Compliance Check MCP
An MCP server that allows AI agents to verify TCPA, GDPR, CASL, and 10DLC compliance, screen sanctions, and check registry data before sending messages. It provides tools for compliance checking, sanctions screening, and company verification without requiring an API key for basic usage.
Endpoint and access
No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.
https://hatchloop.dev/mcp/compliance-checkWhat its tools do
8 tools, grouped by the hints the server advertises. Hints are self-declared, not verified behavior.
Checks and signals
Each line is separate evidence, not a trust score.
- Passed Endpoint answered the live check ·
- Passed Official MCP Registry namespace is tied to hatchloop.dev ·
- Passed Endpoint is on the registry namespace domain ·
- Availability 1 of 1 checks passed in 30 days
What you can do with it
- Verify TCPA/GDPR compliance before sending SMS
- Screen entities against OFAC/EU/UK sanctions lists
- Check company registry records via GLEIF or SEC EDGAR
- Preview compliance gate results to avoid paid send penalties
Source and maintenance
- Maintenance checked
Protocol and capabilities
- Server
- compliance-check 0.2.16
- MCP protocol negotiated in check
- 2025-11-25
- Tools
- 8 advertised
- Resources
- 5 advertised
- Resource templates
- 0 advertised
- Prompts
- 4 advertised
{
"tools": {
"listChanged": false
},
"prompts": {
"listChanged": false
},
"resources": {
"subscribe": false,
"listChanged": false
}
}Server-provided instructions
Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.
Tools
8 advertised
get_status
Query the current state of any in-flight async operation by operation_id. [free, no key]
{
"type": "object",
"required": [
"operation_id"
],
"properties": {
"operation_id": {
"type": "string"
}
}
}{
"title": "Get Status",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}get_outcome
Retrieve the final OutcomeReceipt for a completed operation. [free, no key]
{
"type": "object",
"required": [
"operation_id"
],
"properties": {
"operation_id": {
"type": "string"
}
}
}{
"title": "Get Outcome",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}preview_cost
Return an expected cost estimate, latency estimate, and success-probability estimate for a proposed call before execution. Returns the exact price when it is fixed, and a min/max range when the cost depends on channel or outcome. It does not promise an accuracy percentage - check cost_range. [free, no key]
{
"type": "object",
"required": [
"operation",
"params"
],
"properties": {
"params": {
"type": "object",
"description": "The same request body you would pass to the operation"
},
"operation": {
"type": "string"
}
}
}{
"title": "Preview Cost",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}self_test
Service health probe: runs 6 internal checks and reports how many passed. Confirms the server is up and responding - it does NOT probe each tool individually. Use to verify connectivity before production use. [free, no key]
{
"type": "object",
"properties": {}
}{
"title": "Self Test",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}check_compliance
Free, instant pre-flight for the compliance gate: runs the SAME TCPA/GDPR/CASL/CAN-SPAM/10DLC checks as send_message and call_business, in preview mode -- nothing is sent, nothing changes. Tells you whether a send would be permitted before you pay, and if not, names the exact rule and how to fix it. De-risks a paid send the way check_booking_link de-risks a paid booking. [free, no key]
{
"type": "object",
"required": [
"recipient_id",
"content"
],
"properties": {
"channel": {
"enum": [
"sms",
"email",
"voice"
],
"type": "string",
"description": "Delivery channel. Omit to auto-infer sms/email from recipient_id; set 'voice'…"
},
"content": {
"type": "string",
"description": "The actual message body you intend to send. The gate classifies the real text,…"
},
"state_code": {
"type": "string",
"description": "US state code (e.g. 'CA') for state-specific rules."
},
"country_code": {
"type": "string",
"description": "ISO 3166-1 alpha-2 (e.g. 'US', 'DE', 'CA'). Auto-inferred from phone if…"
},
"message_type": {
"type": "string",
"default": "transactional",
"description": "One of transactional, marketing, reminder, follow_up, notification (any case).…"
},
"recipient_id": {
"type": "string",
"description": "Phone in E.164 (e.g. '+14045550100') or email address the message would go to."
