Compliance Check
Server Details
TCPA/GDPR/CASL compliance + sanctions & registry screening before you act. Free, no key.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP
- URL
- Repository
- basilalshukaili/agentbroker
- GitHub Stars
- 1
- Server Listing
- Agent Broker
Available Tools
8 toolscheck_complianceARead-onlyIdempotentInspect
Free, instant pre-flight for the compliance gate. Runs the SAME TCPA / GDPR / CASL / CAN-SPAM / 10DLC gate that send_message and call_business run — but in preview mode, so NO message is sent and NO state changes. Tells you whether a (recipient, channel, message_type, content) send would be permitted BEFORE you pay for it, and if not, names the exact rule and how to remediate. Use it to de-risk a paid send the same way check_booking_link de-risks a paid booking. Attaches a compliance_receipt: an Ed25519-signed, hash-bound record of what was checked, when, against which sources, and what it returned - verifiable OFFLINE against the public key published at https://hatchloop.dev/agents.md, so you can hand it to an auditor as evidence the check really ran.
EXAMPLE USER QUERIES THAT MATCH THIS TOOL: user: "Is it legal to text this US number a 20%-off promo?" -> call check_compliance({"recipient_id": "+14045550200", "content": "20% off this week only!", "channel": "sms", "message_type": "marketing", "country_code": "US"}) user: "Before you email the dentist, make sure it's allowed" -> call check_compliance({"recipient_id": "office@dentist.example", "content": "Do you accept Cigna? Following up on my request.", "message_type": "follow_up"}) -> then send_message({"recipient": {"id_type": "email", "id_value": "office@dentist.example"}, "message_type": "follow_up", "content": {"body": "Do you accept Cigna? Following up on my request."}})
WHEN TO USE: Call this the moment before send_message or call_business when there is any chance the send is regulated — anything tagged marketing, any SMS to a US number (10DLC), any message to an EU/UK (GDPR) or Canadian (CASL) recipient, or any content you are unsure about. It is free and sub-100ms, so run it as a guard: if legal=true, proceed to send_message with confidence; if legal=false, fix the cited blocker instead of burning a paid, rejected send. WHEN NOT TO USE: Do not treat a legal=true as a permanent license — the gate re-runs at send time, so a fresh opt-out between preview and send still blocks. Do not use it to check two-party voice recording consent (that is evaluated at call time in the voice adapter, not here). It is not a substitute for send_message; it never delivers anything. COST: free - no key required LATENCY: ~15ms
| Name | Required | Description | Default |
|---|---|---|---|
| channel | No | Delivery channel. Omit to auto-infer sms/email from recipient_id; set 'voice' explicitly. | |
| content | Yes | The actual message body you intend to send. The gate classifies the real text, so a meaningful preview needs the real content. | |
| state_code | No | US state code (e.g. 'CA') for state-specific rules. | |
| country_code | No | ISO 3166-1 alpha-2 (e.g. 'US', 'DE', 'CA'). Auto-inferred from phone if omitted; drives which jurisdiction rules apply. | |
| message_type | No | Intent tag: transactional, marketing, reminder, follow_up, notification. 'marketing' triggers the consent checks. Defaults to transactional. | transactional |
| recipient_id | Yes | Phone in E.164 (e.g. '+14045550100') or email address the message would go to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint/idempotentHint annotations, the description discloses meaningful runtime behavior: preview mode causes no state changes, a legal=true result is not a permanent license because the gate re-runs at send time, and the tool attaches an Ed25519-signed, offline-verifiable compliance_receipt. This clearly exceeds what annotations alone provide and does not contradict them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but well-structured with clear sections (purpose, examples, when to use, when not to use, cost, latency) and front-loaded with the core distinction. It repeats 'free' and 'preview/no message sent' a few times, but the complexity of the compliance gate and receipt behavior justifies most of the length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, the description explains what the tool returns (whether the send is permitted, the exact blocking rule, remediation guidance, and a signed compliance_receipt), how to use it safely, its cost/latency, and its limitations. An agent has enough context to decide when to call it and what to do with the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains all six parameters. The description reinforces the meaning of content, channel auto-inference, and message_type's marketing trigger, but adds little semantic detail beyond the schema; the example queries are helpful but not substantial parameter-level additions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('check'), names the resource ('the compliance gate'), and explicitly frames itself as a pre-flight preview that 'NO message is sent and NO state changes.' It distinguishes itself from send_message and call_business by naming them as the tools whose gate it shares while remaining read-only.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is a dedicated 'WHEN TO USE' section specifying concrete triggers (marketing, SMS to US numbers, EU/UK/CAN recipients, uncertain content) and a 'WHEN NOT TO USE' section naming exclusions like two-party voice recording consent. It also gives an explicit alternative chain: check first, then send_message if legal=true.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_outcomeARead-onlyIdempotentInspect
Retrieve the final OutcomeReceipt for a completed operation.
