io.github.cyanheads/sanctions-screening-mcp-server

Est-ce que io.github.cyanheads/sanctions-screening-mcp-server est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.cyanheads/sanctions-screening-mcp-server » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 7 outils

• sanctions_get_designation≈ 2173 tokens

  Fetch the full record for one sanctions designation by source list + entry ID or the list's published reference number — the drill-in after sanctions_screen_name or sanctions_screen_identifier surfaces a candidate, or the lookup for a reference a notice cites (UN QDe.004, EU EU.27.28, UK OFSI Group ID). Returns all published aliases, identifiers (passport, national ID, tax and registration numbers, SWIFT/BIC codes, digital-currency addresses, vessel call signs, aircraft tail and serial numbers, phone numbers, email addresses, websites), addresses, dates and places of birth at the precision the source published, nationalities, descriptive features (a vessel's flag, type, and tonnage; an aircraft's model and operator; a title or gender; sanctions notes), sanctioning program, legal basis, and designation date. The record reflects exactly what the source published; missing fields mean the source omitted them. This is a screening aid — the designation record supports a compliance review, it is not itself a determination.

  Paramètres, retour & exemple (2)

  Paramètres

  • source · string · requis · ofac_sdn | ofac_consolidated | eu | uk | un
    Which source list the entry belongs to.
  • entryId · string · requis
    The source list's own entry ID (the sourceEntryId from sanctions_screen_name), or the reference number the list publishes for the entry (UN QDe.004, EU EU.27.28, UK OFSI Group ID 14196). Matched trimmed and case-insensitive, entry ID first.

  Exemple d'appel

  {"name": "sanctions_get_designation", "arguments": {"source": "ofac_sdn", "entryId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "caveat": "texte", "source": "ofac_sdn", "aliases": [], "program": "texte", "remarks": "texte", "features": [], "addresses": [], "entityType": "person", "legalBasis": "texte", "identifiers": [], "primaryName": "texte"}}

• sanctions_get_entity≈ 3164 tokens

  Fetch the full GLEIF Level 1 record for one LEI: legal name, other/trading names, legal and headquarters addresses, registration status, jurisdiction, registration authority and ID, and last-update date — plus a sanctions cross-reference against all loaded watchlists. The cross-reference screens the legal name and every other and transliterated name strict (exact, then all tokens present — never fuzzy, unlike sanctions_screen_name), and looks up the LEI and the registration number as exact non-document identifiers, the registration number matching only an identifier published for the country of the entity's legal jurisdiction. Hits merge to one per designation, an OFAC party both OFAC lists publish to one hit whose sources names both: matchedOn names every input that produced each, and a hit only an identifier produced carries matchedIdentifiers and no matchedName. The screening cross-reference is a screening AID: a hit is a candidate to verify against the official source, and no hit is not a clearance. screeningStatus says whether that cross-reference actually ran — an empty sanctionsHits under not_ready means the sanctions mirror was unavailable, not that nothing matched. sanctionsScreen says whether the hit list is the whole set: it reports how many potential matches existed before the cap, so a capped cross-reference is distinguishable from a complete one. LEI must be a 20-character GLEIF identifier (18 alphanumerics + 2 check digits).

  Paramètres, retour & exemple (1)

  Paramètres

  • lei · string · requis
    The 20-character GLEIF Legal Entity Identifier to look up.

