Search for an MCP server for due diligence and you get corporate-registry servers, a virtual data room, and a compliance vendor. Those all answer the same question: where does the data come from. This post answers the other half — what a general web-data MCP server does inside a diligence workflow, and the one failure mode that should decide whether you trust its output.
What does an MCP server actually do for due diligence?
It does not hand you a diligence database. CrawlForge owns no registry records, no sanctions lists, no filings, no org charts. It reads pages you point it at.
What it adds is the layer above the sources: your agent can search, fetch, parse and re-check primary documents in the same session it drafts the memo, instead of you copying between a data room, a browser and a spreadsheet. That is a narrower claim than most of the pages ranking around this phrase make, and it is the honest one. If you need a licensed sanctions feed, buy a sanctions feed.
Which tools map to which diligence task?
| Task | Tool | Credits |
|---|---|---|
| Survey what has been published about a counterparty | deep_research | 10 |
| Read a filing, annual report or contract PDF | process_document | 2 |
| Pull named fields off a registry or company page | extract_structured | 3 |
| Enumerate a subsidiary's whole web estate | map_site → crawl_deep | 2 + 4 |
| Watch a counterparty after signing | track_changes | 3 |
How do you keep an agent inside sources you trust?
Diligence lives or dies on source quality, so pin the run to the registers and regulators you would actually cite. research_scope.domains accepts up to 10:
{
"research_query": "ACME Holdings Ltd filing history and current directors",
"research_scope": {
"domains": ["find-and-update.company-information.service.gov.uk", "sec.gov"]
},
"max_sources": 10
}Two parameter traps worth knowing before your first call: the query field is research_query, not query or topic, and it must be at least 10 characters. Unknown keys are discarded silently, so sending topic returns a 400 complaining that research_query is missing — the full parameter list is in the API reference.
What is the failure mode that actually matters?
A model that returns a plausible fact which was never on the page.
In most scraping work that is an annoyance. In diligence it is the entire risk, because a fabricated incorporation date reads exactly like a real one and nothing downstream flags it. We have had extract_structured return a version number that appeared nowhere on the source page, simply because the model preferred one it had memorised — the kind of thing only live testing catches, never a test suite.
So the property to design around is traceability, not accuracy claims. deep_research returns verbatim passages with a source_url on every finding rather than a synthesised summary, which means each line of the memo can be walked back to the page it came from. The working rule: let LLM-backed extraction locate a fact, then confirm it against the raw passage or the PDF through process_document before it reaches anything a partner signs.
What does one counterparty cost?
A realistic pass, using the costs in the table above:
deep_researchscoped to two registries — 10- two filings through
process_document— 4 - one registry page through
extract_structured— 3 - baselines on their pricing page and newsroom for post-close monitoring — 6
That is 23 credits per counterparty, so the free tier's one-time 1,000 credits cover roughly 43 of them end to end before you decide whether this belongs in your stack.
Monitoring is the part people underuse. track_changes takes create_baseline once, then compare on whatever schedule you like, with a CSS selector to scope the diff to the section that matters — a pricing table or a leadership page — so a layout change does not read as a material one.
Start free with 1,000 credits and run the pass above against a real counterparty before you commit to anything.