WHEN TO USE: Use after get_status returns success/failure/partial to retrieve the full result with cost and reason codes. WHEN NOT TO USE: Do not use for operations still in pending/executing state — use get_status first. COST: free - no key required LATENCY: ~50ms
| Name | Required | Description | Default |
|---|---|---|---|
| operation_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly, idempotent, and non-destructive behavior. The description adds useful context beyond this: the response includes cost and reason codes, the operation must be completed, and it is free with ~50ms latency. This enriches the agent's understanding of what calling this tool entails.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: purpose first, then explicit usage guidance, then cost and latency. Every sentence adds value and none is redundant with the schema or annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter read tool with annotations covering safety, the description is nearly complete. It covers preconditions, sequencing, expected content (cost and reason codes), and performance characteristics. Minor gap: it doesn't elaborate on the OutcomeReceipt structure, but no output schema exists and the mention of cost and reason codes provides enough orientation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides zero description for operation_id. The description compensates by linking it to a completed operation from get_status, implying the ID comes from that prior call. Though it doesn't name the parameter explicitly, the context makes the parameter's role clear enough for correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves the final OutcomeReceipt for a completed operation, with a specific verb and resource. It distinguishes itself from get_status by focusing on the full result rather than the status, so an agent can immediately tell what this tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use (after get_status returns success/failure/partial) and when not to use (pending/executing state), and names the alternative (get_status). This leaves no ambiguity about sequencing or conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_statusARead-onlyIdempotentInspect
Query the current state of any in-flight async operation by operation_id.
WHEN TO USE: Use to poll the state of a pending_async operation when no webhook callback has arrived or to check progress. WHEN NOT TO USE: Do not poll more frequently than once per 10 seconds — use webhook delivery for real-time updates instead. COST: free - no key required LATENCY: ~50ms
| Name | Required | Description | Default |
|---|---|---|---|
| operation_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description is not required to re-state those. It adds useful behavioral context beyond annotations: polling cadence guidance, approximate latency, and cost/auth expectations. No contradictions with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured, front-loaded with the core purpose, and uses clear WHEN TO USE / WHEN NOT TO USE sections. Every sentence adds actionable information for call selection or invocation, including cost and latency data.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter polling tool, the description covers the core purpose, usage policy, and operational constraints. The main gap is that there is no output schema and the description does not describe the response shape or status values, but the agent has enough to invoke the tool correctly and interpret that it returns current state.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden of explaining operation_id. It does identify operation_id as the identifier of the in-flight async operation, which gives basic semantics, but it does not explain the format, provenance, or expected values (e.g., how the operation_id is obtained).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the verb ('Query') and resource ('the current state of any in-flight async operation'), keyed by operation_id. This is specific enough for an agent to understand exactly what the tool does and to distinguish it from sibling tools like get_outcome.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use the tool (poll pending_async when no webhook arrived, check progress) and when not to use it (polling more than once per 10 seconds, using webhook for real-time updates). This gives the agent clear decision criteria and mentions the preferred alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
map_trade_restrictionARead-onlyIdempotentInspect
