MCP server (api.exchek.us/mcp)

ExChek runs a hosted Model Context Protocol server at https://api.exchek.us/mcp. Point any MCP-capable agent at it and you get all 20 ExChek skills plus live EAR/ITAR data as tools and resources — no local install, no auth, no API key. The client supplies its own LLM; we supply the content and the data.

This hosted MCP vs. the local plugin

The hosted MCP is the recommended default — no install, always current, and it serves the same 20 skills. The local plugin is still fully supported but will be retired in a future release; prefer the hosted MCP for new setups.

Connect your client

Claude Desktop (or any client using the standard MCP config)

Add ExChek to your client config. For Claude Desktop, edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "exchek": {
      "url": "https://api.exchek.us/mcp",
      "transport": "streamable-http"
    }
  }
}

Restart Claude Desktop. ExChek tools and resources will appear in the tool picker.

Cursor

Open Settings → MCP, add a new server with name exchek, URL https://api.exchek.us/mcp, transport streamable-http.

Codex CLI

codex mcp add exchek --url https://api.exchek.us/mcp

MCP Inspector (debug + try it out)

npx @modelcontextprotocol/inspector --uri https://api.exchek.us/mcp

Opens a UI where you can list resources, browse tools, and run calls interactively. Best way to verify the connection works before wiring it into a real agent.

Raw curl (for testing or shell scripts)

# initialize
curl -sS -X POST https://api.exchek.us/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}'

# list available skills
curl -sS -X POST https://api.exchek.us/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"list_skills","arguments":{}}}'

# fetch one skill's SKILL.md
curl -sS -X POST https://api.exchek.us/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"get_skill","arguments":{"name":"exchek-csl"}}}'

Discovery

api.exchek.us/.well-known/mcp returns the canonical discovery document: protocol version, server info, tool/resource counts, and the endpoint URL. Use it to check capabilities without a full initialize handshake.

Tools

The server exposes 43 tools — 18 free (skill + eCFR lookups — including full section & ECCN control text — the enforcement feed, free denied-party screening against the Consolidated Screening List, plus six legal & regulatory research tools) and 25 Enterprise (disclosed only to authenticated callers). The 14 document tools are listed parametrically (one get_<doc>_pdf_contract + one create_<doc>_pdf per document type):

Enterprise: PDF memoranda

The classify → memo flow, end to end: run the exchek-classify skill (free), then — with your Enterprise account — fetch get_classification_pdf_contract, fill it from your analysis, call create_classification_pdf — and hand your user a branded, audit-ready PDF in the same conversation. The same get_<doc>_pdf_contract / create_<doc>_pdf pair renders the rest of the seven-document suite (the Restricted-Party Screening Certificate renders free). Two ways to authenticate, by client type:

Option A — Sign in (claude.ai, Claude Desktop, any OAuth-capable client)

Add https://api.exchek.us/mcp/pro as a connector. The client opens a sign-in window at app.exchek.us (one-time email link, no password), you approve access, and the paid tools just work — no API key ever touches the conversation or the client config. Manage and revoke connected apps anytime at app.exchek.us.

Option B — API key header (Claude Code, Cursor, agent SDKs)

Add your Enterprise key as a connection header (keys never appear in tool arguments, where clients would log them). In the ExChek plugin this is the enterprise_api_key setting; raw config:

{
  "mcpServers": {
    "exchek": {
      "url": "https://api.exchek.us/mcp",
      "transport": "streamable-http",
      "headers": { "Authorization": "Bearer exk_live_…" }
    }
  }
}

Without credentials the paid tools return purchase information instead of failing the protocol — your agent will relay it. Rendering is stateless: payloads are processed in memory and discarded, never stored or logged. Payloads must not contain CUI or classified information. Plans and key management: app.exchek.us — subscribe for unlimited documents, or pay-per-document at $1 on the free tier (the Screening Certificate is free). See Pricing. REST equivalent: POST /pdf/classification (see the API reference).

Resources

The server enumerates 147 resources under the exchek:// scheme — one per SKILL.md plus every template, reference, and prompt file across all 20 skills. (The PDF payload contract is not a resource — it is part of the Enterprise product, available via the get_classification_pdf_contract tool with a key.) Clients that prefer the resource-based pattern (MCP’s read-only, URI-addressed surface) can use these instead of tools.

Use resources/list to enumerate, resources/read with a URI to fetch content, and resources/templates/list to discover the URI templates.

End-to-end example: classify an item

An agent walking through ECCN classification will typically:

1. Call list_skills to discover what’s available.
2. Call get_skill with name: "exchek-classify"; load the SKILL.md into its system prompt.
3. Follow the flow in SKILL.md — including the mandatory CUI/Classified gate at step 0.
4. Call get_ecfr_part with part: 774 to load the Commerce Control List structure.
5. Optionally call search_ecfr_part with the item description to narrow ECCN candidates.
6. Call get_eccn (e.g. eccn: "5A002") to read the candidate’s full control entry, and get_ecfr_text for any License-Exception section (e.g. part: 740, section: "740.17").
7. Fill out the classification memo template (also fetchable via get_skill_bundle or the exchek://skills/exchek-classify/templates/Classification%20Report.md resource).
8. Return the completed memo to the user for review and approval.

CUI and Classified information

Every SKILL.md begins with a CUI/Classified gate that asks the user upfront whether the information involves Controlled Unclassified Information (CUI), § 126.18 ITAR technical data, or classified material. The gate does not auto-refuse: for CUI or ITAR it proceeds only if the user explicitly confirms a compliant secure enclave or on-prem setup (accredited boundary, no training/retention/logging, controlled content kept in-boundary); for classified it proceeds only on an accredited classified system, otherwise it stops. Controlled content is never sent to the public ExChek API, and this MCP server enforces the same gate as the local plugin — because the gate lives in the SKILL.md content itself, any compliant client running the flow will see and apply it.

Caching and freshness

Skill content is mirrored from exchekinc/exchekskills with a 6h edge cache. eCFR data has a 1h edge cache. A daily Worker cron warms the eCFR cache so the first request after midnight UTC is already hot. Push to the skills repo → cache expires within 6h → all MCP clients see the new content automatically.

What this MCP does not do (yet)

• No server-side LLM execution. The MCP serves content and data; your client’s LLM does the reasoning. We’re intentionally Tier 1 — fast, free, zero session state.
• No CSL search. Trade.gov’s Consolidated Screening List API requires a free per-user key. Get one at developer.trade.gov and call the CSL endpoints directly; see the CSL skill for the call pattern.
• No DOCX rendering. The local plugin includes a Node-based markdown→docx converter. Over MCP you get markdown — or, for Enterprise customers, the branded PDF memorandum via create_classification_pdf (see above).
• No persistent state. The MCP doesn’t remember past determinations. If you need that, install the local plugin (audit log + state files) or wire up your own storage.