CompanyVerify
io.github.greg-wilko/companyverifygreg-wilkostreamable-httpv0.1.0Scanned
UK company lookup, LEIs and sanctions name matching for agents, with source provenance.
20 tools: 1 do something that can't be undone, 13 change things and 6 only read.
- Reads private data · 1
- Reads text others write · 0
- Can send data out · 0
- No findings
Anlyon alternative
14 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
20 tools
Can't be undone 1Claude Code: ask
charge_registerRoadmap probe, not yet served: outstanding charges and security for a UK company.No findings
Why it is in this group
- The name "charge_register" says "charge": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it Roadmap probe, not yet served: outstanding charges and security for a UK company. Calling records the requirement.
Changes things 13Claude Code: ask
adverse_mediaRoadmap probe, not yet served: adverse media screening with citations.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Roadmap probe, not yet served: adverse media screening with citations. Calling records the requirement and returns not-covered.
eu_vat_checkRoadmap probe, not yet served: VIES VAT validation with provenance.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Roadmap probe, not yet served: VIES VAT validation with provenance. Calling records the requirement.
fca_register_checkRoadmap probe, not yet served: authorisation status of a firm or individual on the FCA register.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Roadmap probe, not yet served: authorisation status of a firm or individual on the FCA register. Calling records the requirement.
kyb_verdictRoadmap probe, not yet served: single-call KYB verdict (exists, active, officers, PSC, sanctions, insolvency) with signed provenance receipt.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Roadmap probe, not yet served: single-call KYB verdict (exists, active, officers, PSC, sanctions, insolvency) with signed provenance receipt. Calling records the requirement and returns not-covered.
pep_screenRoadmap probe, not yet served: politically exposed person screening.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Roadmap probe, not yet served: politically exposed person screening. Calling records the requirement and returns a structured not-covered response. Sanctions-only screening is live at /v1/screen/sanctions.
request_dataState a data requirement, intended use, expected monthly volume and acceptable price.No findings
Why it is in this group
- The name "request_data" says "request": a word for a change.
Description, as the server wrote it State a data requirement, intended use, expected monthly volume and acceptable price. Free and logged to inform build priority.
sanctions_screenScreen a person or entity name against sanctions lists loaded directly from primary government sources (configurable: OFAC SDN and consolidated, the UK Sanctions List).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Screen a person or entity name against sanctions lists loaded directly from primary government sources (configurable: OFAC SDN and consolidated, the UK Sanctions List). Returns match verdict, candidate hits with scores, list versions and retrieval timestamps. Not a PEP or adverse-media screen.
uk_company_profileFull Companies House profile for a company number: status, SIC codes, registered office, accounts and confirmation statement dates, plus the first page of officers (up to 35), with…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Full Companies House profile for a company number: status, SIC codes, registered office, accounts and confirmation statement dates, plus the first page of officers (up to 35), with explicit total/coverage metadata. Primary source, cached for up to 24 hours, provenance attached.
uk_director_changesRoadmap probe, not yet served: per-entity change feed for officer appointments and resignations, priced per delta.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Roadmap probe, not yet served: per-entity change feed for officer appointments and resignations, priced per delta. Calling records the requirement and returns not-covered.
uk_insolvency_noticesRoadmap probe, not yet served: structured Gazette insolvency notices for a monitored entity, per event.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Roadmap probe, not yet served: structured Gazette insolvency notices for a monitored entity, per event. Calling records the requirement.
uk_procurement_awardsRoadmap probe, not yet served: contract awards for a supplier from Find a Tender OCDS data.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Roadmap probe, not yet served: contract awards for a supplier from Find a Tender OCDS data. Calling records the requirement.
uk_psc_uboRoadmap probe, not yet served: resolved beneficial-ownership chain for a UK company from PSC data, entity-resolved across registries.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Roadmap probe, not yet served: resolved beneficial-ownership chain for a UK company from PSC data, entity-resolved across registries. Calling this records your requirement and returns a structured not-covered response.
vessel_sanctionsRoadmap probe, not yet served: screen a vessel (IMO, name, flag) against sanctions designations.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Roadmap probe, not yet served: screen a vessel (IMO, name, flag) against sanctions designations. Calling records the requirement.
