Skowron Compliance Gateway
Server Details
OFAC, LEI, EU VAT, AI Act, and company compliance preflight for agents.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP
- URL
Available Tools
5 toolscheck_ai_act_applicabilityBRead-onlyIdempotentInspect
EU AI Act compliance / AI Act applicability screen from official Regulation 2024/1689. Not legal advice.
| Name | Required | Description | Default |
|---|---|---|---|
| biometric | No | ||
| education | No | ||
| employment | No | ||
| system_use | No | ||
| provider_role | No | provider, deployer, importer, or distributor. | |
| creditworthiness | No | ||
| established_in_eu | No | ||
| output_used_in_eu | No | ||
| general_purpose_model | No | ||
| critical_infrastructure | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds a caution that it is 'Not legal advice', which is a useful disclosure. However, it does not explain the behavior beyond 'screen' or mention limitations, side effects, or what the screening entails. Annotations already cover read-only and idempotent nature, so the bar is lower, but the added context is minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that avoids unnecessary detail. It is well-structured and directly to the point, with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is incomplete regarding the tool's output and how to interpret the screening result. It does not mention the return format, possible outcomes, or any contextual details about the EU AI Act applicability criteria. This lack of context makes it difficult for a user to know what to expect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description provides no information about the input parameters (e.g., biometric, education, employment, etc.). It does not explain how these fields are used in the applicability screening. The schema has low coverage, and the tool description fails to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function as an 'EU AI Act compliance / AI Act applicability screen', referencing the official regulation. It is specific and distinct from sibling tools like OFAC screening or VAT validation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide any guidance on when to use this tool over alternatives, nor does it mention conditions, prerequisites, or typical use cases. It simply states what the tool does without context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
company_compliance_preflightCRead-onlyIdempotentInspect
Company compliance API / regulatory applicability / compliance preflight. Informational screening, not legal advice.
| Name | Required | Description | Default |
|---|---|---|---|
| sector | No | ||
| country | No | ||
| uses_ai | No | ||
| ai_use_cases | No | ||
| employee_count | No | ||
| annual_revenue_usd | No | ||
| takes_card_payments | No | ||
| offers_crypto_services | No | ||
| processes_personal_data | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds 'Informational screening, not legal advice' – a useful caution that the results are non-authoritative and not legally binding. This adds value beyond annotations without contradicting them. However, it doesn't disclose return format, edge cases, or rate limits, so a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one sentence, front-loaded with the core purpose, and includes a necessary disclaimer ('not legal advice'). It's concise, though the triple phrasing ('Company compliance API / regulatory applicability / compliance preflight') is slightly redundant. No filler or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 9 parameters and no schema descriptions, the description should explain what the tool does with those inputs. It only says 'regulatory applicability' and 'screening,' which is vague. There's no mention of output format (though output schema exists) or how parameters like 'uses_ai' or 'takes_card_payments' factor in. Annotations cover safety, so the gap is on usage scope and parameter behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides no explanation of how parameters like 'uses_ai', 'takes_card_payments', or 'processes_personal_data' influence the screening. The parameter names are self-explanatory for some (country, sector) but others (e.g., ai_use_cases) lack context. The description fails to compensate for the sparse schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool performs 'Company compliance API / regulatory applicability / compliance preflight' – a clear verb-resource combination. It distinguishes from sibling tools (which are specific checks like AI Act or VAT) by positioning this as a general screening. However, it doesn't explicitly name alternatives or contrast with them, so it's not a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this vs. the more specific sibling tools (e.g., check_ai_act_applicability or screen_ofac). The phrase 'preflight' implies a first-pass screening, but there is no 'use this when...' or 'for specific regulations use...' context. This leaves the agent to infer applicability.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
screen_ofacARead-onlyIdempotentInspect
OFAC sanctions screening API / OFAC sanctions check. Returns NO_POTENTIAL_MATCH or potential matches. Not a legal clearance.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Person or entity name to screen. | |
| country | No | Optional country. | |
| entity_type | No | Optional individual or entity. | |
| date_of_birth | No | Optional date of birth. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only and non-destructive. Description adds that it returns a specific value (NO_POTENTIAL_MATCH or potential matches) and clarifies it is not a legal clearance, which provides transparency beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is concise, contains only essential information: purpose, return type, and a caveat. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool is simple; description covers purpose, return type, and a caveat. It is complete enough for understanding usage. No output schema is defined, but the return type is mentioned in the description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema already provides descriptions for each parameter. Description does not add additional meaning or constraints for the parameters, so it adds no value beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it's an OFAC sanctions screening API/check, and specifies return value and that it's not legal clearance. Purpose is clear and distinguishing from siblings by focusing on OFAC.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description does not provide explicit guidance on when to use this tool versus alternatives like check_ai_act_applicability or validate_eu_vat. It only describes what it does, so usage guidelines are lacking.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validate_eu_vatARead-onlyIdempotentInspect
VAT validation API / VIES API. Official European Commission EU VAT check.
