Prometiam Risk Intelligence
com.prometiam/risk-mcpprometiam.comstreamable-httpv0.4.55Scanned
Company data and KYB API for 35 countries: monitoring, financial statements, insolvency, sanctions
36 tools: 4 can delete or cancel things, 7 change things and 25 only read.
- Reads private data · 0
- Reads text others write · 29
- Can send data out · 0
- 4 findings
Anlyon alternative
11 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
36 tools
Deletes or cancels 4Claude Code: deny
monitor_stopStop monitoring a company and delete its subscription by monitor ID.No findings
Why it is in this group
- The name "monitor_stop" says "stop": a word for a change.
- The description says "irreversible".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Stop monitoring a company and delete its subscription by monitor ID. This is irreversible — the alert history is removed.
Annotations the server declares
- title: Stop monitoring a company
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
monitor_subscribeSubscribe a company to ongoing monitoring.Reads text others writeNo findings
Why it is in this group
- The name "monitor_subscribe" says "subscribe": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Subscribe a company to ongoing monitoring. Status changes, dissolutions, sanctions matches and corporate events (ES, GB, IE/PL/NO (the last three from 14 Oct 2026) and FI/SE/BE/HR/DK/EE/SK/CH/LV/CY/RO/LT/CA/AU/JP/IL/SG/CO/TW/BR/CZ/DE/NL/AR/UA/RS/EC/IT/IN/AT/GR/LU/HU/PT/US) are checked every 30 minutes from 05:00 to 22:30 UTC and POSTed to your webhook_url (HMAC-SHA256 signed). Returns the monitor ID and a webhook_secret (shown once). Available for Spain (ES), the United Kingdom (GB), Ireland (IE), Poland (PL), Norway (NO), Finland (FI), Sweden (SE), Belgium (BE), Croatia (HR), Denmark (DK), Estonia (e-Business Register), Slovakia (RPO), Switzerland (Zefix), Latvia (Register of Enterprises), Cyprus (DRCOR), Romania (ONRC), Lithuania (JAR), Canada (federal corporations), Australia (ASIC and ABR), Japan (NTA), Israel (Corporations Authority), Singapore (ACRA), Colombia (RUES), Taiwan (GCIS), Brazil (CNPJ), Argentina (RNS, read monthly: no events before 28 Oct 2026, and no dissolution alert), the Czech Republic, Germany (LEI-registered entities and energy-market register companies, sanctions matches only for the latter) and the Netherlands (LEI-registered entities with a KVK number), that is every live country except France and Chile. A dissolution alert fires on the dissolution date the register gives or, where the register gives none (Canada, Israel, Singapore, Taiwan, Romania, many US registrations), when the status first shows closed (detail.date_basis first_seen_closed, else register). This creates a persistent subscription — confirm intent before calling.
Annotations the server declares
- title: Monitor a company
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
sanctions_unwatchRemove one of your sanctions watchlist entries by id (from sanctions_watchlist).No findings
Why it is in this group
- The description's first verb is "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Remove one of your sanctions watchlist entries by id (from sanctions_watchlist).
Annotations the server declares
- title: Remove from sanctions watchlist
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
sanctions_watchAdd a name to your sanctions watchlist (sanctions_watch scope, Starter and above): the API re-screens it against every list update and reports new hits on sanctions_watchlist, or c…Reads text others writeNo findings
Why it is in this group
- The description's first verb is "add": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Add a name to your sanctions watchlist (sanctions_watch scope, Starter and above): the API re-screens it against every list update and reports new hits on sanctions_watchlist, or calls webhook_url when set.
Annotations the server declares
- title: Add to sanctions watchlist
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
Changes things 7Claude Code: ask
company_financialsAnnual financial statements of a company as filed with the official registers, mapped to one standard chart (revenue, gross profit, operating profit, net profit, assets, cash, equi…Reads text others write1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Info
The description is 8,944 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...ny without a NACE-based activity code. A percentile is descriptive, not a rating."
Description, as the server wrote it Annual financial statements of a company as filed with the official registers, mapped to one standard chart (revenue, gross profit, operating profit, net profit, assets, cash, equity, liabilities, employees), in the filing currency and in euro, up to ten fiscal years. A null figure was not stated in the filing, never zero. Annual accounts as filed, for GB, FR, DK, SE and NO, plus FI (statements filed digitally with PRH, the Finnish Patent and Registration Office: XBRL, the company own accounts, about one filer in twenty, registered since July 2023, no employee count, profit before tax before appropriations; plus listed groups), US SEC filers (annual reports 10-K, 20-F and 40-F from EDGAR XBRL, consolidated, US GAAP or IFRS, fiscal years from 2023, in the filing currency (mostly USD) plus euro; no statements for other US companies) and consolidated annual reports of listed groups in GB, DK, SE, LV and LT (ESEF, IFRS, beside the individual accounts, fiscal years from 2022; the latest is fiscal 2024 for SE and 2023 for LV), and listed companies only in ES, PL, HR and BE (their ESEF annual financial reports, IFRS, mostly consolidated; the report of every listed company is not held, and Polish reports arrive more than a year late; reports of Spanish listed companies are available free of charge on the CNMV website). FR: accounts keyed by INPI from the filed documents; none for companies that declare their accounts confidential (about 45% of French filers), and no profit and loss account where only it is declared confidential. Elsewhere only digitally filed accounts: GB electronic (iXBRL) filings, about three in four, where small and micro companies often file no profit and loss account; DK XBRL annual reports, where most small companies report gross profit instead of revenue (Contains CVR data (Erhvervsstyrelsen), CC BY 4.0.); SE digitally filed (iXBRL) reports only; NO the last three approved accounts, with no employee count in the accounts. GB, DK, SE, LV and LT also hold the consolidated annual financial report of listed groups and other issuers (ESEF, IFRS; UKSEF for GB), statement_type consolidated, annual reports only, fiscal years from 2022, as filings.xbrl.org (XBRL International) collects them (an issuer registered elsewhere, a building society or a mutual is not matched; SE: no report added after May 2025, LV after July 2024); credit: Contains annual financial reports published by the issuers (ESEF, IFRS), collected by XBRL International (filings.xbrl.org). Adapted by Prometiam. The last three fiscal years at launch. Figures in the filing currency plus euro at the ECB annual average of the fiscal year (for comparison, not an accounting translation). EE: headline figures only (about sixteen summary items from the annual report: assets, equity, revenue, profits, employee expense, head count; total liabilities is assets minus equity), never a full statement, fiscal years 2019 on (a fiscal year whose report carries no figures in the open data is absent), updated monthly; some figures are read from PDF reports and non-profit income statements follow their own layout. Contains data from the Estonian e-Business Register (RIK), CC BY 4.0. LV: full balance sheet and profit and loss account with employees as filed, consolidated statements separate, fiscal years 2015 on in euro, no cash flow, no filing date, updated daily. Contains data from the Register of Enterprises of the Republic of Latvia (CC0). RO: headline indicators only (assets, equity, debts, net turnover, profit or loss, average employees) of companies filing with the Ministry of Finance, never a full statement, fiscal years 2019 on, in lei with euro copies, no banks, insurers or non-profits. Contains data from the Ministry of Finance of Romania (situații financiare, data.gov.ro), licensed under CC BY 4.0. LT: headline figures only (the balance sheet section totals: fixed assets, current assets, equity, liabilities; the profit and loss account revenue, profit before tax and net profit), never a full statement, individual and consolidated, fiscal years 2023 on in euro, no employees, updated daily from the open data of the register, which held filings up to March 2026 at launch. Contains data from the Register of Legal Entities (JAR), Registrų centras, via data.gov.lt, CC BY 4.0. Adapted by Prometiam. CO: companies that file NIIF statements with the Superintendencia de Sociedades only (groups 1 and 2; about 33,000 companies; banks and Superfinanciera issuers excluded; other Colombian companies answer availability `supersociedades_filers_only`), individual and consolidated, fiscal years 2023 on, in pesos with no euro copy (the ECB publishes no peso rate), no employees, personnel costs or depreciation, no filing date. Contains data from the Superintendencia de Sociedades (estados financieros NIIF), via www.datos.gov.co, licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Modified by Prometiam; the Colombian records are offered under CC BY-SA 4.0 (share-alike). BR: listed companies only (about 750, the CVM DFP annual statements, individual and consolidated, in reais with euro copies, fiscal years 2023 on, updated weekly); other Brazilian companies publish none (`listed_companies_only`). Contains data from the Comissão de Valores Mobiliários (CVM), Portal Dados Abertos, licensed under the Open Database License (ODbL, share-alike). Adapted by Prometiam. AU: tax_records only, no financial statements (availability `tax_records_only`): the Australian Taxation Office Corporate Tax Transparency report per income year from 2013-14 (total income, taxable income, tax payable, in Australian dollars) for large corporate tax entities, total income AUD 100 million and over (AUD 200 million for Australian-owned private companies up to 2021-22); a null taxable income or tax payable means withheld (zero or a loss), not 0. Contains data from the Australian Taxation Office (ATO), Corporate Tax Transparency report, licensed CC BY 3.0 A… [2944 more characters not shown]
Annotations the server declares
- title: Get financial statements
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
insolvency_checkCheck up to 100 counterparties for CORPORATE insolvency notices in ONE call (POST /insolvency/check) across FR, DE, GB, AT, CH, NO, FI, US, NL, DK, HR, SE, ES, LV, EE and SG.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Check up to 100 counterparties for CORPORATE insolvency notices in ONE call (POST /insolvency/check) across FR, DE, GB, AT, CH, NO, FI, US, NL, DK, HR, SE, ES, LV, EE and SG. Each item: country plus company_number (alias siren; exact, as printed on the notice) or name. Returns up to 5 notices per item, newest first, plus latest_filing_date; status found / none / error / timeout. "none" is not proof of solvency. Every item costs 2 credits. Optional idempotency_key: replaying the same key with the same items within 24h returns the original response for free (409 if still running, 422 if the items differ).
Annotations the server declares
- title: Bulk insolvency check
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
lei_relationshipsGLEIF Level 2 corporate ownership ("who owns whom") for a 20-character LEI: its direct parent, ultimate parent, and direct children — each with LEI, legal name, jurisdiction, statu…Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it GLEIF Level 2 corporate ownership ("who owns whom") for a 20-character LEI: its direct parent, ultimate parent, and direct children — each with LEI, legal name, jurisdiction, status, and city/country. Reveals the accountable ownership chain behind an entity. Only relationships reported to GLEIF are returned (many entities report none).
Annotations the server declares
- title: Get LEI ownership
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
procurement_buyerRisk profile of a PUBLIC BUYER (a contracting body) in Spain or France — BETA.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Risk profile of a PUBLIC BUYER (a contracting body) in Spain or France — BETA. Two calibrated scores about the buyer, never about a supplier or a tender: competition = probability that its next award receives a single bid; counterparty = probability that a supplier it awards to enters insolvency within 24 months (weak signal). Each carries score 1-10 (log-odds ladder, 1 = 1st percentile of the country's buyers, 10 = 99th), probability, base_rate, relative_risk, percentile of the residual, observed/expected rates, awards_scored, confidence; plus behaviour ratios, up to three evidence awards and the five largest supplier relationships. Find the id with procurement_buyers. A score is a prompt to look, not a finding of wrongdoing.
Annotations the server declares
- title: Get public buyer risk profile
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
procurement_relationshipHow dependent a public buyer and one of its five largest suppliers are on each other (Spain or France, BETA): awards, awarded value, the supplier's share of the buyer's awarded val…Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it How dependent a public buyer and one of its five largest suppliers are on each other (Spain or France, BETA): awards, awarded value, the supplier's share of the buyer's awarded value, first/last award, single-bid awards, average bids, and the supplier's insolvency date when it failed. Only the five largest relationships per buyer are held; a supplier outside them returns 404 — use procurement_awards for its full award list (Spain).
Annotations the server declares
- title: Get buyer-supplier dependency
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
sanctions_screenScreen a person or entity name against 44,000+ active sanctions and export-control designations with trigram fuzzy match.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Screen a person or entity name against 44,000+ active sanctions and export-control designations with trigram fuzzy match. Covers six sanctions lists — EU consolidated, UN, OFAC, the UK Sanctions List (FCDO), the French Registre des gels, and the Australian DFAT Consolidated List (Department of Foreign Affairs and Trade website – www.dfat.gov.au, CC BY 4.0) — plus 11 US export-control lists (BIS Entity List, Denied Persons, Unverified, Military End User; State ITAR-Debarred and Nonproliferation; OFAC SSI, CMIC, MBS, PLC, CAPTA). Refreshed daily. Returns matches with a match score (0–100, by match type as on company search: 100 the name is the query, 80–99 it starts with it, 50–79 it holds the words, under 50 only parts of words), source list, aliases and the country as an ISO code (country_as_listed keeps the spelling as listed); the same entity on several lists is one row per list unless group is entity. Names in non-Latin scripts (Cyrillic, Greek, Arabic and others) are transliterated to Latin letters, in the query and in the listed names, before matching, so a name in its own script and in Latin spelling match the same entity. Use threshold to control match strictness. BETA.
Annotations the server declares
- title: Screen a name for sanctions
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
sanctions_screen_batchScreen up to 50 names against the sanctions lists in ONE call (POST /sanctions/screen).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Screen up to 50 names against the sanctions lists in ONE call (POST /sanctions/screen). Requires the sanctions scope (batch calls do not use the free trial allowance); every item costs 3 credits. Per-item status: match / clear / error / timeout. "clear" means no hit at or above the threshold on the active lists, not a certification. Optional idempotency_key: replaying the same key with the same items within 24h returns the original response for free (409 if still running, 422 if the items differ).
Annotations the server declares
- title: Bulk sanctions screening
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
Only reads 25Show 25 read-only tools
accountReturns the calling API key's account info and current usage: plan tier, rate limits (per minute in requests, per day / month in credits), credits used and left, and enabled scopes…No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it Returns the calling API key's account info and current usage: plan tier, rate limits (per minute in requests, per day / month in credits), credits used and left, and enabled scopes. Use this to check "how many credits do I have left?".
Annotations the server declares
- title: Get account and credits
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
companies_lookupResolve up to 100 companies in ONE call (POST /companies/lookup).Reads text others writeNo findings
Why it is in this group
- The name "companies_lookup" says "lookup": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "resolve" and "post": it reads posts, which other people can write.
Description, as the server wrote it Resolve up to 100 companies in ONE call (POST /companies/lookup). Each item needs country plus an identifier (company_number; aliases nif, siren, vat) or a name (best fuzzy match with match_score; exact only: no similar-spelling fallback and no other-letter NIF). Results come back in request order with status found / not_found / error / timeout and the same company object companies_search returns. Every item costs 1 credit; a batch that does not fit is refused with 429 batch_exceeds_quota and max_items_now. Optional idempotency_key: replaying the same key with the same items within 24h returns the original response for free (409 if still running, 422 if the items differ).
Annotations the server declares
- title: Bulk company lookup
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
companies_searchSearch EU + UK companies in official registries by name or identifier.Reads text others write1 finding
Why it is in this group
- The name "companies_search" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Info
The description is 7,071 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...y company of those countries with annual accounts held, whatever the fiscal year."
Description, as the server wrote it Search EU + UK companies in official registries by name or identifier. Every company is one standard object with the same keys in all 35 countries (null where the register publishes no value): identifiers [{type, value}], vat_number and vat_number_source (register or rule; also in identifiers as type vat; `register`: published by the register (EE; LV from the State Revenue Service’s list of VAT payers; LT from the State Tax Inspectorate’s list; AU the ABN while GST-registered; TW the unified business number where the company is in the tax file) or the register confirms VAT registration and the number is the legal format of its identifier (NO, FI, BE). `rule`: built from the company identifier (ES `ES`+NIF, FR `FR`+key+SIREN, PL `PL`+NIP, NO `NO`+number+`MVA`, FI, SE `SE`+number+`01`, BE, HR `HR`+OIB, DK, RO `RO`+CUI, CH `CHE`+UID+`MWST`): the format is right, the registration is not confirmed (check an EU number with `GET /vat/{number}`; VIES has no NO or CH). Null where the register says the company is not VAT-registered (NO, FI), where a Latvian company is not on the State Revenue Service’s list of VAT payers, and where no rule exists (GB, IE, SK, CY, US, CA, JP, IL, BR, CO, SG, CZ, DE, IT, IN, AT, GR, LU, HU, PT, and EE without a published KMKR).), the standard legal_form abbreviation and legal_form_family beside the register's local_legal_form and local_legal_form_name, a standard status and stage beside the register's own local_status, one main activity_code with its scheme, label and NACE class (nace_class, nace_version, nace_division, nace_derived, and nace_title, its English title), the same industry as a NACE Rev. 2 and a NACE Rev. 2.1 class or division (nace_rev2_class, nace_rev2_division, nace_rev21_class, nace_rev21_division), the ISIC Rev. 4 class (isic4_class) and the US NAICS 2022 sector and subsector (naics_sector, naics_subsector) through the official correspondence tables of Eurostat, the United Nations and the US Census Bureau (a class only where the table links exactly one, the division where the linked classes share one, otherwise null, never a guess and never read from the name; ES and PL mix two editions of their classification, so a class that exists in both revisions with changed content is served only when both readings give it; BR, CO and SG derive from ISIC Rev. 4), and the age of the company: age_years (whole years on the day of the answer), age_band (under_1y, 1_3y, 3_5y, 5_10y, 10_20y, 20y_plus) and age_basis (founding_date, else registration_date; null for CH and JP, which publish no founding date, and for DE, which serves no founding date; in an LEI layer the date is the entity creation date GLEIF holds, which can be later than the start of the company), address with region, capital_amount and capital_eur, and registry_details for what only one register has (null when the dictionary does not recognise a stored value — never a guess). Use country to scope the search to Spain (BORME), France (BODACC), the UK (Companies House), Ireland (CRO), Poland (KRS), Norway (Brønnøysundregistrene), Finland (Kaupparekisteri), Sweden (Bolagsverket), Croatia (Sudski registar), Belgium (KBO/BCE), Denmark (CVR), Estonia (e-Business Register), Slovakia (RPO), Switzerland (Zefix), Latvia (Register of Enterprises), Cyprus (DRCOR), Romania (ONRC), Lithuania (JAR), Canada (Corporations Canada), Australia (ASIC and the ABR), Japan (National Tax Agency), Israel (Corporations Authority), Brazil (CNPJ), Colombia (RUES), Singapore (ACRA), Taiwan (GCIS), the Czech Republic (public register, Ministry of Justice, and RES), Germany (LEI-registered entities and energy-market register companies), or the United States (state registers, SEC EDGAR and GLEIF). Fuzzy name results carry a match_score (0–100) and are ranked by relevance, best first. NOTE: "dissolved" means different things by country — ES/FR still exists pending liquidation, GB/IE/PL/NO/FI no longer exists — read status (the standard value), not local_status, to compare across countries. Norway and France include sole proprietorships (ENK, EI) as the register publishes them; a French company that opted out of publication (INSEE non-diffusible) has company_name null, status withheld and registry_details.non_diffusible true, is left out of name searches, the founding-date feed and event searches by name, and is found by SIREN or SIRET. A Spanish company closed by a merger is served as closed (local_status absorbed). A malformed identifier (a Spanish NIF must pass its control character), or a limit outside the documented range, is a 400 validation_error. A name search ranks a pool of up to about 700 candidates and pages through it: when has_more is true, pass next_cursor (o:<n>) back as cursor (offset=<n> is the same), 1 credit a page; a page past the pool is empty. match_score (0-100) means the same in every country: 100 the name is the query, 80-99 it starts with the words of the query, 50-79 it holds every word, below 50 parts of words. match_type on every result says what it matched on: exact (the identifier, the whole name, or a listing with no name), partial (the name starts with or holds the words) or, only when the usual search found nothing, fuzzy (a similar spelling, any country: similarity 0.6 or more, 0.45 in Spain, at most 10 companies, meta.search_mode name_fuzzy, approximate) or nif_other_letter (Spain only: a NIF with entity letter A or B that finds nothing returns the company holding the same digits under the other letter, which may be another company: confirm the name; meta.search_mode nif_other_letter). Both fallbacks cost the same credits as a normal search and are never applied by companies_lookup, which stays exact. To fetch one company by its register number (NIF, SIREN, CRN, KRS, CVR) use company_detail with country and company_number. eu_size_class, eu_size and fiscal_year_end_month (every plan, no extra credit): an INDICATIVE EU size class (micro, small, medium or large of Commission Recommendation 2003/361… [1071 more characters not shown]
Annotations the server declares
- title: Search companies
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
company_by_identifierFind ONE company from an identifier, the country worked out for you (GET /companies/by-identifier, 1 credit, answered like company_detail with the same include).Reads text others writeNo findings
Why it is in this group
- The description's first verb is "find": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Find ONE company from an identifier, the country worked out for you (GET /companies/by-identifier, 1 credit, answered like company_detail with the same include). type=vat: the prefix names the country (ES, FR, ... EL is Greece, XI Northern Ireland, CHE Switzerland), then that country VAT search runs; a number without a prefix needs country; countries whose registers publish no VAT number answer 400. type=lei: our GLEIF links first, else GLEIF own record (legal-address country plus registered-as number). type=company_number: needs country. meta.resolved_by says which rule found it (vat_prefix, vat_with_country, lei_link, gleif_registration, company_number). No match is a 404; several records (a US number repeated across states) a 409 with candidates.
Annotations the server declares
- title: Find company by identifier
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
company_detailFetch a single company by Prometiam internal ID, or by the register's own number: give country and company_number (NIF, SIREN or SIRET, CRN, KRS, CVR, ...; GET /companies/{country}…Reads text others write1 finding
Why it is in this group
- The description's first verb is "fetch": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Info
The description is 2,946 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...y company of those countries with annual accounts held, whatever the fiscal year."
Description, as the server wrote it Fetch a single company by Prometiam internal ID, or by the register's own number: give country and company_number (NIF, SIREN or SIRET, CRN, KRS, CVR, ...; GET /companies/{country}/{company_number}, 1 credit, same answer and same include). No company with that number is a 404; a number several companies carry (US registers, a German commercial-register entry) is a 409 ambiguous_company_number whose error.candidates list the ids. Returns full profile including officers, registry coordinates, founding date and the age fields (age_years, age_band, age_basis), the NACE class with its English title and the same industry as NACE Rev. 2 and Rev. 2.1, ISIC Rev. 4 and NAICS 2022 codes (the rules and limits are those of companies_search), capital, current standard status (with stage and the register's local_status), standard legal form (with local_legal_form), identifiers and registry_details. include=lei (Spain) adds lei_record, the GLEIF record; lei is the code string. recent_events (ES/FR/GB) carries the same served event_type + raw act_type as events_search. Get an ID from companies_search first. Pass include to attach extra blocks — notably risk_flags (published tax-debt / debarment signals) and insolvency. UK disqualified directors: on a GB company, `disqualified_officers` lists the company's CURRENT officers who are on the Companies House register of disqualified directors with a disqualification in force (each with the same `disqualifications` entry as /people/{id}); an empty list means none found, null means the register could not be read (retry). Matched as on /people/{id} (full name plus birth month), so only persons with significant control are covered, not directors. eu_size_class, eu_size and fiscal_year_end_month (every plan, no extra credit): an INDICATIVE EU size class (micro, small, medium or large of Commission Recommendation 2003/361/EC: staff under 10, 50 and 250, and turnover or balance sheet total up to EUR 2m, 10m and 50m, 43m for the balance sheet total) read from the latest annual accounts held (fiscal year 2022 or later) and the register head count; a class, never the figures, with eu_size.range (the classes still possible when the class is null), eu_size.basis, eu_size.autonomy (unverified, or group_member_known) and indicative true. Not a determination that a company is or is not an SME: the partner and linked-enterprise test cannot be applied (a known parent only floors the class; France INSEE category ETI or GE means large, PME at most medium), one year is read, the head count is the accounts average or the register, not annual work units. GB, RO, FR, EE, SE, DK, LV and NO give a class; LT and FI (no head count) a range, or large; null for sole proprietorships (ENK, EI), Brazil, Colombia and every other country. fiscal_year_end_month (1-12) is the month the latest annual accounts end, for every company of those countries with annual accounts held, whatever the fiscal year.
Annotations the server declares
- title: Get company profile
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
coverageReturns dataset coverage statistics: per-country company count, event count, person count, latest filing date, and data sources.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it Returns dataset coverage statistics: per-country company count, event count, person count, latest filing date, and data sources. Use this when a user asks "what countries does Prometiam cover?" or "how fresh is the data?".
Annotations the server declares
- title: Get data coverage
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
directors_networkList directors/officers who sit on many companies (cross-directorship rollup), optionally filtered by name.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List directors/officers who sit on many companies (cross-directorship rollup), optionally filtered by name. Useful for spotting nominee directors and network hubs in due diligence. Currently Spain (ES) only; other countries return an empty set with a notice.
Annotations the server declares
- title: Find multi-company directors
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
event_detailFetch a single corporate-event record by Prometiam internal ID, with its full before/after values and, with include=notice, the source publication (BORME, BODACC or Companies House…Reads text others writeNo findings
Why it is in this group
- The description's first verb is "fetch": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Fetch a single corporate-event record by Prometiam internal ID, with its full before/after values and, with include=notice, the source publication (BORME, BODACC or Companies House; null for other countries). Get an ID from events_search or events_timeline first.
Annotations the server declares
- title: Get corporate event
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
events_searchSearch normalized corporate-event records (capital changes, director changes, dissolutions, mergers, insolvency, name changes, etc.) by company, or, with neither company_name nor c…Reads text others writeNo findings
Why it is in this group
- The name "events_search" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Search normalized corporate-event records (capital changes, director changes, dissolutions, mergers, insolvency, name changes, etc.) by company, or, with neither company_name nor company_number, as the country event feed (every event of that country, country then required, newest first, from date_from: default 7 days ago, at most 31 days back), for Spain, France and the UK (from their gazettes) and, as register-change events, for Ireland, Poland, Norway, Finland, Sweden, Belgium, Croatia, Denmark, Estonia, Slovakia, Switzerland, Latvia, Cyprus, Romania, Lithuania, Canada, Australia, Japan, Israel, Singapore, Colombia, Taiwan, Czech Republic, Germany, the Netherlands, Ukraine, Serbia, Ecuador, Brazil and the United States. Returns events with a served event_type matching this enum for each of those countries (each row also carries act_type, the raw BORME/BODACC/Companies House code it was derived from, or null when not yet covered), event date, before/after values, and source notice URL. The register-change events of the five (name, status, legal form and registered address; share capital for HR, EE, SK, CH, LV, LT, TW, BR and CZ; for Ukraine name, status, legal form and share capital, no registered address; for Serbia the address is the municipality; for Ecuador the address is the canton) are dated when the change first appears in the register data (for the United States, the weekly read of the registers that first sees it), are not gazette notices and start on 2026-09-30 (Ecuador: none before its launch). Ireland, Poland and Norway publish no gazette either; their register-change events are dated the same way and none are before 14 Oct 2026.
