SanctionsAI MCP server

agentmail — compliance & verification toolkit for AI agents

Your agent is about to send USDC to a stranger. Is that stranger sanctioned?

782 OFAC crypto wallets · 19,086 sanctioned names · 16 embargoed jurisdictions.

No API key. No signup. 30-second setup. Free & open source.

agentmail gives any AI agent three capabilities it can't provide itself:

It exposes all of these through three surfaces — MCP tools (for Claude Code / Cursor / Hermes), an HTTP API (for any agent), and a CLI (for you). Same core, same data.

Why this exists

Agents are starting to pay for things (x402, AP2, ACP, Coinbase AgentKit). But every payment rail assumes a human is watching. If your agent autonomously pays a wallet that's on the OFAC Specially Designated Nationals list, that's your legal problem — and the big payment infra players (OpenAI, Stripe, Coinbase) explicitly do not handle per-jurisdiction sanctions screening, Know-Your-Agent, or agent-transaction fraud signals. That's the gap this fills.

agent ──about to pay──▶  sanctions_check(wallet)  ──▶ clean? proceed. sanctioned? ABORT.

Quick start (30 seconds)

pip install sanctions-mcp

Option A — use it from an MCP client (Claude Code / Cursor)

// .mcp.json or your client's MCP config
{
  "mcpServers": {
    "agentmail": {
      "command": "python",
      "args": ["-m", "agentmail.mcp_server"]
    }
  }
}

Now your agent can call sanctionscheck, riskscore, kyaverify, disputeopen, createinbox, fetchcode, createnumber, fetchsms, releasenumber, listinboxes.

Note: the PyPI package is sanctions-mcp (the name agentmail was taken). The Python import name is still agentmail.

Option B — use it as an HTTP API

python -m agentmail.api   # serves on :8000

# Screen a wallet against real OFAC data — no key, no auth needed for self-host
curl "http://localhost:8000/sanctions?wallet=0x098B716B8Aaf21512996dC57EB0615e2383E2f96"
# → {"matches":[{"list":"OFAC_SDN","match_type":"wallet_exact","confidence":1.0}],
#    "clean":false,"provider":"osint"}

curl "http://localhost:8000/risk" -d '{"counterparty_id":"0xabc...","amount":"5000","rail":"x402"}'
# → {"score":0,"recommendation":"decline","reasons":["sanctions_match:OFAC_SDN/..."]}

Option C — use it from the CLI

# Sanctions screen — real OFAC data, no key
python -m agentmail.cli sanctions --wallet 0x098B716B8Aaf21512996dC57EB0615e2383E2f96
# → flagged: OFAC_SDN wallet_exact

python -m agentmail.cli risk 0xabc123def456 5000 --rail x402
python -m agentmail.cli kya my-agent --wallet 0xabc... --wallet-age 400 --domain bot.dev
python -m agentmail.cli compliance-status
# → OFAC SDN: 782 wallets, 19086 names; source=vile/ofac-sdn-list@...

The compliance layer (the part that matters)

Four tools, called before an agent trusts or pays a counterparty:

Shortened. The full README is on GitHub.