Free cross-border trade screening of the DESTINATION and the PARTIES. IT DOES NOT CLASSIFY THE PRODUCT: the product argument is recorded and echoed back, never checked against any export-control list, so a controlled item to an unrestricted destination returns no findings and reason_code 'partial' -- never 'clear'. This is not an export-control clearance; classify the item (HS/ECCN) against BIS/EU/UK controls yourself. Given a product and destination country (and optionally an HS code, origin country, and a list of parties to screen), returns: (a) whether the destination or any party hits an export-control or sanctions restriction, (b) the destination risk level (comprehensive_embargo / sectoral_sanctions / elevated_scrutiny / standard), (c) HS code hint if the caller provided one, (d) honest tariff guidance + official links without fabricated rates, and (e) party sanctions screening against OFAC SDN (US Treasury), the EU Consolidated list (European Commission) and the UK Sanctions List (FCDO). Acts as a MIDDLEMAN -- unifies the OFAC comprehensive-embargo map, our own indexed copies of the EU and UK lists, and OFAC SDN into one clean call. Never fabricates a tariff rate, a clear, or a restricted status.
EXAMPLE USER QUERIES THAT MATCH THIS TOOL: user: "Can we ship laptops to Iran?" -> call map_trade_restriction({"product": "laptop computers", "destination_country": "IR"}) user: "Screen this supplier before we import from them: Mahan Air, Iran" -> call map_trade_restriction({"product": "aircraft parts", "destination_country": "US", "parties": ["Mahan Air"]}) user: "Is exporting hydraulic pumps to Russia restricted?" -> call map_trade_restriction({"product": "hydraulic pumps", "hs_code": "8413.50", "destination_country": "RU"}) user: "Check if we can sell medical devices to Germany, supplier is ACME GmbH" -> call map_trade_restriction({"product": "medical devices", "origin_country": "US", "destination_country": "DE", "parties": ["ACME GmbH"]})
WHEN TO USE: Use before any cross-border trade to flag embargoed destinations, screen exporters/importers/freight forwarders against sanctions lists, and get authoritative links to the applicable tariff databases. Call this as a pre-flight check before quoting, invoicing, or shipping internationally. Covers OFAC comprehensively-embargoed countries (Iran, North Korea, Cuba, Syria) and significant advisory countries (Russia, Belarus, Ukraine Crimea/DNR/LNR regions). WHEN NOT TO USE: Do NOT use as a substitute for a licensed export compliance review. Do NOT use to obtain authoritative tariff rates (this tool returns guidance links, never fabricated rates). Do NOT use for purely domestic shipments where no cross-border movement is involved. COST: free within the daily quota, then $0.02 per call LATENCY: ~3000ms
| Name | Required | Description | Default |
|---|---|---|---|
| hs_code | No | Optional Harmonized System code (e.g. '8471.30' for laptops). If provided, echoed back and included in tariff guidance. Not derived -- caller must supply the official HS code. | |
| parties | No | Optional list of party names to screen (exporter, importer, freight forwarder, end-user, etc.). Each name is screened against OFAC SDN (US Treasury), the EU Consolidated list (European Commission) and the UK Sanctions List (FCDO). At most 20 parties per call - a longer list is refused outright (bad_input) rather than partially screened; split it across calls. | |
| product | Yes | Product name or description, e.g. 'laptop computers', 'crude oil', 'medical devices'. Used in the tariff guidance note. | |
| origin_country | No | Optional ISO 3166-1 alpha-2 code for the exporting country (e.g. 'US', 'DE'). Used in the tariff guidance note. | |
| destination_country | Yes | ISO 3166-1 alpha-2 code for the importing country (e.g. 'IR', 'CA', 'DE'). Required. Checked against the OFAC comprehensive-embargo map and sectoral-sanctions advisory list. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool read-only and idempotent, and the description adds substantial behavioral context beyond that: the product parameter is only echoed, never checked; the tool never fabricates tariffs, clears, or restricted statuses; >20 parties triggers bad_input; and it unifies OFAC, EU, and UK lists. It also discloses cost and latency. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long, but every section (caveat, examples, when to use/not, cost/latency) earns its place and the critical limitation is front-loaded in uppercase. Minor redundancy in repeated 'never fabricates/not clearance' phrasing keeps it from a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description still enumerates the five categories of returned information, specifies the three sanctions-list sources, states the 20-party limit and bad_input behavior, and gives usage examples plus operational cost/latency. For a 5-parameter tool with no output schema, this is complete enough for an agent to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description earns a point above baseline by clarifying the product parameter's actual role (recorded and echoed, never checked against an export-control list), which the schema does not convey, and by showing realistic parameter combinations via example queries.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb-resource pairing ('screening of the DESTINATION and the PARTIES') and immediately states the critical scope boundary: it does not classify the product and is not an export-control clearance. It also clarifies that controlled items to unrestricted destinations yield reason_code 'partial', which distinguishes this from both general compliance tools and party-only screening. This is more than enough to tell it apart from its siblings without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit 'WHEN TO USE' and 'WHEN NOT TO USE' sections tell the agent to invoke before cross-border trade as a pre-flight check and explicitly exclude use as a licensed compliance review, for authoritative tariff rates, or for domestic shipments. No inference is required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
preview_costARead-onlyIdempotentInspect
Return an expected cost estimate, latency estimate, and success-probability estimate for a proposed call before execution. Returns the exact price when it is fixed, and a min/max range when the cost depends on channel or outcome. It does not promise an accuracy percentage - check cost_range.
EXAMPLE USER QUERIES THAT MATCH THIS TOOL: user: "How much will this SMS cost me?" -> call preview_cost({"operation": "send_message", "params": {"preferred_channel": "sms"}}) user: "Estimate the cost of booking via voice fallback" -> call preview_cost({"operation": "schedule_appointment", "params": {"preferred_channel": "voice"}})
WHEN TO USE: Use before any operation when the agent is operating under a budget constraint and needs to decide whether to proceed. WHEN NOT TO USE: Do not use in a hot loop — cache the result for at least 60 seconds if repeating the same preview. COST: free - no key required LATENCY: ~100ms
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes | The same request body you would pass to the operation | |
| operation | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, and the description is fully consistent with these. Beyond that, it discloses substantial extra behavior: the exact-vs-range return pattern, the explicit accuracy caveat ('does not promise an accuracy percentage - check cost_range'), the ~100ms latency, the free/no-key requirement, and the 60-second caching recommendation. This is rich behavioral context the annotations do not carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is longer than average but tightly structured with labeled sections: core behavior, examples, WHEN TO USE, WHEN NOT TO USE, COST, LATENCY. Core behavior is front-loaded in the first sentence, and every section carries functional information. The two examples are slightly redundant with each other but still earn their place by demonstrating parameter usage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the burden of conveying return values, and it does: cost, latency, and success-probability estimates, plus the cost_range field and exact-vs-range distinction. Operational traits (free, latency, caching) are included. Minor gap: no edge-case behavior described, such as handling of unknown operation names, but for a two-parameter preview tool the essentials are all present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50% (the 'params' field is described but 'operation' is not), so the description must compensate. The two worked examples do exactly that, showing the JSON structure with concrete values like preview_cost({"operation": "send_message", "params": {"preferred_channel": "sms"}}). This clarifies that 'params' mirrors the operation's request body and demonstrates realistic values, adding meaning well beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Return an expected cost estimate, latency estimate, and success-probability estimate for a proposed call before execution.' It clearly explains the exact-price vs min/max-range behavior. The 'before execution' qualifier cleanly separates it from the sibling tools, which all concern compliance, status, and verification rather than cost.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit WHEN TO USE guidance is given: before any operation when operating under a budget constraint and needing to decide whether to proceed. WHEN NOT TO USE excludes hot loops and mandates 60-second caching. No specific alternative sibling is named, but none of the siblings (check_compliance, get_outcome, screen_sanctions, etc.) is a cost-estimation tool, so no routing alternative exists to cite.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
