MCP server (api.exchek.us/mcp)

ExChek runs a hosted Model Context Protocol server at https://api.exchek.us/mcp. Point any MCP-capable agent at it and you get all 20 ExChek skills plus live EAR/ITAR data as tools and resources — no local install, no auth, no API key. The client supplies its own LLM; we supply the content and the data.

When to use this vs. the local plugin

Connect your client

Claude Desktop (or any client using the standard MCP config)

Add ExChek to your client config. For Claude Desktop, edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "exchek": {
      "url": "https://api.exchek.us/mcp",
      "transport": "streamable-http"
    }
  }
}

Restart Claude Desktop. ExChek tools and resources will appear in the tool picker.

Cursor

Open Settings → MCP, add a new server with name exchek, URL https://api.exchek.us/mcp, transport streamable-http.

Codex CLI

codex mcp add exchek --url https://api.exchek.us/mcp

MCP Inspector (debug + try it out)

npx @modelcontextprotocol/inspector --uri https://api.exchek.us/mcp

Opens a UI where you can list resources, browse tools, and run calls interactively. Best way to verify the connection works before wiring it into a real agent.

Raw curl (for testing or shell scripts)

# initialize
curl -sS -X POST https://api.exchek.us/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}'

# list available skills
curl -sS -X POST https://api.exchek.us/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"list_skills","arguments":{}}}'

# fetch one skill's SKILL.md
curl -sS -X POST https://api.exchek.us/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"get_skill","arguments":{"name":"exchek-csl"}}}'

Discovery

api.exchek.us/.well-known/mcp returns the canonical discovery document: protocol version, server info, tool/resource counts, and the endpoint URL. Use it to check capabilities without a full initialize handshake.

Tools

The server exposes 9 tools:

Enterprise: PDF memoranda

The classify → memo flow, end to end: run the exchek-classify skill (free), then — with your Enterprise account — fetch get_classification_pdf_contract, fill it from your analysis, call create_classification_pdf — and hand your user a branded, audit-ready PDF in the same conversation. Two ways to authenticate, by client type:

Option A — Sign in (claude.ai, Claude Desktop, any OAuth-capable client)

Add https://api.exchek.us/mcp/pro as a connector. The client opens a sign-in window at app.exchek.us (one-time email link, no password), you approve access, and the paid tools just work — no API key ever touches the conversation or the client config. Manage and revoke connected apps anytime at app.exchek.us.

Option B — API key header (Claude Code, Cursor, agent SDKs)

Add your Enterprise key as a connection header (keys never appear in tool arguments, where clients would log them). In the ExChek plugin this is the enterprise_api_key setting; raw config:

{
  "mcpServers": {
    "exchek": {
      "url": "https://api.exchek.us/mcp",
      "transport": "streamable-http",
      "headers": { "Authorization": "Bearer exk_live_…" }
    }
  }
}

Without credentials the paid tools return purchase information instead of failing the protocol — your agent will relay it. Rendering is stateless: payloads are processed in memory and discarded, never stored or logged. Payloads must not contain CUI or classified information. Credits and key management: app.exchek.us ($1 per report). REST equivalent: POST /pdf/classification (see the API reference).

Resources

The server enumerates 147 resources under the exchek:// scheme — one per SKILL.md plus every template, reference, and prompt file across all 20 skills. (The PDF payload contract is not a resource — it is part of the Enterprise product, available via the get_classification_pdf_contract tool with a key.) Clients that prefer the resource-based pattern (MCP’s read-only, URI-addressed surface) can use these instead of tools.

Use resources/list to enumerate, resources/read with a URI to fetch content, and resources/templates/list to discover the URI templates.

End-to-end example: classify an item

An agent walking through ECCN classification will typically:

1. Call list_skills to discover what’s available.
2. Call get_skill with name: "exchek-classify"; load the SKILL.md into its system prompt.
3. Follow the flow in SKILL.md — including the mandatory CUI/Classified gate at step 0.
4. Call get_ecfr_part with part: 774 to load the Commerce Control List.
5. Optionally call search_ecfr_part with the item description to narrow ECCN candidates.
6. Fill out the classification memo template (also fetchable via get_skill_bundle or the exchek://skills/exchek-classify/templates/Classification%20Report.md resource).
7. Return the completed memo to the user for review and approval.

CUI and Classified information

Every SKILL.md begins with a CUI/Classified gate that asks the user upfront whether the information involves Controlled Unclassified Information or classified material. If yes, the skill stops and directs the user to on-premises infrastructure with a local LLM. ExChek does not process sensitive government data through cloud APIs, and this MCP server enforces the same gate as the local plugin — because the gate lives in the SKILL.md content itself, any compliant client running the flow will see and apply it.

Caching and freshness

Skill content is mirrored from exchekinc/exchekskills with a 6h edge cache. eCFR data has a 1h edge cache. A daily Worker cron warms the eCFR cache so the first request after midnight UTC is already hot. Push to the skills repo → cache expires within 6h → all MCP clients see the new content automatically.

What this MCP does not do (yet)

• No server-side LLM execution. The MCP serves content and data; your client’s LLM does the reasoning. We’re intentionally Tier 1 — fast, free, zero session state.
• No CSL search. Trade.gov’s Consolidated Screening List API requires a free per-user key. Get one at developer.trade.gov and call the CSL endpoints directly; see the CSL skill for the call pattern.
• No DOCX rendering. The local plugin includes a Node-based markdown→docx converter. Over MCP you get markdown — or, for Enterprise customers, the branded PDF memorandum via create_classification_pdf (see above).
• No persistent state. The MCP doesn’t remember past determinations. If you need that, install the local plugin (audit log + state files) or wire up your own storage.