Back to Browse

Prometiam Risk MCP Server

Developer ToolsModerate7.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Company data for Spain, France, the UK, Ireland, Poland and Norway — registry, KYB and sanctions.

About

Company data for Spain, France, the UK, Ireland, Poland and Norway — registry, KYB and sanctions.

Security Report

7.2
Moderate7.2Low Risk

This is a well-structured MCP server for the Prometiam company data API with proper authentication, reasonable permissions, and clean code quality. The server requires API keys for all operations, implements appropriate error handling, and poses no malicious patterns. Minor findings include broad exception handling and the potential for credential leakage if the API key is accidentally logged, but these are low-severity quality issues that do not materially impact security. Supply chain analysis found 1 known vulnerability in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

4 files analyzed · 5 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

What You'll Need

Set these up before or after installing:

Prometiam Risk API key (rk_live_* or rk_test_*). Get a free key at https://www.prometiam.com/signupRequired

Environment variable: PROMETIAM_API_KEY

Override the API base URL. Default: https://api.prometiam.com/functions/v1/risk-apiOptional

Environment variable: PROMETIAM_BASE_URL

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-matiasmaquieira96-risk-mcp": {
      "env": {
        "PROMETIAM_API_KEY": "your-prometiam-api-key-here",
        "PROMETIAM_BASE_URL": "your-prometiam-base-url-here"
      },
      "args": [
        "-y",
        "prometiam-risk-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

prometiam-risk-mcp

Model Context Protocol server for the Prometiam company data API — official company-registry data for Spain, France, the UK, Ireland, Poland and Norway, plus directors, corporate events, insolvency, VAT/LEI lookup and sanctions screening, as native MCP tools for Claude Desktop, Cursor, Continue, Cline, and any MCP-compatible client.

npm version License: MIT OpenAPI

What you get

30 MCP tools that wrap the Prometiam Risk API:

ToolDescription
companies_searchSearch EU + UK companies by name, NIF (ES), SIREN/SIRET (FR), company_number (UK), or organisation number (NO).
company_detailFull company profile by Prometiam ID — officers, registry coordinates, capital, status. include=risk_flags attaches published tax-debt / debarment signals (ES).
events_searchSearch normalized corporate events: capital changes, director changes, dissolutions, mergers, insolvency.
events_timelineChronological event history for one company (oldest first).
event_detailA single corporate-event record by ID, with before/after values and source notice.
people_searchSearch officers / directors / shareholders by name across registries.
person_detailOfficer / director profile with full appointment history across companies.
directors_networkCross-directorship rollup — people appointed to many companies (nominee/hub detection, ES).
sanctions_screenTrigram-fuzzy match against 44,000+ active designations — five sanctions lists (EU consolidated, UN, OFAC, UK OFSI, French Registre des gels) plus 11 US export-control lists (BIS Entity List, Denied Persons, Unverified, MEU; State ITAR-Debarred, ISN; OFAC SSI, CMIC, MBS, PLC, CAPTA). Refreshed daily. include_pep=true adds a PEP block (beta, ES, national politicians only — no relatives or close associates).
sanctions_entityFull detail for one sanctions entity by ID — aliases, programme, listing date.
sanctions_changesAdditions, removals and amendments detected on the sanctions lists, newest first — answer "what changed" without re-screening a whole book of business.
sanctions_watchlistYour sanctions watchlists and any recent hits against them. Read-only; requires the sanctions_watch scope.
vat_validateValidate an EU VAT number against VIES (27 EU states + XI) — returns registered name/address when valid.
lei_lookupLook up a Legal Entity Identifier in the GLEIF global register — legal name, jurisdiction, status, address.
lei_searchResolve a company name to candidate LEIs (GLEIF full-text search).
lei_relationshipsGLEIF Level-2 ownership: direct and ultimate parents/children of an LEI.
insolvency_searchSearch insolvency / risk notices (bankruptcies, liquidations, judgments).
insolvency_notices_searchCorporate insolvency notices from official gazettes in FR, DE, GB, AT, CH, NO, FI, US — distress coverage in markets with no registry held. Corporate only; personal insolvency is never returned.
insolvency_recordA single insolvency / risk notice by ID, with related events.
notice_detailRegistry gazette PDF metadata: edition, parse status, hash, raw text.
coverageDataset coverage stats per country (companies, events, freshness).
accountCalling key's plan, rate limits, remaining quota, and scopes.
monitor_listList companies subscribed to ongoing monitoring for this key.
monitor_getOne monitored company by ID, with its alert history.
monitor_subscribeSubscribe a company to daily monitoring (events/status/sanctions → signed webhook). ES, IE and PL only. Mutating.
monitor_stopStop monitoring a company and delete the subscription. Mutating.
prospect_companies_searchSearch companies by firmographics — sector group, NACE code, company age, employee band — for ICP / prospect-list building.
prospect_people_searchFind contactable decision-makers (officers ES/FR, PSC owners GB) by seniority, department, and contact-route availability. Compliance-safe.
prospect_company_contactsCompliance-safe contact routes (role/company emails, phone, website, LinkedIn) published by the organisation. Suppression-filtered.
prospect_suppressAdd an email/domain/LinkedIn/phone/person/company to the prospecting opt-out list (GDPR). Mutating.

