notestring
offsetintegeryes
resolve_one_atstring
responder_pubkey_b32string|null
returnedintegeryes
totalintegeryes
verify_atstring

No examples provided.

eudr_get_dds ~79

Read the state of a compile started by eudr_prepare_dds. While it runs, returns the current state. Once finished, returns the verdict, the receipt's content address and signing key, and the link to the printable statement.

NameTypeReqDescription
task_idstringyesThe task_id returned by eudr_prepare_dds.
NameTypeReqDescription
erasedboolean
errorstring|null
next_actionstring
notestring
receipt_cidstring|null
report_urlstring
settledboolean
signer_pubkey_b32string
statestringyes
task_idstringyes
verdictstring|null
verify_atstring

No examples provided.

eudr_import_shipments ~220

Parse a consignment list into structured shipments ready to check. Accepts a CSV export (the column set eudr.dev publishes) or a GS1 EPCIS 2.0 JSON-LD document. Returns one row per shipment with supplier, commodity, country, quantity and plot boundaries, plus a warning for every row that could not be read and the reason. Nothing is stored and nothing is submitted; this only reads the document you pass.

NameTypeReqDescription
documentstringyesThe document itself. CSV text including its header row, or the EPCIS document as JSON text.
formatstringyes`csv` for the published column set, `epcis` for a GS1 EPCIS 2.0 JSON-LD document.
limitintegerHow many shipments to return in full, including plot boundaries. Defaults to 8, which is what eudr_check_plots accepts in one call.
offsetintegerWhich shipment to start detailing from. Totals always cover the whole document.
NameTypeReqDescription
formatstringyes
next_actionstringyes
next_offsetinteger|null
notestringyes
offsetintegeryes
rows_returnedintegeryes
rows_skippedintegeryes
shipmentsarrayyes
shipments_readintegeryes
storedbooleanyes
warningsarrayyes

No examples provided.

eudr_list_statements ~116

List the Due Diligence Statements already in the signed-in organisation's account, newest first, with verdict, reference, commodity, country, quantity and date. Use this to answer what has been filed, what is outstanding, and what a past consignment concluded, rather than asking the user to re-enter details their account already holds.

NameTypeReqDescription
countrystringOnly statements for this country of production.
limitintegerHow many to return. Defaults to 20.
verdictstring
NameTypeReqDescription
notestringyes
organisationstringyes
returnedintegeryes
statementsarrayyes

No examples provided.

eudr_list_supplier_requests ~47

List the supplier evidence requests this organisation has issued: who was asked, whether they responded, and when each request expires. Answers which suppliers still owe plot boundaries and production details.

Input schema present but exposes no named parameters.

NameTypeReqDescription
notestringyes
organisationstringyes
pendingintegeryes
requestsarrayyes
submittedintegeryes

No examples provided.

eudr_lookup_reference ~121

Look up the country benchmark tier under Implementing Regulation (EU) 2025/1093, or the Annex I commodity to HS-code mapping under Regulation (EU) 2023/1115. Returns the table this engine actually evaluates against, with its source and the date it was verified.

NameTypeReqDescription
countrystringWith kind=country_risk, return just this country's tier instead of the whole table.
kindstringyes`country_risk` for the benchmark tiers, `commodities` for the Annex I mapping.
NameTypeReqDescription
basisstring
commoditiesarray
countrystring
high_riskarray
kindstringyes
low_riskarray
notestring
referenceobject
simplified_due_diligence_availableboolean
tierstring

No examples provided.

eudr_mitigation_status ~168

Report the Article 11 risk-mitigation plans this organisation has open against flagged shipments: which steps are outstanding, which article each discharges, whether a step needs a person or can be re-run automatically, and what evidence has been recorded. A non-negligible verdict creates an obligation under Article 11 to act before the product is placed on the market; this answers how far that has got. Pass a shipment id for one plan, or omit it for everything still open. Read-only — recording a decision is a deliberate human act and is done on eudr.dev, because Article 11(3) requires the reasoning to be retained against a named person.

NameTypeReqDescription
shipment_idstringOptional. One shipment's plan; omit for every open plan.
NameTypeReqDescription
notestringyes
open_plansintegeryes
organisationstringyes
outstanding_stepsinteger
plansarrayyes

No examples provided.

eudr_prepare_dds ~175

Compile and sign an Annex II Due Diligence Statement. This WRITES: it stores a compile task holding the operator and supplier details you pass, and sends the plot geometry, HS code, country and quantity to emem.dev to be measured and independently signed. Operator and supplier identity are not forwarded upstream. Returns a task handle; read the outcome with eudr_get_dds. Nothing is filed with any authority. Confirm the details with the user first. Costs 5 credits from the organisation's wallet, refunded automatically if the compile fails; every other tool here is free.

NameTypeReqDescription
geolocationobjectyes
operatorobjectyes
producerobjectThe primary producer, where that is not the supplier.
productobjectyes
supplierobjectyes
NameTypeReqDescription
data_sent_upstreamstringyes
data_stored_herestringyes
filed_with_any_authoritybooleanyes
next_actionstringyes
read_outcome_withstringyes
report_urlstringyes
statestring|null
task_idstringyes

No examples provided.

eudr_request_supplier_evidence ~158

Create a one-time link a supplier can use to submit their plot boundaries and production details straight into this organisation's account, without needing an account of their own. This writes: it creates a credential that lets whoever holds the link submit data to you, and returns that link once. Send it only to the intended supplier. No email is sent by this call.

NameTypeReqDescription
emailstringOptional, recorded so you can see where the link was meant to go. It is not verified and nothing is sent to it.
supplier_namestringyesYour name for the counterparty, shown to them on the intake page.
valid_for_daysintegerHow long the link works. Defaults to 30.
NameTypeReqDescription
emailedbooleanyes
expires_atstringyes
intake_urlstringyes
next_actionstringyes
notestring
request_idstringyes
shown_oncebooleanyes
supplierstringyes

No examples provided.

eudr_verify_receipt ~100

Verify a statement receipt: re-derive its content address from the canonical payload and check the ed25519 signature. Use it on a receipt a counterparty hands you. A valid signature establishes who signed and that the bytes are unchanged; it does not establish that the claim inside is true.

NameTypeReqDescription
receiptobjectyesThe receipt as issued: schema, cid, payload, canonical_b64, signature_b64, signer, signed_at.
NameTypeReqDescription
cidstring|null
notestringyes
reasonstring
signed_atstring|null
signerstring|null
validbooleanyes

No examples provided.

Common questions

What is the io.github.Vortx-AI/eudr MCP server?

io.github.Vortx-AI/eudr is an MCP server listed in the public MCP registry as io.github.Vortx-AI/eudr. Compile EUDR Annex II Due Diligence Statements from operator, supplier, and plot geolocation. This page covers its hosted endpoint (https://eudr.dev/mcp).

Is the io.github.Vortx-AI/eudr MCP server safe to use?

io.github.Vortx-AI/eudr scores 80 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.Vortx-AI/eudr MCP server expose?

io.github.Vortx-AI/eudr exposes 16 tools: eudr_check_plots, eudr_fetch_evidence, eudr_assess_evidence_gaps, eudr_lookup_reference, eudr_verify_receipt, and 11 more. Their descriptions and schemas cost roughly 2,285 tokens of context every time the server is loaded.

Does the io.github.Vortx-AI/eudr MCP server require authentication?

Yes. io.github.Vortx-AI/eudr asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the io.github.Vortx-AI/eudr MCP server still maintained?

io.github.Vortx-AI/eudr is still listed as active in the MCP registry. We last reached this channel on 22 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.