Vendorcheck

io.github.CollinJ0Published by GitHub account CollinJ0v0.1.1Updated Nov 3, 2026

Check a vendor (name, domain, email) for fraud signals and sanctions before an agent pays it.

VerifiedSTDIODesktop onlyFinanceSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that lets an assistant vet a vendor, invoice sender or payee for fraud and sanctions signals before paying.

What you can do
  • Check a vendor, invoice sender or payee for legitimacy before payment or sharing sensitive data
  • Inspect domain age, look-alike or impersonation domains, email security, HTTPS and website signals
  • Screen against US OFAC sanctions and SEC public-company records
  • Return a verdict of allow, review or block with supporting reasons
When to use it
Useful when an assistant handles accounts payable, invoice triage or vendor onboarding and should flag risky counterparties before money moves or sensitive data is shared. It suits workflows that want a quick allow/review/block gate rather than a full due-diligence report.
Requirements
Runs as a local stdio process on the user's machine, installed from the npm package vendorcheck-mcp, so a Node.js runtime is needed. No authentication, environment variables or headers are declared. Network access is implied by the external lookups it performs.
Before you install
The verdict is advisory and based on public signals such as domain age, sanctions lists and SEC records, so a review or allow result is not proof of legitimacy. It sends the vendor name, domain and email you supply to third-party lookup services. Treat block and review outcomes as prompts for human verification before any payment.

Installation

In SourceWeft

  1. Open Vendorcheck in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

This repository has no README.

Tools

1

check_vendor

Check whether a vendor, invoice sender, or payee is legitimate BEFORE paying it or sharing sensitive data. Checks domain age, look-alike/impersonation domains, email security, HTTPS, website, US sanctions (OFAC) and SEC public-company records. Returns verdict allow | review | block with reasons. If verdict is not allow, do not pay without human confirmation.

Parametersnameemaildomain

Version history

1
  1. v0.1.1LatestNov 1, 2026

Score

65% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • License10 pts

    Declare a license in the repository or the registry entry.