| Name | Required | Description | Default |
|---|---|---|---|
| vat_number | Yes | VAT number without or with country prefix. | |
| country_code | Yes | EU member state code, e.g. DE. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, covering the safety profile. The description adds context that it is an 'Official European Commission' API, implying authoritative and reliable, but does not disclose additional behavioral details such as rate limits, error handling, or response specifics. With annotations this strong, a 3 is appropriate as the description adds minimal extra value beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence: 'VAT validation API / VIES API. Official European Commission EU VAT check.' It is front-loaded with the core purpose and contains zero filler. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 well-documented parameters), the presence of an output schema, and strong annotations, the description is complete enough. It identifies the authoritative source (European Commission/VIES) and the purpose. The output schema covers return values, and annotations cover safety, so no further contextual information is necessary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides full descriptions for both parameters (vat_number, country_code) with schema coverage at 100%. The description does not add any additional meaning beyond what the schema already states, so it meets the baseline of 3 but does not exceed it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a VAT validation API, specifically the VIES API from the European Commission. It specifies the resource (EU VAT check) and the action (validation), effectively distinguishing it from sibling tools that deal with AI act applicability, compliance preflight, OFAC screening, and legal entity verification, which are unrelated to VAT validation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for EU VAT validation ('Official European Commission EU VAT check'), but does not explicitly state when to use it vs alternatives or provide exclusions. Since the sibling tools are unrelated to VAT, the need for explicit alternatives is low, but the description still lacks explicit guidance on when to invoke this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_legal_entityARead-onlyIdempotentInspect
LEI lookup API / legal entity verification against GLEIF. Counterparty screening for onboarding and KYC workflows.
| Name | Required | Description | Default |
|---|---|---|---|
| lei | No | 20-character LEI. | |
| country | No | Optional ISO country filter. | |
| company_name | No | Legal name if LEI is unknown. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds useful context that this is an external API lookup against GLEIF, implying reliance on an external data source, which is beyond the annotations. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, front-loaded with the core purpose ('LEI lookup API / legal entity verification against GLEIF') and followed by the use case. No unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description and schema cover the tool's purpose and parameters well, and an output schema exists. However, all parameters are optional but the description does not clarify that at least one identifier (LEI or company_name) is expected, and the relationship between parameters is implied only via schema hints. This leaves a small but important gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with clear descriptions for each parameter ('20-character LEI', 'Optional ISO country filter', 'Legal name if LEI is unknown'). The description itself adds no extra parameter semantics, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool performs 'LEI lookup API / legal entity verification against GLEIF', identifying the specific resource and action. This distinguishes it from sibling tools like screen_ofac (sanctions) and validate_eu_vat (VAT), which serve different verification purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear use case: 'Counterparty screening for onboarding and KYC workflows.' It does not explicitly exclude other tools or name alternatives, but the context is sufficiently clear for an agent to understand when this tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
5 tool updates
- First observed
check_ai_act_applicability - First observed
company_compliance_preflight - First observed
screen_ofac - First observed
validate_eu_vat - First observed
verify_legal_entity
Frequently Asked Questions
Claiming proves that you control a remote MCP connector. It does not move, proxy, or interrupt the server.
Open the connector listing, choose Claim ownership, and sign in to Glama.
Complete one verification method:
GitHub identity — fastest for official registry listings. For a namespace such as
io.github.alice/server, link the matching GitHub user, then choose Claim with GitHub. An organization namespace such asio.github.acme/serveralso needs that organization to have installed the Glama AI GitHub App and approved its permissions, because GitHub discloses organization membership only to apps it has installed. Use HTTP or DNS when it has not.HTTP challenge — works when you can deploy a public file. Generate a token, publish the exact JSON Glama shows at
/.well-known/glama.jsonon the same origin as the connector, then choose Check HTTP challenge.DNS challenge — works when you control DNS but cannot change the server. Generate a token, create the exact TXT record Glama shows, wait for it to propagate, then choose Check DNS challenge.
After verification, Glama sends a confirmation email and gives you access to listing details, thumbnails, health checks, and analytics. Keep the HTTP file or DNS record in place: Glama periodically checks it and ownership remains verified while the token is discoverable.
The HTTP ownership file has this structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"claim": "glama_claim_..."
}Claim tokens are opaque, stable, and bound to the signed-in Glama account. They contain no email address or other personal information. If Glama can no longer discover a verified HTTP or DNS token, it starts a seven-day grace period before removing claim-based access. Restore the same token during that period to keep ownership verified. Never publish an email address, Glama session token, GitHub token, or connector credential as ownership proof.
If verification fails, confirm that you copied the current token exactly. The HTTP file must be public, return valid JSON with a successful HTTP response, and stay on the connector's origin. DNS changes may need more time to propagate. A claim cannot transfer to a different origin or hostname: if the connector target changes, Glama starts the grace period and the new target must be claimed separately after the previous claim is released.
For a connector linked to the official MCP Registry, registry updates continue to replace its name, description, and URL by default. After claiming, open Manage connector and enable Use Glama listing details as the source of truth if edits made on Glama should be preserved. Categories and thumbnails are always managed on Glama; registry linkage and technical connection settings continue to sync.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
To improve your MCP server's ranking:
Claim ownership of the server listing
Complete the server profile with an accurate description and thumbnail
Provide a test profile so Glama can connect to and evaluate the server
Keep tool definitions clear and complete to earn a high Tool Definition Quality Score (TDQS)
Route real usage through the Glama Gateway; more recorded successful server uses also improve the ranking
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
Discussions
No comments yet. Be the first to start the discussion!
Related MCP Connectors
KYB due diligence for agents: sanctions screening, EU VAT/VIES, LEI, IBAN in one verdict.
Sanctions screening, KYB, identifier validation, jurisdiction risk & secret scanning for AI agents
OFAC sanctions screening for AI agents: screen names, wallets, entities against the SDN list.
Entity verification, sanctions screening, and trust scoring for AI agents.
Related MCP Servers
- AlicenseBqualityBmaintenanceAutonomous M2M compliance and trust APIs for AI agents (KYB, OFAC, VAT, Sanctions checking).5MIT
- AlicenseAqualityBmaintenanceEnables AI agents to screen business partners against EU/US/HADDEX sanctions and PEP lists, and maintain the easycompliance daily monitoring list.614MIT
- FlicenseAqualityBmaintenanceAgentic KYC/AML compliance server with tools for sanctions screening, identity verification, and risk assessment, where AI orchestrates discretionary checks within deterministic compliance guardrails.6-
- AlicenseAqualityDmaintenanceCompliance and guardrails infrastructure for AI agents, enabling safe operations within regulatory boundaries like GDPR and EU AI Act.6MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.
TDQS
Each tool targets a distinct compliance or verification domain: AI Act applicability, general company compliance, OFAC sanctions, EU VAT, and legal entity verification. The descriptions clearly delineate their purposes, so an agent can confidently select the appropriate tool.
All tool names follow a consistent verb_noun pattern in snake_case (check_ai_act_applicability, company_compliance_preflight, screen_ofac, validate_eu_vat, verify_legal_entity). This predictable naming convention makes the tool surface easy to navigate.
With 5 tools, the server is well-scoped for a compliance gateway. Each tool covers a major compliance/verification need, and the count is within the ideal 3-15 range, ensuring the set is neither sparse nor bloated.
The tool set covers the primary compliance checks (AI Act, OFAC sanctions, VAT, LEI, and company preflight). Minor gaps exist—such as other sanctions lists (e.g., UN, EU) or additional regulatory checks—but for a focused gateway, the coverage is solid and enough for typical workflows.