Regulatory compliance MCP for AI agents — FDA enforcement, SEC filings, sanctions screening
Server has 5 well-named tools with complete input schemas and reasonable descriptions. All tools follow verb_noun naming (search_*, entity_*, regulatory_*, export_*, compliance_*). Schemas include proper types, required fields, and defaults. However, output schemas are NOT documented, LLMs cannot predict response structure. Descriptions are adequate (100-150 chars) but lack WHEN/WHY guidance and dependency hints. No error handling guidance visible. Parameters lack enum constraints where applicable (e.g., 'source' in search_regulations should be enum ['drug','device'], 'type' in entity_compliance_check should be enum ['company','person']). No tool annotations (readOnlyHint, idempotentHint) despite all tools being read-only. Missing pagination guidance for tools returning lists.
Full composite compliance risk report for a company — fans out to FDA, OpenSanctions, SEC EDGAR, and BIS Entity List simultaneously
Screen any entity (company or person) against sanctions and watchlists via OpenSanctions
Search BIS Entity List and export control regulations for controlled entities/technologies
Track SEC regulatory filings for a company (10-K, 8-K, Form 4, proxy statements)
Search FDA drug/device enforcement actions (recalls, import alerts) by product, firm, or classification
Output schemas not documented. LLMs cannot predict response structure or plan downstream calls. Tools return complex objects (classBreakdown, enforcementActions, matches, signals, recentFilings) but no schema is visible in code.
Enum constraints missing. Parameters like 'source' (drug|device), 'type' (company|person|entity|product), 'classification' (Class I|II|III), and 'dateRange' (7day|30day|90day|1year) accept free-form strings instead of enums. LLMs will hallucinate invalid values.
No tool annotations. All 5 tools are read-only (no side effects), but readOnlyHint is not set. Agents cannot distinguish safe tools from destructive ones without explicit hints.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | 2026-07-28+ | v2 |
No pagination or result-limiting guidance. Tools returning lists (search_regulations, entity_compliance_check, export_control_search, compliance_risk_report) lack documented pagination, cursor, or offset parameters. maxResults in search_regulations is capped at 100 but no guidance on handling large result sets.
Descriptions lack WHEN/WHY context and dependency hints. E.g., 'Search FDA drug/device enforcement actions' does not explain when to use this vs compliance_risk_report, or that it requires a query string. No guidance on multi-step workflows.