screen_sanctionsARead-onlyIdempotentInspect
Free screening of a name or entity against official sanctions lists, each fetched from the authority that issues it: the OFAC SDN list from the US Treasury (SDN.CSV plus ALT.CSV for alternate spellings), the EU consolidated financial sanctions list from the European Commission, and the UK Sanctions List from the FCDO. THE UN CONSOLIDATED LIST IS NOT SCREENED -- it carries no licence permitting commercial redistribution, so we do not claim it. ALWAYS check lists_screened on the response: it names the lists that actually ran ON THAT CALL, and a list that failed to load appears in sources_unavailable instead. reason_code is 'partial_screening' whenever any source was unavailable, never 'clear'. Returns screening_status ('hit' | 'clean' | 'candidates' | 'not_screened' -- branch on THIS, not on matched, because matched:false is also false when nothing could be screened), matched: bool, a list of matches with score, program, and source URL, and which lists were screened. Never fabricates a match or a clear -- if no match is found, explicitly names which lists were checked. Attaches a compliance_receipt: an Ed25519-signed, hash-bound record of what was checked, when, against which sources, and what it returned - verifiable OFFLINE against the public key published at https://hatchloop.dev/agents.md, so you can hand it to an auditor as evidence the check really ran.
EXAMPLE USER QUERIES THAT MATCH THIS TOOL: user: "Screen this vendor before we pay them: ACME Trading LLC, Russia" -> call screen_sanctions({"name": "ACME Trading LLC", "country": "RU", "type": "entity"}) user: "Is Kim Jong-un on the OFAC list?" -> call screen_sanctions({"name": "Kim Jong-un", "country": "KP", "type": "person"}) user: "Run a sanctions check on this person before onboarding" -> call screen_sanctions({"name": "Ivan Petrov", "country": "RU", "type": "person"}) user: "Do a compliance check -- is this company sanctioned?" -> call screen_sanctions({"name": "Mahan Air", "country": "IR", "type": "entity"})
WHEN TO USE: Use before onboarding a counterparty, processing a payment, engaging a vendor, or doing any due-diligence step that requires knowing whether a person or entity appears on official sanctions lists. Essential for agents doing business formation, vendor qualification, payments onboarding, trade compliance, or any workflow where a sanctioned counterparty is a legal or reputational risk. WHEN NOT TO USE: Do not use as a substitute for full KYC/AML screening -- this covers sanctions lists only, not PEP (Politically Exposed Person) databases, adverse media, or credit risk. Do not treat a negative result as a compliance clearance; it is informational only. Do not use for bulk screening of large lists -- each call is a live API query. COST: free within the daily quota, then $0.02 per call LATENCY: ~2000ms
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Full name of the person or entity to screen, e.g. 'Kim Jong-un' or 'ACME Trading LLC'. Use the most complete name available for best accuracy. | |
| type | No | Optional entity type hint. 'person' for individuals, 'entity' for organizations/companies. Omit to screen both. | |
| country | No | Optional ISO 3166-1 alpha-2 country code or country name (e.g. 'IR', 'Iran'). It ANNOTATES AND RANKS results; it never removes any. Each EU/UK match carries country_match: true, false, or null when the listing records no country. Nothing is dropped on a mismatch, because the country we hold is the address/nationality on the listing rather than everywhere a party operates - excluding on it would return a clean screen for someone who IS listed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint. On top of that, the description discloses crucial behavioral traits: lists can fail to load and appear in sources_unavailable, reason_code becomes 'partial_screening', it never fabricates matches or clears, and it attaches an Ed25519-signed compliance_receipt. This materially exceeds what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but well-structured with clear headings (WHEN TO USE, WHEN NOT TO USE, COST, LATENCY) and front-loaded purpose. Example queries are useful for an agent. The COST and LATENCY lines are tangential to invocation correctness, and the four examples are slightly redundant, so it loses one point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries full responsibility for explaining return values. It covers screening_status options, matched, match details (score, program, source URL), lists_screened, sources_unavailable, reason_code, and compliance_receipt. Complex failure modes and offline verification are fully explained, making the definition complete for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds vital meaning beyond the schema for the country parameter: it 'ANNOTATES AND RANKS results; it never removes any,' preventing the serious mistake of treating a non-matching country as a clean screen. No other dimension of any parameter is left unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('screening') and resource ('official sanctions lists'), and explicitly names the specific lists included (OFAC, EU, UK) and the one excluded (UN). This precisely distinguishes the tool from any broader or narrower sanctions-checking sibling without needing to open schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit WHEN TO USE and WHEN NOT TO USE sections, detailing appropriate scenarios (onboarding, payments, due diligence) and exclusions (not a full KYC/AML substitute, not for PEP/adverse media/credit risk, not for bulk screening). It does not name a specific sibling tool as an alternative, so it falls just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
self_testARead-onlyIdempotentInspect
Service health probe: runs 6 internal checks and reports how many passed. Confirms the server is up and responding - it does NOT probe each tool individually. Use to verify connectivity before production use.
EXAMPLE USER QUERIES THAT MATCH THIS TOOL: user: "Run a health check before I send the broadcast" -> call self_test({})
WHEN TO USE: Use at agent startup, before high-stakes task sequences, or after receiving unexpected errors to check if the service is degraded. WHEN NOT TO USE: Do not call more than once per minute in production. COST: free - no key required LATENCY: ~200ms
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description discloses latency (~200ms), cost (free, no key required), the number of checks performed, and the fact that it does not probe individual tools. These details add meaningful behavioral context beyond the readOnly/idempotent hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections, front-loads the core purpose, and every included section adds value: example, when to use, when not to use, cost, and latency. It is thorough without being bloated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only health check with no output schema, the description is complete: it states what it does, what it returns ('reports how many passed'), when to use it, when not to use it, and expected performance characteristics. Nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the input schema is already fully specified as empty, so there is little for the description to add. The example 'call self_test({})' reinforces that no arguments are needed, satisfying the baseline for a zero-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence identifies a specific verb and resource: 'runs 6 internal checks and reports how many passed.' It also explicitly distinguishes itself from per-tool probes ('it does NOT probe each tool individually'), which helps an agent differentiate it from the sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes explicit 'WHEN TO USE' guidance: at agent startup, before high-stakes sequences, and after unexpected errors. It also provides a clear exclusion: 'Do not call more than once per minute in production,' plus a matching example user query.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_company_recordARead-onlyIdempotentInspect
Free, live lookup of a company official registry record. Queries the GLEIF global LEI registry (primary, 2.6 million legal entities worldwide) and SEC EDGAR (US public companies) to return the official legal name, LEI, entity status, jurisdiction, registered address, and registry authority. Never fabricates: if the company is not found in these free registries, returns an honest not_found with the sources that were queried.
