{
  "markdown": "# Apier MCP Server — Norwegian company data and compliance for AI agents\n\n[Apier](https://apier.no) is a hosted [MCP](https://modelcontextprotocol.io) (Model Context Protocol) server that gives AI agents structured access to Norwegian company data and regulatory compliance. It resolves any 9-digit **organisasjonsnummer** (organisation number) against **Brønnøysundregistrene** (the Brønnøysund Register Centre / Enhetsregisteret), answers who holds **signing authority** for a company (**signaturrett** and **prokura**), reads **annual accounts** (årsregnskap) from Regnskapsregisteret, computes **filing deadlines** for MVA, A-melding and Årsregnskap, and brokers **fullmakt** — scoped, revocable company→agent authority delegated through an **Altinn 3** systembruker, authenticated upstream via **Maskinporten** against **Skatteetaten** and other agencies. This repository is the thin, hardened npm proxy (`@apier-no/mcp`) that connects local stdio MCP clients to the hosted server.\n\n## What you can ask\n\nWith this server connected, an AI agent can answer questions like:\n\n- \"What's the organisasjonsnummer for Equinor?\" *(search_companies)*\n- \"Who can legally sign on behalf of org number 923 609 016 — and is it signaturrett or prokura?\" *(get_company_authority)*\n- \"Is this company VAT-registered, and what regulatory obligations does it have?\" *(get_company_summary)*\n- \"What filing deadlines is this company facing in the next six months?\" *(get_company_deadlines)*\n- \"Show me the latest annual accounts (årsregnskap) for this company.\" *(get_company_accounts)*\n- \"What is the Altinn 3 equivalent of this old Altinn 2 role code?\" *(get_altinn_migration_guidance)*\n- \"What's the current Norges Bank exchange rate for EUR to NOK?\" *(get_exchange_rate)*\n- \"Request a fullmakt so I can act on behalf of this company, then verify it before filing.\" *(request_fullmakt, check_fullmakt)*\n\n## Tools\n\nAll 25 tools exposed by the hosted server at `https://www.apier.no/api/mcp` (discovered live via `tools/list`):\n\n| Tool | Description |\n|---|---|\n| `get_company_summary` | Retrieve a one-shot compliance summary for a Norwegian organisation by its 9-digit organisasjonsnummer (organisation number, the public ID issued by the Brønnøysund Register Centre / Enhetsregisteret — Central Register of Legal Entities). |\n| `get_public_obligations` | Retrieve the universal obligation set for a Norwegian entity type. |\n| `get_exchange_rate` | Fetch the most recent Norges Bank (Norway's central bank, Norges Bank in Norwegian — the official issuer of the krone) exchange-rate reference for a currency against NOK. |\n| `list_acting_capacity` | Resolve every Norwegian regulatory action a person is currently authorised to perform on behalf of a specific organisation. |\n| `get_company_profile` | Resolve a Norwegian organisasjonsnummer (9-digit org number) into a structured company profile sourced from Brønnøysund Enhetsregisteret (data.brreg.no). |\n| `check_authorization` | Return the authorisation snapshot for the calling consumer's delegation on a Norwegian organisation. |\n| `get_company_context` | Retrieve the structured Brønnøysund identity slice for a Norwegian organisation by its 9-digit organisasjonsnummer (organisation number, the public ID issued by the Brønnøysund Register Centre / Enhetsregisteret — Central Register of Legal Entities). |\n| `get_company_deadlines` | Compute the upcoming Norwegian regulatory filing calendar for a specific organisation, looking horizon_months into the future. |\n| `get_company_obligations` | Evaluate the Apier Rulebook for a Norwegian organisation and return every applicable regulatory obligation with its current state and the legal reference it derives from. |\n| `get_public_deadlines` | Compute the universal Norwegian regulatory filing calendar — the set of deadlines that apply to every Norwegian business of the covered categories (MVA, A-melding, Årsregnskap), independent of any specific organisation. |\n| `validate_action` | Run the Apier dry-run validator against a proposed regulatory action without producing ANY upstream side effect — no Maskinporten call, no Altinn / Skatteetaten / NAV submission. |\n| `explain_compliance_error` | Resolve a structured Apier compliance error code into a Norwegian-bokmål Explanation envelope sourced from the Apier Compliance Explainer (PR-049). |\n| `search_companies` | Resolve a Norwegian company NAME to its 9-digit organisasjonsnummer (organisation number). |\n| `get_company_verification` | Get the deterministic verification verdict for a Norwegian organisation by its 9-digit organisasjonsnummer (organisation number, the public ID issued by the Brønnøysund Register Centre / Enhetsregisteret). |\n| `get_company_authority` | Use this to answer \"who can legally sign for this Norwegian company, and how?\" before acting on its behalf. |\n| `get_company_accounts` | Use this for a current-snapshot read of a Norwegian company's annual accounts (årsregnskap) from the OPEN Regnskapsregisteret tier. |\n| `get_company_filing_history` | Use this to reconcile a Norwegian company's Altinn 3 filing history against the filings YOUR consumer submitted through Apier — the accountant/auditor reconciliation wedge. |\n| `list_changes` | Use this to read Apier's cross-source change archive — detected created / updated / deleted events across the upstreams Apier polls: Brønnøysund ingestion plus the multi-source pollers for Altinn schemas, DigDir policies, and Norges Bank rates. |\n| `get_altinn_migration_guidance` | Use this to discover the Altinn 3 equivalent of an Altinn 2 service or role code. |\n| `request_fullmakt` | Broker a fullmakt — a legally-grounded, scoped, revocable company→agent authority delegated through an Altinn systembruker (system user). |\n| `check_fullmakt` | Check your fullmakt state for a Norwegian company BEFORE acting on its behalf — the read leg of AGT-02 Fullmakt Rails and the natural follow-up to request_fullmakt. |\n| `revoke_fullmakt` | Revoke a fullmakt — withdraw an agent's delegated authority for a Norwegian company and retire the agent principal. |\n| `get_pricing` | Call this BEFORE metered work to check per-call cost and whether billing enforcement is live. |\n| `get_credit_balance` | Call this BEFORE a batch of metered calls to confirm the calling key's prepaid credit balance covers it, and AFTER a 402 INSUFFICIENT_CREDITS + human top-up to verify the funds landed before retrying. |\n| `redeem_issuance_token` | Call this to convert an owner-issued key-issuance token into your own API key — the headless onboarding step for an agent that holds no credential yet. |\n\n## Try without a key\n\nEvery Category B company endpoint has a zero-auth sandbox mirror under `/api/v1/sandbox/` on apier.no — no signup: where a bearer is expected, you invent your own on the spot. These are direct HTTP calls to the Apier API; starting this npm proxy itself still requires `APIER_API_KEY` (see [Quickstart](#quickstart)).\n\nList the canonical sandbox test data (no auth at all):\n\n```bash\ncurl -sL https://apier.no/api/v1/sandbox/fixtures\n```\n\nTrimmed response — `…` marks omitted fields:\n\n```text\n{\"success\":true,\"data\":{\"schema_version\":\"1.0.0\",\n  \"reserved_test_orgs\":[{\"org_number\":\"999000001\",\"name\":\"Sandbox AS\",\"entity_type\":\"AS\",\"data_tier\":\"tier_1\", …}],\n  \"realistic_orgs\":[{\"org_number\":\"818000006\",\"name\":\"Fjellberg Regnskap AS\",\"entity_type\":\"AS\",\"data_tier\":\"tier_1_2\"}, …],\n  \"magic_scenarios\":[{\"org_number\":\"999660010\",\"state\":\"konkurs\",\"label\":\"Bankrupt (konkurs)\"}, …], …}}\n```\n\nVerify the bankrupt fixture company with a self-invented bearer — any suffix of 1–64 chars from `A-Za-z0-9_-` after `apier_sandbox_test_` works; here bash's `$RANDOM` supplies one. (This call goes to the `www` host directly: the apex→www 308 redirect makes curl drop the `Authorization` header.)\n\n<!--\n  CI COUPLING — keep $RANDOM in the command below; do not substitute a literal\n  suffix. README.md ships inside the npm tarball, and the tarball-audit job in\n  .github/workflows/ci.yml greps the packed files for secret-shaped strings.\n  One of its patterns is the word Bearer, then whitespace, then 20 or more\n  characters from [A-Za-z0-9._+/=-]. The sandbox token prefix on the next line\n  is exactly 19 of those characters, and `$` falls outside the class, so the\n  run stops at 19 and the pattern does not match. Any literal suffix pushes it\n  to 20 or more and fails CI.\n-->\n\n```bash\ncurl -s -H \"Authorization: Bearer apier_sandbox_test_$RANDOM\" https://www.apier.no/api/v1/sandbox/company/999660010/verify\n```\n\nTrimmed response — `…` marks omitted fields:\n\n```text\n{\"success\":true,\"data\":{\"org_number\":\"999660010\",\"name\":\"Sandbox Konkurs AS\",\n  \"verification_status\":\"fail\",\n  \"signals\":{\"is_active\":false,\"not_bankrupt\":false, …},\n  \"summary\":\"Selskapet er ikke aktivt registrert i Enhetsregisteret.