Sanctions and vendor checks in ChatGPT

Pyxmark is a hosted MCP server, so there’s nothing to install and no key to paste. Free use is 25 lookups a day per IP address, and every tool call counts as one.

ChatGPT on the web

Go to ChatGPT Plugins at chatgpt.com/plugins, select the plus button, then Add custom MCP server. Name it Pyxmark and enter the URL as the Server URL. Choose No authentication, review the risk warning and select I understand and want to continue, then select Create as a plugin.

Install the plugin before you use it. In a chat, type @ in the prompt box and select Pyxmark.

On a work account, your workspace permissions and security restrictions apply to adding and using it.

Steps checked against OpenAI’s guide to adding a custom MCP server.

ChatGPT desktop app

Open Settings, then select MCP servers, then Add server. Enter pyxmark as the name, choose Streamable HTTP and paste the URL. Save the server, then select Restart.

To see connected servers, type /mcp in the composer. The desktop app shares its MCP settings with Codex, so a server you add in one shows up in the other. ChatGPT on the web doesn’t read these settings, so add it there separately.

Codex

Run this in a terminal:

codex mcp add pyxmark --url https://mcp.pyxmark.com/mcp

Or add it to ~/.codex/config.toml yourself:

[mcp_servers.pyxmark]
url = "https://mcp.pyxmark.com/mcp"

To check it, run codex mcp list, or type /mcp inside Codex. In the Codex IDE extension, open the gear menu, then MCP servers, then Add server, choose Streamable HTTP and paste the URL, then save and select Restart extension.

Steps checked against OpenAI’s MCP docs for ChatGPT and Codex.

Ask it

First check the connection: ask “List the Pyxmark tools” and ChatGPT should show the read-only tools listed in the tool reference. Then ask “Is Microsoft Corporation on any sanctions list?” It should come back with no match.

For a real vendor, try:

Run a due diligence report on Acme Corp, acme.com, Delaware.

ChatGPT calls due_diligence_report and gets back one report:

• A sanctions screen across the OFAC SDN and Consolidated, UN, EU and UK lists. Each potential match has a score, its list entry ID and a link to the official source.
• The company’s SEC record and risk filings, if it files with the SEC.
• The domain’s registration date, its MX, SPF and DMARC records, and its first Wayback Machine snapshot.
• A link to the state business registry search.
• A clear, review or hold verdict with the reasons.

You can see a full example on the OFAC sanctions MCP page.

Limits

• Results are informational, not a compliance determination or legal advice.
• Names are matched fuzzily, so some potential matches will be other people or companies with similar names. Check each one against the linked official entry before you act.
• SAM.gov federal exclusions aren’t synced yet, so each report links to a SAM.gov search instead.
• Pyxmark isn’t for consumer screening (credit, jobs, housing, insurance or tenancy).

How matching, verdicts and list refreshes work: sources, method and limits.

Using another assistant? Steps for Claude, Cursor, Grok and more are on connect Pyxmark to your AI agent.