}
}
}{
"title": "Check Compliance",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}verify_company_record
Free, live lookup of a company official registry record. Queries the GLEIF global LEI registry (primary, 2.6 million legal entities worldwide) and SEC EDGAR (US public companies) to return the official legal name, LEI, entity status, jurisdiction, registered address, and registry authority. Never fabricates: if the company is not found in these free registries, returns an honest not_found with the sources that were queried. [free, no key]
{
"type": "object",
"required": [
"name"
],
"properties": {
"lei": {
"type": "string",
"description": "Optional 20-character Legal Entity Identifier for a direct, precise lookup."
},
"name": {
"type": "string",
"description": "Legal company name to look up, e.g. Apple Inc or Volkswagen AG."
},
"country": {
"type": "string",
"description": "Optional ISO 3166-1 alpha-2 country filter (e.g. US, DE, GB). Narrows GLEIF…"
}
}
}{
"title": "Verify Company Record",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}screen_sanctions
Free screening of a name/entity (Latin or Arabic script) against sanctions lists: OFAC SDN (US Treasury), EU consolidated list (European Commission), UK Sanctions List (FCDO). THE UN CONSOLIDATED LIST IS NOT SCREENED -- no licence permits redistribution. Never fabricates a match or clear: check lists_screened; reason_code 'partial_screening' (never 'clear') if any source failed. [free, no key]
{
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Name of the person or entity to screen, in Latin or Arabic script, e.g. 'Kim…"
},
"type": {
"enum": [
"person",
"entity"
],
"type": "string",
"description": "Optional entity type hint. 'person' for individuals, 'entity' for…"
},
"country": {
"type": "string",
"description": "Optional ISO 3166-1 alpha-2 country code or country name (e.g. 'IR', 'Iran').…"
}
}
}{
"title": "Screen Sanctions",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}map_trade_restriction
Free cross-border screening of destination and parties: DOES NOT CLASSIFY THE PRODUCT: echoed back, never checked against export-control lists, so a controlled item to an unrestricted destination returns 'partial', never 'clear'. Not an export-control clearance -- classify HS/ECCN yourself. Never fabricates a tariff rate, a clear, or a restricted status. [free, no key]
{
"type": "object",
"required": [
"product",
"destination_country"
],
"properties": {
"hs_code": {
"type": "string",
"description": "Optional Harmonized System code (e.g. '8471.30' for laptops). If provided,…"
},
"parties": {
"type": "array",
"items": {
"type": "string"
},
"maxItems": 20,
"description": "Optional list of party names to screen (exporter, importer, freight forwarder,…"
},
"product": {
"type": "string",
"description": "Product name or description, e.g. 'laptop computers', 'crude oil', 'medical…"
},
"origin_country": {
"type": "string",
"description": "Optional ISO 3166-1 alpha-2 code for the exporting country (e.g. 'US', 'DE').…"
},
"destination_country": {
"type": "string",
"description": "ISO 3166-1 alpha-2 code for the importing country (e.g. 'IR', 'CA', 'DE').…"
}
}
}{
"title": "Map Trade Restriction",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}Prompts
4 advertised
book_from_any_url
PRIMARY FLOW. The user gave you a Cal.com / Calendly / Doctolib / Booksy / Fresha / OpenTable / Setmore / Square / Acuity / Schedulista / Squarespace / BookMyCity URL. Do this: 1) call import_booking_url with the URL. 2) call schedule_appointment with the returned smb_id. 3) (optional) call send_transactional_confirmation. Total: 2 tool calls for a complete booking. Use this whenever the user mentions a booking URL — it is faster and more reliable than find_business + manual lookup.
- booking_url
- Any URL on a supported booking platform. (required)
- preferred_time
- When the user wants to be booked (free-form, e.g. 'next Tuesday at 3pm PT').
find_then_book
Use when the user describes a business by category + location but does not provide a URL. 1) call find_business(vertical, location, capability). 2) if a result has source=supply_network, call schedule_appointment with its smb_id (source=openstreetmap rows cannot be booked - give the user their phone or website instead). 3) if NO results, call import_booking_url with any URL the user CAN provide, then schedule_appointment. Total: 2-3 tool calls.