  Exemple d'appel

  {"name": "sanctions_get_entity", "arguments": {"lei": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"lei": "texte", "error": {}, "caveat": "texte", "status": "texte", "legalName": "texte", "lastUpdate": "texte", "otherNames": [], "jurisdiction": "texte", "legalAddress": "texte", "sanctionsHits": [], "alternateNames": [], "sanctionsScreen": {}}}

• sanctions_list_sources≈ 1110 tokens

  List the sanctions watchlists (OFAC SDN + Consolidated, EU, UK, UN) and GLEIF datasets currently loaded in the local mirror, each with its record count, source URL, license, and the mirror's readiness and as-of timestamp — for GLEIF, also its Level 2 ownership relationship count, whether its reporting exceptions are loaded and how many, and whether its alternate-name index is built. Use this for provenance and freshness on any result — results are only as current as the last mirror refresh, and a not-ready mirror means screening cannot run yet. Attribution: UK data is under the Open Government Licence v3.0; all sources are cited here.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "sanctions_list_sources", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "leiAsOf": "texte", "sources": [], "leiReady": true, "sanctionsAsOf": "texte", "sanctionsReady": true, "alternateNamesIndexed": true, "reportingExceptionsLoaded": true}}

• sanctions_resolve_entity≈ 2230 tokens

  Resolve a company or organization name (with an optional jurisdiction: a country code, which includes its subdivisions, or an ISO 3166-2 subdivision code) to candidate GLEIF Legal Entity Identifiers (LEIs), ranked. This turns a free-text counterparty name into a stable global identifier that sanctions_get_entity and sanctions_trace_ownership key off. Every name GLEIF publishes takes part: the legal name, previous legal names, trading names, alternative-language legal names, and ASCII transliterations of a legal name in another script — each candidate reports the name it matched on and that name's type, one candidate per LEI. Strict mode (default) matches exact-normalized then all-tokens-present; fuzzy mode (or auto when strict is empty) adds Jaro-Winkler scoring labeled approximate with a raw 0–1 score plus the count of query tokens the matched name covers, which orders candidates that tie on score. Results are paged: totalAvailable and hasMore report candidates beyond the returned page, and nextOffset retrieves them. Returns potential matches to confirm against the GLEIF record — name resolution is a candidate ranking, not an authoritative identification.

  Paramètres, retour & exemple (7)

  Paramètres

  • name · string · requis
    The company / organization name to resolve to an LEI, in any script. It must contain at least one letter or digit, and at most 64 words and 1024 characters.
  • limit · integer · optionnel
    Maximum LEI candidates to return in one page.
  • offset · integer · optionnel
    Zero-based index of the first LEI candidate to return. Re-call with the returned nextOffset to page through every candidate when hasMore is true; an offset past the end returns an empty page, not an error.
  • status · string · optionnel · any | issued | lapsed
    Registration status filter. issued (default) matches ISSUED; lapsed matches exactly LAPSED; any applies no filter and is the only value that reaches the other states (RETIRED, DUPLICATE, ANNULLED, PENDING_TRANSFER, PENDING_ARCHIVAL, MERGED) — each candidate's status field names its state.
  • minScore · number · optionnel
    Jaro-Winkler floor for fuzzy hits (0–1); defaults to the server's configured floor.
  • matchMode · string · optionnel · strict | fuzzy
    strict (default): exact then all-tokens-present. fuzzy: also scored Jaro-Winkler.
  • jurisdiction · ? · optionnel
    Optional legal-jurisdiction filter. A country code ("US") matches that country and every subdivision under it (US-DE, US-CA); a subdivision code ("US-DE") matches exactly. Case-insensitive. Empty string disables it.

  Exemple d'appel

  {"name": "sanctions_resolve_entity", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"error": {}, "notice": "texte", "hasMore": true, "matches": [], "nextOffset": 1, "totalCount": 1, "matchModeUsed": "texte", "totalAvailable": 1, "normalizedQuery": "texte", "totalAvailableBasis": "exact"}}

