# Distributed Risk

> Distributed Risk explains official US sanctions, travel and cyber actions for a decision, and arranges protection, investigations and crisis response through firms that work where you need them. A free, read-only MCP server at https://www.distributedrisk.com/mcp lets AI assistants read the desk's notes and search the official record: screening lists, OFAC recent actions, CISA KEV, SEC cyber incident filings and AI-stack advisories.

Experimental file. Every link is a normal page.

## Guides (one question each, dated)
- [CISA KEV and EPSS in your AI assistant](https://www.distributedrisk.com/guides/cisa-kev-and-epss-in-your-ai-assistant)
- [KEV vs EPSS](https://www.distributedrisk.com/guides/kev-vs-epss)
- [OFAC recent actions and sanctions screening in your AI assistant](https://www.distributedrisk.com/guides/ofac-recent-actions-and-screening-in-your-ai-assistant)
- [OFAC general licenses: what to check](https://www.distributedrisk.com/guides/ofac-general-license-what-to-check)
- [What a cyber underwriter checks when CISA adds a KEV listing](https://www.distributedrisk.com/guides/cyber-underwriting-checks-for-a-kev-listing)
- [Tracking SEC 8-K Item 1.05 cybersecurity incident disclosures](https://www.distributedrisk.com/guides/sec-8-k-item-1-05-cybersecurity-incident-disclosures)
- [Tracking vulnerabilities in LiteLLM, MCP servers and AI agent tools](https://www.distributedrisk.com/guides/vulnerabilities-in-ai-agent-software)
- [AI-agent software vulnerabilities on CISA KEV: quarterly count (Q3 2026)](https://www.distributedrisk.com/guides/ai-agent-software-on-cisa-kev-q3-2026)
- [Checking a crypto wallet or exchange for sanctions exposure](https://www.distributedrisk.com/guides/check-a-crypto-wallet-or-exchange-for-sanctions-exposure)
- [First 72 hours after ransomware: the OFAC payment question and who to call](https://www.distributedrisk.com/guides/first-72-hours-after-ransomware)
- [Hiring an executive protection firm for international travel: what to check](https://www.distributedrisk.com/guides/hiring-an-executive-protection-firm-for-international-travel)
- [Using a sanctions MCP server: how an AI assistant can check OFAC data](https://www.distributedrisk.com/guides/sanctions-mcp-server-for-an-ai-assistant)
- [How to screen a counterparty against OFAC lists, and what a match means](https://www.distributedrisk.com/guides/screen-a-counterparty-against-ofac-lists)
- [SEC 8-K Item 1.05 cybersecurity incident filings, October 2026](https://www.distributedrisk.com/guides/sec-8-k-item-1-05-filings-october-2026)

## The desk and the MCP server
- [Desk notes](https://www.distributedrisk.com/desk): numbered, dated notes; feed at https://www.distributedrisk.com/desk/feed.xml
- [AI access](https://www.distributedrisk.com/agents): tool list and setup for Claude Code and other clients
- [Method](https://www.distributedrisk.com/method)