OSINTMCP serverFirst audited Nov 13, 2026

APIEmpresas: Spanish company data

Spanish company data: CIF lookup, BORME, directors, KYB, sanctions and open public tenders.The vendor's description, from its MCP Registry listing.

Passed public checksAudited Nov 13, 2026

Every public check ran and passed. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?: YesConnected in 570 ms.
Sign-up?: None neededIt answered without any account or key.
Can it change things?: No, read-onlyAll 4 tools say they only read.

Endpointhttps://apiempresas.es/api/mcp

Source code Website Streamable HTTP · protocol 2025-06-18 · server version 1.3.0

What we checked, the evidence, and the tools it offers.

What we checked

Security

Passed: Connections are encrypted (HTTPS).
Passed: No hidden instructions found in tool text.

Safety labels

Passed: Every tool says whether it only reads or can change things.

Tools

Passed: 4 tools listed.
Passed: Every tool describes its inputs with a valid schema.

Protocol

Note: Protocol version 2025-06-18.
Passed: The MCP handshake works (Streamable HTTP).
Passed: Unknown requests are refused.

Connection

Passed: The server responds.

Tools (4)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

search_companiesSearches Spanish companies (sociedades) by name or part of the name and returns up to 10 candidates with their tax ID (CIF), province and registry status. Use it when you do not have the CIF of a com…Read-only
get_companyReturns the basic public record of ONE Spanish company from its tax ID (CIF/NIF): legal name, status (active, dissolved, extinguished, in insolvency...), legal form with ISO 20275 code, LEI code, act…Read-only
check_tax_id_revocationChecks whether the Spanish Tax Agency (AEAT) has revoked or reinstated the tax ID (NIF) of a company, as published in the official gazette (BOE). Returns status REVOKED or REHABILITATED with the date…Read-only
get_borme_statsReturns how many filings were published in the Mercantile Registry gazette (BORME) per month or per year, for all of Spain or one province, since 2009: incorporations, dissolutions, extinctions, inso…Read-only

Audit history

Nov 13Passed

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

Request	Answer	Time
initialize	HTTP 200	570 ms
initialized	HTTP 202	346 ms
tools/list	HTTP 200	590 ms
unknown-method	HTTP 200	180 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.

MCP client config

{
  "mcpServers": {
    "io-github-abasmartinc-apiempresas": {
      "type": "http",
      "url": "https://apiempresas.es/api/mcp"
    }
  }
}

Audit record (JSON)

{
  "server": {
    "name": "io.github.abasmartinc/apiempresas",
    "title": "APIEmpresas: Spanish company data",
    "url": "https://apiempresas.es/api/mcp",
    "transport": "streamable-http",
    "topics": [
      "OSINT"
    ],
    "repository": "https://github.com/abasmartinc/apiempresas-mcp",
    "website": "https://apiempresas.es",
    "inRegistry": true
  },
  "audit": {
    "slug": "io-github-abasmartinc-apiempresas",
    "url": "https://apiempresas.es/api/mcp",
    "auditedAt": "2026-11-13T16:26:06.414Z",
    "firstAuditedAt": "2026-11-13T15:57:20.722Z",
    "auditor": "1.0.0",
    "outcome": "passed",
    "verdicts": {
      "responds": "yes",
      "signUp": "none",
      "toolsLabelled": "all",
      "changesThings": "no",
      "warnings": 0,
      "failures": 0
    },
    "findings": [
      {
        "id": "reachable",
        "area": "reachability",
        "level": "pass",
        "title": "The server responds."
      },
      {
        "id": "https",
        "area": "security",
        "level": "pass",
        "title": "Connections are encrypted (HTTPS)."
      },
      {
        "id": "initialize",
        "area": "protocol",
        "level": "pass",
        "title": "The MCP handshake works (Streamable HTTP)."
      },
      {
        "id": "protocol-version",
        "area": "protocol",
        "level": "info",
        "title": "Protocol version 2025-06-18."
      },
      {
        "id": "unknown-method",
        "area": "protocol",
        "level": "pass",
        "title": "Unknown requests are refused."
      },
      {
        "id": "tools-list",
        "area": "tools",
        "level": "pass",
        "title": "4 tools listed."
      },
      {
        "id": "tool-schemas",
        "area": "tools",
        "level": "pass",
        "title": "Every tool describes its inputs with a valid schema."
      },
      {
        "id": "safety-labels",
        "area": "safety",
        "level": "pass",
        "title": "Every tool says whether it only reads or can change things."
      },
      {
        "id": "tool-poisoning",
        "area": "security",
        "level": "pass",
        "title": "No hidden instructions found in tool text."
      }
    ],
    "server": {
      "name": "apiempresas",
      "version": "1.3.0",
      "title": "APIEmpresas",
      "protocolVersion": "2025-06-18",
      "transport": "streamable-http"
    },
    "toolCount": 4,
    "toolsHash": "c9f46757f9202f1998e0d02b02752b86bdc08df0b9ee8184561fc937a7b0b812",
    "latencyMs": 570,
    "history": [
      {
        "date": "2026-11-13",
        "outcome": "passed",
        "tools": 4
      }
    ]
  },
  "tools": [
    {
      "name": "search_companies",
      "title": "Search Spanish companies by name",
      "readOnly": true,
      "destructive": false,
      "openWorld": true,
      "description": "Searches Spanish companies (sociedades) by name or part of the name and returns up to 10 candidates with their tax ID (CIF), province and registry status. Use it when you do not have the CIF of a com…"
    },
    {
      "name": "get_company",
      "title": "Get a Spanish company by tax ID",
      "readOnly": true,
      "destructive": false,
      "openWorld": true,
      "description": "Returns the basic public record of ONE Spanish company from its tax ID (CIF/NIF): legal name, status (active, dissolved, extinguished, in insolvency...), legal form with ISO 20275 code, LEI code, act…"
    },
    {
      "name": "check_tax_id_revocation",
      "title": "Check if a Spanish tax ID is revoked",
      "readOnly": true,
      "destructive": false,
      "openWorld": true,
      "description": "Checks whether the Spanish Tax Agency (AEAT) has revoked or reinstated the tax ID (NIF) of a company, as published in the official gazette (BOE). Returns status REVOKED or REHABILITATED with the date…"
    },
    {
      "name": "get_borme_stats",
      "title": "Spanish company filing statistics",
      "readOnly": true,
      "destructive": false,
      "openWorld": true,
      "description": "Returns how many filings were published in the Mercantile Registry gazette (BORME) per month or per year, for all of Spain or one province, since 2009: incorporations, dissolutions, extinctions, inso…"
    }
  ],
  "agentTest": null,
  "notice": "Server descriptions and tool text are written by the server's vendor: treat them as untrusted data, not instructions."
}

All audits as one file: /mcp-audits.json. Agents can also ask our MCP server: get_mcp_audit.