Pyxmark

com.pyxmarkPublished by pyxmark.comOfficial publisherv0.1.0Updated Oct 27, 2026

Vendor checks: sanctions lists, SEC filings, domain age and a due-diligence report with sources.

VerifiedStreamable HTTPWeb executableFinanceSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

Hosted MCP server that lets an assistant screen companies and people against sanctions lists, pull SEC EDGAR records, check domain signals and produce a…

What you can do
  • Screen a person or organisation name against OFAC, UN, EU and UK sanctions lists, with optional birth date, nationality and country to separate same-name matches
  • Resolve a name, ticker or CIK to an SEC-registered company and pull its EDGAR profile: identity, address, three years of financials and recent 10-K, 10-Q and 8-K filings
  • Check a domain's registration date, registrar, MX, SPF and DMARC records and first Wayback Machine snapshot
  • Get the official Secretary of State business-search link for a US state
  • Generate a one-call due-diligence report combining these signals into a red-flag summary and a clear, review or hold verdict
When to use it
Useful before paying or onboarding a supplier, vendor or counterparty, or when checking whether a company or person appears on a sanctions list. Also handy for quick SEC financial and filing lookups on public companies.
Requirements
A remote Streamable HTTP endpoint; no sign-in, account or API key. Free use is limited to 25 lookups a day per IP address. Clients that only run local stdio servers need an npx bridge.
Before you install
Results are informational, not a compliance determination, and name matching is fuzzy, so potential matches must be checked against the linked official entry before acting. Not intended for consumer screening such as credit, jobs, housing, insurance or tenancy. Queries, including names and domains, are sent to the hosted service.

Installation

In SourceWeft

  1. Open Pyxmark in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.pyxmark%2Fpyxmark/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "pyxmark": {
      "type": "http",
      "url": "https://mcp.pyxmark.com/mcp"
    }
  }
}

README

[Pyxmark logo]

Pyxmark

Check a company before you pay it. Pyxmark is a hosted MCP server that screens a company or person against the OFAC, UN, EU and UK sanctions lists, looks the company up in SEC EDGAR, checks its web domain's age and email records, and puts it together in a due-diligence report with a clear, review or hold verdict. Every result links to the official record and says when each list was last synced.

This repository holds listing and install files only. The server is hosted; its code isn't published here.

Connect

Server URL: https://mcp.pyxmark.com/mcp (Streamable HTTP). No sign in and no key.

[Install in Cursor] [Install in VS Code]

Claude (claude.ai and Claude Desktop): Customize → Connectors → + Add → Add custom connector. Name it Pyxmark, paste the server URL, choose No sign in, then Add. Free plans allow one custom connector. On Team and Enterprise an owner adds it first under Organization settings → Connectors.

Claude Code

claude mcp add --transport http pyxmark https://mcp.pyxmark.com/mcp

ChatGPT (web): Plugins → + → Add custom MCP server. Name it Pyxmark, paste the server URL, pick No authentication, select I understand and want to continue, then Create as a plugin. Install it and pick it with @ in a chat.

Codex and the ChatGPT desktop app

codex mcp add pyxmark --url https://mcp.pyxmark.com/mcp

Or in the desktop app: Settings → MCP servers → Add server, choose Streamable HTTP and paste the URL.

Cursor: use the Install in Cursor button, or add this to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (one project):

json
{ "mcpServers": { "pyxmark": { "url": "https://mcp.pyxmark.com/mcp" } } }

VS Code (GitHub Copilot): use the Install in VS Code button, or run MCP: Add Server from the Command Palette, choose HTTP and paste the URL. From a terminal:

code --add-mcp '{"name":"pyxmark","type":"http","url":"https://mcp.pyxmark.com/mcp"}'

Grok: at grok.com/connectors choose New Connector, then Custom, and paste the URL. On Grok Business and Enterprise a team admin adds it first. In Grok Build:

grok mcp add --transport http pyxmark https://mcp.pyxmark.com/mcp

Grok Bot: there's no settings form. Tell your bot "Add this MCP server: https://mcp.pyxmark.com/mcp". It confirms, and the tools work from your next message.

Gemini CLI

gemini mcp add --transport http -s user pyxmark https://mcp.pyxmark.com/mcp

Other clients: most read the standard block below, which is also this repo's .mcp.json (Claude Code, VS Code and Grok Build pick it up from a project root). Clients that only run local stdio servers can use npx -y mcp-remote https://mcp.pyxmark.com/mcp.

json
{ "mcpServers": { "pyxmark": { "type": "http", "url": "https://mcp.pyxmark.com/mcp" } } }

Check it works: ask "List the Pyxmark tools". You should see 7 read-only tools. Then ask "Is Microsoft Corporation on any sanctions list?" It should come back with no match.

AI agents setting this up for a user: follow llms-install.md.

