Summary

Eight tools for the usual questions, and a discovery trio so the unusual ones still land.

list_endpoints reads the backend's live OpenAPI spec, get_endpoint_schema resolves a single endpoint's parameters inline and call_endpoint executes it read-only, so a question the named tools do not cover is answerable now rather than after the next release. Two things to settle first: the Netherlands and Germany sit behind a Starter+ subscription and return 402 on a free key, and once you are paying, an NL call costs five quota units where most countries cost one. The publisher is explicit that sanctions hits, adverse-media matches and risk scores are signals to review rather than verdicts — treat the report as the start of a decision, not the decision.

What it is

A thin adapter over the Nordic Data API that puts official European business data in front of an agent for DK, NO, SE, FI, IE, UK, FR, DE, CZ, PL, LV, EE, NL, BE and LU. Eight named tools cover the questions that come up most, and three discovery tools open the rest of the API at runtime. Each tool maps one-to-one onto an endpoint — no caching, no transformation in between.

What you get

lookup_company reads the national registries directly — CVR, Brønnøysund, Bolagsverket, Companies House, INSEE and the rest — for name, address, status, industry, VAT registration and founding date
kyb_full is the master report, aggregating nine sections: identity, registration, persons, financials, LEI, VAT, sanctions, adverse media and a risk score
screen_sanctions takes up to 1000 names at once against UN, EU, OFAC and PEP lists — 768K+ OpenSanctions entries — and returns fuzzy match scores with the source list and risk topics behind each hit
validate_vat goes to VIES for the EU and HMRC for GB, and answers with the registered name and address alongside the verdict
lookup_lei resolves a GLEIF identifier forwards, or backwards from a national company number, with parent, ultimate parent and subsidiaries
company_enriched joins registry data to a register-validated address with coordinates, national industry statistics, and Wikidata's website, employee count, CEO, ticker and logo
autocomplete_address uses each country's authoritative register: DAWA for Denmark, Kartverket for Norway, BAN for France, MML for Finland, Nominatim elsewhere
fr_history builds a French company timeline from INSEE Sirene's bitemporal records — one event per change of name, NAF activity code, status or legal form, including the state at registration
list_endpoints, get_endpoint_schema and call_endpoint reach what the named tools do not: list the read-only endpoints from the backend's live OpenAPI spec, read one schema with its $refs resolved, then execute it — GET and HEAD only, plus three allowlisted screening POSTs

Requirements

Runs over stdio as npx -y nordic-data-mcp and refuses to start without NORDIC_API_KEY, issued at addonnordic.com with a free tier of 100 lookups a day. NORDIC_DEFAULT_COUNTRY sets the country to assume when a call omits one. Remote clients have two hosted endpoints: /mcp is public, needs no key and bills the operator, while /mcp/auth requires Authorization: Bearer ndk_… and bills your own quota. Authentication is a static API key rather than OAuth, so a client that only understands URL-plus-OAuth belongs on the public endpoint. The Netherlands and Germany need a Starter+ subscription and answer HTTP 402 upgrade_required on a free key; on paid tiers an NL call spends 5x quota units and a DE call 3x, against 1x everywhere else. MIT.

Setup effort

One command plus a key — npx -y nordic-data-mcp, then supply credentials

Nordic Data MCP