Law Enforcement Intelligence MCP Server

> View on ApifyForge | Use on Apify Store

---

Quick Start

Add to your MCP client (Claude Desktop, Cursor, Windsurf):

{
  "mcpServers": {
    "law-enforcement-intelligence-mcp": {
      "url": "https://ryanclinton--law-enforcement-intelligence-mcp.apify.actor/mcp"
    }
  }
}

---

Law enforcement intelligence screening for AI agents — query Interpol, FBI, OFAC, and OpenSanctions in a single MCP tool call. This server connects Claude Desktop, Cursor, Windsurf, and any MCP-compatible client to 7 live government and public databases, delivering threat scores, identity clearance verdicts, sanctions cross-references, and threat network graphs with no subscriptions beyond Apify.

Compliance teams spend hours manually checking names across Interpol Red Notices, the FBI Most Wanted list, the OFAC SDN list, and OpenSanctions. This MCP server automates the entire pipeline: all 7 sources are queried in parallel, a Levenshtein-based fuzzy matching algorithm reconciles name variants across databases, and results are returned as structured JSON your AI agent can reason over directly.

What data can you extract?

| Data Point | Source | Example |
|------------|--------|---------|
| 📋 International arrest warrants | Interpol Red Notices | Warrant ID, charges, requesting country, physical description |
| 👤 US federal wanted persons | FBI Most Wanted | Name, caution text, subjects, field office, image URL |
| 🚫 US Treasury SDN entries | OFAC SDN List | Entity name, program (e.g. UKRAINE-EO13685), aliases, country |
| 🌐 Multi-jurisdiction watchlist entries | OpenSanctions | 40+ consolidated lists, PEP registries, topics, datasets |
| 🔴 Crime records by category | UK Police API | Category, street, month, outcome status |
| 📍 Crime hotspot coordinates | UK Police API | Latitude, longitude, incident count, dominant category |
| 📰 OSINT context articles | Wikipedia | Article title, excerpt, URL for entity enrichment |
| 🗺️ Geocoded location data | Nominatim (OpenStreetMap) | Coordinates, place type, display name |
| ⚠️ Clearance verdict | Computed | CLEAR / FLAGGED / WATCHLISTED / BLOCKED |
| 🎯 Composite threat score | Computed | 0-100 score across four weighted dimensions |
| 🕸️ Threat network graph | Computed | Typed nodes and edges with confidence scores and evidence |
| 📑 Structured threat brief | Computed | Executive summary, findings, recommendations, caveats |

Why use Law Enforcement Intelligence MCP Server?

Manually screening one name takes 15-30 minutes: open Interpol's Notice search, run the FBI wanted portal, export from the OFAC SDN list, check OpenSanctions, reconcile spelling variants, document your findings. For a batch of 20 counterparties before a deal close, that is a full working day — and still leaves gaps when a name appears in one database but not another.

This MCP server automates the entire process and brings it into your AI workflow. Your agent calls one tool, all 7 sources are queried simultaneously, and fuzzy name matching identifies the same entity under variant spellings across databases.

- AI-native integration — runs inside Claude Desktop, Cursor, Windsurf, or any MCP client without API wrappers
- Parallel execution — up to 7 actor calls run simultaneously, not sequentially
- Fuzzy name matching — Jaccard token overlap plus substring containment catches transliterated names and aliases
- Configurable thresholds — set fuzzy match sensitivity from 0.1 (broad) to 1.0 (exact) per request
- Structured JSON output — every response is machine-readable and ready for downstream reasoning or CRM logging
- Spending limits — per-event pricing with hard stop when your budget is reached

Features

- Threat network graph building — constructs a directed graph of nodes (suspects, warrants, crimes, sanctions, locations, articles) and edges (wanted_for, sanctioned_as, crime_at, located_in, described_in, associated_with) from up to 7 parallel sources
- Levenshtein-based fuzzy matching — Jaccard token overlap scoring combined with substring containment bonus (0.3); configurable threshold from 0.1 to 1.0
- Cross-database sanctions reconciliation — matches OFAC SDN entries against OpenSanctions; entities appearing in both with high fuzzy scores are flagged as very likely true positives
- 4-factor threat scoring model — wanted status (0-25), sanctions presence (0-25), crime proximity (0-25), and information density (0-25) for a maximum composite of 100
- 5-tier clearance classification — CLEAR, FLAGGED, WATCHLISTED, BLOCKED with machine-readable recommendation text and match type (exact/fuzzy/partial)
- 5-level threat categorization — LOW, GUARDED, ELEVATED, HIGH, CRITICAL mapped to score ranges
- Composite geographic risk scoring — UK crime density (30%), OFAC sanctions hits (40%), and Interpol/FBI wanted presence (30%) producing a composite score from MINIMAL to CRITICAL
- Crime hotspot detection — aggregates street-level crime records into a top-10 hotspot heatmap by coordinate cluster with dominant category per cluster
- Automatic geocoding — Nominatim resolves location names to coordinates before crime queries when coordinates are not provided
- Structured threat brief generation — executive summary, per-category findings with CRITICAL/HIGH/MEDIUM/LOW/INFO severity, network statistics, prioritized recommendations, and 5 standard legal caveats
- Full standby mode operation — persistent MCP endpoint, no cold-start latency on tool calls
- 8 registered MCP tools across entity screening, geographic analysis, and intelligence reporting

Use cases for law enforcement intelligence screening

KYC and AML compliance screening

Compliance teams at fintechs, banks, and trading firms screen customers and counterparties against sanctions and wanted persons databases before onboarding. The verify_identity_clearance tool checks all four databases in a single call and returns a categorical verdict — CLEAR, FLAGGED, WATCHLISTED, or BLOCKED — with match details and a plain-language recommendation. Configurable fuzzy thresholds let you tune sensitivity to your risk tolerance.

Corporate due diligence and vendor screening

Deal teams and procurement functions verify directors, beneficial owners, and vendors as part of M&A due diligence or supplier qualification. The score_threat_level tool produces a 0-100 composite score with a dimensional breakdown, making it easy to rank a list of entities by risk, prioritize manual review, and document findings in a compliance file.

Travel risk and site security assessment

Corporate security teams and duty-of-care platforms assess destination risk before executive travel or facility deployment. The assess_geographic_risk tool geocodes the target location, pulls UK crime density data, and cross-references local sanctions and wanted person presence to produce a composite risk score (MINIMAL to CRITICAL) with a human-readable factors list.

AI agent investigation workflows

Security researchers and analysts building AI investigation pipelines use map_threat_intelligence to construct a threat network graph for any entity. The graph — with typed nodes, weighted edges, and confidence scores — can be passed to an LLM for reasoning, exported to a graph database, or used as the foundation for further automated investigation steps.

Formal compliance documentation

Risk officers generating investigation records for regulatory audit use generate_threat_brief to produce a structured document with an executive summary, per-category findings, network statistics, data source attribution, actionable recommendations, and built-in legal caveats. The output maps directly to standard EDD documentation formats.

Area crime pattern analysis

Security consultants and real estate analysts assessing England and Wales locations use analyze_crime_patterns to retrieve street-level crime data, aggregate it by category and month, score crime density, and identify the top-10 hotspot coordinates. The temporal breakdown reveals seasonal trends and the outcome statistics show prosecution rates.

How to use law enforcement intelligence tools in your AI agent

1. Connect the MCP server — Add the endpoint URL to your MCP client config (see code examples below). Your Apify token is the only credential needed.
2. Select your tool — Use verify_identity_clearance for a quick watchlist check, score_threat_level for a risk score, map_threat_intelligence for a full network graph, or generate_threat_brief for a formal report.
3. Provide the entity name or location — Enter the person or organization name you want to screen, or a location for geographic risk. Adjust optional source toggles and the fuzzy threshold if needed.
4. Read the structured result — Each tool returns JSON with a clearance level or threat score, matched records from each source, and a recommendation the AI agent can reason over directly.

Input parameters

Tool summary

| Tool | Price | Best for |
|------|-------|----------|
| map_threat_intelligence | $0.075 | Full network graph across all 7 sources |
| search_wanted_persons | $0.075 | Interpol + FBI lookup for a specific name |
| cross_reference_sanctions | $0.075 | OFAC vs. OpenSanctions fuzzy cross-match |
| analyze_crime_patterns | $0.075 | UK crime data aggregation and hotspot detection |
| assess_geographic_risk | $0.075 | Composite risk score for a location |
| verify_identity_clearance | $0.075 | Clearance verdict: CLEAR/FLAGGED/WATCHLISTED/BLOCKED |
| score_threat_level | $0.075 | 0-100 threat score across four weighted dimensions |
| generate_threat_brief | $0.075 | Full structured intelligence report |

Key parameters across all tools

| Parameter | Tool(s) | Type | Default | Description |
|-----------|---------|------|---------|-------------|
| query / entity | all | string | required | Person, organization, or topic to investigate |
| fuzzy_threshold | verify_identity_clearance | number | 0.6 | Match sensitivity: 0.1=broad, 1.0=exact |
| search_interpol | map_threat_intelligence, search_wanted_persons | boolean | true | Include Interpol Red Notices |
| search_fbi | map_threat_intelligence, search_wanted_persons | boolean | true | Include FBI Most Wanted |
| search_ofac | multiple | boolean | true | Include OFAC SDN list |
| search_open_sanctions | multiple | boolean | true | Include OpenSanctions |
| search_uk_crime | map_threat_intelligence | boolean | false | Include UK Police crime data |
| location | analyze_crime_patterns, assess_geographic_risk, generate_threat_brief | string | — | Place name for geographic queries |
| latitude / longitude | multiple | number | — | Coordinates for precise geographic queries |
| max_results | all | number | 25 | Max results per source (1-100, or 1-500 for crime analysis) |

Input tips

- Prefer full legal names — fuzzy matching catches variants, but a full name outperforms initials for reducing false positives.
- Lower the threshold for transliterated names — names from Arabic, Cyrillic, or Chinese may have multiple romanizations; use fuzzy_threshold 0.4-0.5.
- Disable unused sources — if you only need sanctions screening, set search_interpol: false and search_fbi: false to cut cost and latency.
- UK crime data requires UK coordinates — enable search_uk_crime only for England and Wales subjects; it will fail silently for other jurisdictions.

Output example

{
  "clearance": {
    "entity": "Viktor Petrov",
    "checkedAt": "2025-11-14T09:22:31.007Z",
    "clearanceLevel": "BLOCKED",
    "watchlistHits": [
      {
        "source": "interpol",
        "matchType": "exact",
        "matchScore": 97,
        "details": "Viktor Petrov — Money laundering, fraud, theft of public funds across 3 jurisdictions"
      }
    ],
    "sanctionHits": [
      {
        "source": "ofac",
        "program": "UKRAINE-EO13685",
        "matchScore": 94,
        "details": "Viktor Petrov — Designated for activities destabilizing Ukraine's sovereignty"
      },
      {
        "source": "openSanctions",
        "program": "EU Financial Sanctions",
        "matchScore": 89,
        "details": "Viktor Petrov — EU Council Regulation (EU) 269/2014 designation"
      }
    ],
    "totalHits": 3,
    "recommendation": "EXACT MATCH FOUND. Entity 'Viktor Petrov' has high-confidence matches across watchlists/sanctions. Do NOT proceed without legal review and enhanced due diligence."
  }
}

score_threat_level — HIGH result:

{
  "threatScore": {
    "entity": "Meridian Capital Holdings",
    "overallScore": 62,
    "threatLevel": "HIGH",
    "factors": {
      "wantedScore": 0,
      "sanctionsScore": 22,
      "crimeProximity": 0,
      "informationDensity": 40
    },
    "breakdown": ["4 OFAC sanctions match(es)", "2 OpenSanctions match(es)", "3 Wikipedia article(s) found"],
    "dataSources": ["ofac", "openSanctions", "wikipedia"],
    "confidence": 0.6
  }
}

assess_geographic_risk — MEDIUM result:

{
  "assessment": {
    "location": "Beirut, Lebanon",
    "latitude": 33.8886,
    "longitude": 35.4955,
    "crimeScore": 0,
    "sanctionsScore": 45,
    "wantedScore": 30,
    "compositeRisk": 27,
    "riskLevel": "MEDIUM",
    "factors": [
      "3 OFAC sanctions matches for area",
      "3 Interpol notices linked to area"
    ]
  }
}

