Example agent workflows: screening flows with MCP tools

The CompliAPI MCP tools are designed to be chained together so agents can run multi-step compliance checks as part of a larger workflow. The examples below show three common patterns. Every result is the same JSON envelope the REST API returns, delivered as the tool result's structured content.

Screen a withdrawal address

When a user initiates a withdrawal, an agent can check the destination address before processing it:

Before I process this withdrawal, check 0x098B716B8Aaf21512996dC57EB0615e2383E2f96 against the sanctions lists.

The agent calls screen_crypto_address with { "address": "0x098B716B8Aaf21512996dC57EB0615e2383E2f96" }. A result with sanctioned: true means a government sanctions list matched — the agent should block the withdrawal and can cite the source_url from the match as its authoritative reference. A result with flagged: false and sanctioned: false means no match was found on any enabled list.

Vet a new signup

When a user signs up, an agent can chain three tools to build a fuller picture of the account:

1. Call screen_email with the user's email address to check it directly against sanctions lists.
2. Call detect_vpn with the user's IP to check whether they are masking their location.
3. Call geolocate_ip with the same IP to resolve their country and check whether it carries a sanctions designation.

A clean email combined with sanctioned: true and country: "RU" from geolocate_ip tells the agent that the identity itself is unlisted but the account warrants enhanced review based on location — even if the email check passed.

Narrow a screen to specific lists

If you only need to check against a subset of lists, pass the lists argument:

{ "address": "vitalik.eth", "lists": "ofac,eu_fsf" }

The ENS name is resolved before screening, lists_checked in the response comes back as ["ofac", "eu_fsf"], and matches from any other list are excluded. List slugs come from the source list registry — if the agent passes an unknown slug, it receives a tool error it can read and correct.

Interpreting flagged without sanctioned

Some hits set flagged: true but leave sanctioned: false. A Tornado Cash association hit, for example, has list_type: "risk" — it signals exposure or risk, not a government designation. The right response to a risk-only hit is a business decision, not a legal one. Define your own policy for these cases — for example, treating risk-list hits as requiring manual review rather than automatic blocking — and prompt your agent with that policy so it applies it consistently.