@fonteum/mcp

Free, dated, source-traced US public records + global sanctions over MCP. Every fact links to its government source with the date Fonteum captured it; signed and re-checkable. Spans US healthcare providers, federal contractors, global sanctions parties (OFAC / EU / UK), and SEC / corporate filers — bitemporal history, public records only (no PHI, no risk scores or labels).

It exposes seven read-only tools over stdio. Every tool calls the public Fonteum REST API and returns records that carry the full 14-tuple provenance contract — source, source URL, dataset id, capture/snapshot date, methodology version, last-checked timestamp, confidence, data-availability, pipeline version, DOI, license, coverage window, and the signed build-attestation URL — plus a signed, re-checkable attestation with a /verify link.

What it does

This server is the grounding layer for any US-public-record or sanctions lookup. An LLM can resolve an entity (NPI → healthcare provider; UEI / CAGE → federal contractor) to its canonical record, search records by attribute, check one name against US exclusion & debarment lists (OIG LEIE, SAM.gov, state Medicaid, OIG CIA, CMS penalties) and the global sanctions lists (OFAC, EU, UK), pull a record as of a captured date (the bitemporal differentiator), and re-check the signed fingerprint against the live source — with every returned field tied back to its upstream government source, capture date, and license. Public records only — no PHI. No trust badges, no opaque scores, no verdicts — radical source transparency. Signatures attest fidelity-to-source (the value matches what the source published on the captured date), never truth.

Status

Source-available in this repository today. npm publish is targeted for a manual operator release. The REST API the server calls is live and works with the read-only demo key pk_dx_sample (no signup).

Install

The server runs out of the box with the bundled demo key. Add it to your MCP client config:

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "fonteum": {
      "command": "npx",
      "args": ["-y", "@fonteum/mcp"],
      "env": { "FONTEUM_API_KEY": "pk_dx_sample" }
    }
  }
}

Restart Claude Desktop, then ask: Resolve NPI 1234567893 with Fonteum.

Claude Code

claude mcp add fonteum -- npx -y @fonteum/mcp

Or add to .mcp.json in your project:

{
  "mcpServers": {
    "fonteum": { "command": "npx", "args": ["-y", "@fonteum/mcp"] }
  }
}

Cursor

Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project):

{
  "mcpServers": {
    "fonteum": { "command": "npx", "args": ["-y", "@fonteum/mcp"] }
  }
}

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "fonteum": { "command": "npx", "args": ["-y", "@fonteum/mcp"] }
  }
}

Tools

Each tool returns a JSON envelope { "data": ..., "provenance": { …14 keys… } }.

fonteum_resolve_entity

The grounding tool. Resolve the canonical entity for an identifier and trace every fact to its government source + capture date. NPI → healthcare provider (NPPES record + exclusion/integrity screen); UEI / CAGE → federal contractor (SAM.gov registration, exclusions, awards, ownership). Exact facts only.

| Param | Type | Required | Notes | | --------- | ------ | -------- | -------------------------------------------- | | id | string | yes | 10-digit NPI, 12-char GSA UEI, or 5-char CAGE | | id_type | enum | no | npi | uei | cage (omit to auto-detect) |

Example: { "id": "1234567893" }

fonteum_search_records

Search records by attribute (US healthcare providers by vertical/state/name/ specialty) with source-provenance on every hit.

| Param | Type | Required | Notes | | ----------- | ------ | -------- | ---------------------------------- | | query | string | yes | name, specialty, vertical, or location | | specialty | string | no | Taxonomy/specialty filter | | state | string | no | 2-letter US state filter | | limit | int | no | 1–25 (default 10) |

Example: { "query": "dermatology", "state": "TX", "limit": 5 }

fonteum_check_exclusions_and_sanctions

Check one NPI / name against US exclusion & debarment lists (OIG LEIE + SAM.gov

• state Medicaid + OIG CIA + CMS penalties) and the global sanctions lists (OFAC SDN + Consolidated, EU, UK), each hit linked to its issuing authority + capture date. Exclusion & sanction-list monitoring for billing, program- integrity, and export-control compliance — aggregate facts only, no risk score, no verdict.

| Param | Type | Required | Notes | | ------ | ------ | -------- | -------------------------------------------- | | npi | string | no | 10-digit NPI (exclusion lists) | | name | string | no | Party name (OFAC/EU/UK sanctions lists) |

Example: { "npi": "1234567893" } or { "name": "Acme Trading Co" }

fonteum_get_record_as_of

The bitemporal differentiator. Return a federal contractor's record exactly as it stood on a captured date — for eligibility-at-award-date / FCA-defense.

| Param | Type | Required | Notes | | ------- | ------ | -------- | ------------------------------------ | | uei | string | no | 12-char GSA UEI (provide uei or cage) | | cage | string | no | 5-char CAGE code | | as_of | string | yes | Captured date, YYYY-MM-DD |

Example: { "uei": "ABC123DEF456", "as_of": "2025-01-01" }

fonteum_recheck

Return the signed fingerprint + live source link to independently re-check a fact. With a snapshot id: the signed content hash + source archive URL + /verify/{id}. Without one: the live Ed25519 attestation-chain head.

| Param | Type | Required | Notes | | ------------- | ---- | -------- | -------------------------------------- | | snapshot_id | int | no | Snapshot to deep-re-check; omit for the chain head |

Example: { "snapshot_id": 1042 } or {}

fonteum_list_sources

List every government source Fonteum ingests across all verticals — healthcare, federal procurement, global sanctions, and corporate/securities registries — each with authority, vertical, cadence, and official URL.

No parameters. Example: {}

fonteum_dataset_info

Read the published methodology + metadata: methodology version, the 14-tuple provenance contract spec, and the full multi-vertical source catalog.

| Param | Type | Required | Notes | | --------- | ------ | -------- | ---------------------------------------------- | | dataset | string | no | Optional slug, e.g. nppes | oig-leie | ofac-sdn |

Example: {} or { "dataset": "ofac-sdn" }

Authentication

| Variable | Default | Notes | | ------------------ | ---------------------------- | ------------------------------------ | | FONTEUM_API_KEY | pk_dx_sample | Read-only demo key, 100 req/hour/IP. | | FONTEUM_API_BASE | https://api.fonteum.com/v1 | Override for self-hosted / staging. |

pk_dx_sample is the free demo key — no signup, so npx @fonteum/mcp works immediately. For production rate limits, custom datasets, or signed enterprise terms, request a paid key at [email protected]. Set it via the env block in your MCP client config ("FONTEUM_API_KEY": "pk_live_…").

14-tuple provenance contract

Every tool response is funnelled through withProvenance() so the envelope always carries all 14 keys:

_source            _source_url         _dataset_id            _snapshot
_methodology       _last_checked       _confidence            _data_availability
_pipeline_version  _doi                _license               _coverage_period_start
_coverage_period_end                   _slsa_provenance_url

Field naming matches the Fonteum audit-pack endpoint, so tooling that already consumes the REST API reads MCP responses without translation. The contract is additive-only — keys are never stripped.

Build from source

cd packages/mcp
npm install
npm run build          # tsc -> dist/
npm test               # builds, then runs the vitest suite
npm run publish:dry-run

Registry manifests

Submission manifests for the major MCP registries live in registry/: the official MCP registry, Smithery, PulseMCP, mcp.so, and the Docker MCP Catalog. See registry/SUBMISSION_NOTES.md and the operator runbook at docs/mcp-registry-submission.md.

License

MIT. Federal source data is US-Government-Works; Fonteum composite terms apply to joined records (see the _license field on each response).

Contact

[email protected] · fonteum.com