Skip to content
anlyon.dev

Stablecoin Gateways

com.stablecoingateways/compliance-datastablecoingateways.comstreamable-httpv1.0.0Scanned

Pay-per-call compliance data: OFAC sanctions, merchant check, LEI, SEC, WHOIS, FX. x402 in USDC/XRP

15 tools: 1 do something that can't be undone, 13 change things and 1 only read.

Tools: 0 delete, 1 irreversible, 13 write, 1 read.
  • Reads private data · 0
  • Reads text others write · 12
  • Can send data out · 2
  • 1 finding

Anlyon alternative

14 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

15 tools

Can't be undone 1Claude Code: ask
  • fx_convertCurrency converter (ECB reference rates): convert an amount from one currency to one or more others, e.g.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "fx_convert" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "fx_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "fx_convert" says "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Currency converter (ECB reference rates): convert an amount from one currency to one or more others, e.g. 250 USD to EUR, GBP and JPY, at the latest European Central Bank rate or any day in the last 90 days. Returns the rate, converted amount and rate date for each target. 30 currencies. Reference rates, not transaction rates. Source: ECB. Signed receipt. Price: $0.001 per call via x402 (USDC on Base or XRP on XRPL).

    Annotations the server declares

    • title: Currency Converter (ECB)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Changes things 13Claude Code: ask
  • business_daysBusiness days and public holidays: check if a date is a business day, add or subtract N business days, count business days between dates, or list holidays, for 250 countries, 630 s…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Business days and public holidays: check if a date is a business day, add or subtract N business days, count business days between dates, or list holidays, for 250 countries, 630 subdivisions (e.g. US-NY, GB-ENG) and 31 stock exchanges, 2025-2030. Use for due dates, T+N settlement and SLAs. Data: python-holidays (MIT). Signed receipt. Price: $0.001 per call via x402 (USDC on Base or XRP on XRPL).

    Annotations the server declares

    • title: Business Days and Holidays
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • catalogFree.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Free. Lists every paid tool with its price in USD, parameters, data source, payment networks and docs links.

    Annotations the server declares

    • title: Catalog
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • domain_factsDomain lookup (DNS, WHOIS/RDAP, email security): give a domain or hostname, get DNS records (A, AAAA, MX, NS, TXT, CAA), SPF, DMARC, DKIM and MTA-STS email-auth posture, HTTPS/HSTS…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Domain lookup (DNS, WHOIS/RDAP, email security): give a domain or hostname, get DNS records (A, AAAA, MX, NS, TXT, CAA), SPF, DMARC, DKIM and MTA-STS email-auth posture, HTTPS/HSTS status, and registrar, creation and expiry dates from registry RDAP. Use when checking a domain's setup, deliverability or age. No personal data. Signed receipt. Price: $0.003 per call via x402 (USDC on Base or XRP on XRPL).

    Annotations the server declares

    • title: Domain DNS WHOIS Email Check
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • fx_reference_ratesCurrency exchange rates and conversion from the European Central Bank: euro reference rates for 29 currencies plus EUR (USD, GBP, JPY, CHF, CNY...), latest or any day in the last 9…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Currency exchange rates and conversion from the European Central Bank: euro reference rates for 29 currencies plus EUR (USD, GBP, JPY, CHF, CNY...), latest or any day in the last 90 days, with cross rates for any base and amount conversion (e.g. 100 USD to EUR). Reference rates, not transaction rates. Source: ECB; free at ecb.europa.eu. Signed receipt. Price: $0.001 per call via x402 (USDC on Base or XRP on XRPL).

    Annotations the server declares

    • title: ECB Currency Exchange Rates
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • healthFree.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Free. Service health, enabled payment rails, uptime summary and dataset freshness (OFAC list publish dates, ECB, Treasury).

