Distributed Risk

npx add-mcp 'https://www.distributedrisk.com/mcp'

Use the desk from your AI assistant.

Connect Claude, ChatGPT or your own AI agent software through MCP (Model Context Protocol, the open standard for linking AI tools to outside sources). It can then read the notes and search the official US record they cite: the screening lists, OFAC's recent actions, CISA's exploited-vulnerability catalog, the Federal Register and State travel advisories. The cyber tools add CISA's advisories, incidents companies report to the SEC, and new advisories against the software AI agents run on.

MCP

Read-only · no key

Endpoint

https://www.distributedrisk.com/mcp

The desk

• list_notes List desk notes
• search_notes Search desk notes
• get_note Read a desk note

The official record

• search_screening_lists Search the US screening lists
• list_ofac_actions OFAC recent actions
• search_kev Search CISA's KEV catalog
• search_federal_register Search the Federal Register
• list_travel_advisories State travel advisories
• get_reference_rates New York Fed reference rates
• get_treasury_yields Treasury par yield curve

Connect

Add a remote MCP server with this address. It speaks Streamable HTTP on protocol 2026-07-28, and negotiates the 2025 revisions with a client that opens with initialize. It needs no key.

Claude Code

claude mcp add --transport http distributed-risk https://www.distributedrisk.com/mcp

Clients that read an mcpServers file

{
  "mcpServers": {
    "distributed-risk": {
      "type": "http",
      "url": "https://www.distributedrisk.com/mcp"
    }
  }
}

Tools

The desk

• list_notes Published desk notes, newest first: entry number, date, title, status, topic (cyber or sanctions), readers, source class, a one-line summary, and the note's URL. Pages with limit and offset; total is the count that matches, next_offset the offset of the next page. Filter by topic or reader as on the desk page.
• search_notes Find published notes that mention every word of the query (a name, a list, a country, a program, a date) in the title, summary, sources or body.
• get_note One published note in full (Markdown), with its numbered sources and links to the official record.

The official record

• search_screening_lists Search the Consolidated Screening List (OFAC SDN and other Treasury lists; BIS Entity, Denied Persons, Unverified and Military End User lists; State ITAR-debarred and nonproliferation lists) by name, alias or identifier (IMO, SWIFT/BIC, registration number). Close spellings match. Each result gives the list, programs, addresses, IDs, remarks and the official list link; the answer says when each list last changed. Source: Consolidated Screening List, International Trade Administration
• list_ofac_actions OFAC's recent actions, newest first: designations and removals, general licenses, FAQs, regulations and settlements, each with its date, categories and the official page. Filter by date or words in the title. Source: OFAC Recent Actions, Treasury
• search_kev CISA's Known Exploited Vulnerabilities catalog, newest first: CVE, vendor, product, date added, federal due date, known ransomware use, the required action, FIRST's EPSS estimate, and whether it sits in the AI and agent software stack. Look up one CVE, search vendor or product words, list what was added since a date, or only the AI stack. For one CVE in full, use get_cve. Source: Known Exploited Vulnerabilities catalog, CISA
• search_federal_register Search Federal Register rules, proposed rules, notices and presidential documents: title, type, agencies, publication and effective dates, citation, abstract and the official document link. Narrow by agency (for example foreign-assets-control-office, industry-and-security-bureau, state-department), type or date. Source: Federal Register API, Office of the Federal Register
• list_travel_advisories US State Department travel advisories, most recently updated first: country, level (1 to 4), the advisory's summary and the official page. Filter by country, minimum level or update date. Source: Travel advisories, State Department
• get_reference_rates The New York Fed's reference rates: EFFR and OBFR (unsecured), SOFR, BGCR and TGCR (secured), and the SOFR averages and index (SOFRAI). With no rate, the latest of each; with a rate, its last N days, with percentiles, volume and, for EFFR, the target range. Source: Reference rates, Federal Reserve Bank of New York
• get_treasury_yields Treasury's daily par yield curve, newest first: yields by tenor from 1 month to 30 years. Ask for the last N days, and optionally only some tenors (for example ["2 Yr", "10 Yr"]). Source: Daily par yield curve rates, US Treasury

Cyber

CVE.org, CISA and SEC EDGAR are official. FIRST's EPSS is a model's estimate of exploitation, and OSV.dev is the open-source advisory record. Answers label both.

• get_cve Everything the record says about one CVE, in one answer: the CVE.org record (description, severity, weakness, affected products, references), CISA's exploitation call (SSVC) and its KEV listing with the federal due date, FIRST's EPSS estimate, and whether it sits in the AI and agent software stack. Source: CVE.org (CVE Program), with CISA KEV and SSVC, and FIRST EPSS
• list_cyber_advisories CISA's advisories, newest first: alerts, joint cybersecurity advisories (#StopRansomware, state-sponsored activity), ICS and ICS-medical advisories, and analysis reports. Each with its kind, date, summary, the CVEs it names and the official page. Filter by kind, date, words, or the AI stack. Source: Cybersecurity advisories, CISA
• list_cyber_incident_filings Cybersecurity incidents public companies report on Form 8-K, newest first: Item 1.05 (the company judged it material) and, unless excluded, Item 8.01 reports made without that judgment. Each with the company, tickers, filing and event dates, items, state, industry code and the EDGAR filing. Source: EDGAR full-text search, SEC
• list_ai_stack_vulnerabilities New advisories against the software AI agents run on, newest and most severe first: agent frameworks (LangChain, LlamaIndex, CrewAI, n8n, Langflow), LLM gateways (LiteLLM), MCP servers and SDKs, model serving (vLLM, Ollama), ML platforms (MLflow, Ray, Jupyter), model libraries, AI apps and coding agents. Malicious-package reports (a compromised or lookalike release) come first. CISA KEV entries in the same stack are included. Each with package, severity, fixed versions, CVEs, EPSS and the advisory. Source: OSV.dev (GitHub, PyPI and OpenSSF advisories), with CISA KEV

What it returns

Two kinds of answer. From the desk: each note's entry number, date, status, sources and full text, with a link back to its page. From the official record: what the government source publishes, as it publishes it, with the source link and the time we read it. A screening-list answer also says when each list last changed. A CVE answer joins the CVE.org record, CISA's KEV listing and exploitation call, and the EPSS estimate, each dated.

A list match is a lead to check against the official entry, not a determination that a party is listed. No match is not a clearance: names vary in spelling and transliteration, and the lists change.

The desk's terms apply to every answer, and every tool result carries them: decision support from official public sources, not a legal determination of sanctions, travel, or cyber status. Readers own their compliance obligations.

Every tool only reads, and none of them can see requests sent to an advisor. One address can make about 120 calls a minute. A newly published note reaches connected assistants within a minute. The lists and catalogs are read again every hour, OFAC's recent actions every 20 minutes, CISA's advisories and SEC filings every 30 minutes. The first list search after a quiet spell can take a few seconds while the lists load.

Beyond the record

Some decisions need people on the ground, an investigation, or insurance. Tell us what you need and where, and an advisor arranges it with a partner firm that works in that country.

Brief an advisor