OFAC sanctions MCP server

Add the URL to Claude, ChatGPT, Cursor or another MCP client, then ask “is this supplier on a sanctions list?” The assistant calls Pyxmark and gets back scored matches, each with its list entry ID and a link to the official source, and a hold, review or clear verdict it can act on. A reviewer uses the entry ID to find the record on the official list.

Connect

Claude

Customize → Connectors → + Add → Add custom connector. Name it Pyxmark, paste the URL and choose No sign in. In Claude Code: claude mcp add --transport http pyxmark https://mcp.pyxmark.com/mcp

ChatGPT

Plugins → + → Add custom MCP server. Paste the URL, pick No authentication, then Create as a plugin.

Cursor

Install in Cursor, or add it to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "pyxmark": { "url": "https://mcp.pyxmark.com/mcp" }
  }
}

Also VS Code, Codex, Grok, Grok Bot and Gemini CLI: setup for every client. Step by step guides for Claude, ChatGPT, Cursor and VS Code and Grok, and steps for more AI agents.

What’s different

• Hosted. There’s no package to install or process to run, and you don’t download or refresh the lists yourself. Pyxmark tries to refresh each list from its publisher daily. If a refresh fails, an earlier copy stays in use (for OFAC, a fallback copy up to 72 hours old), and every result shows how current each list’s data is.
• No API key. Free use needs no sign-up or key: 25 lookups a day per IP address (per /48 network on IPv6), and every tool call counts as one. The count resets at midnight UTC, and all free use shares a ceiling of 5,000 calls a day.
• More than OFAC. One screen covers the OFAC SDN list, the OFAC Consolidated (non-SDN) lists, the UN Security Council Consolidated List, the EU’s consolidated financial sanctions list and the UK Sanctions List. The same server looks up SEC EDGAR filings and checks a domain’s registration age, email records (MX, SPF, DMARC) and first Wayback Machine snapshot.
• More than a name. Add a birth date, nationality or country to set aside people who only share a name. Add an address, email, phone, website, ID numbers (IMO, SWIFT/BIC, crypto addresses) or owners with their shares, and they’re matched against what the lists record, including the OFAC 50 percent rule.

SAM.gov federal exclusions aren’t synced yet, so reports link to a SAM.gov search instead. Results are informational, not a compliance determination. Sources, method and limits.

Tools

screen_sanctions

Fuzzy-screens a person or organisation name against the OFAC, UN, EU and UK lists. Returns up to 15 scored matches with source links and a hold, review or clear assessment.

due_diligence_report

One call: sanctions screen, SEC profile if the company files with the SEC, domain signals and a state registry link, ending in a verdict with reasons.

search_company

Finds which SEC-registered company a name, ticker or CIK refers to.

company_profile

The SEC EDGAR record for one company: legal name, industry, state, three years of financials and recent filings.

domain_age

Registration date, registrar, MX, SPF and DMARC records, and the first Wayback Machine snapshot.

state_registry_link

The official Secretary of State business-search link for a US state.

All six are read-only. Full tool reference.

A real check

We asked for a report on Sovcomflot, a Russian shipping company, with its domain scf-group.com. This is the tool call an assistant makes:

due_diligence_report
{ "name": "Sovcomflot", "domain": "scf-group.com" }

The same report comes back from the web form, so you can try it without an assistant. For the work around it, see how to check a new vendor before you pay, have Claude screen a supplier before a payment and check a vendor’s domain before a bank change.