Supply Chain Risk Intelligence MCP Server

All-in-one supply chain risk analysis for AI agents. Integrates OFAC sanctions screening, EPA environmental compliance, OSHA safety violations, FMCSA carrier safety, and USGS mineral supply risk data into a single MCP API.

Free US government data sources. $0.30 per analysis call.

Features

7 MCP Tools

1. vendor_risk_score — Comprehensive vendor risk (0-100)

   • Weights: Sanctions (45%), Environmental (27.5%), Safety (27.5%)
   • Instant "APPROVED" / "MONITOR" / "REVIEW_REQUIRED" / "BLOCKED" recommendation

2. sanctions_check — OFAC SDN screening

   • Detects sanctioned entities and countries
   • Match scoring for close name matches
   • Returns specific sanctions programs and entities

3. environmental_compliance — EPA ECHO violations

   • Inspection count, violation count, penalty totals
   • Facility-level breakdown
   • Compliance status: COMPLIANT / AT_RISK / NON_COMPLIANT

4. safety_violations — OSHA safety records

   • Serious, willful, and routine violations
   • Penalty assessment
   • Safety rating: GOOD / FAIR / AT_RISK / POOR / CRITICAL

5. mineral_supply_risk — USGS mineral supply analysis

   • Supply risk (producer concentration)
   • Geopolitical risk (country stability)
   • Conflict mineral detection
   • Strategic recommendations

6. supply_chain_audit — Batch vendor audit

   • Audit up to 100 vendors per call
   • Risk distribution summary
   • Sorted by risk score
   • Single call, parallel processing

7. regulatory_changes — Federal Register monitoring

   • Recent supply chain regulations (30 days default)
   • Critical item flags (embargo, sanctions, recall, etc.)
   • Agency tracking

Data Sources

All public domain, no authentication required:

• OFAC SDN List — treasury.gov
• EPA ECHO — echo.epa.gov
• OSHA Inspections — dol.gov API
• USGS Minerals — usgs.gov
• Federal Register — federalregister.gov

Installation

Prerequisites

• Node.js 18+
• Apify Account (free tier works)

Quick Start

npm install
npm start

With Apify CLI

$apify push --force

Usage

As MCP Server (Claude Desktop)

Add to ~/.claude/claude.json:

{
  "mcpServers": {
    "supply-chain-risk": {
      "command": "node",
      "args": ["/path/to/supply-chain-risk-mcp/src/main.js"]
    }
  }
}

REST API (via Apify)

curl -X POST https://api.apify.com/v2/acts/{ACTOR_ID}/call \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "toolName": "vendor_risk_score",
    "input": {
      "vendor_name": "Acme Manufacturing Inc"
    }
  }'

Direct Function Calls

import { vendorRiskScore } from './src/handlers/vendor_risk.js';

const result = await vendorRiskScore('Acme Manufacturing Inc');
console.log(result);
// {
//   overall_risk_score: 42,
//   risk_level: "MEDIUM",
//   recommendation: "MONITOR",
//   components: { sanctions: 0, environmental: 35, safety: 28 },
//   flags: ["Environmental non-compliance: 3 violations"]
// }

Response Format

Vendor Risk Score

{
  "vendor": "Acme Manufacturing Inc",
  "overall_risk_score": 42,
  "risk_level": "MEDIUM",
  "recommendation": "MONITOR",
  "components": {
    "sanctions": 0,
    "environmental": 35,
    "safety": 28
  },
  "details": {
    "sanctions": { "is_sanctioned": false, "sanctioned_entities": [] },
    "environmental": { "violations_count": 3, "compliance_status": "AT_RISK" },
    "safety": { "willful_violations": 0, "safety_rating": "FAIR" }
  },
  "flags": ["Environmental non-compliance: 3 violations"]
}

Mineral Supply Risk

{
  "mineral": "Cobalt",
  "found": true,
  "risk_level": "CRITICAL",
  "is_conflict_mineral": true,
  "primary_producers": [
    "Democratic Republic of Congo",
    "Russia",
    "Australia",
    "Zambia"
  ],
  "supply_risk_score": 85,
  "geopolitical_risk_score": 84,
  "overall_risk_score": 84,
  "recommendations": [
    "Establish strategic reserves or long-term supplier contracts",
    "Diversify supplier base across multiple countries",
    "Implement conflict-free sourcing certification"
  ]
}

Supply Chain Audit

{
  "total_vendors": 5,
  "audit_timestamp": "2025-03-27T12:00:00Z",
  "risk_distribution": {
    "CRITICAL": 0,
    "HIGH": 1,
    "MEDIUM": 2,
    "LOW": 2
  },
  "average_risk_score": 38,
  "vendors_requiring_action": 3,
  "detailed_results": [
    { "vendor": "Vendor A", "overall_risk_score": 62, ... },
    ...
  ]
}

Risk Scoring Logic

Overall Risk Formula

risk_score = (sanctions × 0.45) + (environmental × 0.275) + (safety × 0.275)

Risk Levels

Score	Level	Action
0-29	LOW	APPROVED — Continue business
30-59	MEDIUM	MONITOR — Watch for changes
60-79	HIGH	REVIEW_REQUIRED — Escalate decision
80-100	CRITICAL	BLOCKED — Do not engage

Performance

• Single vendor check: ~2-5 seconds (parallel API calls)
• Batch audit (10 vendors): ~5-8 seconds
• Batch audit (100 vendors): ~15-20 seconds
• Timeout per tool: 30 seconds
• Retry logic: 3 attempts with exponential backoff

Error Handling

• API failures → Graceful degradation (missing data section = null)
• Timeout → Partial results with available data
• Invalid input → Clear error messages
• Charging failures → Logged but non-blocking

Pricing

$0.30 per tool execution on Apify. Includes:

• All parallel API calls (OFAC, EPA, OSHA, USGS, Federal Register)
• Batch audit (up to 100 vendors = $0.30, not per vendor)
• Regulatory monitoring

Limitations

• Batch audit: max 100 vendors per call
• API response latency: depends on external government APIs (typically 2-5 sec)
• No historical trending (analyzes current state only)
• Mineral data: pre-loaded database (updated with releases)

Development

# Install dependencies
npm install

# Run locally
node src/main.js

# Test vendor risk
node -e "
import { vendorRiskScore } from './src/handlers/vendor_risk.js';
const r = await vendorRiskScore('Tesla Inc');
console.log(JSON.stringify(r, null, 2));
"

Roadmap

• Historical risk tracking (30/60/90-day trends)
• Custom risk weights (industry-specific)
• Real-time alerts for regulatory changes
• Supplier scorecard export (CSV/PDF)
• Integration with procurement platforms

License

MIT. Uses public domain US government data (OFAC, EPA, OSHA, USGS, Federal Register).

Support

For issues or feature requests, contact the Apify community or submit an issue.

---

Built with Apify SDK | MCP Protocol v1.0 | Last Updated: 2025-03-27