Export Control

dev.toolstopv0.4.1Updated Oct 1, 2026

Does the US Commerce Country Chart require an export licence for an ECCN to a destination?

VerifiedStreamable HTTPWeb executableBusiness & Commerce

Overview

AI-generated overview

A small stateless MCP server that checks whether the US Commerce Country Chart requires an export licence for an ECCN to a given destination.

What you can do
Answer export-licence questions: given an ECCN and a destination, check whether the US Commerce Country Chart requires a licence, instead of the assistant guessing. The server is stateless and answers from its arguments alone, with no database or upstream API. Its export-control tables are frozen at the 2026-08-27 edition.
When to use it
Useful when an assistant needs a quick, narrow answer on US export-control licence requirements for a classification and destination, and a frozen 2026-08-27 table is acceptable.
Requirements
Declared as a remote streamable HTTP endpoint with no account, API key, headers or environment variables. The README states the hosted endpoints were discontinued in September 2026 and the code now runs only locally over stdio.
Before you install
The README marks the hosted service discontinued and the packages deprecated, so the remote endpoint may not work. The export-control tables are frozen at the 2026-08-27 edition and may be out of date. Treat answers as reference only, not legal compliance advice.

Installation

In SourceWeft

  1. Open Export Control in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/dev.toolstop%2Fexport-control/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "export-control": {
      "type": "http",
      "url": "https://export-control.toolstop.dev/"
    }
  }
}

README

toolstop

Small, stateless MCP servers. Each one does a single narrow job exactly, so an assistant can call it instead of guessing.

Every server runs on Cloudflare Workers at <name>.toolstop.dev, holds no state, and can also run locally over stdio.

Discontinued September 2026. The hosted endpoints are gone and the npm packages are deprecated. The code still runs locally over stdio if you want it; the export-control tables are frozen at their 2026-08-27 edition.

Servers

ServerDoesEndpoint
check-digitsValidates check digits for IBAN, LEI, ISBN, GTIN/UPC/EAN, VIN, NPI, ISIN, ABA routing numbers and payment cardshttps://check-digits.toolstop.dev

Connecting

Remote, over streamable HTTP. No install, no account:

json
{  "mcpServers": {    "check-digits": {      "type": "url",      "url": "https://check-digits.toolstop.dev"    }  }}

Local, over stdio:

bash
npx @toolstop/check-digits

Design

Stateless. No database, no vector index, no metered upstream API. A request is answered from its arguments alone. Servers scale to zero and an idle one costs nothing.

Zero runtime dependencies. No MCP SDK, no schema library. MCP over streamable HTTP is request/response, which makes hand-rolled dispatch small enough to be worth it: faster cold starts, and no supply chain.

Telemetry records shape and outcome, never argument values. A check-digit server that logged its input would be storing real IBANs and card numbers. The transport emits one row per request describing what kind of call happened and whether it succeeded. packages/_shared/transport.test.mjs asserts that no raw argument value can reach it.

The row also carries a session id, and it is derived from the network the request came from, truncated to a /24 or /48 before hashing, never the full address. Hashing the whole IP would not have anonymised it: the IPv4 space is 32 bits and the other inputs are public, so the id was walkable back to one address until this was fixed on 2026-08-10. Each server's README states the complete recorded row rather than only what is left out.

Every tool declares readOnlyHint, a complete inputSchema and an outputSchema, so a client can tell what a call will do before making it and what shape comes back. The transport refuses to start a server whose tools do not state their annotations, rather than defaulting them to something reassuring.

Repo layout

packages/_shared/     shared transport, dispatch and telemetrypackages/mcp-<name>/  one serverscripts/discover.mjs  derives the CI matrix from the filesystemscripts/smoke.mjs     protocol check against a live endpoint

See CLAUDE.md for the operating manual.

Development

bash
npm installnpm test                                # every server plus the shared transportnode scripts/smoke.mjs mcp-check-digits # protocol check against the live endpoint

License

MIT

Source: README.md at commit 5d0d0f8

Tools

0
SourceWeft has not read this server's tools yet.

Version history

2
  1. v0.4.1LatestSep 17, 2026
  2. v0.4.0Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declaredRequired10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts