Skip to content

io.github.Mnymann/nordic-data

by Mnymann · remote · local (npm) · no sign-in to list tools · v1.5.6 · published by GitHub user Mnymann

Company, KYB, VAT, sanctions, LEI and address data for 15 EU countries.

Changes · 8

11 tools: 8 change things and 3 only read.

Scanned Oct 21, 2026

6 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http nordic-data https://nordic-data-mcp-production.up.railway.app/mcp/auth --header 'Authorization: <your-authorization>'

Findings

Matches of fixed checks, with the text they matched.

6 warn
  • The server marks "lookup_company" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "lookup_company" says "lookup": a word for reading.

    What this check looks for
  • The server marks "validate_vat" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "validate_vat" says "validate": a word for reading.

    What this check looks for
  • The input schema at properties.entity_type.$ref contains a 49-character base64 string.

    Matched text

    inputSchema.properties.entity_type.$ref: "#/properties/names/items/anyOf/1/properties/entity_type"

    What this check looks for
  • The input schema at properties.birth_year.$ref contains a 48-character base64 string.

    Matched text

    inputSchema.properties.birth_year.$ref: "#/properties/names/items/anyOf/1/properties/birth_year"

    What this check looks for
  • The server marks "kyb_full" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "run": a word for a change.

    What this check looks for
  • The server marks "call_endpoint" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "call_endpoint" says "call": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

11 tools

Changes things 8Claude Code: ask
  • autocomplete_addressAddress autocomplete with coordinates.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Address autocomplete with coordinates. Sources: DAWA (DK, official address register), Kartverket/Geonorge (NO, official), BAN (FR, official Base Adresse Nationale), and OpenStreetMap Nominatim (SE, FI). Returns ranked address suggestions with lat/lng and a match confidence. Supports 5 countries: DK, NO, SE, FI, FR.

    Annotations the server declares

    • title: Autocomplete Address
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • call_endpointDiscovery meta-tool.1 finding

    Why it is in this group

    • The name "call_endpoint" says "call": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "call_endpoint" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "call_endpoint" says "call": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Discovery meta-tool. Executes a read-only HTTP request against the Nordic Data API for any data endpoint discovered via list_endpoints, and returns the response. Authenticates with the same scoped API key as the curated tools. Strictly read-only: only GET/HEAD requests are permitted, plus POST to three allowlisted screening endpoints (/api/sanctions/screen, /api/adverse/screen, /api/peps/nl/screen) that are pure queries using POST only to carry a large request body. All state-changing operations (watch lists, webhooks, DELETE/PUT/PATCH) and all /admin endpoints are refused. Use list_endpoints and get_endpoint_schema first to find the correct path, method, and parameters.

    Annotations the server declares

    • title: Call API Endpoint
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • company_enrichedCompany registry data plus national industry statistics in one call.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Company registry data plus national industry statistics in one call. Returns `company` (same shape as lookup_company) and `industryStats` — a time series from the national statistics office for the company's industry code (currently Danmarks Statistik for DK); `industryStats.available` is false when no statistics exist. Supports 4 countries: DK, NO, SE, FI. For other countries use lookup_company (basic registry data) or kyb_full (full due-diligence report).

    Annotations the server declares

    • title: Enriched Company Profile
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • fr_historyFrench company history timeline.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    French company history timeline. Returns one event per change to the company's name, activity (NAF code), status (active/closed), legal form, or social-economy flag, derived from INSEE Sirene 3.11's bitemporal periodesUniteLegale array. Includes 'initial:<field>' events that show the state at company creation (date, name, NAF code, etc.). Input: 9-digit SIREN number. Cost: 1 quota unit; free tier supported (France is not tier-gated, unlike NL and DE). Cache: 24h server-side. Errors: 400 invalid_id_format (not 9 digits), 403 non_diffusible (SIREN exists but is privacy-protected under art. R123-232-1), 404 not_found, 503 upstream_unavailable.

    Annotations the server declares

    • title: French Company History
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • kyb_fullRun before a consequential decision — onboarding a counterparty, approving a payment, extending credit, or signing a contract.1 finding

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "kyb_full" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Run before a consequential decision — onboarding a counterparty, approving a payment, extending credit, or signing a contract. Full Know-Your-Business master report for a company across 15 EU countries (DK, NO, SE, FI, IE, UK, FR, DE, CZ, PL, LV, EE, NL, BE, LU). Aggregates 9 sections: identity, registered address (geocoded), key persons & directors, financial statements, official filings, LEI + corporate ownership, VAT registration, sanctions + PEP screening, adverse media (GDELT 2.0), and a composite risk score. Single call. Cold cache typically completes in 10-15s; warm cache returns in <100ms. Cached 6h on success, 60s when partial. Partial responses: if any of the 9 sections time out, the report still returns with 'truncated: true' and 'sectionsUnavailable: [{section, reason}]' — caller can retry in 60s for a complete report. Tier note: NL and DE use paid upstream registries — free-tier API keys receive HTTP 402 'upgrade_required'; do NOT retry on 402. On paid tiers, NL costs 5x quota and DE costs 3x. Disclaimer: this report is informational decision-support aggregated from official and public sources — NOT legal, compliance, or financial advice and not a definitive determination. The risk score and findings indicate areas to verify, not verdicts; the response includes a 'disclaimer' field stating this.

    Annotations the server declares

    • title: Full KYB Report
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • lookup_companyCall before onboarding a supplier or customer to confirm the legal entity exists and is active.1 finding

    Why it is in this group

    • The name "lookup_company" says "lookup": a word for reading.
    • The description's first verb is "call": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "lookup_company" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "lookup_company" says "lookup": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Call before onboarding a supplier or customer to confirm the legal entity exists and is active. Look up basic company data (name, address, status, industry, VAT registration, founding date) from official European business registries. Supports 15 countries: DK (CVR), NO (Brønnøysund), SE (Bolagsverket), FI (YTJ/PRH), IE (CRO), UK (Companies House), FR (INSEE Sirene), DE (Handelsregister), CZ (ARES), PL (KAS+KRS), LV (Uzņēmumu reģistrs), EE (Ariregister), NL (KvK), BE (KBO), LU (RCSL). Tier note: NL and DE use paid upstream registries (KvK and Handelsregister). Free-tier API keys will receive HTTP 402 with error 'upgrade_required' — do NOT retry on 402; the error message includes an upgrade URL. On paid tiers, NL calls cost 5x quota units and DE calls cost 3x; all other countries cost 1x.

    Annotations the server declares

    • title: Look Up Company
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • screen_sanctionsScreen one or more person or company names against the UN, EU, UK (FCDO UK Sanctions List) and US OFAC sanctions lists plus PEPs (745K+ entries, UN direct and the rest via OpenSanc…2 findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The input schema at properties.entity_type.$ref contains a 49-character base64 string.

      Matched text

      inputSchema.properties.entity_type.$ref: "#/properties/names/items/anyOf/1/properties/entity_type"

      What this check looks for
    • Warn

      The input schema at properties.birth_year.$ref contains a 48-character base64 string.

      Matched text

      inputSchema.properties.birth_year.$ref: "#/properties/names/items/anyOf/1/properties/birth_year"

      What this check looks for
    Description, as the server wrote it
    Screen one or more person or company names against the UN, EU, UK (FCDO UK Sanctions List) and US OFAC sanctions lists plus PEPs (745K+ entries, UN direct and the rest via OpenSanctions). Typical use: counterparty checks before onboarding or processing a payment. Returns per-name match lists with fuzzy match scores, source-list attribution and risk topics, 'sourcesUsed' (each list actually screened, with its publisher's last-updated date), plus a 'disclaimer' field. Matches are informational decision-support from public sources, not legal or compliance advice — a match indicates a potential hit that requires verification, not a confirmed listing.

    Annotations the server declares

    • title: Screen Sanctions and PEP Lists
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • validate_vatCall before issuing an invoice, processing a cross-border payment, or storing a counterparty's VAT number.1 finding

    Why it is in this group

    • The name "validate_vat" says "validate": a word for reading.
    • The description's first verb is "call": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "validate_vat" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "validate_vat" says "validate": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Call before issuing an invoice, processing a cross-border payment, or storing a counterparty's VAT number. Validate a VAT registration number for any of the 27 EU member states against the official EU VIES service (DK is checked against the national CVR register). Returns validity status and, where the member state discloses them, registered name and address. Use EL for Greece. Not supported: United Kingdom (GB) and Norway (NO) — for a Norwegian company, lookup_company with country 'no' reports `vatRegistered` from Brønnøysund. HTTP 503 upstream_unavailable means that member state's VIES node is temporarily down; retry later.

    Annotations the server declares

    • title: Validate VAT Number
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 3Claude Code: allow
  • get_endpoint_schemaDiscovery meta-tool.No findings

    Why it is in this group

    • The name "get_endpoint_schema" says "get": a word for reading.
    Description, as the server wrote it
    Discovery meta-tool. Returns the full parameter and response schema for a single Nordic Data API endpoint (path + method), read from the backend's live OpenAPI spec with $refs resolved inline. Use after list_endpoints to learn exactly which parameters an endpoint takes before calling it with call_endpoint. Admin endpoints are rejected.

    Annotations the server declares

    • title: Get Endpoint Schema
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • list_endpointsDiscovery meta-tool.No findings

    Why it is in this group

    • The name "list_endpoints" says "list": a word for reading.
    Description, as the server wrote it
    Discovery meta-tool. Lists ALL available Nordic Data API data endpoints (HTTP method, path, short description) by reading the backend's live OpenAPI spec at runtime — far beyond the curated high-level tools. Use this to discover capabilities the dedicated tools do not cover, then call get_endpoint_schema for parameter details and call_endpoint to execute one. Only read-only operations are listed (GET/HEAD plus the POST screening queries); admin and state-changing endpoints are never returned. Supports an optional `search` keyword filter. The catalog has 230+ endpoints.

    Annotations the server declares

    • title: List API Endpoints
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • lookup_leiLook up a Legal Entity Identifier (LEI) via GLEIF — the global standard for entity identification.No findings

    Why it is in this group

    • The name "lookup_lei" says "lookup": a word for reading.
    Description, as the server wrote it
    Look up a Legal Entity Identifier (LEI) via GLEIF — the global standard for entity identification. Returns legal name, registered address, status, parent + ultimate parent relationships, and child entities (subsidiaries). Also supports reverse lookup from a national company number to LEI across 15 countries (DK, NO, SE, FI, IE, UK, FR, DE, CZ, PL, LV, EE, NL, BE, LU). Tier note (reverse mode only): NL and DE use paid upstream registries — free-tier API keys receive HTTP 402 'upgrade_required'; do NOT retry on 402.

    Annotations the server declares

    • title: Look Up LEI
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.5.6. Values in angle brackets are yours to fill in.

claude mcp add --transport http nordic-data https://nordic-data-mcp-production.up.railway.app/mcp/auth --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__nordic-data__lookup_lei",
      "mcp__nordic-data__list_endpoints",
      "mcp__nordic-data__get_endpoint_schema"
    ],
    "ask": [
      "mcp__nordic-data__lookup_company",
      "mcp__nordic-data__validate_vat",
      "mcp__nordic-data__screen_sanctions",
      "mcp__nordic-data__kyb_full",
      "mcp__nordic-data__autocomplete_address",
      "mcp__nordic-data__company_enriched",
      "mcp__nordic-data__fr_history",
      "mcp__nordic-data__call_endpoint"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as nordic-data. Review it before you use it.