# VendorWatch Muse connector

From musedirectory.ai, the independent directory of Meta Muse connectors. Not affiliated with Meta.

## VendorWatch

Check vendor compliance, DPA coverage, subprocessors, certifications and data locations before you sign.

- Record: https://musedirectory.ai/connector/vendorwatch
- Category: Legal
- Developer: Sergio Maldo (https://vendor.watch/agents)
- Muse status: Extra setup. Not in Muse's Connectors list yet. Muse can still use it: its page gives you a request to paste into Muse.
- Health: Working, 781ms, checked 2026-10-29T12:00:54Z
- Endpoint: https://vendor.watch/api/v1/mcp
- Auth: Needs an access key; Pricing: unknown
- Screening: Screened, no issues found (2026-10-28T22:21:19Z)
- Source: Found in the official MCP Registry (io.github.sergiomaldo/vendorwatch) https://registry.modelcontextprotocol.io/v0/servers?search=io.github.sergiomaldo%2Fvendorwatch

Look up vendors in the VendorWatch catalogue to review their DPA coverage by law, subprocessor count, certifications, data locations, transfer safeguards and AI use policies. Helps teams evaluate vendor risk before signing contracts.

Example request: "Check if our new CRM vendor has DPA coverage and where they store our data."

How to connect: Not in Muse's Connectors list yet, but Muse can still use it. Paste this into Muse: "Use VendorWatch to help me. It is a free service with an MCP server at https://vendor.watch/api/v1/mcp. It needs an API key from Sergio Maldo; ask me to enter it through your secure credential prompt. Ask me before you share anything with it." Muse asks before it shares anything with the app's site. Meta does not review apps used this way, so only use ones you trust. We tested this in the Muse app on September 24, 2026: Muse used an app's link directly this way and returned a live answer.

Tools:
- find_vendor: Find a vendor in the VendorWatch catalogue by its exact name or website domain. Returns up to 5 candidates (slug, name, category). Free: no lookup is spent.
- get_vendor_profile: Get one vendor's documentation profile: DPA coverage by law, number of subprocessors, certifications, data locations, transfer safeguards and AI use. Give the slug from find_vendor, or the vendor's name or domain. Spends one lookup.
- list_vendor_changes_since: List the vendors in your VendorWatch portfolio whose record changed on or after a date (profile updated, DPA analysed, DPA document changed). Free: no lookup is spent. 50 vendors a page; read the new profile with get_vendor_profile.
- check_portfolio: Check a list of up to 25 vendors (names, domains or both) and get one profile each. Spends one lookup per vendor answered; a name that matches nothing costs nothing.

Screening checks:
- MCP handshake: pass (Answered in 536ms)
- Domain against threat feeds (Cloudflare security DNS): pass (vendor.watch not flagged)
- Published packages against the OSV malicious-package database: n/a (No npm or PyPI package published)
- Hidden instructions or invisible characters in tool text: pass (4 tools read, nothing found)
- Inputs asking for passwords, card numbers or seed phrases: pass (None found)
- Domain and redirects: pass (No redirects off the domain)
- AI review of purpose and tool behavior: pass (No concerns)