    Annotations the server declares

    • title: Health
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • merchant_checkMerchant check before an agent pays: give a merchant's domain and (optionally) its company name, get neutral sourced facts in one call: domain registration date and age, expiry and…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Merchant check before an agent pays: give a merchant's domain and (optionally) its company name, get neutral sourced facts in one call: domain registration date and age, expiry and registrar (registry RDAP), DNS and SPF/DMARC email-auth, an OFAC sanctions screen of the name, GLEIF LEI match and SEC EDGAR match. No risk score or fraud verdict. Signed receipt. Price: $0.012 per call via x402 (USDC on Base or XRP on XRPL).

    Annotations the server declares

    • title: Merchant Check (KYB facts)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • page_to_markdownWeb page to markdown: give a public URL, get its main content as clean Markdown for LLMs (navigation, footers and scripts removed) with title, canonical URL, language, publish date…Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Web page to markdown: give a public URL, get its main content as clean Markdown for LLMs (navigation, footers and scripts removed) with title, canonical URL, language, publish date and links. Use when an agent needs to read, quote or summarise a page. Respects robots.txt, ai.txt and noai; no paywall bypass; refusals are not charged. Signed receipt. Price: $0.002 per call via x402 (USDC on Base or XRP on XRPL).

    Annotations the server declares

    • title: Web Page to Markdown
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • product_recalls_usProduct recall check (US): has a product or brand been recalled?Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Product recall check (US): has a product or brand been recalled? Searches CPSC consumer product recalls and FDA food, drug and medical device enforcement reports (openFDA) in one call; returns hazard or reason, remedy, date, FDA recall class and agency link. Use for product safety, e-commerce and procurement checks. Signed receipt. Price: $0.002 per call via x402 (USDC on Base or XRP on XRPL).

    Annotations the server declares

    • title: US Product Recalls CPSC FDA
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sanctions_screenSanctions check (OFAC): is a company, organisation, vessel (name or IMO), aircraft or crypto wallet address sanctioned?Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Sanctions check (OFAC): is a company, organisation, vessel (name or IMO), aircraft or crypto wallet address sanctioned? Screens the official US Treasury OFAC SDN and Consolidated lists with fuzzy name and alias matching; returns matches, scores and each list's publish date. Use for KYB, AML or pre-payment screening. Data lookup, not a compliance determination. Signed receipt. Price: $0.005 per call via x402 (USDC on Base or XRP on XRPL).

    Annotations the server declares

    • title: OFAC Sanctions Screening
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sec_company_factsSEC EDGAR company financials and filings by stock ticker or CIK: revenue, net income, assets, liabilities, equity, cash, EPS and shares from the latest 10-K/10-Q XBRL data, plus re…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    SEC EDGAR company financials and filings by stock ticker or CIK: revenue, net income, assets, liabilities, equity, cash, EPS and shares from the latest 10-K/10-Q XBRL data, plus recent 10-K, 10-Q and 8-K filings with links. Use when you need a US public company's fundamentals or latest filings. Signed receipt. Price: $0.003 per call via x402 (USDC on Base or XRP on XRPL).

    Annotations the server declares

    • title: SEC EDGAR Financials and Filings
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • us_rates_macroUS Treasury yields and inflation data: daily Treasury par yield curve (1-month to 30-year) plus BLS CPI, core CPI, unemployment rate and nonfarm payrolls for the last 13 months wit…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    US Treasury yields and inflation data: daily Treasury par yield curve (1-month to 30-year) plus BLS CPI, core CPI, unemployment rate and nonfarm payrolls for the last 13 months with year-over-year change. Use when a finance agent needs current US interest rates or inflation. Sources: US Treasury, BLS (public). Signed receipt. Price: $0.002 per call via x402 (USDC on Base or XRP on XRPL).

    Annotations the server declares

    • title: US Treasury Yields and CPI
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • verify_receiptFree.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Free. Verifies an Ed25519 receipt returned by any paid tool: signature, presence in the hash-chained log, and an explorer link for the payment.

