Docs

Changelog

Release history and notable updates for the ExChek API and docs.

Releases

2026-06-02 — API: Part 732 added; Resources gets a News section

Two small updates.

  • API: Part 732 (Steps for Using the EAR). PR #17. Added to the supported-parts registry; /api/ecfr/732 now serves the full procedural roadmap including Supplement No. 3 (BIS Know Your Customer red-flag indicators), which the exchek-red-flag-assessment skill already cites. Total parts: 12 (11 EAR + USML). Verified live with version 6c73187c.
  • Website: News section under Resources. PR #18. Three external links beneath the Learning Center / Champion Kit bentos: news.exchek.us, bis.gov, and pmddtc.state.gov. Mirrors the “Step-by-step guides” pattern on the Solutions dropdown.

2026-05-15 → 2026-05-17 — API expansion: 24 parts, edge cache, skills over HTTP, MCP, OpenAPI

The largest infrastructure week since the Cloudflare migration. Seven PRs.

  • API: 24-part eCFR mirror (PR #10). Expanded the registry from 11 → 24 parts — 17 EAR + 7 ITAR — closing every gap where a skill or report template already cited a part the API didn’t serve. Title 22 now actually covers ITAR beyond just USML.
  • API: edge cache via Cloudflare Cache API (PR #12). Hono middleware fronts every cacheable GET with caches.default. On hit, the route handler is skipped entirely — no eCFR upstream fetch, no response rebuild, no Worker CPU beyond cache.match(). New x-cache: HIT/MISS debug header.
  • API: 20 ExChek skills over HTTP + MCP (PR #13). The 20 skills are now network-addressable for agents that can’t install the Claude plugin (Manus, ChatGPT/Gemini with HTTP tools, custom LLM stacks). Closes the production MCP server item that had been sitting in roadmap.md:215 since the Render era.
  • API: OpenAPI 3.1 spec at /openapi.json (PR #14). Closes roadmap.md:214 (originally blocked on Render quota — non-issue post-Cloudflare).
  • Docs: API reference sync to 11-part list (PR #11). Replaced stale infrastructure claims that survived the Render → Cloudflare migration.
  • Docs: new MCP guide + reference covers skills / MCP / OpenAPI / 20 skills (PR #15). Documents the surface introduced in #13 and #14. After this lands, the docs match what the API actually serves.
  • Website: Get started card shows 3 install paths (PR #16). The bento card and its modal were plugin-only — three steps that all assumed Cowork. With the hosted MCP and REST API both live, the card now branches: plugin / MCP / API.

2026-05-06 — API: Part 734 added

PR #9. GET /api/ecfr/734 had been returning “Unsupported part” even though the upstream eCFR Title 15 structure exposes Part 734 cleanly — the hardcoded PARTS registry in apps/api/src/parts.js was simply missing the entry. One-line fix plus doc + reference updates. Part 734 is the foundational EAR-scoping part (deemed exports § 734.2(b)(2)(ii), technology releases § 734.7); the Learning Center cites it in three sections, so callers expecting /api/ecfr/734 to be live were doing the right thing.

2026-05-01 → 2026-05-04 — May polish week

Small UI / infra commits across the website.

  • Industries: Professionals page (PR #1). /industries/professionals live.
  • Resources nav (PR #2). Initial Resources dropdown wiring (Learning Center + Champion Kit bentos).
  • Homepage CTA tweaks (PR #3).
  • Footer: “An American Co.” (PR #4).
  • Get Started route (PR #5). /get-started shortcut to install.
  • Apollo activity tracker (PR #6).
  • ElevenLabs ConvAI widget (PR #7). Mounted once in the root layout — shows on every page of exchek.us.
  • Header: Spotify icon (PR #8). Third social icon between GitHub and the [ Get started ] CTA, linking to the show.

2026-04-28 — Website + docs migrated to Cloudflare; SMB-voice pass

Major infrastructure and copy update.

