Skip to main content
Glama

Tolca: business verification (KYB)

verify-business

verify_business
Read-onlyIdempotent

Call before paying, onboarding or contracting a company (KYB). Returns a clear action (allow / review / block), a 0-100 risk score and which official registries corroborate the company. Every response includes an Ed25519-signed receipt you can verify offline (public key: https://tolca.tonbot.ca/.well-known/tolca-receipt-key.json) or online at /receipts/verify. Every response includes an Ed25519-signed receipt you can verify offline (public key: https://tolca.tonbot.ca/.well-known/tolca-receipt-key.json) or online at /receipts/verify. One call: US, UK, EU and Canadian sanctions lists (CSL incl. OFAC SDN), company registries (UK Companies House, Canada federal), legal entity status (GLEIF, worldwide), contractor licences (Québec, Washington, Oregon). Verdict ok / review / blocking / not_found with reasons. Input: name, optional country (ISO-2) and region (WA, OR, QC). Businesses only. Costs $0.05 USDC per call (x402 v2, Base). Send the HTTP header PAYMENT-SIGNATURE with your x402 payment, or call POST https://tolca.tonbot.ca/v1/verify-business with an x402 client.

Input Schema

NameRequiredDescriptionDefault
nameYesBusiness legal or trade name
regionNoState/province code: WA, OR or QC enables contractor-licence checks
countryNoISO 3166 alpha-2 country code, e.g. US, CA, GB

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive), yet the description adds substantial unstated-elsewhere context: $0.05 USDC per call via x402 on Base, the PAYMENT-SIGNATURE header requirement, the exact verdict vocabulary, and the Ed25519-signed receipt with key URL. It falls short of 5 because the receipt sentence is duplicated verbatim and the raw-HTTP payment instructions are awkward for an MCP caller, but the disclosure itself is genuinely rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded well with the use case and decision output, but the entire receipt/public-key sentence appears twice word-for-word, wasting roughly a fifth of the text. The tail also drifts into raw endpoint and HTTP-header instructions that clutter the tool-call framing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Without an output schema, the description usefully pre-announces the return shape: action (allow/review/block), 0-100 risk score, corroborating registries, verdict enum and signed receipt. Coverage of sources and cost is thorough; only edge behavior (e.g. what not_found implies, latency/caching) is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so name, region and country are already documented. The description restates them ('Input: name, optional country (ISO-2) and region (WA, OR, QC)') and adds only the rationale that specific region codes unlock contractor-licence checks, which is already present in the schema. Baseline 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('verify' a 'business' for KYB) and immediately frames the decision output (allow/review/block plus risk score). It is clearly distinguishable from enrichment siblings like company_enrich or the narrow qc_contractor_check, since it names the registries and sanctions lists it corroborates against.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Call before paying, onboarding or contracting a company' gives an explicit trigger context, and 'Businesses only' sets a scope exclusion. It does not name alternatives or say when to prefer a sibling (e.g. qc_licence for a single licence lookup instead of a full KYB verdict), so the routing guidance stops short of 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources