Skip to main content
Glama

Vendor due diligence report

due_diligence_report
Read-onlyIdempotent

One-call due-diligence report: SEC profile (if public), sanctions screen, federal exclusions, domain signals (registration age, email records, Wayback Machine first-seen date), and state registry link, with a red-flag summary, a verdict (clear / review / hold; rules at https://mcp.pyxmark.com/#verdict) and source links. An agent should not pay or onboard on 'hold', and should ask a person on 'review'. Informational only, not a compliance determination. Results come from public government lists and filings, may be incomplete or out of date, and fuzzy name matches can be false positives or miss variants. Verify every potential match against the official source before acting. Colorado vendors only (state CO or a Colorado address): address_density gives how many active Colorado companies list the vendor's address, from the Colorado Department of State's Business Entities in Colorado data (Public Domain), refreshed monthly. A building that also hosts a listed virtual mailbox service, an address shared by 1,000+ companies, or a registered agent's address used by hundreds of companies that almost none of them list as their principal address adds a worth-a-second-look line under info, never a red flag or a verdict change; other states are not covered.

Input Schema

NameRequiredDescriptionDefault
cikNoSEC CIK
dobNoOptional: date of birth (YYYY-MM-DD) of the person, to tell them apart from others with the same name
idsNoOptional: identifiers to match against the lists: company registration or tax numbers, passport or national ID numbers, vessel IMO numbers, SWIFT/BIC codes, crypto addresses
nameNoCompany or person name
emailNoOptional: contact email, matched against emails and domains the lists give
phoneNoOptional: phone number, matched on its last 9 digits against phones the lists give
stateNoUS state of incorporation/registration
domainNoCompany website or email domain
ownersNoOptional: owners and their share (percent). Each is screened; listed owners holding 50% or more in total make the company blocked under the OFAC 50 percent rule
tickerNoTicker
addressNoOptional: street address or city (free text). Flags addresses in comprehensively sanctioned regions: Crimea, the so-called DNR/LNR, Iran, North Korea, Cuba (Syria is flagged for review)
countryNoOptional: country where the person lives or the organisation is based
websiteNoOptional: website or domain, matched against websites the lists give
birth_yearNoOptional: birth year, if the full date isn't known
nationalityNoOptional: the person's nationality (country name or ISO code)
subject_typeNoOptional: whether the name is a company or a person. Defaults to company when the name has a legal suffix such as Inc or LLC (or, in a report, when it is an SEC-registered company); then person, vessel and aircraft entries must match almost exactly.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this as read-only, idempotent, and non-destructive, but the description adds substantial context: data-source limitations, potential false positives and missed fuzzy matches, the difference between informational output and compliance determination, and the precise meaning of the verdict states. It also explains that address-density signals are informational only and never change the verdict.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The main purpose and verdict guidance are front-loaded, and most sentences carry relevant caveats or scope limits. It is dense and long for a description, especially the address-density explanation, but the length is largely justified by the tool's complexity and lack of an output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 16 optional parameters, no output schema, and a broad data-aggregation purpose, the description covers what the report includes, how to interpret the verdict, data limitations, verification expectations, and geographic scope. An agent has enough context to decide when and how to use it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all 16 parameters are already documented in the input schema. The description reinforces a few constraints, such as Colorado-only scope and state/address relevance, but adds little per-parameter semantics beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: a one-call due-diligence report covering SEC, sanctions, exclusions, domain, and registry data plus a verdict. It clearly positions the tool as an aggregate report rather than a single-purpose sibling like screen_sanctions or domain_age.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives actionable usage guidance tied to the verdict: do not pay or onboard on 'hold' and ask a person on 'review'. It also limits scope to Colorado vendors and instructs verification against official sources, though it does not explicitly contrast with sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.