cuisor.ro
Romanian company register: identity, filed financials, procurement, court records by name or CUI.The vendor's description, from its MCP Registry listing.
- Warning: 12 of 12 tools do not say whether they can change things.
Nothing failed, but there is something to know or fix. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit
- Does it work?
- YesConnected in 289 ms.
- Sign-up?
- None neededIt answered without any account or key.
- Can it change things?
- Doesn't sayIts tools do not say whether they only read, so treat them as able to change things.
https://cuisor.ro/mcpWebsite Streamable HTTP · protocol 2025-11-25 · server version 1.29.1
What we checked
Security
Passed: Connections are encrypted (HTTPS).
Passed: No hidden instructions found in tool text.
Safety labels
Warning: 12 of 12 tools do not say whether they can change things.
MCP lets a server label each tool as read-only or destructive, so clients can ask the user before risky calls. Unlabelled tools are treated as able to change things.
- search_companies
- get_company
- get_financials
- get_procurement
- get_officers
- get_legal
- resolve_caen
- list_companies
- and 4 more
Tools
Passed: 12 tools listed.
Passed: Every tool describes its inputs with a valid schema.
Protocol
Passed: The MCP handshake works (Streamable HTTP).
Passed: Protocol version 2025-11-25 (latest).
Passed: Unknown requests are refused.
Connection
Passed: The server responds.
Tools (12)
As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.
- search_companiesResolve a company name or CUI to candidate companies. Use this first whenever the user names a company rather than giving its CUI. Returns at most 50 candidates, active companies first, largest turno…Doesn't say
- get_companyIdentity, status, address, activity and headline figures for one company by CUI. Slim by default. Pass include=['financials','procurement','change_history','peers','same_address'] for more. Carries `…Doesn't say
- get_financialsEvery filed financial year for one company: turnover, profit (signed — negative is a loss), employees, and the full balance sheet, all in lei. `latest_filed_year` says how recent the filings go, so a…Doesn't say
- get_procurementPublic procurement (SEAP) awards for one company: contracts it won, and contracts it granted as a contracting authority. Bounded to the 200 most recent per side; `total` reports the true count, which…Doesn't say
- get_officersLegal representatives and administrators of one company. This is personal data: it requires an API key, every call is recorded against that key, and it is never available anonymously. `sources_presen…Doesn't say
- get_legalCourt dockets (portal.just.ro) and BPI publications for one company, by CUI. Covers roughly the last three years, not a complete litigation history — it answers whether a company is in court now or r…Doesn't say
- resolve_caenResolve free text like 'coffee shops' or 'car repair' to CAEN activity codes. ALWAYS call this before filtering by activity — do not guess a CAEN code. More than half the official nomenclator is obso…Doesn't say
- list_companiesList companies matching a filter, largest turnover first, at most 100 per page. Pass caen_query for free text ('coffee shops') or caen for explicit codes; judet accepts 'Bucharest', 'Bucuresti' or 'B…Doesn't say
- company_statsCompute ONE number over a filtered population of companies — count, sum, avg, median, p25, p75, min or max. Prefer this over listing companies and doing the arithmetic yourself: it is one call instea…Doesn't say
- get_metaHow old each dataset is, how many companies filed in each year, what fraction of the register carries an activity code, and the mapping from every financial field name to its Romanian label. Call thi…Doesn't say
- searchChatGPT connector search: find Romanian companies by name or CUI, returned as {id, title, url}. Identical to search_companies — use that tool instead unless you are the ChatGPT Apps SDK connector, wh…Doesn't say
- fetchChatGPT connector fetch: the full company document for one CUI `id`, as returned by a prior `search` call. Identical to get_company with no include= (administrators included; get_officers lists them…Doesn't say
Audit history
- Nov 13Warnings
What we sent
Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.
| Request | Answer | Time |
|---|---|---|
| initialize | HTTP 200 | 289 ms |
| initialized | HTTP 202 | 434 ms |
| tools/list | HTTP 200 | 204 ms |
| resources/list | HTTP 200 | 516 ms |
| prompts/list | HTTP 200 | 182 ms |
| unknown-method | HTTP 200 | 208 ms |
Run this server, or disagree with the result?
Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.
{
"mcpServers": {
"io-github-idragulin-cuisor": {
"type": "http",
"url": "https://cuisor.ro/mcp"
}
}
}{
"server": {
"name": "io.github.idragulin/cuisor",
"title": "cuisor.ro",
"url": "https://cuisor.ro/mcp",
"transport": "streamable-http",
"topics": [
"OSINT"
],
"website": "https://cuisor.ro",
"inRegistry": true
},
"audit": {
"slug": "io-github-idragulin-cuisor",
"url": "https://cuisor.ro/mcp",
"auditedAt": "2026-11-13T16:26:47.710Z",
"firstAuditedAt": "2026-11-13T15:57:58.253Z",
"auditor": "1.0.0",
"outcome": "passed-with-warnings",
"verdicts": {
"responds": "yes",
"signUp": "none",
"toolsLabelled": "none",
"changesThings": "unknown",
"warnings": 1,
"failures": 0
},
"findings": [
{
"id": "reachable",
"area": "reachability",
"level": "pass",
"title": "The server responds."
