# registry-mcp — national company registries

> The company registry MCP: brreg orgnr, Companies House, Bolagsverket organisationsnummer.

- name: io.github.foretak/registry-mcp
- version: 0.4.2
- connection class: R0 (autonomous)
- trust: 94/100
- quality: 94/100 (strong)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.foretak%2Fregistry-mcp
- tools: https://api.protogrid.dev/v1/servers/io.github.foretak%2Fregistry-mcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "registry-mcp": {
      "type": "http",
      "url": "https://api.foretak.dev/mcp"
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: 100
- freshness: 85
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-100% ~updated-40d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 94/100 (strong)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 4 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 7 of 7 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 4,323 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 100 (weight 15)

- pass `deps.known_vulns`: no known advisory in 77 resolved packages
- pass `deps.mcp_sdk_version`: mcp 2.2.0, no known advisory
- pass `deps.resolvable`: registry-mcp@0.4.2, registry-mcp@0.4.2 resolved: 77 packages

- tools: 7, about 4,323 tokens to load them all
- tool set hash: 4b14d5cd725232b9b78f57fc3b14c702
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.foretak/registry-mcp.svg)](https://protogrid.dev/servers/io.github.foretak/registry-mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- pypi registry-mcp@0.4.2: resolved, 75 dependencies, MCP SDK mcp 2.2.0
- npm registry-mcp@0.4.2: resolved, 0 dependencies

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://api.foretak.dev/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

- pypi registry-mcp@0.4.2 secrets: COMPANIES_HOUSE_API_KEY, BOLAGSVERKET_CLIENT_ID, BOLAGSVERKET_CLIENT_SECRET
- npm registry-mcp@0.4.2 secrets: COMPANIES_HOUSE_API_KEY, BOLAGSVERKET_CLIENT_ID, BOLAGSVERKET_CLIENT_SECRET

## Tools (7)

- `company_deadlines`: Give the next occurrence of each statutory filing deadline a company faces.

`country="NO"` covers the Norwegian calendar (Regnskapsregisteret, Skatteetaten) for a
company looked up by organisasjonsnummer (orgnr, org.nr) in Brønnøysundregistrene /
Enhetsregisteret (brreg): årsregnskap, generalforsamling, skattemelding,
aksjonærregisteroppgaven, mva-melding, a-melding. `country="GB"` covers the two
Companies House obligations for a company number (CRN): the annual accounts filing and
the confirmation statement (CS01). `country="SE"` covers the two Swedish obligations of
an aktiebolag (AB) or ekonomisk förening (EK) looked up by organisationsnummer at
Bolagsverket: the ordinary general meeting (ordinarie bolagsstämma / årsstämma) at six
months from the financial year end, and the annual report (årsredovisning) at seven,
where the late-filing fee (förseningsavgift) begins.

Pass `today` (`YYYY-MM-DD`) for a reproducible answer; it defaults to the server's
current UTC date. Quote `due_date`, not `statutory_date`, and quote each deadline's
`applies_because` rather than presenting a date as unconditional fact — that sentence
carries the legal form or flag the date rests on, its statute, any assumption still in
it, and for the UK whether it is Companies House's own figure or one computed here.
`days_until` goes negative for a filing Companies House still shows as overdue. Swedish
dates assume a financial year ending 31 December unless you pass `include=["filings"]`,
which substitutes the year end of the last filed annual report where Bolagsverket's
document list holds one; the filing date is an outer limit regardless, since a company
whose general meeting was earlier must file earlier. An empty `deadlines` list is a real
answer — a bankrupt, deleted or compulsorily-liquidated entity, a branch/sub-unit, or
any company whose status is not active — and `notes` explains why.
`registry://rules/{country}` carries each country's full deadline rules, roll-forward
treatment and legal sources. `rules_last_reviewed` names the date this country's
statutes and day-count arithmetic were last checked against the law — a deadline
computed long after that date should be re-verified before anyone acts on it.

Errors are the `{"error": {"code", "message", "hint"}}` envelope this server's
instructions set out code by code; `hint` names the next call. This tool looks the
entity up first, so any `lookup_company` error code can surface here too.
- `fetch`: ChatGPT connector alias; other clients should prefer `lookup_company` plus
`company_deadlines`, which return the CompanyReport and DeadlineReport shapes directly.
Takes one `id` from `search` — "{COUNTRY}:{identifier}", e.g. "NO:923609016" — and
returns that company's register record and statutory filing deadlines as readable text,
both full JSON documents in `metadata`.
- `list_countries`: List every national company registry this service can answer for right now, with each
one's identifier scheme, source URL, licence, `supported_includes`, and whether the
upstream register needs a credential (`requires_api_key`, `api_key_env`).

Call it before your first lookup in a country you have not used here, whenever a user
names a country you are unsure of, or before guessing an `include` value — never
hard-code a country list of your own, since it grows as modules are added. Stub modules
are hidden; only registries that actually answer are listed. No error mode.
- `lookup_company`: Look up a company by its national identifier and get the full CompanyReport — legal
form, status, address, VAT registration where the register publishes it, board and
accounts duties, employees, and more.

