Skip to content
anlyon.devby Anlyon

EU Business Data (VAT, EORI, company, sanctions, KYB)

io.github.wsystemdev/eu-business-data-mcpwsystemdevstreamable-httpv1.0.3Scanned

EU VAT (VIES) and EORI validation, company registry, sanctions screening, KYB. Free tier, x402.

13 tools: 1 do something that can't be undone, 6 change things and 6 only read.

Tools: 0 delete, 1 irreversible, 6 write, 6 read.
  • Reads private data · 0
  • Reads text others write · 0
  • Can send data out · 1
  • No findings

Anlyon alternative

7 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

13 tools

Can't be undone 1Claude Code: ask
  • send_einvoice_sandboxSANDBOX ONLY - never reaches a real buyer.Can send data outNo findings

    Why it is in this group

    • The name "send_einvoice_sandbox" says "send": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • outboundThe name "send_einvoice_sandbox" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    SANDBOX ONLY - never reaches a real buyer. Runs the full send flow on an invoice (same JSON as create_einvoice): VIES check of the buyer VAT, sanctions screen of the buyer name, EN 16931 create + validate, route lookup (Peppol/mandate), transport hand-off and an Ed25519-signed evidence receipt (JWS). transport: "mock" (simulated, default), "recommand" or "e-invoice-be" (the UBL is really submitted to that Peppol access point's sandbox, addressed to W System's own sandbox company; the partner document id is returned). Use it to build and test an integration before live sending exists.
Changes things 6Claude Code: ask
  • check_fr_pa_registryIs this e-invoicing platform on France's official list of Plateformes Agréées (PA)?No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Is this e-invoicing platform on France's official list of Plateformes Agréées (PA)? name = platform or company name (e.g. 'Pennylane'), website = its site (e.g. 'https://www.acubeapi.com/'); give at least one. Checks the DGFiP lists on impots.gouv.fr: registered PAs (with registration date) and operators awaiting interoperability tests. Returns on_official_list, status (approved | awaiting_interop_tests | possible_match | not_found), scored matches, list date and the official source. Use for supplier due diligence before the French reform (receive from 1 Sep 2026, SMEs issue from 1 Sep 2027). A 'solution compatible' is not a PA itself. Unofficial copy; the official lists prevail.
  • create_einvoiceCreate a validated EU e-invoice (UBL 2.1) from simple JSON.No findings

    Why it is in this group

    • The name "create_einvoice" says "create": a word for a change.
    Description, as the server wrote it
    Create a validated EU e-invoice (UBL 2.1) from simple JSON. invoice = {format: en16931|xrechnung|peppol-bis3, invoice_number, issue_date (YYYY-MM-DD), due_date?, tax_point_date?, delivery_date?, currency (EUR), buyer_reference?, seller: {name, vat_id, street, city, postal_code, country, email, phone, contact_name, company_id?, company_id_scheme?, legal_form?}, buyer: {...}, lines: [{description, quantity, unit_price, unit?, vat_category (S|Z|E|AE|K|G|O), vat_rate}], payment: {iban, bic?, terms?}}. Totals and VAT breakdown are computed; returns {valid, xml, totals, errors}.
  • due_diligence_reportCounterparty due-diligence report in one call: VIES VAT, official business register, EU/UN/OFAC/UK sanctions, EC EORI, GLEIF LEI and Peppol e-invoice route, with deterministic risk…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Counterparty due-diligence report in one call: VIES VAT, official business register, EU/UN/OFAC/UK sanctions, EC EORI, GLEIF LEI and Peppol e-invoice route, with deterministic risk flags, 0-100 risk score, pass/review/fail verdict, sources and UTC timestamp. company: VAT ID (best), registry number or name; country: ISO code for names.
  • einvoice_route'Can I e-invoice this company?' id = EU VAT number (e.g.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    'Can I e-invoice this company?' id = EU VAT number (e.g. 'BE0403170701') or Peppol id ('0208:0403170701'). Returns VIES VAT status, Peppol registration (Peppol Directory, then SML/SMP; BIS 3 invoice support), the country's B2B e-invoice mandate (dates, format, source) and the recommended format for create_einvoice. France's PPF directory is not included yet.
  • kyb_checkOne-call KYB check of a supplier/customer: EU VAT validation (VIES) + official business register + EU/UN/OFAC/UK sanctions screening, returning a pass / review / fail verdict with …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    One-call KYB check of a supplier/customer: EU VAT validation (VIES) + official business register + EU/UN/OFAC/UK sanctions screening, returning a pass / review / fail verdict with reasons. company: a VAT ID ('FR40303265045'), a company name, or a registry id; country: optional ISO code (e.g. 'NO').
  • screen_sanctionsScreen a person or company name against official EU, UN, OFAC SDN and UK sanctions lists.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Screen a person or company name against official EU, UN, OFAC SDN and UK sanctions lists. Fuzzy matching with transliteration; returns candidate matches with 0-100 scores, list, programme, DOB. A potential match needs human review; this is a screening aid, not legal advice.
Only reads 6Show 6 read-only tools
  • lookup_companyLook up a company in official European business registers by name or registry number.No findings

