Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

pl-firmy: Polish company check

REMOTE · API.ALMMITY.COM

Verify Polish companies: VAT white list (MF), KRS, VIES, payment audit PDF, monitoring.

Available components

+3 this week 86 Trust /100

Last scanned (21 hours ago)

Scores higher than 93% of remote servers

Reachable. Last reached 4 Nov 2026.

Category Finance and Payments

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security89
Transport & Reachability100
Schema Quality & AI Usability76
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 2901 tokens (~131/item across 22 items; 20 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management77
  • Stability observed for 23 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage81
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 33% of tool parameters carry a description.Partial
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety92
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 2 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "build_transfer_title" implies "transfer" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Partial
  • An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
  • Supports UI / widget rendering.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.

  • 1 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.

  • 30 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.

  • 28 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

  • 26 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

  • 24 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

  • 23 Oct 26 +2
    • Tool “add_watch” rewrote its description, which is the text the model reads security
    • Tool “check_vat_whitelist” rewrote its description, which is the text the model reads security
    • Tool “contractor_due_diligence” rewrote its description, which is the text the model reads security
    • Tool “find_company” rewrote its description, which is the text the model reads security
    • Tool “get_krs_extract” rewrote its description, which is the text the model reads security
    • Tool “list_watches” rewrote its description, which is the text the model reads security
    • Tool “payment_audit_report” rewrote its description, which is the text the model reads security
    • Tool “remove_watch” rewrote its description, which is the text the model reads security
    • Tool “vies_check” rewrote its description, which is the text the model reads security
    • Schema quality: pass → fail ▼ functional
    • Tool coverage: 26% → 33% ▲ functional
    • Tool “add_watch” now declares an output schema ▲ functional
    • Tool “check_vat_whitelist” now declares an output schema ▲ functional
    • Tool “contractor_due_diligence” now declares an output schema ▲ functional
    • Tool “find_company” now declares an output schema ▲ functional
    • Tool “get_krs_extract” now declares an output schema ▲ functional
    • Tool “list_watches” now declares an output schema ▲ functional
    • Tool “payment_audit_report” now declares an output schema ▲ functional
    • Tool “remove_watch” now declares an output schema ▲ functional
    • Tool “vies_check” now declares an output schema ▲ functional
    • The server now declares the “resources” capability functional
    • First check of Capabilities: pass functional
    • First check of Schema quality: 100 functional
    • First check of Tool coverage: 100 functional
    • Destructive annotations: 2 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "build_transfer_title" implies "transfer" and declares readOnlyHint instead, contradicting what its own name says it does. functional
    • New resource “due-diligence” functional
    • New resource “invoice-summary” functional
    • Server version: 0.3.0 → 0.4.0 functional
    • New tool “build_transfer_title” functional
    • New tool “calculate_late_interest” functional
    • New tool “draft_payment_demand” functional
    • New tool “export_transfer_batch” functional
    • New tool “generate_correction_xml” functional
    • New tool “generate_fa3_xml” functional
    • New tool “list_cost_invoices” functional
    • New tool “nip_checksum” functional
    • New tool “summarize_ksef_invoice” functional
    • New tool “unpaid_due_soon” functional
    • New tool “validate_ksef_xml” functional
    • “check_vat_whitelist” added an optional parameter “nips” cosmetic
    • “add_watch” reworded the description of “accounts” cosmetic
    • “add_watch” reworded the description of “label” cosmetic
    • “add_watch” reworded the description of “nip” cosmetic
    • “check_vat_whitelist” reworded the description of “bank_account” cosmetic
    • “add_watch” dropped the optional parameter “email” cosmetic
    • “add_watch” dropped the optional parameter “webhook_url” cosmetic
  • 21 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Probed https://api.almmity.com/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=api.almmity.com CN=YE2,O=Let's Encrypt,C=US 12 Oct 2026 10 Jan 2027 ECDSA 256 ECDSA-SHA384 6fcc6a06d90e8fc96d60ecb4158ee203082
SANs: api.almmity.com
CN=YE2,O=Let's Encrypt,C=US (CA) CN=Root YE,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 ECDSA 384 ECDSA-SHA384 4df3b15dd6c0784c507cd37b58e6f115
CN=Root YE,O=ISRG,C=US (CA) CN=ISRG Root X2,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 ECDSA-SHA384 872165fc34b6e5fba8add5b3705fb53a
CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 SHA256-RSA 6c8f1dc727c7117f7baf853ac980f9cd

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of api.almmity.com. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
com. present 19718 13 Verified
almmity.com. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication Challenged, unverified

The endpoint asked for a token, but we could not retrieve and validate the RFC 9728 metadata that tells a client how to obtain one.

