Skip to main content
Glama

score_risk

Produce a composite 0-100 financial-crime risk score for a company from its jurisdiction, sector and sanctions exposure. RETURNS JSON with: risk_score (integer 0-100, where 0 is lowest risk and 100 is highest), risk_level ("LOW", "MEDIUM", "HIGH" or "CRITICAL"), recommendation ("PROCEED", "ENHANCED_DUE_DILIGENCE" or "DO_NOT_PROCEED"), fatf_status (the FATF listing state of the jurisdiction, e.g. "BLACKLIST", "GREYLIST" or "NOT_LISTED"), basel_aml_score (Basel AML Index country score, roughly 0-10 where higher is worse), sector_risk, and notes explaining which factors drove the score. SOURCES: FATF high-risk and increased-monitoring lists, Basel AML Index 2025, live sanctions-screening output, and the ARM sector risk classification. USE WHEN you need a single comparable risk figure for onboarding thresholds, portfolio ranking or periodic review. Called via MCP — usage is logged but not billed. For metered billing use the REST API with an API key.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
sectorNoOptional business sector or industry, in plain English, used to apply a sector risk weighting. Higher-risk examples: "crypto exchange", "money services business", "gambling", "arms trading", "precious metals". Lower-risk examples: "software", "agriculture". Omit if unknown.
entity_nameYesFull registered company name being scored. Example: "Nestle SA". Also screened against sanctions lists, because a hit raises the composite score.
jurisdictionYesISO 3166-1 alpha-2 country code of incorporation, uppercase. Examples: "CH", "PA", "IR", "GB". This is the single largest input to the score, via FATF listing status and the Basel AML Index.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed3 schema fields changed
    • changedInput schema / properties / entity_name / description
      Previous value: -"Entity name"New value: +"Full registered company name being scored. Example: \"Nestle SA\". Also screened against sanctions lists, because a hit raises the composite score."
    • changedInput schema / properties / jurisdiction / description
      Previous value: -"ISO 2-letter country code"New value: +"ISO 3166-1 alpha-2 country code of incorporation, uppercase. Examples: \"CH\", \"PA\", \"IR\", \"GB\". This is the single largest input to the score, via FATF listing status and the Basel AML Index."
    • changedInput schema / properties / sector / description
      Previous value: -"Business sector (optional)"New value: +"Optional business sector or industry, in plain English, used to apply a sector risk weighting. Higher-risk examples: \"crypto exchange\", \"money services business\", \"gambling\", \"arms trading\", \"precious metals\". Lower-risk examples: \"software\", \"agriculture\". Omit if unknown."
  2. Changed3 schema fields changed
    • addedInput schema / properties / entity_name / description
      Added value: +"Entity name"
    • addedInput schema / properties / jurisdiction / description
      Added value: +"ISO 2-letter country code"
    • addedInput schema / properties / sector / description
      Added value: +"Business sector (optional)"
  3. Changed3 schema fields changed
    • removedInput schema / properties / entity_name / description
      Removed value: -"Entity name"
    • removedInput schema / properties / jurisdiction / description
      Removed value: -"ISO 2-letter country code"
    • removedInput schema / properties / sector / description
      Removed value: -"Business sector (optional)"
  4. First observed

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that usage is logged but not billed, that the tool is called via MCP, that it screens entity_name against sanctions lists, and that jurisdiction is the single largest input. It also explains the meaning of the score scale. It doesn't mention rate limits or whether the score is cached, but for a read-only scoring tool this is strong disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-organized: it front-loads the core purpose and return format, then sources, then usage guidance, then billing note. Every sentence adds information. It is longer than average, but the length is justified by the rich return payload and the need to distinguish from siblings.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, the description thoroughly documents the return JSON fields, their types, and example values. It also covers data sources and usage context. Minor gaps: no mention of error conditions (e.g., invalid jurisdiction code) or whether the tool is synchronous, but the description is largely complete for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds value by explaining that entity_name is also screened against sanctions lists, that jurisdiction is the single largest input via FATF and Basel AML Index, and that sector is optional with examples. This goes beyond the schema's field descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Produce'), a precise resource (composite 0-100 financial-crime risk score), and the inputs (jurisdiction, sector, sanctions exposure). It also names the return fields, which distinguishes it from siblings like screen_sanctions (which likely returns raw hits) and verify_entity (which likely returns identity data).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'USE WHEN you need a single comparable risk figure for onboarding thresholds, portfolio ranking or periodic review.' It also contrasts with the REST API for metered billing, and the sibling names (screen_sanctions, verify_entity) imply alternatives for raw screening or verification. This is clear when-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources