# Compliance & Sanções

> Due diligence & KYC: PEP, national and international sanctions (OFAC, UN, EU, UK, FBI, INTERPOL, FIN

- name: io.github.mcp-dir/compliance-mcp
- version: 0.1.0
- connection class: R0 (autonomous)
- trust: 90/100
- quality: 88/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.mcp-dir%2Fcompliance-mcp
- tools: https://api.protogrid.dev/v1/servers/io.github.mcp-dir%2Fcompliance-mcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "compliance-mcp": {
      "type": "http",
      "url": "https://api.mcp.ai/p_compliance"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 98
- freshness: 85
- provenance: 80
- drivers: +repository +namespace-matches-repo +reachable +uptime-95% ~updated-60d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 88/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 1 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 37 of 37 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 4,155 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 37, about 4,155 tokens to load them all
- tool set hash: 1ef146589a104e372ce042af063daeb0
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.mcp-dir/compliance-mcp.svg)](https://protogrid.dev/servers/io.github.mcp-dir/compliance-mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://api.mcp.ai/p_compliance (streamable-http, auth none, reachable true, uptime30d 0.94690263)

## Packages

_none_

## Tools (37)

- `authenticate`: MCP.AI for IDE agents (Cursor, etc.): log in in the browser, copy the access token. Best: add it to this server's config as a header `Authorization: Bearer <token>` for a permanent, non-expiring connection. Or paste it here for a session-only login: call with { token: "<jwt>" } after the user pastes, or with no args to get the link.
- `compliance_antecedentes_civil`: Antecedentes criminais (Polícia Civil) por CPF/nome/UF.
- `compliance_antecedentes_pf`: Antecedentes criminais (Polícia Federal) por CPF/nome.
- `compliance_antt`: Regularidade de transportadora na ANTT por CPF/CNPJ/RNTRC.
- `compliance_bacen_inabilitados`: Banco Central — quadro geral de inabilitados, por CPF/CNPJ.
- `compliance_bacen_proibidos`: Banco Central — quadro geral de proibidos, por CPF/CNPJ.
- `compliance_cadin`: CADIN estadual (inadimplentes com a Fazenda) por CPF/CNPJ/UF.
- `compliance_carf`: Processos no CARF (Conselho Administrativo de Recursos Fiscais) por CPF/CNPJ.
- `compliance_ceaf`: CEAF — expulsões da administração federal, por CPF.
- `compliance_ceis`: CEIS — empresas inidôneas e suspensas, por CNPJ/CPF.
- `compliance_cepim`: CEPIM — entidades privadas impedidas, por CNPJ.
- `compliance_cgu`: Consulta de penalidades CGU por CPF/CNPJ.
- `compliance_cnd_municipal`: Certidão Negativa de Débitos Municipal por CNPJ/CPF (informe o município).
- `compliance_cnep`: CNEP — empresas punidas, por CNPJ/CPF.
- `compliance_confea_crea`: Registro profissional no CONFEA/CREA (engenharia/agronomia).
- `compliance_cvm`: Cadastro na CVM (Comissão de Valores Mobiliários) por CPF/CNPJ.
- `compliance_cvm_sancionadores`: Processos administrativos sancionadores da CVM por CPF/CNPJ.
- `compliance_fbi`: Busca na lista FBI Most Wanted por nome.
- `compliance_fincen`: Busca na lista FINCEN por nome.
- `compliance_ibama_debitos`: Certidão negativa de débitos do IBAMA por CPF/CNPJ.
- `compliance_improbidade`: CNIA — condenações por improbidade administrativa e inelegibilidade, por CNPJ/CPF.
- `compliance_interpol`: Busca na lista da INTERPOL por nome.
- `compliance_leniencia`: Acordos de leniência por CNPJ.
- `compliance_mandados_prisao`: CNJ — mandados de prisão em aberto, por CPF/nome.
- `compliance_ofac`: Busca em listas de sanções OFAC (EUA) por nome.
- `compliance_onu`: Busca na lista consolidada de sanções da ONU por nome.
- `compliance_pep`: Verifica se um CPF é Pessoa Exposta Politicamente (PEP).
- `compliance_pep_parentescos`: PEP estendida — pessoa exposta politicamente + parentescos.
- `compliance_pix`: Antifraude de chave PIX — valida o titular de uma chave PIX.
- `compliance_trabalho_forcado`: Verificação de empregador em lista de trabalho forçado/escravo, por CNPJ/CPF.
- `compliance_ue`: Busca na lista de sanções financeiras da União Europeia por nome.
- `compliance_uk`: Busca na lista de sanções do Reino Unido (HM Treasury) por nome.
- `connect`: Returns connection status and URLs. When all providers are connected, returns authenticated:true and empty pending[]. When credentials are missing, returns connect_url for the toolkit and per-install URLs.
- `marketplace`: The official mcp.ai marketplace — the in-platform catalog of every MCP/tool, AND the way to run them. Covers capability requests like "find an MCP that does X", "consulta um CPF", "is there a tool for Y". Core flow: action=search discovers MCPs by intent → describe returns one MCP's full profile (every tool with its id + params, pricing, auth) so you pick the right tool_id → invoke RUNS that tool. KEY: invoke works even when the MCP is NOT installed — it runs the tool pontualmente (one-off), without adding the MCP to the toolkit and without bloating the tool list. If the MCP needs a credential/login, invoke returns a connect link; if it is paid and the wallet is empty, invoke returns a checkout/top-up link (the user opens it, then you retry). Use install only to make an MCP PERMANENT in the active toolkit (its tools then show up natively in future sessions); prefer invoke for a single/occasional use. list_tools lists what is callable right now. subscribe/cancel handle per-MCP billing; report_bug sends feedback; request_mcp asks us to build a NEW MCP when nothing fits. Search/describe flag installed_in_toolkit vs installed_in_workspace. Writes (install/uninstall/subscribe/cancel and the one-off install behind invoke) require workspace owner/admin. It also carries the mcp.ai PROMPT LIBRARY, which is about ready-made prompt TEXT rather than MCPs: search_prompts finds one, get_prompt returns its full text with {{variables}} filled, and publish_prompt saves a prompt and returns a shareable mcp.ai/p/<slug> link that opens without login.
- `report_bug`: Report a bug, missing feature, or send feedback. Include the conversation array with recent messages for reproduction.
- `show_version`: Show the current MCP platform and adapter versions.
- `toolkit_info`: Returns the current toolkit state: installed MCPs, their connection status, the accounts connected to each one, and how many catalog tools each exposes.