    Why it is in this group

    • The name "lookup_company" says "lookup": a word for reading.
    Description, as the server wrote it
    Look up a company in official European business registers by name or registry number. country: FR (SIREN), NO (org.nr), FI (Y-tunnus), CZ (ICO), PL (KRS number), EE, or any other ISO code / 'LEI' (GLEIF). Returns legal name, ID, status/active, address, VAT ID, activity code and official source link. Use to confirm a company exists and is active, find its registry number, or map a name to a VAT ID.
  • validate_einvoiceValidate an EU e-invoice XML (UBL 2.1 Invoice/CreditNote or UN/CEFACT CII, e.g.No findings

    Why it is in this group

    • The name "validate_einvoice" says "validate": a word for reading.
    Description, as the server wrote it
    Validate an EU e-invoice XML (UBL 2.1 Invoice/CreditNote or UN/CEFACT CII, e.g. XRechnung, Factur-X/ZUGFeRD XML) against the official CEN EN 16931 rules and, for XRechnung, the KoSIT XRechnung 3.0 rules. Returns valid, and every error with its rule ID (e.g. BR-CO-10), a plain-English message, XPath and a fix hint. rules: auto | en16931 | xrechnung. Slovak sellers also get eFaktúra field checks (FR SR transposition v1.12, warnings with ruleset SK-FS); Norwegian sellers get NO-LAW field checks. Peppol-specific rules are not checked yet. For PDFs use the REST endpoint POST /einvoice/validate.
  • verify_batchValidate up to 100 EU VAT numbers in one call via VIES (supplier/customer list cleanup, onboarding, invoice runs).No findings

    Why it is in this group

    • The description's first verb is "validate": a word for reading.
    Description, as the server wrote it
    Validate up to 100 EU VAT numbers in one call via VIES (supplier/customer list cleanup, onboarding, invoice runs). Same per-item result as verify_vat; items with member_state_unavailable should be retried later (GB items stay member_state_unavailable until HMRC live access is granted; they are not charged).
  • verify_eoriValidate an EU EORI (customs Economic Operators Registration and Identification) number, e.g.No findings

    Why it is in this group

    • The description's first verb is "validate": a word for reading.
    Description, as the server wrote it
    Validate an EU EORI (customs Economic Operators Registration and Identification) number, e.g. 'SE5560360793', 'DE1234567890123', against the official European Commission EOS service. Use for import/export, customs declarations and freight-forwarder onboarding. Returns valid/invalid and trader name/address only when the trader consented to publication. UK (GB) EORIs are not in EOS (HMRC checks those); XI EORIs are.
  • verify_eori_batchValidate up to 100 EU EORI numbers in one call via the official EC EOS service (customs / import-export KYB).No findings

    Why it is in this group

    • The description's first verb is "validate": a word for reading.
    Description, as the server wrote it
    Validate up to 100 EU EORI numbers in one call via the official EC EOS service (customs / import-export KYB).
  • verify_vatValidate an EU VAT number against the official European Commission VIES service (27 EU states + XI Northern Ireland).No findings

    Why it is in this group

    • The description's first verb is "validate": a word for reading.
    Description, as the server wrote it
    Validate an EU VAT number against the official European Commission VIES service (27 EU states + XI Northern Ireland). Use when asked whether a VAT ID is valid/active, before zero-rated reverse-charge B2B invoices, or to get a company's registered name/address from its VAT number. Input: VAT with country prefix, e.g. 'IE6388047V', 'DE811193231' (spaces/dots ok). Returns status: valid | invalid | invalid_format | member_state_unavailable (VIES/member state down - retry later, valid=null) | error, plus name, address (if the member state discloses them; DE/ES often don't) and consultation_number (audit proof) when requester is set. UK (GB) VAT checks are coming soon: until HMRC live access is granted, GB numbers return status member_state_unavailable, valid=null, error HMRC_LIVE_ACCESS_PENDING (not charged). For >1 number use verify_batch.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or untrusted-input.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.3. Values in angle brackets are yours to fill in.

claude mcp add --transport http eu-business-data https://api.wsystem.dev/mcp/
claude mcp add --transport http eu-business-data https://api.wsystem.dev/mcp/

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__eu-business-data__verify_vat",
      "mcp__eu-business-data__verify_batch",
      "mcp__eu-business-data__lookup_company",
      "mcp__eu-business-data__verify_eori",
      "mcp__eu-business-data__verify_eori_batch",
      "mcp__eu-business-data__validate_einvoice"
    ],
    "ask": [
      "mcp__eu-business-data__screen_sanctions",
      "mcp__eu-business-data__kyb_check",
      "mcp__eu-business-data__create_einvoice",
      "mcp__eu-business-data__einvoice_route",
      "mcp__eu-business-data__send_einvoice_sandbox",
      "mcp__eu-business-data__due_diligence_report",
      "mcp__eu-business-data__check_fr_pa_registry"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as eu-business-data. Review it before you use it.

Capability tags behind 1 rule
  • mcp__eu-business-data__send_einvoice_sandbox outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.wsystemdev/eu-business-data-mcp/verify?hash=2a16302537e5ccc218f62a4409d69e7ea42f3277da1b8aa967cbe8ee317c790c" | jq -e '.changed == false'

Pinned hash 2a16302537e5, from Oct 26, 2026, 21:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.wsystemdev/eu-business-data-mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.github.wsystemdev/eu-business-data-mcp
[![anlyon.dev](https://anlyon.dev/badge/io.github.wsystemdev/eu-business-data-mcp.svg)](https://anlyon.dev/servers/io.github.wsystemdev/eu-business-data-mcp)

Source: MCP Registry · repository. Synced Oct 26, 2026, 21:18 UTC.