prometiam-risk-mcp

Model Context Protocol server for the Prometiam company data API — official company-registry data for Spain, France, the UK, Ireland, Poland, Norway, Finland, Sweden, Croatia, Belgium, Denmark, Estonia, Slovakia, Switzerland, Latvia, Cyprus, Romania and the United States (state registers, SEC EDGAR, GLEIF), plus directors, corporate events, insolvency, VAT/LEI lookup, sanctions screening, annual financial statements, public-procurement awards (Spain, France, the UK, Ireland, Poland, Norway) and public-buyer risk scores (Spain, France), as native MCP tools for Claude Desktop, Cursor, Continue, Cline, and any MCP-compatible client.

What you get

35 MCP tools that wrap the Prometiam Risk API:

Source: Spain (BORME), France (BODACC), United Kingdom (Companies House), Ireland (CRO), Poland (KRS), Norway (Brønnøysundregistrene / Enhetsregisteret, NLOD), Finland (Kaupparekisteri), Sweden (Bolagsverket), Croatia (Sudski registar), Belgium (KBO/BCE), Denmark (CVR), Estonia (e-Business Register), Slovakia (RPO), Switzerland (Zefix), Latvia (Register of Enterprises), Cyprus (DRCOR), Romania (ONRC), and in the United States the New York, Colorado, Connecticut and Pennsylvania state registers, SEC EDGAR and GLEIF — 33M+ companies. Daily updates for Spain, France, Ireland, Poland and Norway, monthly bulk plus daily delta for the UK, every working day for Finland, Sweden, Belgium, Denmark, Croatia, Estonia and Slovakia, and weekly for the United States. EU data residency.

Officer/director data is held for Spain, France, the UK and Norway. Ireland and Poland are company-level for now. Norway has no corporate-event stream, so the event tools return nothing for country=NO (nor for IE and PL). Finland, Sweden, Belgium, Croatia, Denmark, Estonia, Slovakia, Switzerland, Latvia, Cyprus, Romania and the United States are company records only, with register-change events (name, status, legal form and registered address; share capital for Croatia; dated when the change first appears in the register data (for the United States, the weekly read of the registers that first sees it), not gazette notices, none before 2026-09-30) and monitoring, but no officers and no registry-compliance signal. Corporate insolvency notices are linked by business ID (Finland), organisationsnummer (Sweden), MBS (Croatia), CVR number (Denmark) and UID (Switzerland, where the SHAB notice names the debtor's UID): Swedish notices are Bolagsverket's procedure data (konkurs, företagsrekonstruktion, ackordsförhandling), updated weekly, with no court, case number or link; Croatian notices are court decisions with court and case number where the register states them, only for companies still on the register; Danish notices come from CVR credit information (konkurs and tvangsakkord): one notice per proceeding, dated by the decision that opened it, with the latest stage of the proceeding, with no court or case number. Belgium, Estonia and Slovakia have no insolvency notices (their bankruptcy shows in the company status and in their register-change events). Sole traders (enskild näringsverksamhet, trgovac pojedinac), enterprises of natural persons (eenmanszaak / entreprise individuelle), sole proprietorships (enkeltmandsvirksomhed) and estates are never served; Denmark has no share capital, and its status includes the register's bankruptcy state. Switzerland, Latvia and Cyprus have no activity code (Latvia, Cyprus and Romania also have no insolvency notices; Latvian individual merchants, Cypriot trade names and partnerships and Romanian natural persons and sole traders are never served; Cyprus has no VAT number; Romania has no share capital and its VAT number is built from the CUI by rule), and its sole proprietorships and other natural persons are never served. Every company object carries vat_number and vat_number_source (published by the register, or built from the identifier by rule where the registration is not confirmed; null for the UK, Ireland, Slovakia, Cyprus, Romania and the United States). United States (country=US): company records from the business registers of New York, Colorado, Connecticut and Pennsylvania (state open data) plus SEC filers (EDGAR) and LEI holders (GLEIF) from every state, Delaware included, as one record per state registration (NY-4424185, CIK-0000320193, LEI-…); New York and Pennsylvania active entities only; updated weekly; no officers and no registry-compliance signal, with register-change events (dated by the weekly read) and monitoring; no VAT number; US insolvency notices are not linked to the company records; sole proprietorships never served; not every US company. US sources: New York Department of State, Colorado Secretary of State, Connecticut Secretary of the State, Pennsylvania Department of State (open data), SEC EDGAR, GLEIF (CC0). Contains CVR data (Erhvervsstyrelsen), CC BY 4.0. Source: Zefix, Federal Office of Justice, Federal Commercial Registry Office (open use, source required); restructured by Prometiam, not a certified register extract. Contains data from the Register of Enterprises of the Republic of Latvia and the State Revenue Service (CC0). Contains data from the Department of the Registrar of Companies and Intellectual Property (DRCOR), Republic of Cyprus, via data.gov.cy, CC BY 4.0. Contains data from the National Trade Register Office (ONRC), CC BY 4.0.

Install

npx -y prometiam-risk-mcp   # one-shot run, no install needed
# or
npm install -g prometiam-risk-mcp   # global install for the bin

Configure

It works without any key. The server ships with a shared demo key — 30 requests a minute and 2,000 a day for everyone using it — so the first tool call answers right after npx. When the shared quota is used up the error tells you how to continue.

For your own credits — 14-day free trial: 500 credits; a card is required, nothing is charged for 14 days — sign up at https://www.prometiam.com/signup?utm_source=mcp and set the key as an environment variable:

export PROMETIAM_API_KEY="rk_live_..."

Use with Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "prometiam-risk": {
      "command": "npx",
      "args": ["-y", "prometiam-risk-mcp"],
      "env": {
        "PROMETIAM_API_KEY": "rk_live_your_key_here"
      }
    }
  }
}

Restart Claude Desktop. The 35 tools appear in the tool list. Try:

"What's the Prometiam coverage today?" "Search for companies named Mercadona in Spain." "Run a sanctions screen on the name Juan Perez at threshold 85." "Build a corporate-event timeline for Inditex."

Use with Cursor

Edit .cursor/mcp.json in your project (or globally at ~/.cursor/mcp.json):

{
  "mcpServers": {
    "prometiam-risk": {
      "command": "npx",
      "args": ["-y", "prometiam-risk-mcp"],
      "env": {
        "PROMETIAM_API_KEY": "rk_live_your_key_here"
      }
    }
  }
}

Use with Continue

Add to ~/.continue/config.json under experimental.modelContextProtocolServers:

{
  "experimental": {
    "modelContextProtocolServers": [
      {
        "transport": {
          "type": "stdio",
          "command": "npx",
          "args": ["-y", "prometiam-risk-mcp"],
          "env": { "PROMETIAM_API_KEY": "rk_live_your_key_here" }
        }
      }
    ]
  }
}

Use with any other MCP client

Anything that speaks MCP over stdio works. Run the binary with PROMETIAM_API_KEY set in the environment. JSON-RPC requests on stdin, responses on stdout, logs on stderr.

Environment variables

Smoke test

Once installed and configured, you can verify the server lists tools without spinning up an MCP client:

echo '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | PROMETIAM_API_KEY=rk_live_... npx -y prometiam-risk-mcp

You should see a JSON-RPC response with all 35 tools and their schemas.

Rate limits & pricing

Per Prometiam tier (returned in every response's meta.rate_limit). Every successful call costs credits (0 for account and coverage, 1 for a company search or record, 2 for corporate events, people, director network, insolvency and procurement, 3 for a sanctions screen per name, 25 for one company's financial statements); errors cost nothing, and each response states its cost in the X-Credits-Cost header:

Privacy and data residency

• All requests hit the Prometiam Risk API in EU (AWS eu-central-1, Frankfurt).
• The MCP server adds no telemetry of its own — it just forwards requests to the API.
• Officer data is processed under GDPR Article 6(1)(c) (legal obligation of public registries) and 6(1)(f) (legitimate interest in fraud prevention).
• Mostly read-only. The only mutating tools are monitor_subscribe and monitor_stop (create/delete a monitoring subscription tied to your key); every other tool is read-only.

Source

This package is open source under the MIT license. The Risk API itself is a commercial service — see https://www.prometiam.com/mcp for the install page, or https://www.prometiam.com for terms.

• API documentation: https://www.prometiam.com/risk-api/docs
• OpenAPI 3.0 spec: https://www.prometiam.com/openapi.json
• Pricing: https://www.prometiam.com/pricing
• Support: https://www.prometiam.com/contact

License

MIT © Prometiam