Annotations the server declares
- title: Search corporate events
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
events_timelineReturns the event history for one company, newest first.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "return": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Returns the event history for one company, newest first. Useful for building lifecycle timelines from incorporation through capital changes, director appointments, and dissolution. One of company_number or company_name is required.
Annotations the server declares
- title: Get company event timeline
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
insolvency_notices_searchSearch CORPORATE insolvency notices published in official gazettes and registers across France, Germany, the UK, Austria, Switzerland, Norway, Finland, the US, the Netherlands, Den…Reads text others write1 finding
Why it is in this group
- The name "insolvency_notices_search" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Info
The description is 4,220 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...ed ES/FR/GB risk-notice corpus. Contains CVR data (Erhvervsstyrelsen), CC BY 4.0."
Description, as the server wrote it Search CORPORATE insolvency notices published in official gazettes and registers across France, Germany, the UK, Austria, Switzerland, Norway, Finland, the US, the Netherlands, Denmark, Croatia, Sweden, Spain, Latvia, Estonia and Singapore. Use this for distress coverage in all sixteen markets. DE, AT, US and NL notices stand alone: they are not linked to company records (German and US company records come from other sources and do not carry them). FR, GB, NO and ES notices are linked by company number or NIF, and the notices of the other registry countries can be cross-referenced against companies_search with the same country code (for FI, DK, HR, SE and CH the notices are linked by business ID, CVR number, MBS, organisationsnummer and UID: a company record with include=insolvency returns them; a Swiss notice is linked only where the SHAB notice names the debtor's UID, and one without a UID stays unlinked). DK notices come from CVR credit information (konkurs and tvangsakkord: one notice per proceeding, dated by the decision that opened it, with the latest stage of the proceeding; no court or case number); HR notices are court decisions from the Croatian court register (only companies still on the register); SE notices are Bolagsverket's procedure data (konkurs, företagsrekonstruktion, ackordsförhandling), updated weekly, with no court, case number or link, and proceedings that ended before collection are not included. Belgium and Slovakia are not insolvency markets (their bankruptcy shows in the company status). Spanish notices are the concurso entries (declaration, opening of the liquidation phase, conclusion) published in BORME since 2009, one per court resolution, linked by NIF and dated by the court's resolution date with the BORME publication date alongside (a median of about ten weeks later, sometimes more than a year); legal entities with a NIF only, judge and administrator never served, and an entry that cannot be tied to the company, or whose NIF is an administrator's, is withheld. Latvian notices are the Insolvency Register's insolvency and legal protection proceedings, an opening notice and a closing notice each, since 2008, with court and case number where stated, linked by registration number, legal persons of the commercial register only, updated daily. Estonian notices are bankruptcy declarations from the e-Business Register, one per register entry, dated by the entry (a few days after the court's order), linked by registry code, with no court, case number, trustee or closing notice, for companies still on the register, in liquidation or in bankruptcy only (a floor), sole traders (FIE) never served. Singapore notices are the corporate notices of the Singapore Government Gazette (egazette.gov.sg), back to September 1998: winding-up applications and orders, judicial management, and the steps of a creditors' voluntary or court-ordered liquidation (resolutions, meetings of creditors, claims and dividend notices), dated by the order, filing or resolution date where the notice prints it, else by its first publication, with the court and case number where it prints them; members' voluntary (solvent) liquidations are not included and no liquidator, judicial manager or other natural person is served; linked to the company record by the UEN (a company record with include=insolvency returns them), and a notice that prints no valid UEN stays unlinked. Spanish notices: based on data from the Agencia Estatal Boletín Oficial del Estado (BORME). Contains data from the Insolvency Register of the Republic of Latvia (Register of Enterprises), CC0. Contains data from the Estonian e-Business Register (RIK), CC BY 4.0. Source: Republic of Singapore Government Gazette, www.egazette.gov.sg. The e-Gazettes are subject to copyright of the Singapore Government and are reproduced here with the permission of the Singapore Government. You may check www.egazette.gov.sg for the latest e-Gazettes. US notices are not linked to the US company records. Personal/consumer insolvency is deliberately excluded and is never returned. Distinct from insolvency_search, which covers the linked ES/FR/GB risk-notice corpus. Contains CVR data (Erhvervsstyrelsen), CC BY 4.0.
Annotations the server declares
- title: Search corporate insolvency notices
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
insolvency_recordFetch a single insolvency / risk notice by Prometiam internal ID, with related corporate events.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "fetch": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Fetch a single insolvency / risk notice by Prometiam internal ID, with related corporate events. Get an ID from insolvency_search.
Annotations the server declares
- title: Get insolvency notice
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
insolvency_searchSearch insolvency and risk notices (bankruptcies, liquidations, court judgments) by company name or identifier.Reads text others writeNo findings
Why it is in this group
- The name "insolvency_search" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Search insolvency and risk notices (bankruptcies, liquidations, court judgments) by company name or identifier. Complements company registry data with distress signals. Scope with country and date range.
Annotations the server declares
- title: Search insolvency and risk notices
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
lei_lookupLook up a Legal Entity Identifier (LEI) in the GLEIF global register by its 20-character ISO 17442 code.Reads text others writeNo findings
Why it is in this group
- The name "lei_lookup" says "lookup": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Look up a Legal Entity Identifier (LEI) in the GLEIF global register by its 20-character ISO 17442 code. Returns legal name, jurisdiction, entity and registration status, legal/HQ address, managing LOU, and next renewal date. Use to validate or enrich a counterparty that publishes an LEI.