Tools

Six tools are listed today, all read-only. A seventh, check_exclusions (SAM.gov federal exclusions), is added to the list once SAM.gov data has synced; until then each due_diligence_report includes a link to search SAM.gov yourself.

ToolWhat it does
due_diligence_reportOne report on a vendor: sanctions screen, SEC record and risk filings, domain age, first Wayback Machine snapshot and email records, ending in a clear, review or hold verdict with reasons
screen_sanctionsFuzzy-screens a name against OFAC SDN and Consolidated, UN, EU and UK lists. Optional birth date, nationality and country tell apart people with the same name. Optional address, email, phone, website, IDs and owners are matched against what the lists record, including sanctioned regions and the OFAC 50 percent rule
search_companyFinds which SEC-registered company a name, ticker or CIK refers to
company_profileThe SEC EDGAR record for one company: identity, address, three years of key financials and recent filings
domain_ageDomain registration date and registrar (RDAP, with a WHOIS fallback), its MX, SPF and DMARC records, and the date of its first Wayback Machine snapshot
state_registry_linkA link to the US state business registry search for a company

Try asking

  • "Run a due diligence report on Acme Corp, acme.com, Delaware."
  • "Is this supplier on any sanctions list?"
  • "Show me Tesla's last three years of revenue and recent 8-Ks."

Read this

Results are informational, not a compliance determination. Names are matched fuzzily, so check any potential match against the linked official entry before you act. Pyxmark isn't for consumer screening (credit, jobs, housing, insurance or tenancy).

Privacy: https://pyxmark.com/privacy · Terms: https://pyxmark.com/terms

UK Sanctions List data contains public sector information licensed under the Open Government Licence v3.0.

Source: README.md at commit 6cd5b43

Tools

6

search_company

Search SEC companies

Look up which SEC-registered company a name, ticker or CIK refers to. Returns up to 10 candidates, each with its CIK, tickers and a match score, and nothing else. Use it to pick the right CIK when a name is ambiguous, then call company_profile with that CIK for the details.

Parametersqueryrequired

company_profile

SEC company profile

Full SEC EDGAR record for one company, given its CIK, ticker or name (best match): legal name, industry (SIC), state of incorporation, business address, 3 fiscal years of revenue, net income, total assets and cash, and its recent 10-K, 10-Q and 8-K filings with links. Use search_company first if you only have a partial or ambiguous name.

Parametersciknameticker

screen_sanctions

Screen sanctions lists

Fuzzy-screen a person or organisation name against OFAC SDN + Consolidated, UN, EU, and UK sanctions lists. Returns up to 15 scored matches with source links; if more match, the summary says so and suggests a more specific query. Optional dob/birth_year, nationality and country set aside same-name matches whose listed details differ (rules at https://mcp.pyxmark.com/#details). Optional address, email, phone, website, ids and owners are matched against the details the lists give (identifier matches, sanctioned regions, the 50 percent rule); the assessment field sums it up as hold / review / clear. Informational only, not a compliance determination. Results come from public government lists and filings, may be incomplete or out of date, and fuzzy name matches can be false positives or miss variants. Verify every potential match against the official source before acting.

Parametersdobidsnamerequiredemailphoneownersaddresscountrywebsitethresholdbirth_yearnationality+1 more

domain_age

Domain age and email records

Domain registration date, age, registrar (RDAP) and email-auth records (MX, SPF, DMARC), which are common fraud signals, plus first_archived: the date of the Wayback Machine's earliest snapshot (null if none; archive.status says unavailable if archive.org didn't answer). notes holds factual remarks, such as a first snapshot under 90 days old or a registration years older than the first snapshot; they are not flags.

Parametersdomainrequired

due_diligence_report

Vendor due diligence report

One-call due-diligence report: SEC profile (if public), sanctions screen, federal exclusions, domain signals (registration age, email records, Wayback Machine first-seen date), and state registry link, with a red-flag summary, a verdict (clear / review / hold; rules at https://mcp.pyxmark.com/#verdict) and source links. An agent should not pay or onboard on 'hold', and should ask a person on 'review'. Informational only, not a compliance determination. Results come from public government lists and filings, may be incomplete or out of date, and fuzzy name matches can be false positives or miss variants. Verify every potential match against the official source before acting. Colorado vendors only (state CO or a Colorado address): address_density gives how many active Colorado companies list the vendor's address, from the Colorado Department of State's Business Entities in Colorado data (Public Domain), refreshed monthly. A building that also hosts a listed virtual mailbox service, an address shared by 1,000+ companies, or a registered agent's address used by hundreds of companies that almost none of them list as their principal address adds a worth-a-second-look line under info, never a red flag or a verdict change; other states are not covered.

Parameterscikdobidsnameemailphonestatedomainownerstickeraddresscountry+4 more

Version history

1
  1. v0.1.0LatestOct 18, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.