• sanctions_screen_identifier≈ 1760 tokens

  Look up an identifier — a vessel IMO number, a SWIFT/BIC code, a digital-currency wallet address, a passport or national ID number, or any other identifier a list publishes — against all loaded sanctions watchlists at once: OFAC SDN + Consolidated, EU, UK, and UN. Exact match after normalization, with no fuzzy or partial matching and no score: spacing, letter case, and the separators - . / are ignored, an IMO number matches with or without its IMO prefix, a SWIFT/BIC code compares on its first eight characters so a branch code matches its institution, and a wallet address folds case only where its encoding is case-insensitive (hex, bech32, cashaddr — never base58). Returns every designation that publishes a matching identifier, one per designation — an OFAC party both OFAC lists publish under one entry ID is one hit, its sources naming both lists — with the identifiers that matched as published; sanctions_get_designation pulls the full record. This is a screening AID for a human/compliance review, NOT a compliance determination: a hit means "review this candidate against the official source," and an empty result never means "cleared" — an identifier a list prints only in free-text remarks, or bundled with other numbers in one field, does not match.

  Paramètres, retour & exemple (3)

  Paramètres

  • type · string · optionnel · any | imo | swift_bic | digital_currency_address | passport | national_id
    Restrict to one identifier category, matched on the label each list publishes, or "any" (default) to search every published identifier, including categories with no name here (MMSI, call signs, tail numbers, tax and registration numbers, email, websites).
  • value · string · requis
    The identifier to look up, as you hold it (e.g. "IMO 7406784", "DCBKKPPY", a wallet address, a passport number). Must contain at least one character other than whitespace and - . /
  • sources · array · optionnel
    Restrict to specific source lists. Omit to search all loaded lists.

  Exemple d'appel

  {"name": "sanctions_screen_identifier", "arguments": {"value": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"hits": [], "error": {}, "caveat": "texte", "notice": "texte", "totalCount": 1}}

• sanctions_screen_name≈ 2982 tokens

  Screen a name (person, company, vessel, aircraft) against all loaded sanctions watchlists at once — OFAC SDN + Consolidated, EU, UK, and UN — alias- and fuzzy-aware. Returns scored potential matches with the source list, sanctioning program, designation date, and the matched alias; an OFAC party both OFAC lists publish under one entry ID is one hit, its sources naming both lists. Strict mode (default) matches exact-normalized then all-tokens-present, then runs a fuzzy pass over each selected list strict finds nothing on: a full pass when strict finds nothing on any list, otherwise one that adds only candidates covering every word of the name other than legal forms, articles and other function words, and the jurisdiction codes uk, usa, uae, and rf, ranked after the strict hits. Fuzzy mode runs the fuzzy pass over every selected list. It adds Jaro-Winkler and phonetic matching and labels hits approximate with a raw 0–1 similarity score plus the count of query tokens the candidate covers, which orders candidates that tie on score; fuzzySources names the lists it searched. Results are paged: totalAvailable and hasMore report matches beyond the returned page, and nextOffset retrieves them. This is a screening AID for a human/compliance review, NOT a compliance determination: a hit means "review this candidate against the official source," and an empty result never means "cleared."

  Paramètres, retour & exemple (7)

  Paramètres

  • name · string · requis
    The name to screen (person, organization, vessel, or aircraft), in any script. It must contain at least one letter or digit, and at most 64 words and 1024 characters.
  • limit · integer · optionnel
    Maximum number of potential matches to return in one page.
  • offset · integer · optionnel
    Zero-based index of the first potential match to return. Re-call with the returned nextOffset to page through every match when hasMore is true; an offset past the end returns an empty page, not an error.
  • sources · array · optionnel
    Restrict to specific source lists. Omit to screen all loaded lists.
  • minScore · number · optionnel
    Score floor for approximate hits (0–1), applied uniformly to every fuzzy candidate regardless of how it was matched (Jaro-Winkler, token, or phonetic); a query token counts toward queryTokenCoverage only when its match clears it too. It governs every fuzzy pass: fuzzy mode, and in strict mode the pass over the lists strict found nothing on, so raising it can remove approximate hits from a strict screen as well. Exact and strong hits are unaffected. Defaults to the server's configured floor.
  • matchMode · string · optionnel · strict | fuzzy
    strict (default): exact-normalized then all-tokens-present, then a fuzzy pass over each selected list strict finds nothing on — a full pass when strict finds nothing on any list, otherwise adding only candidates that cover every word of the name other than legal forms, articles and other function words, and the jurisdiction codes uk, usa, uae, and rf. fuzzy: a scored Jaro-Winkler + phonetic pass over every selected list.
  • entityType · string · optionnel · any | person | organization | vessel | aircraft
    Restrict to one entity class, or "any" (default) to screen across all.

