@oilflow/mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| OILFLOW_API_KEY | No | An `oilflow_...` key. Without it the server still starts and the three keyless tools work. Get one at https://oilflow.us/dashboard, or a free 30-day sandbox key at https://oilflow.us/sandbox. | |
| OILFLOW_BASE_URL | No | Override only for self-hosted/staging. | https://oilflow.us |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| predeal_previewA | Run OilFlow's Pre-Deal Compliance check on a proposed physical-commodity deal and get a clearance probability (0-100) and verdict tier (clear/review/heavy_friction/block) with named blockers and a restructure suggestion. NO API KEY REQUIRED: this is the full verdict, not a teaser. QUOTA: 5 verdicts per caller per 24 hours; on exhaustion the error is demo_limit_reached, which means the free allowance is used up and NOT that OilFlow is down. Returns |
| verify_receiptA | Independently verify an OilFlow screening receipt. NO API KEY REQUIRED. Given a receipt id (a UUID, from |
| request_sandbox_keyA | Mint a free 30-day OilFlow sandbox API key (100 calls/day) scoped to the regulatory matrix and cluster endpoints, emailed to the address supplied. NO API KEY REQUIRED, which is the point: this is how an agent running keyless gets its user onto the keyed tools. CONSENT: requires the END USER'S email address and must only be called with their knowledge and agreement, because OilFlow emails the key and may send product follow-ups. Do not supply an address the user has not asked you to use. Limits: 3 keys per IP/hour, 5 per email/day. The sandbox scope does NOT cover kyc, ubo, lc or the keyed predeal endpoint; use predeal_preview for a free verdict, or https://oilflow.us/pricing for production access. Once the key arrives, set OILFLOW_API_KEY in this server's environment and restart it. |
| kyc_screenA | Run an OilFlow counterparty KYC screen: cluster-blocklist match, regulatory tradability, and the 7-step registration pipeline with 8-list sanctions screening (OFAC SDN, OFAC Consolidated, UN, EU, UK HMT, Canada SEMA, AU DFAT, Swiss SECO). PEP screening is NOT shipped — coverage is sanctions-only, so a politically exposed person who is not also designated will not be flagged; tell the user this. Sanctions/registration/asset/footprint steps run out-of-band and return as 'queued' with a poll_url. Returns a verdict (pass/review/fail) with per-check evidence. Decision-support for a compliance analyst, not a legal determination. Requires a production API key. |
| regulatory_checkA | Check whether a given commodity can be supplied/bought from a given jurisdiction under OilFlow's 235-jurisdiction regulatory matrix. Returns allowed:true/false plus any blockers. Compiled regulatory guidance, not legal advice — confirm with the relevant national regulator before acting. |
| regulatory_countriesA | List every jurisdiction covered by the OilFlow regulatory matrix (235 jurisdictions). Returns a count and the country list with slugs for use in regulatory_check. |
| regulatory_productsA | List the commodity/product categories the regulatory matrix recognizes (with their canonical labels), for use as the |
| cluster_checkA | Look up a counterparty name against OilFlow's first-party-investigated Scam Cluster Intelligence Feed. Returns any matches with a severity: 'confirmed' (OilFlow-verified fraud), 'likely', or 'suspected' (publicly reported but NOT first-party confirmed — treat as a lead, verify the cited source). matched:false means no hit, which is not by itself an exoneration. |
| clusters_listA | List entries from the Scam Cluster Intelligence Feed, optionally filtered by severity, country, or date. Useful for browsing known fraud clusters. Severity 'suspected' rows are publicly reported leads, not OilFlow-confirmed. |
| lc_validateA | Validate a Letter of Credit presentation (LC + commercial invoice + bill of lading) against UCP 600 rules. Returns discrepancies with severity, an overall recommendation (honor/inquiry/refuse), and the UCP 600 articles cited. Requires a production API key (sandbox keys get 403). Output is DRAFT decision-support for a documentary-credit examiner — not a legal opinion. |
| ubo_screenA | Start a beneficial-ownership (UBO) graph traversal for an entity: walks ownership across registries, flags shell-company patterns, and screens nodes for sanctions exposure (8 lists; PEP is NOT screened). Applies the OFAC 50%-rule to derived ownership. Returns the cached graph immediately when available, otherwise a graph_id to poll with ubo_graph. Coverage caveat to pass on: there is no functioning US domestic UBO registry post-March-2025, so beneficial-ownership coverage is partial and every result says so. Flagged patterns are structural signals to review, not a verdict on any individual. Requires a production API key. |
| ubo_graphA | Fetch the status/result of a UBO graph build started by ubo_screen. Pass the graph_id returned when the screen was queued. Returns the graph nodes, ownership edges, aggregate risk, and flagged patterns once status is 'ready'. |
| predeal_checkA | Run a Pre-Deal Compliance Copilot check for a front-office originator: a sub-30s clearance probability (0-100) and verdict tier (clear/review/heavy_friction/block) for a proposed physical-commodity deal, with blockers, a restructure suggestion, and an estimated post-restructure clearance. Runs cluster, regulatory, adverse-media, sanctions, and verified-profile primitives. The response is self-describing about its own reliability: |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/rafaemush/oilflow-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server