  • Cloudflare migration. Website, docs, and API moved from Vercel + Render to Cloudflare Workers. exchek.us, www.exchek.us, docs.exchek.us, and api.exchek.us all serve from Cloudflare’s edge with auto-deploy from GitHub on every push. Old Render API ($7/mo) shut down; Cloudflare hosting is effectively $0 on the free tier.
  • API v2.0.0 on Workers. Hono-based Worker, edge-cached eCFR responses (1h TTL with stale-while-revalidate), daily cron warm-up of all 7 supported parts. Same endpoints as v1.x; classify and expert-review endpoints return 410 Gone with migration pointer to the local-first MCP server.
  • Homepage rewritten for SMB voice. Killed the developer-tab install UI. Replaced with three plain-English steps: 1) Download Claude, 2) Paste one line, 3) Ask your first question. Industry-archetype testimonials replaced the [[NAMED CUSTOMER]] placeholders that were rendering live. Trust strip dropped openclaw/spacebot/MCP-compatible jargon, leads with “Built for Claude”.
  • HowItWorks + FAQ: tightened. Dropped ECCN / 15 CFR / Trade.gov-API jargon from the steps. Added “What’s an AI assistant and why do I need one?” and “Where does my data go?” entries.
  • Docs install page: added Option 4 — download a tagged release zip from GitHub Releases for air-gapped or IT-restricted environments.
  • Docs nav: removed “Enterprise” and “Audit” links (those apps were retired). Quick actions dropdown rewritten with working items: Copy install command, View on GitHub, Download latest release, Copy page URL, Copy as Markdown, Donate. Stale 5-skill list and broken Claude/ChatGPT-import URLs removed.
  • API reference: required q search parameters now pre-fill with example values so the “Send Request” button works on the first click. Health/meta descriptions updated for the Cloudflare Worker (edge cache, daily cron) instead of the old Render API (in-memory cache + snapshot files).
  • Privacy policy: Section 2 rewritten — the enterprise intake form on enterprise.exchek.us no longer exists. Replaced with plain-language Done-with-you email contact terms.

v3.0.2 — 2026-04-28

Removed the dead telemetry_enabled userConfig toggle. The field existed in v3.0.0/v3.0.1 but no code emitted any spans — it was a switch that did nothing. The plugin now emits zero telemetry of any kind. Rewrote docs/TELEMETRY.md to reflect the truth: nothing leaves the machine except the two U.S. government API calls (ecfr.gov, data.trade.gov) and only when a skill needs them.

v3.0.1 — 2026-04-28

Removed the commands/ directory in favor of the canonical skills/*/SKILL.md format. Cowork now picks up each skill as /<skill-name> automatically; no separate flat .md wrappers needed. Silences the legacy-format deprecation notice on install.

v3.0.0 — 2026-04-28 — Enterprise plugin packaging, local-first MCP, slash commands, agents, hooks

Major release. Cowork-first packaging, also runs in Claude Code. SMB-manufacturer voice for setup. Key additions:

  • Local-first MCP server (servers/exchek-mcp/) — 12 tools wrapping eCFR, Trade.gov CSL, input sanitization, AI-disclosure validation, HMAC-chained audit log, and the docx converter. No call-home; api.exchek.us is no longer a dependency. Outbound network is limited to www.ecfr.gov and data.trade.gov.
  • Slash invocation for every skill. Cowork picks them up from skills/*/SKILL.md. Commands like /exchek-classify, /exchek-csl, /exchek-license, /exchek-jurisdiction, /exchek-encryption, etc. (16 total).
  • Two specialist agents: exchek-audit-runner (long-running CSV audits, runs in its own context window) and exchek-classification-reviewer (independent second-opinion on a draft classification memo).
  • Hooks: SessionStart installs MCP dependencies into $${CLAUDE_PLUGIN_DATA} on first run and on package.json changes; PreToolUse ensures the audit log file exists; PostToolUse records report emission.
  • userConfig: platform_tier, trade_gov_api_key (sensitive, OS keychain), audit_key (sensitive), default_report_dir.
  • HMAC-chained audit log — tamper-evident, verifiable with mcp__exchek__audit_verify.
  • New docs in repo: SECURITY.md, TELEMETRY.md, DATA_STORAGE.md, COMMUNICATIONS_KIT.md, CHAMPION_KIT.md. All in SMB-manufacturer voice.
  • Skills now reference MCP tools (mcp__exchek__*) instead of bare HTTPS calls. Skill bodies unchanged for v3.0.0; full SMB-voice rewrite is queued for v3.1.0.

v2.1.0 — 2026-04-21

Documented canonical 7-step audit-ready flow across all 16 skills. Inlined full canonical AI-disclosure placeholders in templates. Comprehensive license rewrite with adversarial protections.

2026-03-28 — Skills repo restructured to Claude Code plugin standard

The public skills repo (exchekinc/exchekskills) has been restructured to follow the Claude Code plugin standard. Skills are now in a skills/ subdirectory with .claude-plugin/plugin.json for plugin discovery and marketplace.json for marketplace install. Install all 16 skills with: /plugin marketplace add github:exchekinc/exchekskills then /plugin install exchekskills. Added LICENSE.md (comprehensive proprietary license with adversarial protections), ETHOS.md (mission, principles, regulatory citations), and compatibility badges for Claude Code, Claude Desktop, Cursor, ChatGPT Agents, Perplexity Compute, OpenClaw, and Spacebot.

