Docs

API & MCP changelog

Change history and conventions for the hosted surface at api.exchek.us — the REST endpoints and the MCP server. (For the ExChek skills / plugin, see the plugin changelog.) Build against these conventions and you can rely on the surface staying stable within a major version.

Conventions

Every response from the hosted API follows these rules:

  • Correlation IDs. Every response carries an X-Request-Idheader (Cloudflare ray id when present). Quote it in any support request — it lets us find the exact invocation. An API-Version header is also returned on every response.
  • Errors are application/problem+json (RFC 7807). REST error bodies are { type, title, status, detail, instance }, where instance is the request id. Any endpoint-specific fields (e.g. migration, supportedParts) are preserved alongside. The MCP surface uses JSON-RPC 2.0 error envelopes instead (its own protocol), not problem+json.
  • Conditional requests. Cacheable GETs return a weak ETag. Send it back as If-None-Match to get a 304 Not Modified and skip the payload.
  • Rate limits. Anonymous reads of the public surface (/api/*, /skills, /openapi.json) are limited to 120 requests / 60s per IP. Responses carry RateLimit-Limit and RateLimit-Policy; on exhaustion you get 429 + Retry-After. Authenticate with an Enterprise key for credit-metered access without the per-IP limit. Note: this is a best-effort surge guard enforced per Cloudflare edge location (not a single global counter) with a few seconds of counter propagation — so the effective ceiling scales with the number of edge locations serving you, and the limit is approximate rather than an exact global cap. It fails open: a limiter error never blocks a legitimate request.
  • Pagination. Paged tools/endpoints return an opaque cursor (meta.nextCursor on eCFR search, next_cursor on list_compliance_transactions). Pass it back verbatim to fetch the next page; a null cursor means there are no more pages. Do not construct cursors yourself.
  • Security headers. X-Content-Type-Options: nosniff on every response; /health is no-store.

Versioning & deprecation policy

  • The REST surface reports its version via the API-Version header and the OpenAPI info.version at /openapi.json.
  • The MCP tool/resource surface reports a surfaceVersion and per-tool version/deprecated flags in the discovery document at /.well-known/mcp (which also carries example calls and the conventions above).
  • Additive changes (new endpoints, tools, optional fields) ship without a version bump. Breaking changes are announced here first.
  • Removed endpoints return 410 Gone with an RFC 8594 Deprecation: true header, a Link; rel="deprecation" to docs, and migration guidance in the body.

Changes

2026-07-19 — Free denied-party screening (1 free tool)

  • New free endpoint & tool. GET /api/csl?name=Acme and the MCP tool search_csl screen a party or entity name against the U.S. Consolidated Screening List (Trade.gov — BIS Entity/Denied/Unverified lists, OFAC SDN + consolidated, State DTC debarred, and more). Fuzzy name matching is on by default; an optional sources filter narrows to specific lists. Returns { query, total, result, lists, matches[] } — each match with name, score, source list, programs, alt names, countries/addresses, ids, and remarks. Free, no auth.
  • Why. Denied-party screening is a first-step compliance check, but agents previously had to hand-roll data.trade.gov calls with the caller’s own API key. search_csl uses ExChek’s platform-managed key, edge-cached (1h) to protect the shared rate limit. Party names are not logged. A name match is not a determination — hits are surfaced for human adjudication. MCP tool count is now 43 (18 free, 25 Enterprise).

2026-07-08 — Full eCFR section & ECCN text (2 free tools)

  • Two new free endpoints & tools. GET /api/ecfr/:part/plain/:section and the MCP tool get_ecfr_text return a CFR section’s full text as clean readable text (the actual control text, not just structure or search excerpts). GET /api/eccn/:eccn and the MCP tool get_eccn return a single ECCN’s complete control entry from the Commerce Control List (Supplement No. 1 to Part 774) — License Requirements, Reason for Control, License Exceptions, and List of Items Controlled. Free, no auth.
  • Why. Agents could fetch eCFR structure, section labels, and search excerpts but never the full regulatory text, so they fell back to calling eCFR directly. The whole CCL is fetched once and edge-cached (1h); a single ECCN is sliced out per request by its heading boundary. MCP tool count is now 42 (17 free, 25 Enterprise).

2026-07-06 — Legal & regulatory intel tools (6 free + 3 Enterprise court tools)

  • Six new free endpoints & tools. GET /api/federal-register (full-text FR document search), GET /api/federal-register/:document_number (one FR document + its plain-text body), GET /api/sec-edgar (SEC EDGAR filing search), GET /api/cfr-search (global cross-title eCFR discovery search), GET /api/govinfo (GovInfo full text — FR/CFR/US Code/USCOURTS opinions), and GET /api/regulations (Regulations.gov dockets + comments), each with a matching MCP tool (search_federal_register, get_federal_register_document, search_sec_edgar, search_ecfr, search_govinfo, search_regulations). Free, no auth.
  • Three new Enterprise court tools (MCP only). search_court_records, find_court_case (DOJ press releases + CourtListener RECAP), and get_court_case_documents query CourtListener / RECAP for litigation records. Gated by an API key like the other Enterprise tools (CourtListener’s free token is rate-limited too low for an anonymous public tool); the free path never returns 401. No REST equivalent.
  • Fail-soft by design. Every source degrades independently — a slow, blocked, or misconfigured upstream returns a soft result ({ results: [], error }) rather than failing the request. GovInfo and Regulations.gov use a server-side DATA_GOV_KEY; when it is absent they return { configured: false, error } (never a 5xx). Public information only — no CUI or classified data. MCP tool count is now 40 (15 free, 25 Enterprise).