Only reads 6Show 6 read-only tools
cross_registry_resolveRoadmap probe, not yet served: resolve a company across Companies House, GLEIF, OpenOwnership and sanctions lists into one entity record with per-assertion provenance.No findings
Why it is in this group
- The name "cross_registry_resolve" says "resolve": a word for reading.
Description, as the server wrote it Roadmap probe, not yet served: resolve a company across Companies House, GLEIF, OpenOwnership and sanctions lists into one entity record with per-assertion provenance. Calling records the ask and returns not-covered.
entity_matchCompare two company references using supplied company-number/LEI equality and normalised name similarity.No findings
Why it is in this group
- The description's first verb is "compare": a word for reading.
Description, as the server wrote it Compare two company references using supplied company-number/LEI equality and normalised name similarity. When one reference has a UK company number and the other only a name, optionally corroborates against Companies House. LEIs are compared as supplied, not validated against GLEIF by this tool. Returns a verdict, heuristic confidence and signal provenance.
find_capabilitySearch live and honestly planned data capabilities.No findings
Why it is in this group
- The name "find_capability" says "find": a word for reading.
Description, as the server wrote it Search live and honestly planned data capabilities. Searches inform build priority.
lei_lookupResolve a legal entity to its Legal Entity Identifier via the GLEIF API, by LEI or by name.No findings
Why it is in this group
- The name "lei_lookup" says "lookup": a word for reading.
Description, as the server wrote it Resolve a legal entity to its Legal Entity Identifier via the GLEIF API, by LEI or by name. Returns LEI, legal name, jurisdiction, status and registration dates. CC0 source data, provenance attached.
registry_doc_fetchRoadmap probe, not yet served: fetch and parse a specific Companies House filing into structured JSON.Reads private dataNo findings
Why it is in this group
- The name "registry_doc_fetch" says "fetch": a word for reading.
What it can reach
- private-dataThe name "registry_doc_fetch" says "fetch" and "doc": it reads documents.
Description, as the server wrote it Roadmap probe, not yet served: fetch and parse a specific Companies House filing into structured JSON. Calling records the requirement.
uk_company_searchSearch the UK Companies House register by name or number.No findings
Why it is in this group
- The name "uk_company_search" says "search": a word for reading.
Description, as the server wrote it Search the UK Companies House register by name or number. Returns candidate companies with number, status, type, incorporation date and registered address, with provenance. Primary source with retrieval timestamp; cached for up to 24 hours.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged untrusted-input or outbound.
- Reads private data1
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write0
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
No check matched anything in these tool definitions. That is not a safety guarantee.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 0.1.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http companyverify https://box.tailacc44f.ts.net/mcpclaude mcp add --transport http companyverify https://box.tailacc44f.ts.net/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__companyverify__uk_company_search",
"mcp__companyverify__lei_lookup",
"mcp__companyverify__entity_match",
"mcp__companyverify__cross_registry_resolve",
"mcp__companyverify__registry_doc_fetch",
"mcp__companyverify__find_capability"
],
"ask": [
"mcp__companyverify__uk_company_profile",
"mcp__companyverify__sanctions_screen",
"mcp__companyverify__uk_psc_ubo",
"mcp__companyverify__pep_screen",
"mcp__companyverify__adverse_media",
"mcp__companyverify__uk_director_changes",
"mcp__companyverify__uk_insolvency_notices",
"mcp__companyverify__fca_register_check",
"mcp__companyverify__kyb_verdict",
"mcp__companyverify__vessel_sanctions",
"mcp__companyverify__uk_procurement_awards",
"mcp__companyverify__eu_vat_check",
"mcp__companyverify__charge_register",
"mcp__companyverify__request_data"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as companyverify. Review it before you use it.
Capability tags behind 1 rule
- mcp__companyverify__registry_doc_fetch private-data
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/io.github.greg-wilko/companyverify/verify?hash=70b4e0a78a307934e0b60290710c9238fb82b517001b6668769b69499c6a51ac" | jq -e '.changed == false'Pinned hash 70b4e0a78a30, from Nov 2, 2026, 19:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/io.github.greg-wilko/companyverify/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/io.github.greg-wilko/companyverify)Source: MCP Registry. Synced Nov 2, 2026, 19:18 UTC.