Annotations the server declares
- title: Look up LEI
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
lei_searchSearch the GLEIF global LEI register by legal-entity name (full-text).Reads text others writeNo findings
Why it is in this group
- The name "lei_search" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Search the GLEIF global LEI register by legal-entity name (full-text). Returns candidate LEIs with legal name, jurisdiction, status, and city/country — use to resolve a company name to its LEI before lei_lookup. Ranked by match_score (exact name, then names starting with yours, then names holding the words), so name=telefonica lists TELEFONICA SA first.
Annotations the server declares
- title: Search LEIs by name
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
monitor_getGet one monitored company by its monitor ID, including its alert history (events/status/sanctions matches detected since subscription).No findings
Why it is in this group
- The name "monitor_get" says "get": a word for reading.
Description, as the server wrote it Get one monitored company by its monitor ID, including its alert history (events/status/sanctions matches detected since subscription).
Annotations the server declares
- title: Get monitored company
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
monitor_listList the companies currently subscribed to ongoing monitoring for this API key, with their labels and last-alert timestamps.No findings
Why it is in this group
- The name "monitor_list" says "list": a word for reading.
Description, as the server wrote it List the companies currently subscribed to ongoing monitoring for this API key, with their labels and last-alert timestamps. Company monitoring (ES, GB, IE, PL, NO, FI, SE, BE, HR, DK, EE, SK, CH, LV, CY, RO, LT, CA, AU, JP, IL, SG, CO, TW, BR, CZ, DE, NL, AR, UA, RS, EC, IT, IN, AT, GR, LU, HU, PT, US) emits status changes, dissolutions, sanctions matches and, for ES, GB, IE/PL/NO (the last three from 14 Oct 2026) and FI/SE/BE/HR/DK/EE/SK/CH/LV/CY/RO/LT/CA/AU/JP/IL/SG/CO/TW/BR/CZ/DE/NL/AR/UA/RS/EC/IT/IN/AT/GR/LU/HU/PT/US, corporate events to a webhook.
Annotations the server declares
- title: List monitored companies
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
people_searchSearch officers / directors / shareholders by name across EU + UK registries.Reads text others writeNo findings
Why it is in this group
- The name "people_search" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Search officers / directors / shareholders by name across EU + UK registries. Returns matching people with their appointment counts, ranked by a fuzzy-match match_score (0–100), best first. Use person_detail for a full appointment history. Scope with country — officer-level data is held for Spain, France, the UK and Norway (Polish officers are on the company record only: the KRS masks natural persons, so there are no person records); Ireland, Finland, Sweden, Croatia, Belgium, Denmark, Estonia, Slovakia, Switzerland, Latvia, Cyprus and Romania are company-level only.
Annotations the server declares
- title: Search officers and directors
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
person_detailFetch a single person (officer / director) by Prometiam internal ID.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "fetch": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Fetch a single person (officer / director) by Prometiam internal ID. Returns the person's full appointment history across all companies. Useful for director-network analysis and counterparty due diligence. Get the ID from a company_detail or people_search response. UK disqualified directors: on a GB person, `disqualifications` is the person's entry on the Companies House register of disqualified directors (orders and undertakings under the Company Directors Disqualification Act 1986, and sanctions-regime disqualifications) with each period, the section of the Act, whether it is an order, an undertaking or a sanction, and the companies named; null when the person is not on the register. Matched on the words of the full name and the month and year of birth together (the register publishes no id shared with the officer records), so only persons with significant control, whose birth month is held, can match, never a director listed without a birth month; two register entries with the same name and birth month match nobody; `match_basis` says whether a company named in the disqualification is also one the person is linked to. An identity match on those signals, not a determination. Month and year of birth only, no address. Contains public sector information licensed under the Open Government Licence v3.0.
Annotations the server declares
- title: Get officer profile
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
procurement_awardsList public-contract awards by supplier, buyer, supplier tax id, CPV code and date, newest first.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List public-contract awards by supplier, buyer, supplier tax id, CPV code and date, newest first. Spain (PLACSP, including minor contracts), France (DECP), the United Kingdom (Contracts Finder, Find a Tender) and Ireland, Poland and Norway (TED, above the EU thresholds only); pass country to restrict, omit it for all countries. One row per award to one supplier: amount_eur is that supplier's share as published, before VAT where the source distinguishes; amount_contract_eur is the whole contract; amount_is_ceiling marks a framework or dynamic-purchasing ceiling that is not spend; amount_suspect marks a form default rather than a price. bids_received is the competition signal where the source publishes it. company_id is set when the supplier resolves to a company record in that country (use company_detail on it). Natural-person suppliers are never returned. Requires at least one of company_id, nif, supplier, buyer, cpv or date_from.
Annotations the server declares
- title: Search procurement awards
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
procurement_buyersList scored public buyers (contracting bodies) in Spain or France ordered by one buyer score, highest first — BETA.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List scored public buyers (contracting bodies) in Spain or France ordered by one buyer score, highest first — BETA. Use it to screen a portfolio (min_score), to see a region, or to find a buyer's identifier by name before calling procurement_buyer. Rows carry the buyer, its coverage and both risk blocks (score 1-10, probability, base_rate, relative_risk).
Annotations the server declares
- title: List scored public buyers
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
sanctions_changesList additions, removals and amendments detected on the sanctions lists, newest first.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List additions, removals and amendments detected on the sanctions lists, newest first. Use this to answer "what changed recently" without re-screening a whole book of business — each change carries the entity it affects, so a hit can be joined back to sanctions_entity.
Annotations the server declares
- title: List sanctions changes
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
sanctions_entityFetch full detail for a single sanctions entity by Prometiam internal ID: all aliases, the issuing programme/list, listing date, and identifying data.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "fetch": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Fetch full detail for a single sanctions entity by Prometiam internal ID: all aliases, the issuing programme/list, listing date, and identifying data. Get an ID from a sanctions_screen match.
Annotations the server declares
- title: Get sanctions entity
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
sanctions_watchlistReturn your sanctions watchlists and any recent hits against them.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it Return your sanctions watchlists and any recent hits against them. Requires the sanctions_watch scope; the number of entries allowed depends on your tier. Add entries with sanctions_watch and remove them with sanctions_unwatch.
Annotations the server declares
- title: List sanctions watchlist
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
vat_validateValidate an EU VAT number against VIES (the European Commission's VAT Information Exchange System) and return the registered trader name and address when valid.Reads text others writeNo findings
Why it is in this group
- The name "vat_validate" says "validate": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Validate an EU VAT number against VIES (the European Commission's VAT Information Exchange System) and return the registered trader name and address when valid. Covers the 27 EU member states plus XI (Northern Ireland); Greek numbers use the EL prefix and GB VAT is out of scope post-Brexit. Live official check — returns a retryable error when a member-state registry is temporarily down (not a false "invalid"). When VIES says a Spanish or German number is valid but withholds the name, registry_match {company_id, company_name, address, register} names the company our register holds under that number: register data, not VIES confirmation.
Annotations the server declares
- title: Validate VAT number
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write29
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
- Infocompanies_search
The description is 7,071 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...y company of those countries with annual accounts held, whatever the fiscal year."
- Infocompany_detail
The description is 2,946 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...y company of those countries with annual accounts held, whatever the fiscal year."
The description is 8,944 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...ny without a NACE-based activity code. A percentile is descriptive, not a rating."
The description is 4,220 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...ed ES/FR/GB risk-notice corpus. Contains CVR data (Erhvervsstyrelsen), CC BY 4.0."
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 0.4.55. Values in angle brackets are yours to fill in.
claude mcp add --transport http risk https://api.prometiam.com/functions/v1/mcpclaude mcp add --transport http risk https://api.prometiam.com/functions/v1/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__risk__companies_search",
"mcp__risk__company_detail",
"mcp__risk__events_search",
"mcp__risk__events_timeline",
"mcp__risk__event_detail",
"mcp__risk__people_search",
"mcp__risk__person_detail",
"mcp__risk__directors_network",
"mcp__risk__sanctions_entity",
"mcp__risk__insolvency_search",
"mcp__risk__insolvency_notices_search",
"mcp__risk__procurement_awards",
"mcp__risk__procurement_buyers",
"mcp__risk__company_by_identifier",
"mcp__risk__companies_lookup",
"mcp__risk__insolvency_record",
"mcp__risk__coverage",
"mcp__risk__account",
"mcp__risk__vat_validate",
"mcp__risk__lei_lookup",
"mcp__risk__lei_search",
"mcp__risk__monitor_list",
"mcp__risk__monitor_get",
"mcp__risk__sanctions_changes",
"mcp__risk__sanctions_watchlist"
],
"ask": [
"mcp__risk__company_financials",
"mcp__risk__sanctions_screen",
"mcp__risk__procurement_buyer",
"mcp__risk__procurement_relationship",
"mcp__risk__sanctions_screen_batch",
"mcp__risk__insolvency_check",
"mcp__risk__lei_relationships"
],
"deny": [
"mcp__risk__sanctions_watch",
"mcp__risk__sanctions_unwatch",
"mcp__risk__monitor_subscribe",
"mcp__risk__monitor_stop"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as risk. Review it before you use it.
Capability tags behind 29 rules
- mcp__risk__companies_search untrusted-input
- mcp__risk__company_detail untrusted-input
- mcp__risk__company_financials untrusted-input
- mcp__risk__events_search untrusted-input
- mcp__risk__events_timeline untrusted-input
- mcp__risk__event_detail untrusted-input
- mcp__risk__people_search untrusted-input
- mcp__risk__person_detail untrusted-input
- mcp__risk__directors_network untrusted-input
- mcp__risk__sanctions_screen untrusted-input
- mcp__risk__sanctions_entity untrusted-input
- mcp__risk__insolvency_search untrusted-input
- mcp__risk__insolvency_notices_search untrusted-input
- mcp__risk__procurement_awards untrusted-input
- mcp__risk__procurement_buyer untrusted-input
- mcp__risk__procurement_buyers untrusted-input
- mcp__risk__procurement_relationship untrusted-input
- mcp__risk__sanctions_watch untrusted-input
- mcp__risk__company_by_identifier untrusted-input
- mcp__risk__companies_lookup untrusted-input
- mcp__risk__sanctions_screen_batch untrusted-input
- mcp__risk__insolvency_check untrusted-input
- mcp__risk__insolvency_record untrusted-input
- mcp__risk__vat_validate untrusted-input
- mcp__risk__lei_lookup untrusted-input
- mcp__risk__lei_search untrusted-input
- mcp__risk__lei_relationships untrusted-input
- mcp__risk__monitor_subscribe untrusted-input
- mcp__risk__sanctions_changes untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/com.prometiam/risk-mcp/verify?hash=4594b8474226b425f41c52adee0c25a5f82d091315ad8ebc8e7ce09ba96b0326" | jq -e '.changed == false'Pinned hash 4594b8474226, from Nov 4, 2026, 23:17 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/com.prometiam/risk-mcp/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/com.prometiam/risk-mcp)Source: MCP Registry. Synced Nov 4, 2026, 23:17 UTC.