Verifex sanctions screening

Verifex sanctions screening — MCP server

A Model Context Protocol server that lets an AI assistant screen a person or company with Verifex, read back a past screening, and fetch the screening's Evidence Capsule — the audit record of what was checked and found.

• Uses your own Verifex API key. Screenings bill to your existing Verifex plan.
• Sends Verifex only the name, type (person or company), country and date of birth.
• No runtime dependencies. Node.js 18.17 or later. Runs locally over stdio.

How results read

Every result starts with a status line, then the scope, then the full result exactly as the Verifex API served it. The status follows the decision Verifex itself served (verdict); this server only ever adds caution to it, never removes it.

On the Free plan Verifex screens OFAC and UN only, and every result says so. EU and UK are required lists, so a Free-plan result with no match reads Screening incomplete and names the lists the plan did not check.

Get an API key

Sign in at verifex.dev → Dashboard → API Keys → create a key. Create a separate key just for your MCP client, so you can revoke it on its own. The key has full access to your account's API, not only screening. Keep it in your MCP client's configuration; never paste it into a chat.

Set up

Claude Desktop

Settings → Developer → Edit Config, then add:

{
  "mcpServers": {
    "verifex": {
      "command": "npx",
      "args": ["-y", "verifex-mcp@0.1.2"],
      "env": { "VERIFEX_API_KEY": "<your Verifex API key>" }
    }
  }
}

Restart Claude Desktop. You can also install the verifex-mcp.mcpb bundle from the releases page; Claude Desktop asks for the key.

Claude Code

claude mcp add verifex --env VERIFEX_API_KEY=<your Verifex API key> -- npx -y verifex-mcp@0.1.2

Cursor, Windsurf and other clients

Use the same command, args and env as the Claude Desktop example in the client's MCP settings (Cursor: ~/.cursor/mcp.json).

VS Code

.vscode/mcp.json:

{
  "inputs": [{ "type": "promptString", "id": "verifex-key", "description": "Verifex API key", "password": true }],
  "servers": {
    "verifex": {
      "command": "npx",
      "args": ["-y", "verifex-mcp@0.1.2"],
      "env": { "VERIFEX_API_KEY": "${input:verifex-key}" }
    }
  }
}

Pin the version (verifex-mcp@0.1.2, as above) so a new release never runs on your machine until you choose to update. Releases are listed on the releases page.

Tools

Example prompts

1. "Screen Acme Trading FZE, a company registered in the United Arab Emirates (AE), and tell me exactly which lists were checked."
2. "We're onboarding a new distributor contact, Ivan Petrov, born 1971, Russian national. Screen him and, if there is a potential match, list each candidate with its list and programmes."
3. "Get the Evidence Capsule for request scr_… and summarise what was screened, when, and against which list versions, so I can attach it to our customer file."

Security

• Your key goes only to Verifex. It is sent as a bearer token to the configured origin (by default https://api.verifex.dev) and nowhere else. Redirects are never followed. The key is never written to the assistant, to stdout or to logs, and is removed from any result that might contain it.
• Results are data, not instructions. Names, aliases and notes come from records, including names your own systems screened earlier. The server cleans them: no control, invisible or bidi characters and no line breaks, each one quoted and length-capped, and the same characters are escaped in the full JSON. It tells the assistant to treat everything after the status line as data. The status line itself is computed by the server.
• Approve screenings yourself. Each screen_name call uses quota. Don't set your client to "always allow" it. The per-process limit above is a backstop, not a substitute.
• Bounded. Answers over 2 MB are refused; every request has a 30-second limit; there are no runtime dependencies.
• Releases. Use a pinned version. Report a vulnerability as described in SECURITY.md.

Data and privacy

Only the four fields above are sent to Verifex, over HTTPS to api.verifex.dev, with your API key as a bearer token. The key is read from the environment and is never written to the assistant, to stdout or to logs. Verifex keeps the screening and its Evidence Capsule on your account as described in the privacy policy and DPA.

The name you ask about, and the results this server returns (including candidate records and, with get_screening, earlier screenings on your account), become part of your conversation with your AI assistant. They are handled by that assistant's provider under its own terms.

Verifex results support your compliance decision; they are not legal advice.

Develop

npm test                # node --test, no dependencies
npm run pack:mcpb       # builds dist/verifex-mcp.mcpb

Support: verifex.dev/support. Security reports: see SECURITY.md. Licence: MIT.