`country="NO"` is the norway company lookup for the norwegian business registry:
Brønnøysundregistrene / Enhetsregisteret (brreg), by organisasjonsnummer (orgnr,
org.nr). `country="GB"` is the uk company lookup at Companies House, by company number
(company registration number, CRN) — "UK" is not a country code here. `country="SE"` is
the swedish company lookup at Bolagsverket, by organisationsnummer or a sole trader's
(enskild näringsidkare) personnummer, and by identifier only, since Bolagsverket's free
API has no name search.

`include=[...]` attaches seven second fetches, each with its own provenance and
`null` unless you ask: `filings` (filing history — do they file, and on time),
`charges` (registered mortgages and security interests), `insolvency` (winding-up
and administration), `financials` (annual accounts — turnover, operating result,
profit, balance sheet: the solvency question), `lei` (the GLEIF Legal Entity
Identifier), `parents` (direct and ultimate parent — this entity's group — from
GLEIF) and `peppol` (whether an e-invoice would reach them, ahead of Norway's 1
January 2027 EHF duty). The `include` argument explains each: what it returns, which
countries declare it, how to read its nulls.

Use it once you have the identifier — from the user, an invoice, a contract, or a
`search_company` hit's `id`. Read the returned `notes` before acting: it carries
caveats such as bankruptcy, dissolution, a deleted entity, an unclassified legal
form, or an attachment whose own fetch failed.

This tool does not perform sanctions, PEP or adverse-media screening, and it does not
verify bank account details — it returns identity and filing data from the national
register only, never a compliance clearance or a confirmed payment detail.

Errors are the `{"error": {"code", "message", "hint"}}` envelope this server's
instructions set out code by code (D-007); `hint` names the next call. A failed
*attachment* fetch is not one of them: the base report still comes back, that block
is left `null`, and `notes` says which attachment failed and why.
- `search`: ChatGPT connector alias; other clients should prefer `search_company`, which takes an
explicit `country` and returns the full SearchResult. One free-text query — a name, an
identifier, or either plus a country — across Norway, the United Kingdom and Sweden.
Returns {"results": [{"id", "title", "url"}]}; pass a result's `id` to `fetch`.
- `search_company`: Search a national company register by name, when you have a name rather than an
identifier.

`country="NO"` searches Brønnøysundregistrene / Enhetsregisteret (brreg) — the norway
company lookup for the norwegian business registry when the organisasjonsnummer (orgnr,
org.nr) is not yet known; `country="GB"` is the uk company search at Companies House,
returning each hit's company number (company registration number, CRN).

**Sweden cannot be searched by name.** Bolagsverket's free API has four operations and
none takes a company name, so `country="SE"` raises `not_implemented` — a fact about
the register, not a temporary gap, and it will not start working. Sweden supports
lookup by identifier only: call `lookup_company` with the ten-digit
organisationsnummer (or a sole trader's twelve-digit personnummer), or
`validate_company_id` first to check the shape for free. Bolagsverket publishes the
whole register as bulk downloadable files for callers who must search by name.

Then call `lookup_company` with the `id` of the right hit for the full report — a
search hit is deliberately thin (name, legal form, status, city) and must not be acted
on directly. Hits arrive in the register's own relevance order, so read each hit's
`confidence` rather than assuming the first row is best. Zero hits is not an error, and
`hint` says what to try next — Norwegian names are registered upper-case and often carry
an 'AS', 'ASA' or 'NUF' suffix, UK names a 'LIMITED', 'LTD', 'PLC' or 'LLP' one, worth
dropping before concluding a company does not exist.

Errors are the `{"error": {"code", "message", "hint"}}` envelope this server's
instructions set out code by code; `hint` names the next call. Call `list_countries`
if you are unsure a country is supported.
- `validate_company_id`: Check whether a national company identifier is well-formed — no network call.

`country="NO"` checksum-checks a Norwegian organisasjonsnummer (orgnr, org.nr) for
Brønnøysundregistrene / Enhetsregisteret (brreg) — the cheap norway company lookup
pre-check for the norwegian business registry. `country="GB"` shape-checks and
normalises a UK company number (company registration number, CRN) for Companies House
('445790' → '00445790', 'oc303675' → 'OC303675'); a CRN has no check digit, so a GB
`valid: true` means the shape is right and nothing more. `country="SE"` shape-checks and
normalises a Swedish organisationsnummer for Bolagsverket ('556016-0680' and
'SE556016068001' both become '5560160680') and accepts a sole trader's twelve-digit
personnummer; Sweden's check digit is **not** enforced here (`registry://rules/SE` says
why), so an `SE` `valid: true` means the shape is right, `reason` may carry a caveat,
and the register's own verdict arrives on the lookup. It is the cheapest way to tell a
ten-digit Swedish organisationsnummer from a nine-digit Norwegian organisasjonsnummer.

Use it on user input or a spreadsheet column before spending a real `lookup_company`
call, since it is instant and free.

Returns a ValidationResult and never raises for a malformed identifier: `valid: false`
comes with `reason` and `hint` rather than a tool error — this tool answers a question,
it does not fail on bad input (D-010). A valid identifier does not mean the entity
exists; follow it with `lookup_company` if you need facts. The only error it raises is
`unsupported_country`, in the usual `{"error": {"code", "message", "hint"}}` envelope —
call `list_countries`.