
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
sanctionwise
Advanced tools
Verified UK sanctions screening for AI agents — official FCDO UK Sanctions List, not guesses.
Verified UK sanctions screening for AI agents — official FCDO UK Sanctions List, not guesses.
Verified, trustworthy data tools for AI agents. "Qiniso" means "truth" in Zulu.
Website · npm · MCP Registry
Ask an LLM "is this person on the UK sanctions list?" and it will answer from stale, fuzzy memory. Designations change constantly and are specific — that's data, not something to recall. sanctionwise screens a name against the official FCDO UK Sanctions List and returns possible matches with their real designation details, or a clean "no match".
{ "mcpServers": { "sanctionwise": { "command": "npx", "args": ["-y", "sanctionwise"] } } }
The official UK Sanctions List data is bundled in the package (works offline, out of the box). The tool also auto-refreshes from a weekly-updated GitHub Release on startup — cached locally, no key, no token, no manual step — so it stays current on its own. Every response reports the dataset's report date.
npm i sanctionwise
import { screenName, getSanctionsEntry } from "sanctionwise";
screenName("Vladimir Putin");
// { matchCount: 3, results: [{ id: "RUS0251", type: "Individual",
// primaryName: "Vladimir Vladimirovich PUTIN", matchType: "exact",
// regimes: ["The Russia (Sanctions) (EU Exit) Regulations 2019"], sanctions: "Asset freeze|…" }],
// disclaimer: "INDICATIVE NAME-MATCH SCREEN ONLY. …" }
screenName("Acme Quilting Supplies Ltd").matchCount; // 0 — no match (NOT a clearance)
getSanctionsEntry("RUS0251"); // full official entry for a Unique ID
Matching folds accents and is case/punctuation-insensitive, and screens primary names and aliases.
| Tool | What it does |
|---|---|
| screen_name | Screen a person/company/vessel name → ranked POSSIBLE matches with official designation details |
| get_sanctions_entry | Full official entry for a Unique ID (names, aliases, regime, statement of reasons, …) |
The data is the official FCDO UK Sanctions List (designated persons, entities and ships under the Sanctions and Anti-Money Laundering Act 2018), published under the Open Government Licence v3.0. scripts/build-data.mjs parses the official CSV into one record per target (all names/aliases grouped); the bundled build currently carries 6,200+ designated targets. A weekly GitHub Action (.github/workflows/refresh-data.yml) re-downloads the list and publishes it as a GitHub Release asset; the installed tool fetches that asset on startup (cached, offline-safe), so it self-updates with no npm token and no manual step. The bundled copy is the offline / first-run fallback.
This tool runs locally on your machine and is built not to collect, store, or transmit your data — no analytics, no telemetry, no account. Screening runs locally; on startup it may download the latest public UK Sanctions List from a GitHub Release, but the names you screen are never transmitted. Full policy: https://qinisolabs.github.io/privacy.html.
Apache-2.0 (code). Sanctions data © Crown copyright, FCDO, Open Government Licence v3.0; see NOTICE.
FAQs
Verified UK sanctions screening for AI agents — official FCDO UK Sanctions List, not guesses.
The npm package sanctionwise receives a total of 18 weekly downloads. As such, sanctionwise popularity was classified as not popular.
We found that sanctionwise demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.