EXAMPLE USER QUERIES THAT MATCH THIS TOOL: user: "Is Apple Inc a real registered company?" -> call verify_company_record({"name": "Apple Inc", "country": "US"}) user: "Look up the LEI for Volkswagen AG" -> call verify_company_record({"name": "Volkswagen AG", "country": "DE"}) user: "Verify this LEI: 529900HNOAA1KXQJUQ27" -> call verify_company_record({"name": "Volkswagen AG", "lei": "529900HNOAA1KXQJUQ27"})
WHEN TO USE: Use when you need to verify that a company exists as a registered legal entity and retrieve its official registry details -- before signing a contract, qualifying a vendor, validating a counterparty, or populating a due-diligence record. Accepts a legal name plus optional country filter or a direct LEI for a precise lookup. WHEN NOT TO USE: Do not use to verify private companies not registered with GLEIF or SEC. Do not use as an exhaustive fraud-detection tool; this is a first-pass existence check against free public registries, not a full KYC screen. COST: free within the daily quota, then $0.02 per call LATENCY: ~800ms
| Name | Required | Description | Default |
|---|---|---|---|
| lei | No | Optional 20-character Legal Entity Identifier for a direct, precise lookup. | |
| name | Yes | Legal company name to look up, e.g. Apple Inc or Volkswagen AG. | |
| country | No | Optional ISO 3166-1 alpha-2 country filter (e.g. US, DE, GB). Narrows GLEIF results to one jurisdiction. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, so the bar for added behavioral context is lower but the description still adds significant value: it explicitly states 'Never fabricates' and describes the honest not_found return with queried sources. It also discloses data sources, cost, and latency, giving the agent clear expectations about behavior on failure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well structured with clear sections: core function, examples, WHEN TO USE, WHEN NOT TO USE, COST, LATENCY. Every section contributes unique information, and the core definition is front-loaded. No redundant or tautological content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter lookup with no output schema, the description is fully complete: it specifies invocation examples, required and optional parameters, data sources, returned fields, not-found behavior, use cases, exclusions, and cost/latency. An agent has everything needed to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description goes beyond the schema by explaining the interaction of parameters: 'Accepts a legal name plus optional country filter or a direct LEI for a precise lookup,' and it includes three concrete example calls mapping user intents to parameter combinations. This adds practical semantics not present in the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Free, live lookup of a company official registry record.' It names the exact registries queried (GLEIF and SEC EDGAR) and the returned fields (legal name, LEI, status, jurisdiction, address, registry authority). It also distinguishes the tool from sanction/compliance siblings by positioning it as first-pass existence verification, not a full KYC screen.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit 'WHEN TO USE' with concrete scenarios (before signing a contract, qualifying a vendor, validating a counterparty, populating due-diligence records) and 'WHEN NOT TO USE' with clear exclusions (private companies not in GLEIF/SEC, exhaustive fraud detection). These conditions are sufficient for an agent to decide between this tool and the sibling compliance/sanction tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
1 tool update
- Changed
map_trade_restriction2 fields changed- changed
Input schema / properties / parties / descriptionPrevious value: -"Optional list of party names to screen (exporter, importer, freight forwarder, end-user, etc.). Each name is screened against OFAC SDN (US Treasury), the EU Consolidated list (European Commission) and the UK Sanctions List (FCDO)."New value: +"Optional list of party names to screen (exporter, importer, freight forwarder, end-user, etc.). Each name is screened against OFAC SDN (US Treasury), the EU Consolidated list (European Commission) and the UK Sanctions List (FCDO). At most 20 parties per call - a longer list is refused outright (bad_input) rather than partially screened; split it across calls." - added
Input schema / properties / parties / maxItemsAdded value: +20
8 tool updates
- First observed
check_compliance - First observed
get_outcome - First observed
get_status - First observed
map_trade_restriction - First observed
preview_cost - First observed
screen_sanctions - First observed
self_test - First observed
verify_company_record
Frequently Asked Questions
Claiming proves that you control a remote MCP connector. It does not move, proxy, or interrupt the server.
Open the connector listing, choose Claim ownership, and sign in to Glama.
Complete one verification method:
GitHub identity — fastest for official registry listings. For a namespace such as
io.github.alice/server, link the matching GitHub user, then choose Claim with GitHub. An organization namespace such asio.github.acme/serveralso needs that organization to have installed the Glama AI GitHub App and approved its permissions, because GitHub discloses organization membership only to apps it has installed. Use HTTP or DNS when it has not.HTTP challenge — works when you can deploy a public file. Generate a token, publish the exact JSON Glama shows at
/.well-known/glama.jsonon the same origin as the connector, then choose Check HTTP challenge.DNS challenge — works when you control DNS but cannot change the server. Generate a token, create the exact TXT record Glama shows, wait for it to propagate, then choose Check DNS challenge.
