@fonteum/mcp

Fonteum is a multi-vertical US public-records service for global corporate registers, government enforcement actions, and named sanctions and watchlist sources. 111 active production source-registry rows were observed July 12, 2026. Active status does not establish loaded, fresh, or complete coverage.

@fonteum/mcp exposes seven read-only tools over stdio. The tools resolve and search records, check NPI exclusions and name-based sanctions sources, inspect available federal-contractor history, inspect snapshot attestations, and return current source and methodology metadata. Source, capture-date, licensing, availability, and provenance fields are nullable and vary by source and result. Snapshot signatures do not create deterministic fact-to-signature links. The service does not produce consumer reports, risk scores, or PHI.

Status

The source tree targets version 0.4.0, while npm currently serves 0.3.0. Version 0.4.0 is not yet published. Publication is a separate manual operator step; do not assume the current npm package supports the schemas or route contracts documented below.

Future 0.4.0 install (after publication)

The following examples are pinned to the future 0.4.0 contract so they fail clearly until that version is published instead of silently installing the older live package. After publication, the bundled demo key will work without signup.

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "fonteum": {
      "command": "npx",
      "args": ["-y", "@fonteum/[email protected]"],
      "env": { "FONTEUM_API_KEY": "fnt_DEMO_PUBLIC_V1" }
    }
  }
}

Claude Code

claude mcp add fonteum -- npx -y @fonteum/[email protected]

Cursor or Windsurf

Use the same stdio configuration in your client’s MCP configuration file:

{
  "mcpServers": {
    "fonteum": { "command": "npx", "args": ["-y", "@fonteum/[email protected]"] }
  }
}

Authentication

The package defaults to the read-only sample key fnt_DEMO_PUBLIC_V1 (20 requests/minute and 100 requests/day per trusted source IP), so it works without signup after version 0.4.0 is published. Set FONTEUM_API_KEY to an issued Fonteum API key for configured limits. The client sends either key as Authorization: Bearer <key>.

This Bearer credential is for the package's downstream REST requests. The hosted MCP endpoint itself permits anonymous, rate-limited access; if Fonteum separately issues a hosted transport key, that key is sent as x-fonteum-mcp-key. Do not substitute a custom REST credential header.

| Variable | Default | Notes | | --- | --- | --- | | FONTEUM_API_KEY | fnt_DEMO_PUBLIC_V1 | Read-only sample key; override with an issued account key. | | FONTEUM_API_BASE | https://fonteum.com/api | Override only for a compatible endpoint. |

For example:

{
  "mcpServers": {
    "fonteum": {
      "command": "npx",
      "args": ["-y", "@fonteum/[email protected]"],
      "env": { "FONTEUM_API_KEY": "fnt_YOUR_ISSUED_KEY" }
    }
  }
}

Tools

These are the seven live, read-only tools:

fonteum_resolve_entity

Resolve available public records for an NPI, UEI, or CAGE identifier. Returned source, capture-date, and provenance fields are nullable and vary by result; facts have no deterministic link to a signature.

| Param | Type | Required | Notes | | --- | --- | --- | --- | | id | string | yes | 10-digit NPI, 12-character UEI, or 5-character CAGE. | | id_type | enum | no | npi, uei, or cage; omit to detect the identifier type. |

fonteum_search_records

Search the available US healthcare record lookup by required vertical and state, with optional county context. This is not a global or complete record search, and source or observation metadata may be null.

| Param | Type | Required | Notes | | --- | --- | --- | --- | | vertical | string | yes | Healthcare vertical slug. | | state | string | yes | Two-letter US state code. | | county | string | no | County context filter. | | limit | int | no | 1–100; default 25. |

fonteum_check_exclusions_and_sanctions

Check an NPI against OIG LEIE, SAM.gov / GSA exclusions, 13 state Medicaid lists, OIG Corporate Integrity Agreements, and CMS Civil Money Penalties, or a name against the named OFAC, EU, and UK sanctions sources. Hits include an issuing authority and a source or capture date when stored; date fields may be null. A returned match is not a clearance or verdict. Negative exclusion determinations are fail-closed: stale or unreconciled OIG, SAM.gov, or state Medicaid coverage returns determination: "indeterminate" rather than a false negative.

| Param | Type | Required | Notes | | --- | --- | --- | --- | | npi | string | no | 10-digit NPI for exclusion and debarment sources. | | name | string | no | Party name for sanctions collections. |

fonteum_get_record_as_of

Return available federal-contractor records for a requested date. Retained history is currently limited to USASpending award rows; SAM.gov registration and exclusions, FAPIIS, and ownership fields may be current, absent, or nullable and are not universal replay.

| Param | Type | Required | Notes | | --- | --- | --- | --- | | uei | string | no | 12-character GSA UEI; provide uei or cage. | | cage | string | no | 5-character CAGE; provide uei or cage. | | as_of | string | yes | Captured date in YYYY-MM-DD form. |

fonteum_recheck

Inspect snapshot-attestation metadata and public verification endpoints. A signature covers only the identified snapshot object; it does not sign an individual fact or create a deterministic fact-to-signature link.

| Param | Type | Required | Notes | | --- | --- | --- | --- | | snapshot_id | int | no | Snapshot to re-check; omit for the current chain head. |

fonteum_list_sources

List Fonteum’s generated multi-vertical source catalog, including available issuer, domain, declared cadence, and official URL. Catalog presence does not establish loaded coverage.

No parameters.

fonteum_dataset_info

Return the current methodology, nullable fourteen-field provenance schema, and generated multi-vertical source catalog. Field population varies by result.

No parameters.

Response context

Responses define nullable source, capture-date, methodology, licensing, and availability fields. Include only values actually returned; do not infer a source date, DOI, hash, coverage window, signature, or /verify relationship when absent. Treat each source’s published scope and limitations as part of the returned record.

Build from source

cd packages/mcp
npm install
npm run build
npm test
npm run publish:dry-run

Registry manifests

Submission manifests for the official MCP registry, Smithery, PulseMCP, mcp.so, and the Docker MCP Catalog are in registry/.

License and review

MIT © Fonteum LLC. Reviewed by Dr. Jennifer Montecillo, MD for metadata and clinical terminology.

Contact

[email protected] · fonteum.com