# pro.tvarka/due-diligence

> Lithuanian company due diligence and KYC identification, attested by an attorney-at-law.

- name: pro.tvarka/due-diligence
- version: 1.3.1
- connection class: R1 (autonomous)
- trust: 82/100 flags: no-repository
- quality: 79/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/pro.tvarka%2Fdue-diligence
- tools: https://api.protogrid.dev/v1/servers/pro.tvarka%2Fdue-diligence/tools

**An agent can connect on its own if it already holds `DUE_DILIGENCE_TOKEN`.** Remote endpoint behind a static API key or header. The registry never sees the value; the agent fills the placeholder.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "due-diligence": {
      "type": "http",
      "url": "https://api.tvarka.pro/mcp",
      "headers": {
        "Authorization": "Bearer ${DUE_DILIGENCE_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${DUE_DILIGENCE_TOKEN}`.

## Trust

- hygiene: 80
- liveness: 98
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-96% +updated-16d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 79/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 71 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- fail `tools.annotations`: no tool declares readOnlyHint or destructiveHint, so clients cannot tell safe calls from risky ones
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: get_participants (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_court_cases (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_real_estate (readOnlyHint, destructiveHint, idempotentHint, openWorldHint); …
- pass `tools.token_cost`: about 1,936 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: 5 tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 10, about 1,936 tokens to load them all
- tool set hash: 352ba127f0c44dfdefad7543a8079790
- tools last changed: 2026-10-18T17:55:54.759Z
- badge: [![protogrid quality](https://protogrid.dev/badge/pro.tvarka/due-diligence.svg)](https://protogrid.dev/servers/pro.tvarka/due-diligence)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-18 `screen_sanctions` added
  - Screens a Lithuanian legal entity and every person in its own registry data (management, shareholders and members, beneficial owners) against the official EU, UN, US (OFAC) and UK sanctions lists. Each potential match comes with its score, the words that matched, the spelling rules applied and the birth-date check, and the answer names the exact list versions used. A purpose is required because beneficial owners are among the people screened.
- 2026-10-18 `get_due_diligence_report` changed (inputSchema)
- 2026-10-18 `get_beneficial_owners` changed (inputSchema)
- 2026-10-18 `get_participants` changed (inputSchema)
- 2026-10-18 `lookup_company` changed (inputSchema)

Full history: https://api.protogrid.dev/v1/servers/pro.tvarka%2Fdue-diligence/changes

## Remotes

- https://api.tvarka.pro/mcp (streamable-http, auth api_key ${DUE_DILIGENCE_TOKEN}, reachable true, uptime30d 0.95726496)

## Packages

_none_

## Tools (10)

- `create_kyc_package`: Order a QES-signed identification package for a role-holder of a Lithuanian legal entity. The register says who holds the role; the person proves they are that person by signing a dossier with their own qualified electronic signature, and an attorney-at-law attests the verified correspondence. Returns immediately with an order id and a ceremony URL to give the subject; the outcome arrives later. Poll with get_kyc_package. Billed only when a package is delivered.
- `get_beneficial_owners`: Declared beneficial owners of a Lithuanian legal entity, with ownership percentages and control basis. Served under the legitimate-interest regime; a purpose is required and is logged.
- `get_court_cases`: Court hearings where the Lithuanian legal entity appears as a party.
- `get_due_diligence_report`: One call returning the whole picture: profile, participants, beneficial owners, real property, seizure acts and court cases. Cheaper than the parts bought separately. A purpose is required because the report contains beneficial-owner data.
- `get_kyc_package`: Current state of a KYC package order: whether the subject has signed, the cross-check outcome, and the evidence container digest once delivered. The container bytes are fetched over REST, not through this tool.
- `get_participants`: Current participants (shareholders, members) of a Lithuanian legal entity.
- `get_real_estate`: Real property registered to a Lithuanian legal entity, with the rights recorded on each object. Legal entities only.
- `get_seizures`: Property seizure acts registered against a Lithuanian legal entity, with the institution that imposed them, the parties and the seized assets. An entity with no acts is a clean record, not a missing answer.
- `lookup_company`: Core registry profile of a Lithuanian legal entity: name, legal form, status, registered address, registration dates, capital, activities and current management. Current data with officially attested provenance.
- `screen_sanctions`: Screens a Lithuanian legal entity and every person in its own registry data (management, shareholders and members, beneficial owners) against the official EU, UN, US (OFAC) and UK sanctions lists. Each potential match comes with its score, the words that matched, the spelling rules applied and the birth-date check, and the answer names the exact list versions used. A purpose is required because beneficial owners are among the people screened.