Result Challenged, unverified
Enforced On tool calls
HTTP status 200
Header Value
strict-transport-security max-age=31536000

Protected resource metadata

Retrieved No
Problem no_resource_metadata

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://api.almmity.com/mcp Verified 200
http (plaintext) http://api.almmity.com/mcp HTTPS enforced 301 https://api.almmity.com/mcp
MCP tools · 20 exposed · ~2,867 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_watch ~257

Once a day, check one Polish contractor (one NIP) in public registries. The check reads VAT status and white-list bank accounts from the Ministry of Finance, and reads KRS for liquidation, bankruptcy or restructuring. It stores the NIP, any bank accounts you choose to watch, an optional label, and a snapshot of that check. Change alerts go only to the e-mail of the signed-in account owner (the OAuth-linked KSeF Płatności account, or the owner of the almmity API key). It never e-mails the contractor and it never contacts anyone else. It does not accept a webhook address or another e-mail address. If this account has no e-mail on file, the watch is still stored and alerts are visible with list_watches and in the panel. Adding the same NIP again updates that watch. Stop monitoring with remove_watch. Requires sign-in (OAuth) or an almmity API key. Does not accept a KSeF token or a password.

NameTypeReqDescription
accountsarray–Bank accounts you pay this contractor to. Optional.
labelstring–Optional label stored with this NIP.
nipstringyesPolish NIP of the one contractor to monitor.

Structured output declared, but exposes no named fields.

No examples provided.

build_transfer_title ~131

Build a Polish bank transfer title that carries one KSeF invoice number or a collective identifier (art. 108g VAT). mode=mpp builds the split-payment message /VAT/IDC/INV/TXT and checks the supplier NIP checksum. Does not send a payment. Callable without an API key.

NameTypeReqDescription
collectiveIdstring––
descriptionstring––
grossAmount–––
invoiceNumberstring––
ksefNumbersarray––
modestring––
supplierNipstring––
vatAmount–––

Structured output declared, but exposes no named fields.

No examples provided.

calculate_late_interest ~239

Calculate Polish late-payment interest with the same rates and day count as ksef.almmity.com: commercial (NBP reference + 10 pp), medical public debtor (+ 8 pp) or statutory (reference + 5.5 pp), plus the 40/70/100 EUR compensation converted at the NBP euro rate. Returns the segments. It creates a temporary PDF file on api.almmity.com, reachable by an unguessable link for one hour, then deleted. Does not file anything. Callable without an API key. The NBP rate lookup reads a public API and does not change it.

NameTypeReqDescription
asOfstring–Calculation date, default today Europe/Warsaw.
compensationboolean–40/70/100 EUR recovery compensation. Default on, except for ustawowe.
creditorobject––
debtor–––
documentNumberstring––
ibanstring––
invoicesarrayyes–
kindstring–Default handlowe (commercial transactions).
payWithinDaysinteger––
placestring––

Structured output declared, but exposes no named fields.

No examples provided.

check_vat_whitelist ~353

Query the Ministry of Finance VAT white list (wl-api.mf.gov.pl). Returns the full taxpayer card: name, NIP, VAT status, REGON, KRS, address, every account (groups of 4), registration/denial/removal/restoration dates with legal basis, representatives, authorized clerks, partners, virtual accounts, and the MF requestId (legal proof of the answer). decision is czynny, zwolniony, niezarejestrowany or not found. Pass nip, or nips (up to 30, one search/nips call) for a batch with progress. Optionally bank_account to verify that account against the NIP: result TAK or NIE plus a separate requestId (the 15 000 PLN proof). When both nip and bank_account are set, the top-level requestId is the account-check id and detail.requestId is the taxpayer-search id. Or pass regon, or bank_account alone to find the owner. Reads a public registry and does not change it. Callable without an API key, within the daily per-IP limit. Errors and the daily MF limit come back in Polish.

NameTypeReqDescription
bank_accountstring–26-digit NRB or PL IBAN. With nip, verifies the account (TAK/NIE). Alone, finds the owner.
datestring–YYYY-MM-DD, default today (Europe/Warsaw). MF allows up to 5 years back.
nipstring––
nipsarray–Up to 30 NIPs, checked with one MF search/nips request. Each entry has decision and the full card.
regonstring––

Structured output declared, but exposes no named fields.

No examples provided.

contractor_due_diligence ~85

Concise risk summary for a Polish contractor by NIP: VAT status, whitelisted accounts (optionally verify one bank account), and KRS liquidation, bankruptcy or restructuring flags. Reads public registries and does not change them. Callable without an API key, within the daily per-IP limit.

NameTypeReqDescription
bank_accountstring––
nipstringyes–

Structured output declared, but exposes no named fields.

No examples provided.

draft_payment_demand ~197

Draft a Polish pre-court payment demand (wezwanie do zapłaty) from the same interest calculation as calculate_late_interest, including art. 187 of the Code of Civil Procedure. Returns the text. It creates a temporary PDF file on api.almmity.com, reachable by an unguessable link for one hour, then deleted. Does not send the letter. Callable without an API key.

NameTypeReqDescription
asOfstring–Calculation date, default today Europe/Warsaw.
compensationboolean–40/70/100 EUR recovery compensation. Default on, except for ustawowe.
creditorobject––
debtor–––
documentNumberstring––
ibanstring––
invoicesarrayyes–
kindstring–Default handlowe (commercial transactions).
payWithinDaysinteger––
placestring––

Structured output declared, but exposes no named fields.

No examples provided.

export_transfer_batch ~90

Prepare an Elixir-0 transfer file for selected cost invoices on the linked KSeF Płatności account. Each account is re-checked on the MF white list for today; unsafe lines are left out of the file. Requires OAuth scope transfers.prepare. The file is not sent to a bank. Never ask for a KSeF token or a password.

NameTypeReqDescription
invoiceIdsarrayyes–

Structured output declared, but exposes no named fields.

No examples provided.

find_company ~80

Combine the MF VAT white list and KRS into one normalized company profile. Provide one of nip, regon or krs. Reads public registries and does not change them. Callable without an API key, within the daily per-IP limit.

NameTypeReqDescription
krsstring––
nipstring––
regonstring––

Structured output declared, but exposes no named fields.

No examples provided.

generate_correction_xml ~328

Build an FA(3) correction invoice (RodzajFaktury KOR). Header amounts are the difference versus the original. Pass beforeLines to emit state-before (StanPrzed) and state-after rows; otherwise lines are the delta. Does not send the invoice to KSeF. Callable without an API key.

NameTypeReqDescription
beforeLinesarray–State before correction, same length as lines. Omit to send lines as the difference.
buyer–yes–
correctedobjectyes–
correctionTypenumber–FA(3) TypKorekty. Default 2.
currencystring–ISO 4217, default PLN.
dueDatestring––
exemptionBasisstring–Required when any line uses vatRate zw.
gvstring–Buyer is in a VAT group: 1 yes, 2 no (default).
ibanstring–Polish NRB, 26 digits or PL IBAN.
issueDatestringyes–
jststring–Buyer is a local-government unit: 1 yes, 2 no (default).
linesarrayyes–
notestring––
numberstringyes–
paidboolean––
paidDatestring––
placestring––
reasonstringyes–
saleDatestring––
sellerobjectyes–
splitPaymentboolean–Set true to mark MPP (P_18A).

Structured output declared, but exposes no named fields.

No examples provided.

generate_fa3_xml ~270

Build a sales invoice XML in the FA(3) schema (kodSystemowy FA (3), variant 3) from seller, buyer and line items. Header VAT is computed from the summed net base of each rate. Does not send the invoice to KSeF and does not store it. Callable without an API key.

NameTypeReqDescription
buyer–yes–
currencystring–ISO 4217, default PLN.
dueDatestring––
exemptionBasisstring–Required when any line uses vatRate zw.
gvstring–Buyer is in a VAT group: 1 yes, 2 no (default).
ibanstring–Polish NRB, 26 digits or PL IBAN.
issueDatestringyes–
jststring–Buyer is a local-government unit: 1 yes, 2 no (default).
linesarrayyes–
notestring––
numberstringyes–
paidboolean––
paidDatestring––
placestring––
saleDatestring––
sellerobjectyes–
splitPaymentboolean–Set true to mark MPP (P_18A).

Structured output declared, but exposes no named fields.

No examples provided.

get_krs_extract ~88

Current KRS (National Court Register) extract: name, legal form, address, share capital, board and representation, proxies, PKD codes, liquidation and bankruptcy flags. Reads a public registry and does not change it. Callable without an API key, within the daily per-IP limit.

NameTypeReqDescription
krsstringyesKRS number, e.g. 0000028860

Structured output declared, but exposes no named fields.