Source: Spain (BORME), France (BODACC), United Kingdom (Companies House), Ireland (CRO), Poland (KRS), Norway (Brønnøysundregistrene / Enhetsregisteret, NLOD) — 26M+ companies. Daily updates. EU data residency.

Officer/director data is held for Spain, France, the UK and Norway. Ireland and Poland are company-level for now. Norway has no corporate-event stream, so the event tools return nothing for country=NO.

Install

npx -y prometiam-risk-mcp   # one-shot run, no install needed
# or
npm install -g prometiam-risk-mcp   # global install for the bin

Configure

You need a Prometiam API key. Free tier: 1,000 calls/month, no credit card. Sign up at https://www.prometiam.com/signup.

Set it as an environment variable:

export PROMETIAM_API_KEY="rk_live_..."

Use with Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "prometiam-risk": {
      "command": "npx",
      "args": ["-y", "prometiam-risk-mcp"],
      "env": {
        "PROMETIAM_API_KEY": "rk_live_your_key_here"
      }
    }
  }
}

Restart Claude Desktop. The 30 tools appear in the tool list. Try:

"What's the Prometiam coverage today?" "Search for companies named Mercadona in Spain." "Run a sanctions screen on the name Juan Perez at threshold 85." "Build a corporate-event timeline for Inditex."

Use with Cursor

Edit .cursor/mcp.json in your project (or globally at ~/.cursor/mcp.json):

{
  "mcpServers": {
    "prometiam-risk": {
      "command": "npx",
      "args": ["-y", "prometiam-risk-mcp"],
      "env": {
        "PROMETIAM_API_KEY": "rk_live_your_key_here"
      }
    }
  }
}

Use with Continue

Add to ~/.continue/config.json under experimental.modelContextProtocolServers:

{
  "experimental": {
    "modelContextProtocolServers": [
      {
        "transport": {
          "type": "stdio",
          "command": "npx",
          "args": ["-y", "prometiam-risk-mcp"],
          "env": { "PROMETIAM_API_KEY": "rk_live_your_key_here" }
        }
      }
    ]
  }
}

Use with any other MCP client

Anything that speaks MCP over stdio works. Run the binary with PROMETIAM_API_KEY set in the environment. JSON-RPC requests on stdin, responses on stdout, logs on stderr.

Environment variables

VariableRequiredDefault
PROMETIAM_API_KEYYes
PROMETIAM_BASE_URLNohttps://api.prometiam.com/functions/v1/risk-api

Smoke test

Once installed and configured, you can verify the server lists tools without spinning up an MCP client:

echo '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | PROMETIAM_API_KEY=rk_live_... npx -y prometiam-risk-mcp

You should see a JSON-RPC response with all 30 tools and their schemas.

Rate limits & pricing

Per Prometiam tier (returned in every response's meta.rate_limit):

TierPriceCalls/monthDaily capRPM
Free€01,00020010
Starter€9.9910,0002,00060
Professional€29.99100,00020,000300
Scale€99.991,000,000200,000600
EnterpriseCustomCustomCustomCustom

Privacy and data residency

  • All requests hit the Prometiam Risk API in EU (AWS eu-central-1, Frankfurt).
  • The MCP server adds no telemetry of its own — it just forwards requests to the API.
  • Officer data is processed under GDPR Article 6(1)(c) (legal obligation of public registries) and 6(1)(f) (legitimate interest in fraud prevention).
  • Mostly read-only. The only mutating tools are monitor_subscribe and monitor_stop (create/delete a monitoring subscription tied to your key) and prospect_suppress (adds a GDPR opt-out); every other tool is read-only.

Source

This package is open source under the MIT license. The Risk API itself is a commercial service — see https://www.prometiam.com for terms.

License

MIT © Prometiam

Reviews

No reviews yet

Be the first to review this server!