Skip to content

SanctionsKit developer MCP

by SanctionsKit · remote · no sign-in to list tools · v1.0.1 · published by GitHub user SanctionsKit

Sanctions API docs and request validation, with account-linked synthetic sandbox testing.

Changes · 2
CompareRegistry entry

9 tools: 2 change things and 7 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http sanctionskit https://www.sanctionskit.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnget_screening_result

    The server marks "get_screening_result" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "get_screening_result" says "get": a word for reading.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

9 tools

Changes things 2Claude Code: ask
  • get_screening_resultRetrieve retained evidence by screening ID from the connected sandbox workspace.1 finding

    Why it is in this group

    • The name "get_screening_result" says "get": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "get_screening_result" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "get_screening_result" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Retrieve retained evidence by screening ID from the connected sandbox workspace. An expired result is an error. Preserve coverage, versions, warnings and potential-match review requirements.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • run_sandbox_screeningSubmit invented data to sandbox@1.No findings

    Why it is in this group

    • The name "run_sandbox_screening" says "run": a word for a change.
    Description, as the server wrote it
    Submit invented data to sandbox@1. Requires synthetic=true and an idempotencyKey of 8–128 URL-safe characters, reused unchanged with the same request for retries. Retains screening evidence according to policy and may create a review case; consumes sandbox allowance, never paid production allowance. Cannot screen production or link counterparties.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
Only reads 7Claude Code: allow
  • get_api_schemaWithout path, list consumer REST operations.No findings

    Why it is in this group

    • The name "get_api_schema" says "get": a word for reading.
    Description, as the server wrote it
    Without path, list consumer REST operations. With a path such as /screenings and lowercase method, retrieve its OpenAPI request, response, examples and referenced schemas. Describes REST capabilities; MCP account tools are sandbox only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_docRead a document returned by search_docs, including code examples and error handling.No findings

    Why it is in this group

    • The name "get_doc" says "get": a word for reading.
    Description, as the server wrote it
    Read a document returned by search_docs, including code examples and error handling. Uses a fixed local document catalog; does not fetch arbitrary URLs.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_profileIdentify the sandbox profile represented by the authenticated connection.No findings

    Why it is in this group

    • The name "get_profile" says "get": a word for reading.
    Description, as the server wrote it
    Identify the sandbox profile represented by the authenticated connection. Takes no user or workspace selector.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_usageRead the connected sandbox workspace allowance, completed subjects and pending reservations.No findings

    Why it is in this group

    • The name "get_usage" says "get": a word for reading.
    Description, as the server wrote it
    Read the connected sandbox workspace allowance, completed subjects and pending reservations.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • list_sourcesRead current source metadata and qualification from the connected sandbox workspace, with bounded pagination.No findings

    Why it is in this group

    • The name "list_sources" says "list": a word for reading.
    Description, as the server wrote it
    Read current source metadata and qualification from the connected sandbox workspace, with bounded pagination. Catalog/production source availability does not enable live MCP screenings; sandbox screening uses sandbox@1.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • search_docsFind current integration documentation and guides by keyword.No findings

    Why it is in this group

    • The name "search_docs" says "search": a word for reading.
    Description, as the server wrote it
    Find current integration documentation and guides by keyword. Returns document slugs for get_doc. Public; no account needed.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • validate_screening_requestValidate request structure against the runtime REST screening schema without submitting or retaining it.No findings

    Why it is in this group

    • The name "validate_screening_request" says "validate": a word for reading.
    Description, as the server wrote it
    Validate request structure against the runtime REST screening schema without submitting or retaining it. Does not check live source eligibility or grant clearance. Use synthetic development inputs.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http sanctionskit https://www.sanctionskit.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__sanctionskit__search_docs",
      "mcp__sanctionskit__get_doc",
      "mcp__sanctionskit__get_api_schema",
      "mcp__sanctionskit__validate_screening_request",
      "mcp__sanctionskit__list_sources",
      "mcp__sanctionskit__get_usage",
      "mcp__sanctionskit__get_profile"
    ],
    "ask": [
      "mcp__sanctionskit__run_sandbox_screening",
      "mcp__sanctionskit__get_screening_result"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as sanctionskit. Review it before you use it.