For teams who use Claude to prepare or approve supplier payments. One instruction makes Claude run Pyxmark’s due diligence report before any payment and act on the verdict. You need Claude with the Pyxmark connector added (setup steps).
Paste this into your project instructions or CLAUDE.md:
Before you approve, schedule or recommend any payment to a supplier, vendor or contractor, call the Pyxmark tool due_diligence_report with the supplier's legal name, and its website or email domain and US state if you have them. Then act on the verdict.
hold: do not pay, approve or onboard. Give me the reasons and wait until a person has checked the matches against the official entries.
review: do not decide yourself. Show me the red flags and ask a person to decide.
clear: you may go ahead, but say that clear covers only the sources checked and is not a guarantee.
Always quote the verdict, the report's generated time and the list sync dates. If the tool call fails, treat it as review.Then ask Claude about a payment the way you normally would.
With this instruction in place, Claude checks the supplier before it approves anything. A hold stops the payment until a person has checked, a review goes to a person, and a clear lets Claude carry on while saying what clear covers. Those are the rules the Pyxmark docs give agents.
In claude.ai, open the project you use for payments, choose Set project instructions, paste the text and click Save instructions. Claude applies project instructions to every chat in that project, and projects are available on free accounts too (Anthropic’s projects guide).
In Claude Code, put it in the project’s ./CLAUDE.md, which your team shares through source control, or in ~/.claude/CLAUDE.md to cover all your projects (Claude Code memory docs).
Does Claude need a paid plan? Free plans allow one custom connector, which is enough for Pyxmark. On Team and Enterprise an owner adds it first under Organization settings → Connectors, and then each member connects it from Customize → Connectors.
An instruction is guidance, not a lock. Anthropic’s docs say Claude treats CLAUDE.md as context, not enforced configuration, so keep a person on the final approval.
For a supplier such as W.W. Grainger, the call looks like this:
due_diligence_report
{ "name": "W.W. Grainger, Inc.", "domain": "grainger.com", "state": "IL" }Claude gets the report back as JSON. Real output, shortened (fields left out), run Oct 25, 2026 (6:11 pm Pacific time):
{
"subject": "W.W. Grainger, Inc.",
"generated_at": "2026-10-26T01:11:42.657Z",
"verdict": "clear",
"verdict_reasons": ["Name screened against every sanctions list; nothing flagged in the sources checked"],
"red_flags": [],
"sec": { "cik": "277135", "name": "W.W. GRAINGER, INC.", "tickers": ["GWW"], "risk_filings": [] },
"sanctions": {
"result": "NO_MATCH_FOUND",
"summary": "No entries scored 0.88 or higher across 5 list(s).",
"lists_checked": [
{ "list": "OFAC Specially Designated Nationals (SDN) list", "as_of": "2026-10-25T12:45:57.340Z" },
{ "list": "OFAC Consolidated (non-SDN) lists", "as_of": "2026-10-25T12:46:00.894Z" },
{ "list": "UN Security Council Consolidated List", "as_of": "2026-10-25T21:23:35.945Z" },
{ "list": "EU Financial Sanctions (consolidated)", "as_of": "2026-10-25T07:25:32.317Z" },
{ "list": "UK Sanctions List (FCDO)", "as_of": "2026-10-26T00:23:23.294Z" }
]
},
"federal_exclusions": { "result": "UNAVAILABLE", "manual_search_url": "https://sam.gov/search/?index=ex&keywords=W.W.%20Grainger%2C%20Inc." },
"domain": { "domain": "grainger.com", "registration": { "created": "1994-03-23T05:00:00Z" }, "first_archived": "1996-12-25" },
"state_registry": { "name": "Illinois", "url": "https://apps.ilsos.gov/businessentitysearch/" }
}A person reading the same check gets it as a report on the web; see checking a new vendor before you pay for that version.
Claude: doesn’t pay, approve or onboard. It gives you the reasons, with links to the official entries.
You: compare each match with its official entry. The payment waits until a person has done that.
Claude: doesn’t decide. It lists the red flags, such as a lower scoring match, a domain under 6 months old or a missing email record, and asks you.
You: look at each flag. A young domain or missing email records on a new supplier is a reason to confirm them on a phone number you already have.
Claude: carries on, and says that clear covers only the sources checked.
You: SAM.gov exclusions aren’t synced yet, so if they matter for this payment, open the SAM.gov link in the report.
Claude sees the whole report, because it comes back as the tool result in your chat.
On our side, we don’t save the supplier names you search or the reports we return. For each tool call we log the tool name, the client app’s name, the first word of its user agent, the country Cloudflare reports, whether it worked and how long it took. Those logs never include your IP address or what you searched, and we delete them after 90 days. To build the report, our server queries SEC EDGAR, the domain’s registry, Cloudflare DNS and the Wayback Machine. The privacy policy has the details.
Every report lists each sanctions list with the time it was last synced, which is why the instruction asks Claude to quote the sync dates. Pyxmark tries to refresh each list daily. If a refresh fails, an earlier copy stays in use (for OFAC, up to 72 hours old). A list that was unavailable or out of date makes the verdict review, so Claude hands it to a person.
The tool and its verdicts work the same in any MCP client, so the instruction carries over. Steps for ChatGPT, Cursor, VS Code, Gemini CLI and more are on connect Pyxmark to your AI agent.
If Claude never prepares or approves payments for you, skip the instruction and have a person run the free check before paying. And if your accounts payable software already screens every payee against the sanctions lists, a second sanctions check from Claude adds little.