  Exemple d'appel

  {"name": "sanctions_screen_name", "arguments": {"name": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"hits": [], "error": {}, "caveat": "texte", "notice": "texte", "hasMore": true, "nextOffset": 1, "totalCount": 1, "fuzzySources": [], "matchModeUsed": "texte", "totalAvailable": 1, "normalizedQuery": "texte", "totalAvailableBasis": "exact"}}

• sanctions_trace_ownership≈ 4887 tokens

  Trace the GLEIF Level 2 corporate-ownership graph for an LEI: direct and ultimate parents and/or children, traversed breadth-first to a bounded depth, with relationship type for each edge. Direction both walks up to the parents and down to the children from the root, never sideways into siblings or co-parents. An ultimate-parent edge is a shortcut to the top of the group, not a hop: a node only it reaches within the depth is returned as a leaf flagged reachedVia: ultimate. Set screenNodes to also cross-reference every entity in the graph against all loaded watchlists — resolving "is anyone in this ownership chain sanctioned." Each node is cross-referenced as sanctions_get_entity does it: its legal name and every other and transliterated name screened strict (exact, then all tokens present — never fuzzy), and its LEI and registration number looked up as exact non-document identifiers, the registration number matching only an identifier published for the country of its legal jurisdiction; hits merge to one per designation, an OFAC party both OFAC lists publish to one hit whose sources names both, matchedOn naming every input that produced each. A node with no Level 1 record (missingEntityLeis) has no names, so it is looked up by its LEI alone. Each per-node screen is a screening AID: hits are candidates to verify, and an empty result for a node is not a clearance of that node. Each node whose parents were walked carries parentStatus for its direct and ultimate parent: a published relationship, a reporting exception with the reasons the entity gave (such as NATURAL_PERSONS or NON_CONSOLIDATING), none, or unknown when reporting exceptions are not loaded. The response says what it could not do: complete/truncated/missingEntityLeis report whether the loaded relationship graph within the depth is fully shown, screeningStatus reports whether the cross-reference actually ran, and each screened node reports whether its own hit list was capped. Requires a valid 20-character LEI (use sanctions_resolve_entity to obtain one).

  Paramètres, retour & exemple (4)

  Paramètres

  • lei · string · requis
    The 20-character GLEIF LEI at the root of the ownership graph.
  • depth · integer · optionnel
    Maximum traversal depth from the root entity (1–5), on each side of a both walk. Ultimate-parent edges do not count as hops.
  • direction · string · optionnel · parents | children | both
    Walk parents (who owns it), children (what it owns), or both (default): a parents walk plus a children walk from the root, each to depth, never into siblings or co-parents.
  • screenNodes · boolean · optionnel
    When true, cross-reference every node against all watchlists — the ownership-chain cross-reference: the node's legal, other, and transliterated names screened strict, and its LEI and country-matched registration number looked up as identifiers. A node with no Level 1 record has no names: its LEI lookup alone.

  Exemple d'appel

  {"name": "sanctions_trace_ownership", "arguments": {"lei": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"edges": [], "error": {}, "nodes": [], "caveat": "texte", "rootLei": "texte", "complete": true, "truncated": true, "screeningStatus": "screened", "flaggedNodeCount": 1, "missingEntityLeis": [], "screenedNodeCount": 1, "reportingExceptionsLoaded": true}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://sanctions-screening.caseyjhand.com/mcp