After verification, Glama sends a confirmation email and gives you access to listing details, thumbnails, health checks, and analytics. Keep the HTTP file or DNS record in place: Glama periodically checks it and ownership remains verified while the token is discoverable.
The HTTP ownership file has this structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"claim": "glama_claim_..."
}Claim tokens are opaque, stable, and bound to the signed-in Glama account. They contain no email address or other personal information. If Glama can no longer discover a verified HTTP or DNS token, it starts a seven-day grace period before removing claim-based access. Restore the same token during that period to keep ownership verified. Never publish an email address, Glama session token, GitHub token, or connector credential as ownership proof.
If verification fails, confirm that you copied the current token exactly. The HTTP file must be public, return valid JSON with a successful HTTP response, and stay on the connector's origin. DNS changes may need more time to propagate. A claim cannot transfer to a different origin or hostname: if the connector target changes, Glama starts the grace period and the new target must be claimed separately after the previous claim is released.
For a connector linked to the official MCP Registry, registry updates continue to replace its name, description, and URL by default. After claiming, open Manage connector and enable Use Glama listing details as the source of truth if edits made on Glama should be preserved. Categories and thumbnails are always managed on Glama; registry linkage and technical connection settings continue to sync.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
To improve your MCP server's ranking:
Claim ownership of the server listing
Complete the server profile with an accurate description and thumbnail
Provide a test profile so Glama can connect to and evaluate the server
Keep tool definitions clear and complete to earn a high Tool Definition Quality Score (TDQS)
Route real usage through the Glama Gateway; more recorded successful server uses also improve the ranking
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
Discussions
No comments yet. Be the first to start the discussion!
Related MCP Connectors
Sanctions, PEP, watchlist, recall, business, and contract screening. Free tier, no auth required.
Send WhatsApp, SMS, email or voice to real businesses. TCPA/GDPR/CASL gate built in.
Screen people & companies against 12 US sanctions & exclusion lists (OFAC, LEIE, SAM, Medicaid).
Screen names against OFAC SDN and 7 more global sanctions lists. Free, no account required.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceScreens names against the US Consolidated Screening List including OFAC SDN and BIS Entity List, keyless.10MIT
- AlicenseNot gradedqualityCmaintenanceChecks names against US FinCEN financial crime lists for compliance and AML due diligence, with a single read-only tool.MIT
- FlicenseNot gradedqualityBmaintenanceScreens names and companies against OFAC, EU, UK, and UN sanctions lists with fuzzy-match scores, supporting bulk lookups for AML/KYC checks. Data is sourced directly from official government lists and cached for fast repeat checks.-
- AlicenseNot gradedqualityDmaintenanceTrust Intelligence API - entity screening, sanctions, risk scoring, IBAN validation, and compliance checks via MCPMIT
Glama MCP Gateway
Add one secure layer between your agents and this server.
TDQS
Most tools target clearly distinct compliance subdomains: messaging compliance, sanctions screening, trade restrictions, company verification, and cost preview. The main overlap is between map_trade_restriction and screen_sanctions, since both screen parties against sanctions lists, but their descriptions differentiate trade-level screening from dedicated name screening well enough.
Tool names mostly follow a consistent snake_case verb_noun pattern: check_compliance, get_outcome, get_status, preview_cost, screen_sanctions, verify_company_record. self_test is the one minor deviation since it reads more like a noun than an imperative verb_object name, but it does not break the overall pattern.
Eight tools is a well-scoped size for a compliance pre-flight server. Each tool has a distinct role, and the count is neither bloated nor too thin for the apparent domain.
The core compliance workflows are covered: messaging pre-flight checks, sanctions screening, cross-border trade restrictions, company registry verification, and cost/status helpers. The main gaps are intentional exclusions like PEP screening, export-control product classification, and consent management, which are documented but prevent the set from being a fully comprehensive compliance suite.