MCP Connector Reference

Verified against the live MCP server and its tool catalog while writing this page — endpoint names, tool names and OAuth routes are real, not illustrative.

---

1. What This Is, And How It Relates To The API Docs

There are two ways to integrate: plain REST under /v1, documented at api.compliance-mcp.com/docs — and the MCP connector, a single JSON-RPC endpoint that exposes the same underlying checks as a tool catalog for AI clients like ChatGPT and Claude.

The REST docs are auto-generated from the OpenAPI schema, and that schema does show that POST /mcp and GET /mcp exist — but OpenAPI has no way to describe what happens inside a JSON-RPC method dispatch. It can't enumerate the tool catalog, say which tool to call for which request, or describe the MCP-specific OAuth flow. This page is that missing layer.

Use /docs if you're integrating over plain REST. Use this page if you're building or configuring an MCP host or client — ChatGPT Connectors, Claude Connectors, or any other MCP-compatible assistant.

---

2. Connecting

The connector is self-describing: call initialize, then tools/list, and use resources/list / prompts/list when the host supports them.

search and fetch are compatibility tools for ChatGPT-style connector discovery and deep-research mode — useful for finding connector capabilities and CN/TARIC reference text, but not the operational screening path. Business checks should call the domain tools below directly.

---

3. Tool Catalog — Discovery And Metadata

The catalog is versioned (toolset_version, metadata_version) rather than dated in this document — call get_connector_metadata for the version and change history currently live, the same way Prompt Scenarios: Banking & Payments treats /sources as the live word on source coverage.

---

4. Tool Catalog — Goods, Customs And Chemicals

---

5. Tool Catalog — Entity, Vessel And PEP Screening

---

6. Tool Catalog — KYB, Business Registry

Not in the original internal reference this page replaces — genuinely new capability, and worth calling out on its own, matching the depth given to it in Prompt Scenarios: Banking & Payments §8–9.

Registry data is reference evidence, not a sanctions clearance on its own — screen_business_entity_with_related_parties is what turns it into one.

---

7. Tool Catalog — ISO 20022 Payments

---

8. Tool Catalog — Interactive Widgets

Widget submissions run the underlying tool directly and persist a transient run — read it back with get_goods_screening_run, get_entity_screening_run or get_payment_screening_run rather than resubmitting the same input.

---

9. Routing Guidance

• CN/TARIC code plus country → get_compliance_report
• Quick duty rate → get_overview or get_duties
• RU/BY goods sanctions only → check_sanctions
• Person, company, vessel, aircraft, bank, address or identifier screening → screen_entities
• Vessel/aircraft owner or operator relationship → lookup_ofac_asset_related_parties, then screen_entities on the returned names
• Payment / PSP / EPC VoP close-match decision → screen_entity_vop
• PEP / EDD risk on a person → screen_pep, alongside screen_entities when sanctions exposure also matters
• Company registry lookup, UBO, related parties → search_business_registry → screen_business_entity_with_related_parties
• ISO 20022 XML parse only → validate_iso20022_payment
• ISO 20022 one-shot preview → screen_iso20022_payment
• ISO 20022 persisted audit case → create_iso20022_payment_case
• Follow-up on a run already made → the matching get_*_screening_run / get_payment_case_evidence tool, not a resubmission
• Source/freshness/audit coverage → list_sanctions_sources
• Connector version/capabilities question → get_connector_metadata

---

10. JSON-RPC Examples

Initialize:

curl -X POST "https://api.compliance-mcp.com/mcp" \
  -H "Authorization: Bearer tk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize",
    "params": {
      "protocolVersion": "2025-06-18",
      "clientInfo": {"name": "example-client", "version": "1.0.0"}
    }
  }'

List tools:

curl -X POST "https://api.compliance-mcp.com/mcp" \
  -H "Authorization: Bearer tk_..." \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'

Call a tool — screen an entity:

curl -X POST "https://api.compliance-mcp.com/mcp" \
  -H "Authorization: Bearer tk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 3,
    "method": "tools/call",
    "params": {
      "name": "screen_entities",
      "arguments": {
        "query": "Petr Aven",
        "threshold": 60,
        "limit": 20,
        "list_name": "LV_FID_FROZEN"
      }
    }
  }'

Follow up on the latest one-shot payment run, without resubmitting XML:

curl -X POST "https://api.compliance-mcp.com/mcp" \
  -H "Authorization: Bearer tk_..." \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"get_payment_screening_run","arguments":{}}}'

---

11. Resources And Prompts

Prompt templates are exposed through prompts/list and prompts/get for clients that support them — useful for hosts that render prompts as guided forms. Clients that don't should use the open_*_screening_form tools directly instead.

---

12. OAuth 2.1 For MCP Clients

For OpenAI Web custom connectors and other OAuth-capable MCP hosts, the endpoint advertises protected resource metadata and an Authorization Code + PKCE flow.

Flow: the host reads the protected-resource and authorization-server metadata, registers a public OAuth client through /oauth/register, opens /oauth/authorize with PKCE S256, the user pastes an organization API key (tk_...) into the hosted consent page, and the host exchanges the code at /oauth/token. The issued access token is the organization key, so existing tenant access controls apply unchanged.

Direct bearer mode. Hosts that support direct bearer auth can skip OAuth entirely and send Authorization: Bearer tk_<organization-api-key> directly. Never place the key in public connector metadata, instructions or screenshots — only in the OAuth consent form or the host's private bearer-token setting.

The organization key needs mcp_access for MCP calls; api_access is a separate capability for REST — one does not imply the other.

---

13. Access And Error Model

Tool results are compliance evidence and review signals. They do not replace legal, customs, trade or regulatory advice.

---

14. Related Material

• AI Assistant User Guide — the same tools, driven from in-cabinet slash commands instead of a raw MCP client
• Entity Screening Algorithms — how the score behind every screen_entities result is actually assigned
• Prompt Scenarios: Banking & Payments — live-tested natural-language prompts for the KYC/KYB/payment tools above