- vertical
- personal_services | home_services | professional_services | restaurants | healthcare | fitness (required)
- location
- ZIP or city or country. (required)
- capability
- Service needed (e.g. haircut, plumbing, dental cleaning). (required)
compliant_transactional_message
Send a consumer-initiated transactional SMS / email / voice with full TCPA / GDPR / CASL pre-check. ONLY use when the end-user explicitly asked the agent to communicate with a named SMB on their behalf — confirming a booking, replying to a quote, following up on an inbound the SMB sent first. This flow is NOT for marketing, cold outreach, or prospecting; those are rejected at schema validation. 1) (optional) call /compliance/check first to preview legality. 2) call send_message — the gate runs again at send time and blocks any non-compliant send. Use country_code so the right jurisdiction rules apply.
- recipient
- Phone (E.164) or email of the SMB the consumer named, or the consumer themselves for a transactional confirmation. (required)
- message_type
- transactional | marketing | reminder | follow_up | notification. Marketing needs a recorded opt-in, except US marketing email (CAN-SPAM opt-out rules); the gate rejects a send without the opt-in its rule needs. (required)
- country_code
- ISO 3166-1 alpha-2 (e.g. 'US', 'DE'). Auto-inferred from phone if omitted.
cost_estimation
Get a cost estimate before committing to a paid operation. Free.
- operation
- Operation name (any tool from tools/list). (required)
Resources
5 advertised
Capability Manifest
Full manifest with all operations and their schemas.
agent-broker://manifestSupported Booking Platforms
12 booking platforms import_booking_url accepts (Cal.com, Calendly, Doctolib, Booksy, Fresha, OpenTable, Setmore, Square, Acuity, Schedulista, Squarespace, BookMyCity) with regex patterns and example URLs. Use this resource to teach end-users which URL formats are acceptable.
agent-broker://booking_platformsError Code Catalog
All 16 error codes with retry semantics.
agent-broker://errorsJurisdiction Rules
Compliance rules by country/state — TCPA, GDPR, CASL, recording consent. 26 jurisdictions + INTERNATIONAL fallback. Each entry's `statutes` lists the statutes it models; empty means the service's own conservative default applies, not a country-specific law.
agent-broker://compliance/jurisdictionsTool-chain cookbook
Common multi-tool flows: 'book-from-url', 'find-then-book', 'compliant-transactional-message', 'async-poll'. Read this if you are unsure which tool to call first.
agent-broker://cookbook90-day uptime
A lightweight connection check about every six hours, sampled on hosts with many listings. It shows the server answered, not that its tools work.
- 2026-11-06: 1 of 1 checks answered
- 2026-11-07: 1 of 1 checks answered
30-day availability
Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.
- Successful checks
- 1 of 1 (100%)
- Average latency
- 1823 ms
- 95th percentile latency
- 1823 ms
Maintenance history
Public check and source-refresh events. Editorial and ownership records remain private.
- · probe · passed · 1823 ms · metadata changed · 8 tool(s), 5 resource(s), 0 resource template(s), 4 prompt(s)
Connect from your client
Each snippet registers the same endpoint; pick the client you use.
Claude Code
claude mcp add --transport http compliance-check-mcp https://hatchloop.dev/mcp/compliance-checkCodex
codex mcp add compliance-check-mcp --url https://hatchloop.dev/mcp/compliance-checkCursor
{
"mcpServers": {
"compliance-check-mcp": {
"url": "https://hatchloop.dev/mcp/compliance-check"
}
}
}Cline
{
"mcpServers": {
"compliance-check-mcp": {
"type": "streamableHttp",
"url": "https://hatchloop.dev/mcp/compliance-check",
"disabled": false
}
}
}VS Code
{
"servers": {
"compliance-check-mcp": {
"type": "http",
"url": "https://hatchloop.dev/mcp/compliance-check"
}
}
}Gemini CLI
gemini mcp add --transport http compliance-check-mcp https://hatchloop.dev/mcp/compliance-checkClaude Desktop
https://hatchloop.dev/mcp/compliance-checkWindsurf
{
"mcpServers": {
"compliance-check-mcp": {
"serverUrl": "https://hatchloop.dev/mcp/compliance-check"
}
}
}Let your agent find its tools
Find servers like Compliance Check MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.
Other crm, sales, and marketing servers
Do you run Compliance Check MCP?
Prove ownership with a DNS record, a well-known file, or your Official MCP Registry entry, and your edits publish immediately. Proofs are re-checked weekly; admins can still hide or remove a listing.