2026-03-28 — All 16 skills audited and updated for production

Complete audit and update of all 16 ExChek skills. Fixed stale GitHub URLs (mrdulasolutions → exchekinc) across 18 files. Updated exchek-skill and exchek-skill-license reference.md files with all 7 API endpoints (Parts 774, 738, 740, 742, 744, 746, 121) plus search endpoints. Added CUI/Classified check to exchek-skill-csl (was the only skill missing it). Created skill.yaml for exchek-skill-docx (was the only skill missing it). Integrated new API endpoints into relevant skills: /api/ecfr/746 and search into exchek-skill-country-risk for embargo analysis, /api/ecfr/742 and search into exchek-skill-encryption for §742.15 controls, /api/ecfr/121 and search into exchek-skill-jurisdiction for USML review.

2026-03-28 — API docs rebuilt with interactive endpoint explorer

The API reference page at docs.exchek.us/docs/api-reference has been completely rebuilt with interactive, Swagger-style endpoint documentation. Each endpoint has expandable cards with method badges, parameter tables, response tables, and a “Try it” panel that lets you edit parameters, preview the URL, send live requests, and see formatted JSON responses with status codes and timing. All 12 endpoints documented: health, meta, 7 CFR part endpoints, sections, per-part search, and title-wide search.

2026-03-28 — Full-text eCFR search with ECCN-level results

New search endpoints added to the ExChek API. GET /api/ecfr/:part/search?q=term searches within a specific CFR part and returns matching sections with excerpts, highlights, relevance scores, and pagination. GET /api/ecfr/search?q=term&title=15 searches across all parts in a title. Powered by the eCFR Search API for real full-text results at ECCN-level granularity.

2026-03-28 — API expanded: caching, CORS, compression, rate limiting, 3 new parts

Major API infrastructure update. Added in-memory TTL cache (1-hour default) to eliminate redundant eCFR fetches — Title 15 fetched once, all 6 parts extracted from cache. Added CORS, compression, and express-rate-limit (120 req/min). Three new CFR part endpoints: GET /api/ecfr/742 (Control Policy), GET /api/ecfr/744 (End-Use Controls), GET /api/ecfr/746 (Embargoes). New /api/ecfr/meta endpoint with supported parts list, snapshot metadata, and cache stats. Enhanced /health with eCFR reachability, cache stats, and snapshot ages. Daily refresh cron (changed from weekly). Cache-Control headers for CDN/client caching. All 7 supported parts: 121 (Title 22), 738, 740, 742, 744, 746, 774 (all Title 15).

2026-03-28 — License and legal pages updated

Comprehensive rewrite of the ExChek proprietary LICENSE with adversarial protections: anti-competitive restrictions, reverse engineering prohibition, scraping/crawling prohibition, rate-limit circumvention prohibition, DDoS and cyberattack prohibition, agentic abuse restrictions, API Terms of Use, security and responsible disclosure, indemnification, IP and trade secret protections, enforcement monitoring. Terms and Conditions updated to match. Contact email updated to matt@exchek.us across all sites.

v1.0.0 (2026-03-14)

First stable major release. ExChek delivers five export-compliance skills: ECCN classification (exchek-classify), Consolidated Screening List search (exchek-csl), license determination (exchek-license), export documentation & filing helper (exchek-export-docs), and ECP / policy & training generator (exchek-ecp). API supports health and eCFR snapshots (Parts 738, 740, 774, 121), classification with agent-driven flows, and optional x402 payments. Docs and install guide cover all skills; no API key required for skills.

2026-03-14 — ECP / Policy & Training skill (exchek-ecp)

ExChek adds a fifth skill: exchek-ecp (ECP / Policy & Training Generator). The skill generates tailored Export Compliance Program (ECP) documents, SOPs, and training outlines from company footprint, product mix, and risk profile. Aligns with BIS nine ECP elements and DDTC expectations (where ITAR applies); maps screening, classification, and licensing into CRM/ERP/agents. No classification, screening, or license determination performed—program-level and training content only. No API key required. Docs: New ECP / Policy & Training skill page; install, quickstart, and nav updated for five skills. Skill: exchek-skill-ecp/; report template: report-templates/ecp/.

2026-03-14 — Export documentation skill (exchek-export-docs)

ExChek adds a fourth skill: exchek-export-docs (Export Documentation & Filing Helper). Given shipment details plus classification and screening results, it drafts commercial invoice export block, packing list annotations, Shipper's Letter of Instruction (SLI), and AES/EEI data elements; flags when AES filing is required vs exempt and documents the reasoning (15 CFR 758.1, Census FTR 30.7). Prep only—no actual AES filing. No API key required. Docs: New Export documentation skill page; install, quickstart, and nav updated for four skills. Report template: report-templates/export-docs/; skill: exchek-skill-export-docs/.

2026-03-14 — Three skills, license determination, API 738/740

ExChek now offers three skills in the public repo exchekskills: exchek-classify (ECCN classification), exchek-csl (Consolidated Screening List search), and exchek-license (license determination). The license skill determines EAR license requirements and exceptions (Part 738 Country Chart, Part 740) and produces an audit-ready memo; no API key required. Docs: New License determination skill page; API Reference documents GET /api/ecfr/738 and GET /api/ecfr/740 (used by the license skill) and eCFR fallback for Title 15 (774, 738, 740). Install, quickstart, and nav updated for three skills. Website and docs copy updated throughout (hero, offer, flow, pricing, FAQ, get-started).

2026-03-12 — CSL search skill and two-skills repo

ExChek now offers two skills in the public repo exchekskills: exchek-classify (ECCN classification) and exchek-csl (Consolidated Screening List search). The CSL skill uses the Trade.gov API (data.trade.gov/consolidated_screening_list/v1/search and /sources) with a free API key from developer.trade.gov; supports name, fuzzy_name, sources, types, countries, address fields, offset, and size. Screening memo report with Word/Pages export. Backup: JSON/CSV/TSV at trade.gov/consolidated-screening-list. Classification skill: added skill.yaml manifest. Docs: new CSL search skill page, API reference and integrations updated for both skills, install and quickstart cover both. Public repo layout: exchek-classify/, exchek-csl/, root README.

2026-03-12 — Agent platforms and wallet payments

Docs and site updates for AI agent platforms and agent-native payments. ExChek now highlights support for Anthropic Claude Cowork, Perplexity Computer, and other agents such as openclaw and spacebot, with OpenAI and Grok agents ready as their platforms mature. Funding docs add guidance on getting a wallet on Base or via Coinbase, connecting wallets to agents through PaySponge, and why on-chain payments are a better fit for agents than traditional or virtual credit cards. The marketing site’s "How it works" flow layout has been refined for clearer spacing and readability.

2026-03-11 — API and skill agent improvements

API and skill updates for reliable AI agent use. API: All classify error responses now include promptForUser and nextStep. Start-free 402 response is machine-readable: nextStep: "payment_required", requiredAction: "pay_start", paymentAmount, paymentEndpoint. New POST /api/classify/status returns job state and suggested next step for context recovery. Submit-classification and confirm-jurisdiction 400 responses may include validationErrors: [{ "field": "...", "message": "..." }]. Approve response includes reportStorageError when report storage fails. Skill: Error handling section (400, 402, 404, 500, 503). When-to-use triggers, cancel/start-over behavior, wallet source guidance, report fallback when reportUrl is missing. Reference doc: error responses table and status endpoint.

2026-03-11

ExChek is a free Claude skill for ECCN classification. The API serves health and eCFR snapshots (Part 774, Part 121). Classification and report are done in-skill with human oversight; optional donation. Install the ExChek skills for Claude Code.

2026-03-11 — Production setup

Supabase and Render production setup. API uses Supabase for persistence (jobs, wallets, reports) and the reports bucket for classification reports; local dev uses .env and dotenv. Render blueprint defines the exchek-api web service and the refresh-ecfr cron (weekly); set SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY on both. eCFR snapshot store is wired to the Supabase ecfr-snapshots bucket: the cron uploads Part 774 and Part 121 after each run, and the API falls back to that bucket when the live eCFR API is unavailable. Blueprint uses per-service env vars for reliable sync. Docs nav and changelog skill updates.

Current

Classification API aligned with expert prompt flow. Extended item inputs (description, specifications, performance parameters, valuation, units, HTS Code, Schedule B, end user, end use, destination country). Structured output: regulatoryAgency, justification, exportRestrictions, licenseRequirements, auditLog. New POST /api/classify/submit-classification for agent-driven flow: agent runs classification using skill prompts and submits proposed classification for adjudicator review. Report includes full item fields and export-restrictions section. ExChek classification skill: system and user prompts in prompts/, Option A (API-driven) and Option C (agent-driven) flows documented. Public skill repo updated.

See also