\", …}}\n```\n\nDon't confuse the two test prefixes: `apier_test_` is a production test-mode key that requires signup, while `apier_sandbox_test_` is self-generated and keyless. `GET /api/v1/sandbox/fixtures` is the canonical machine-readable table of sandbox test data.\n\n## Quickstart\n\n### Hosted endpoint (streamable HTTP)\n\nThe fastest path — no install. Point any streamable-HTTP-capable MCP client at:\n\n```text\nhttps://www.apier.no/api/mcp\n```\n\nDiscovery is **keyless**: `initialize`, `tools/list`, resources and prompts all work without credentials, so an agent can explore the full catalogue before authenticating. An API key (`Authorization: Bearer apier_live_…`) is needed only for protected tool calls. See https://www.apier.no/docs/authentication for how to get a key, then create one in the dashboard at https://www.apier.no/dashboard.\n\n### npx stdio proxy (`@apier-no/mcp`)\n\nFor stdio-only clients, this package wraps [`mcp-remote`](https://github.com/punkpeye/mcp-remote), reads `APIER_API_KEY` from your environment, removes it from the spawned child's environment, redacts it from stderr, and hands the bearer value over out-of-band so it never appears on the child's command line — see [SECURITY.md](./SECURITY.md).\n\n`mcp-remote` moved from `geelen/mcp-remote` to `punkpeye/mcp-remote`; the npm package name is unchanged, and 0.8.1 is published with SLSA provenance attestations.\n\n**Published as `@apier-no/mcp`.** The `@apier` scope was unavailable, so this package ships under the `@apier-no` scope.\n\n**Claude Desktop / Cursor** (`claude_desktop_config.json` / `~/.cursor/mcp.json`):\n\n```json\n{\n  \"mcpServers\": {\n    \"apier\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@apier-no/mcp\"],\n      \"env\": { \"APIER_API_KEY\": \"apier_live_<your_key_here>\" }\n    }\n  }\n}\n```\n\n**VS Code** (`.vscode/mcp.json`):\n\n```json\n{\n  \"servers\": {\n    \"apier\": {\n      \"type\": \"stdio\",\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@apier-no/mcp\"],\n      \"env\": { \"APIER_API_KEY\": \"apier_live_<your_key_here>\" }\n    }\n  }\n}\n```\n\n**Zed** (`settings.json`):\n\n```json\n{\n  \"context_servers\": {\n    \"apier\": {\n      \"source\": \"custom\",\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@apier-no/mcp\"],\n      \"env\": { \"APIER_API_KEY\": \"apier_live_<your_key_here>\" }\n    }\n  }\n}\n```\n\nReady-to-paste config files for each client live in [`examples/`](./examples).\n\n## Configuration\n\n| Variable | Required | Default |\n|---|---|---|\n| `APIER_API_KEY` | yes | — |\n| `--endpoint <url>` | no | `https://www.apier.no/api/mcp` |\n| `MCP_REMOTE_CONFIG_DIR` | no | `~/.mcp-auth` |\n\n## Security\n\n- `APIER_API_KEY` is read by the parent process and **scrubbed from the spawned child's environment**, and stderr is passed through a redactor that strips `Bearer …`, `apier_(live|test)_…`, `ghp_…`, and `Authorization:` substrings.\n- **The key never appears in the child's command line.** The `--header` argument carries only the placeholder `Authorization:${APIER_MCP_AUTH_HEADER}`; the bearer value is passed out-of-band in that variable and expanded by `mcp-remote` at request time. Command lines are world-readable on Linux (`/proc/<pid>/cmdline`), process environments are not — so this is no longer readable by other local users ([#33](https://github.com/PowerLaunch/apier-mcp/issues/33), fixed in 1.2.0). An attacker already running as you can still read the environment — see [SECURITY.md](./SECURITY.md).\n- Non-https endpoints are rejected before spawn; `mcp-remote` is exact-pinned and releases are published with npm provenance via GitHub Actions Trusted Publishing (OIDC).\n- Treat client config files (`claude_desktop_config.json`, `.cursor/mcp.json`, …) like `.env` files — never commit them with a real key.\n\nFull threat model and disclosure policy: [SECURITY.md](./SECURITY.md).\n\n## Documentation\n\n- MCP server docs: https://www.apier.no/docs/mcp\n- Apier platform docs: https://apier.no/docs\n\n## License\n\nMIT\n",
  "bytes": 12724,
  "sha": "b7859e0da513311f04f588ed89426481f5127a032378d33664dd131140c26960",
  "repo_slug": "powerlaunch/apier-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_no_apier_mcp_b13f557e/readme"
}