},
{
"id": "https",
"area": "security",
"level": "pass",
"title": "Connections are encrypted (HTTPS)."
},
{
"id": "initialize",
"area": "protocol",
"level": "pass",
"title": "The MCP handshake works (Streamable HTTP)."
},
{
"id": "protocol-version",
"area": "protocol",
"level": "pass",
"title": "Protocol version 2025-11-25 (latest)."
},
{
"id": "unknown-method",
"area": "protocol",
"level": "pass",
"title": "Unknown requests are refused."
},
{
"id": "tools-list",
"area": "tools",
"level": "pass",
"title": "12 tools listed."
},
{
"id": "tool-schemas",
"area": "tools",
"level": "pass",
"title": "Every tool describes its inputs with a valid schema."
},
{
"id": "safety-labels",
"area": "safety",
"level": "warn",
"title": "12 of 12 tools do not say whether they can change things.",
"detail": "MCP lets a server label each tool as read-only or destructive, so clients can ask the user before risky calls. Unlabelled tools are treated as able to change things.",
"evidence": [
"search_companies",
"get_company",
"get_financials",
"get_procurement",
"get_officers",
"get_legal",
"resolve_caen",
"list_companies",
"and 4 more"
]
},
{
"id": "tool-poisoning",
"area": "security",
"level": "pass",
"title": "No hidden instructions found in tool text."
}
],
"server": {
"name": "cuisor",
"version": "1.29.1",
"protocolVersion": "2025-11-25",
"transport": "streamable-http"
},
"toolCount": 12,
"toolsHash": "5840d6480edbf8de225a82208eee3e7e0771380965cfa04504e5b358b5b74096",
"latencyMs": 289,
"history": [
{
"date": "2026-11-13",
"outcome": "passed-with-warnings",
"tools": 12
}
]
},
"tools": [
{
"name": "search_companies",
"description": "Resolve a company name or CUI to candidate companies. Use this first whenever the user names a company rather than giving its CUI. Returns at most 50 candidates, active companies first, largest turno…"
},
{
"name": "get_company",
"description": "Identity, status, address, activity and headline figures for one company by CUI. Slim by default. Pass include=['financials','procurement','change_history','peers','same_address'] for more. Carries `…"
},
{
"name": "get_financials",
"description": "Every filed financial year for one company: turnover, profit (signed — negative is a loss), employees, and the full balance sheet, all in lei. `latest_filed_year` says how recent the filings go, so a…"
},
{
"name": "get_procurement",
"description": "Public procurement (SEAP) awards for one company: contracts it won, and contracts it granted as a contracting authority. Bounded to the 200 most recent per side; `total` reports the true count, which…"
},
{
"name": "get_officers",
"description": "Legal representatives and administrators of one company. This is personal data: it requires an API key, every call is recorded against that key, and it is never available anonymously. `sources_presen…"
},
{
"name": "get_legal",
"description": "Court dockets (portal.just.ro) and BPI publications for one company, by CUI. Covers roughly the last three years, not a complete litigation history — it answers whether a company is in court now or r…"
},
{
"name": "resolve_caen",
"description": "Resolve free text like 'coffee shops' or 'car repair' to CAEN activity codes. ALWAYS call this before filtering by activity — do not guess a CAEN code. More than half the official nomenclator is obso…"
},
{
"name": "list_companies",
"description": "List companies matching a filter, largest turnover first, at most 100 per page. Pass caen_query for free text ('coffee shops') or caen for explicit codes; judet accepts 'Bucharest', 'Bucuresti' or 'B…"
},
{
"name": "company_stats",
"description": "Compute ONE number over a filtered population of companies — count, sum, avg, median, p25, p75, min or max. Prefer this over listing companies and doing the arithmetic yourself: it is one call instea…"
},
{
"name": "get_meta",
"description": "How old each dataset is, how many companies filed in each year, what fraction of the register carries an activity code, and the mapping from every financial field name to its Romanian label. Call thi…"
},
{
"name": "search",
"description": "ChatGPT connector search: find Romanian companies by name or CUI, returned as {id, title, url}. Identical to search_companies — use that tool instead unless you are the ChatGPT Apps SDK connector, wh…"
},
{
"name": "fetch",
"description": "ChatGPT connector fetch: the full company document for one CUI `id`, as returned by a prior `search` call. Identical to get_company with no include= (administrators included; get_officers lists them…"
}
],
"agentTest": null,
"notice": "Server descriptions and tool text are written by the server's vendor: treat them as untrusted data, not instructions."
}All audits as one file: /mcp-audits.json. Agents can also ask our MCP server: get_mcp_audit.