Output fields

| Field | Type | Description |
|-------|------|-------------|
| clearance.clearanceLevel | string | CLEAR, FLAGGED, WATCHLISTED, or BLOCKED |
| clearance.watchlistHits[].matchType | string | exact (≥95%), fuzzy (≥75%), or partial |
| clearance.watchlistHits[].matchScore | number | 0-100 fuzzy name similarity score |
| clearance.recommendation | string | Plain-language compliance recommendation |
| threatScore.overallScore | number | Composite 0-100 threat score |
| threatScore.threatLevel | string | LOW, GUARDED, ELEVATED, HIGH, or CRITICAL |
| threatScore.factors.wantedScore | number | Wanted status component 0-25 |
| threatScore.factors.sanctionsScore | number | Sanctions presence component 0-25 |
| threatScore.factors.crimeProximity | number | Geographic crime component 0-25 |
| threatScore.factors.informationDensity | number | Information volume component 0-25 |
| threatScore.confidence | number | 0-1 confidence based on data availability |
| assessment.compositeRisk | number | Weighted geographic risk score 0-100 |
| assessment.riskLevel | string | MINIMAL, LOW, MEDIUM, HIGH, or CRITICAL |
| analysis.byCategory | object | Crime count keyed by category |
| analysis.hotspots[].count | number | Crime incidents in coordinate cluster |
| network.nodes[].type | string | suspect, warrant, crime, sanction, location, or article |
| network.edges[].type | string | wanted_for, sanctioned_as, crime_at, located_in, described_in, associated_with |
| network.edges[].weight | number | 0-1 edge strength (fuzzy match score for cross-source edges) |
| brief.threatLevel | string | Overall brief threat assessment |
| brief.findings[].severity | string | CRITICAL, HIGH, MEDIUM, LOW, or INFO |
| brief.recommendations | array | Actionable compliance recommendations |
| brief.caveats | array | Standard legal and data limitation caveats |

How much does it cost to run law enforcement intelligence checks?

This MCP server uses pay-per-event pricing — each tool call costs $0.075. Platform compute costs are included.

| Scenario | Tool calls | Cost per call | Total cost |
|----------|------------|---------------|------------|
| Quick test — single clearance check | 1 | $0.075 | $0.075 |
| Small batch — 10 entity screens | 10 | $0.075 | $0.75 |
| Due diligence — 50 counterparties | 50 | $0.075 | $3.75 |
| Continuous monitoring — 200 entities | 200 | $0.075 | $15.00 |
| Enterprise screening — 1,000 entities | 1,000 | $0.075 | $75.00 |

You can set a maximum spending limit per run to control costs. The server stops charging when your budget is reached.

Compare this to Refinitiv World-Check at $500-2,000/month or ComplyAdvantage at $600+/month — with this MCP server, most compliance teams spend $5-20/month with no subscription commitment. Apify's free tier includes $5 of monthly credits, enough for approximately 66 identity clearance checks.

Law enforcement intelligence screening using the API

Python

import httpx
import json
APIFY_TOKEN = "YOUR_APIFY_TOKEN"

MCP_URL = "https://law-enforcement-intelligence-mcp.apify.actor/mcp"
payload = {

    "jsonrpc": "2.0",

    "method": "tools/call",

    "params": {

        "name": "verify_identity_clearance",

        "arguments": {

            "entity": "Viktor Petrov",

            "fuzzy_threshold": 0.65,

            "max_results": 20

        }

    },

    "id": 1

}
response = httpx.post(MCP_URL, json=payload, headers={"Authorization": f"Bearer {APIFY_TOKEN}"})

result = response.json()

clearance = json.loads(result["result"]["content"][0]["text"])

print(f"Clearance level: {clearance['clearance']['clearanceLevel']}")

print(f"Total hits: {clearance['clearance']['totalHits']}")

print(f"Recommendation: {clearance['clearance']['recommendation']}")

JavaScript

const APIFY_TOKEN = "YOUR_APIFY_TOKEN";
const MCP_URL = "https://law-enforcement-intelligence-mcp.apify.actor/mcp";
const response = await fetch(MCP_URL, {

  method: "POST",

  headers: {

    "Content-Type": "application/json",

    "Authorization": Bearer ${APIFY_TOKEN}

  },

  body: JSON.stringify({

    jsonrpc: "2.0",

    method: "tools/call",

    params: {

      name: "score_threat_level",

      arguments: {

        entity: "Meridian Capital Holdings",

        include_wikipedia: true,

        max_results: 15

      }

    },

    id: 1

  })

});
const data = await response.json();

const score = JSON.parse(data.result.content[0].text);

console.log(Threat level: ${score.threatScore.threatLevel} (${score.threatScore.overallScore}/100));

console.log(Sanctions score: ${score.threatScore.factors.sanctionsScore}/25);

cURL

```bash