2026-07-02 — Export-control enforcement actions (free feed + Pro party check)

  • New free endpoint & tool. GET /api/enforcement and the MCP tool get_enforcement_actions aggregate recent U.S. export-control enforcement from public sources — BIS denial/settlement orders and DDTC ITAR notices (Federal Register), DOJ National Security Division criminal cases, BIS charging letters, and DDTC civil consent agreements — normalized to one record shape, newest first, edge-cached. Filter by agency, action_type, party, statute, and since. Free, no auth.
  • New Enterprise tool. check_party_enforcement screens a named counterparty against every source (plus the trade.gov Denied Persons List when configured) and returns matches grouped by source with a short summary. Gated by an API key like the other Enterprise tools; the free path never returns 401.
  • Fail-soft by design. Every source degrades independently — a slow or broken upstream contributes nothing rather than failing the request. The DDTC civil consent-agreement list is refreshed weekly via Browser Rendering into a KV snapshot; the tool never depends on it being present (the Federal Register still carries DDTC notices). Public information only — no CUI or classified data.

2026-06-25 — Enterprise document suite: six new audit-ready PDFs join the classification memorandum

  • Six new document types. The Documents surface (/pdf/*) now renders, alongside the classification memorandum, the License Determination Memorandum, Restricted-Party Screening Certificate, Transaction Compliance File, Export Management & Compliance Program (EMCP) Manual, Technology Control Plan / Deemed-Export Memorandum, and Encryption Self-Classification Report — each as deep and citation-backed as the classification memo, with primary-source (eCFR) verification.
  • New endpoints & tools. Each document adds a REST pair — POST /pdf/<slug> and GET /pdf/<slug>/contract — and an MCP tool pair — create_<slug>_pdf and get_<slug>_pdf_contract (12 new MCP tools; 14 PDF tools in total). Slugs: license-determination, restricted-party-screening, transaction-compliance-file, emcp-manual, tcp, encryption-report.
  • The Screening Certificate renders free. Its final render consumes no credit — the rest still cost 1 prepaid credit ($1 per report). An authenticated account with zero credits can still render the certificate.
  • Same conventions as classification. Draft → review → finalize (watermarked drafts are free and not stored); application/pdf bytes over REST, link-only delivery over MCP; rendering is stateless (the payload is processed in memory and discarded); Enterprise-gated with the same progressive disclosure — anonymous tools/list and /openapi.json show only the free surface. Payloads must not contain CUI or classified information.

2026-06-25 — OAuth Dynamic Client Registration: omit null optional metadata (RFC 7591)

  • Registration responses no longer echo unset optional fields as null. The OAuth authorization server’s dynamic client registration endpoint (/oauth/register, RFC 7591) now returns only registered metadata — per RFC 7591 §3.2.1, any field the client did not supply (e.g. software_id, software_version, client_uri) is omitted rather than returned as an explicit null.
  • Unblocks strict clients. Clients that validate those fields as optional strings (e.g. openwork) previously failed registration with expected string, received null → they now register cleanly. If you build against the MCP OAuth flow, your registration parser no longer needs to tolerate an explicit null where it expects an absent optional string.
  • Surface. OAuth AS on app.exchek.us; the rest of the registration response is unchanged.

2026-06-16 — Enterprise surface hardening

  • Progressive disclosure of Enterprise tools. The free regulatory + skill tools remain publicly discoverable; the Enterprise tools and their payload schemas are now disclosed only to authenticated callers (a valid OAuth token or an active key). Anonymous tools/list, /.well-known/mcp, and /openapi.json show only the free surface plus a generic “Enterprise available” note. Per-request authorization is unchanged — paid actions still require credits.
  • Signed-in dashboard users keep full access. Connecting via OAuth (even on the free tier, before buying credits) discloses the Enterprise tools so you can evaluate and convert; rendering a memorandum still consumes a credit.
  • /mcp/pro auth tightened. A missing or unrecognized bearer now returns 401 (which triggers the OAuth flow) instead of silently serving the free surface; a recognized key with a billing issue still connects and the paid tools return purchase information.

2026-06-16 — MCP pagination, surface versioning, hosted changelog

  • Cursor pagination. search_ecfr_part, search_ecfr_title (REST + MCP) now return meta.nextCursor and accept a cursor argument; list_compliance_transactions returns { transactions, count, next_cursor } and accepts cursor + limit for paging large accounts.
  • MCP discovery enriched. /.well-known/mcp now reports surfaceVersion, per-tool version/deprecated, example tool/resource calls, pagination + error conventions, and the authenticated endpoint.
  • This page. A dedicated changelog + conventions reference for the hosted surface, separate from the plugin changelog.

2026-06-16 — API hardening

  • Correlation IDs + problem+json. Every response now carries X-Request-Id and API-Version; all REST errors are normalized to application/problem+json.
  • Conditional requests + rate limits. Weak ETag / If-None-Match → 304 on cacheable reads; a 120 req/60s per-IP limit on the anonymous read surface with RateLimit-* headers and 429 + Retry-After.
  • Deprecation signalling. Retired endpoints emit Deprecation + Link headers (RFC 8594).

2026-06-16 — OAuth connection source & Connected Apps

  • The MCP OAuth authorization server now records the true client source of each connection (registration User-Agent, redirect host, and RFC 7591 software metadata), so the dashboard shows the actual client (Grok, Cursor, a custom agent) rather than defaulting to “Claude.”

Machine-readable: OpenAPI 3.1 spec · MCP discovery. Questions: matt@exchek.us.