# @arcnautical/mcp

MCP server for the ArcNautical API: screen any vessel by IMO for sanctions, ownership opacity and vetting grade from Claude, ChatGPT, Cursor or any MCP client. The check needs no API key. Local (stdio) or remote at https://mcp.arcnautical.com/mcp.

- **Type:** MCP server
- **Trust:** 60/100 (B), scored on the package rubric
- **Verification:** community-indexed — nobody has claimed this listing
- **Version:** 0.2.0
- **Author:** ArcNautical
- **License:** MIT
- **npm:** @arcnautical/mcp
- **Endpoints:** streamable-http https://mcp.arcnautical.com/mcp
- **Source:** https://github.com/arcnautical/arcnautical-mcp
- **Endpoint health:** reachable (last checked 2026-09-19T10:53:34.754Z, 1 sample) — uptime is not a security property and is not part of the trust score
- **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport)

## Trust

60/100 (B), scored on the package rubric
- Publisher verified: no
- Install scripts: nothing suspicious found
- Prompt-injection scan: not run
- Obfuscation scan: not run
- Evidence age: 4 days

## Security scan

- **Status:** clean
- **Scanned:** 2026-09-19T14:22:24.421Z
- **Version scanned:** 0.2.0
- **CVEs:** none found by OSV at scan time
**Findings**
- injection-shaped content (note) in description: Links to undeclared domain: mcp.arcnautical.com

## Tools

7 declared. Statically extracted from the shipped source — a floor on the surface, not a census.
- `check_vessel` — Screen one vessel by IMO number against OFAC SDN, EU, UN, UK OFSI and OpenSanctions, with an ownership-opacity score
- `find_port` — Resolve a port name, country or partial UN/LOCODE to the LOCODEs the routing engine knows. Routes are addressed by
- `screen_vessel` — The authenticated screening record for one vessel: every sanctions match with its source list, programme and
- `screen_vessels` — Batch-screen a list of IMO numbers and wait for the results (up to two minutes). Returns one verdict per hull plus the
- `get_screening` — Fetch a stored screening record by id — the audit copy, retained ten years. Needs ARCNAUTICAL_API_KEY.
- `score_voyage` — Route risk between two ports (UN/LOCODEs): a 0–100 score, risk level, the signals driving it (war-risk areas, piracy,
- `get_usage` — Live and test usage, remaining allowance, reset time, batch limits and monitor capacity for the configured key.

## Install

**Verdict: review** — Installable, but 1 thing to check first: No publisher has proved control of this listing; it is indexed, not vouched for.
**Cautions** (coverage gaps and advisories — never blocking)
- No publisher has proved control of this listing; it is indexed, not vouched for.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"mcp\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"@arcnautical/mcp\"\n      ],\n      \"env\": {\n        \"ARCNAUTICAL_API_KEY\": \"<YOUR_ARCNAUTICAL_API_KEY>\"\n      }\n    }\n  }\n}"
```
**Credentials it will ask for** (names only — Forge never holds a value):
- `ARCNAUTICAL_API_KEY` — Arcnautical API Key (optional)
Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each <YOUR_NAME> in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one.
- This entry needs 1 credential (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset.

## Blast radius

Moderate blast radius — runs locally and hosted; holds an api key.
- Floor 27, ceiling 27 (tier: moderate)
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/%40arcnautical%2Fmcp
- Install plan: https://forgeregistry.com/api/v1/packages/%40arcnautical%2Fmcp/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/%40arcnautical%2Fmcp
- HTML page: https://forgeregistry.com/registry/%40arcnautical%2Fmcp
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.