    Annotations the server declares

    • title: Verify receipt
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whoisWHOIS / RDAP domain lookup: give a domain, get registrar, registration (creation), expiry and last-updated dates, status codes and nameservers from the registry's RDAP service, plu…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WHOIS / RDAP domain lookup: give a domain, get registrar, registration (creation), expiry and last-updated dates, status codes and nameservers from the registry's RDAP service, plus DNS records and SPF/DMARC/DKIM email-auth posture. Use to check a domain's age, owner registrar or expiry before trusting a counterparty. No personal data. Signed receipt. Price: $0.003 per call via x402 (USDC on Base or XRP on XRPL).

    Annotations the server declares

    • title: WHOIS RDAP Domain Lookup
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 1Show 1 read-only tool
  • lei_lookupLEI lookup (GLEIF): find a company's Legal Entity Identifier by name, or get the full record by LEI: legal name, jurisdiction, status, registered and headquarters address, and dire…Reads text others writeNo findings

    Why it is in this group

    • The name "lei_lookup" says "lookup": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    LEI lookup (GLEIF): find a company's Legal Entity Identifier by name, or get the full record by LEI: legal name, jurisdiction, status, registered and headquarters address, and direct and ultimate parent companies. Use for KYB, counterparty identification and corporate ownership checks. Global coverage, CC0 data. Signed receipt. Price: $0.002 per call via x402 (USDC on Base or XRP on XRPL).

    Annotations the server declares

    • title: LEI Lookup (GLEIF)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write12
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out2
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnfx_convert

    The server marks "fx_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "fx_convert" says "convert": a word for a change.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http compliance-data https://api.stablecoingateways.com/mcp
claude mcp add --transport http compliance-data https://api.stablecoingateways.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__compliance-data__lei_lookup"
    ],
    "ask": [
      "mcp__compliance-data__catalog",
      "mcp__compliance-data__health",
      "mcp__compliance-data__verify_receipt",
      "mcp__compliance-data__domain_facts",
      "mcp__compliance-data__sec_company_facts",
      "mcp__compliance-data__sanctions_screen",
      "mcp__compliance-data__page_to_markdown",
      "mcp__compliance-data__business_days",
      "mcp__compliance-data__fx_reference_rates",
      "mcp__compliance-data__product_recalls_us",
      "mcp__compliance-data__us_rates_macro",
      "mcp__compliance-data__whois",
      "mcp__compliance-data__fx_convert",
      "mcp__compliance-data__merchant_check"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as compliance-data. Review it before you use it.

Capability tags behind 12 rules
  • mcp__compliance-data__domain_facts untrusted-input
  • mcp__compliance-data__sec_company_facts untrusted-input
  • mcp__compliance-data__sanctions_screen untrusted-input
  • mcp__compliance-data__page_to_markdown untrusted-input, outbound
  • mcp__compliance-data__business_days untrusted-input
  • mcp__compliance-data__fx_reference_rates untrusted-input
  • mcp__compliance-data__lei_lookup untrusted-input
  • mcp__compliance-data__product_recalls_us untrusted-input
  • mcp__compliance-data__us_rates_macro untrusted-input
  • mcp__compliance-data__whois untrusted-input
  • mcp__compliance-data__fx_convert untrusted-input, outbound
  • mcp__compliance-data__merchant_check untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.stablecoingateways/compliance-data/verify?hash=19c13d1685944d5317bbfc203aea41625d0d402ff181b664557aea4c2e8a4890" | jq -e '.changed == false'

Pinned hash 19c13d168594, from Oct 22, 2026, 22:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.stablecoingateways/compliance-data/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.stablecoingateways/compliance-data
[![anlyon.dev](https://anlyon.dev/badge/com.stablecoingateways/compliance-data.svg)](https://anlyon.dev/servers/com.stablecoingateways/compliance-data)

Source: MCP Registry. Synced Oct 22, 2026, 22:17 UTC.