No examples provided.

list_cost_invoices ~79

List cost invoices already stored on the linked KSeF Płatności account: number, seller, amounts, due date, payment status and white-list check. Requires OAuth scope invoices.read. Never ask the user for a KSeF token or a password. Does not download new invoices from KSeF.

NameTypeReqDescription
limitinteger––

Structured output declared, but exposes no named fields.

No examples provided.

list_watches ~47

List contractors monitored for your account, with the last stored status and recent change events. Reads only this server's database. Requires sign-in (OAuth) or an almmity API key.

Input schema present but exposes no named parameters.

Structured output declared, but exposes no named fields.

No examples provided.

nip_checksum ~65

Check the checksum of a Polish NIP (weights 6,5,7,2,3,4,5,6,7). Local arithmetic only. Callable without an API key. Does not look the NIP up in any registry.

NameTypeReqDescription
nipstringyes–

Structured output declared, but exposes no named fields.

No examples provided.

payment_audit_report ~163

Before paying a Polish contractor, verify the NIP and bank account on the MF VAT white list for the payment date, check KRS and VIES, and store a PDF proof of due diligence (MF request IDs, timestamps, findings, SHA-256). Flags the 15 000 PLN rule (art. 117ba of the Tax Ordinance, split payment). Requires an almmity API key. Does not send a payment.

NameTypeReqDescription
accountstringyes–
amountnumber––
currencystring––
datestring–YYYY-MM-DD, default today (Europe/Warsaw). MF allows up to 5 years back.
invoicestring–Invoice number
nipstringyes–

Structured output declared, but exposes no named fields.

No examples provided.

remove_watch ~52

Remove one contractor, identified by NIP, from monitoring for your account. Deletes the watch and stops future alerts. Requires sign-in (OAuth) or an almmity API key.

NameTypeReqDescription
nipstringyes–

Structured output declared, but exposes no named fields.

No examples provided.

summarize_ksef_invoice ~110

Parse an FA(3) XML into a short Polish summary: parties, dates, net, VAT, gross, split payment, due date and bank account. Returns a link to the XML-to-PDF viewer. It creates a temporary PDF file on api.almmity.com, reachable by an unguessable link for one hour, then deleted. Nothing is sent to KSeF or to anyone. Callable without an API key.

NameTypeReqDescription
xmlstringyesFA(3) invoice XML.

Structured output declared, but exposes no named fields.

No examples provided.

unpaid_due_soon ~67

List unpaid cost invoices on the linked KSeF Płatności account that are overdue or due within withinDays (default 7, max 90). Requires OAuth scope invoices.read. Never ask for a KSeF token or a password.

NameTypeReqDescription
withinDaysinteger––

Structured output declared, but exposes no named fields.

No examples provided.

validate_ksef_xml ~99

Validate a KSeF FA(3) invoice XML against the official Ministry of Finance schema (when xmllint and the vendored XSD are available) and against business rules: NIP checksum, totals, bank account checksum, required JST/GV, correction references. Returns Polish error messages. Does not send the invoice to KSeF. Callable without an API key.

NameTypeReqDescription
xmlstringyesFA(3) invoice XML.

Structured output declared, but exposes no named fields.

No examples provided.

vies_check ~67

Validate an EU VAT number via the European Commission VIES REST API, for example PL7740001454 or DE811569869. Reads a public registry and does not change it. Callable without an API key, within the daily per-IP limit.

NameTypeReqDescription
eu_vatstringyes–

Structured output declared, but exposes no named fields.

No examples provided.

Install

How do I install the pl-firmy: Polish company check MCP server?

pl-firmy: Polish company check is a hosted endpoint at https://api.almmity.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · api.almmity.com

# add to Claude Code
claude mcp add --transport http com-almmity-api-pl-firmy 'https://api.almmity.com/mcp'
Common questions

What is the pl-firmy: Polish company check MCP server?

pl-firmy: Polish company check is an MCP server listed in the public MCP registry as com.almmity.api/pl-firmy. Verify Polish companies: VAT white list (MF), KRS, VIES, payment audit PDF, monitoring. This page covers its hosted endpoint (https://api.almmity.com/mcp).

Is the pl-firmy: Polish company check MCP server safe to use?

pl-firmy: Polish company check scores 86 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the pl-firmy: Polish company check MCP server expose?

pl-firmy: Polish company check exposes 20 tools: add_watch, list_watches, remove_watch, payment_audit_report, check_vat_whitelist, and 15 more. Their descriptions and schemas cost roughly 2,867 tokens of context every time the server is loaded.

Does the pl-firmy: Polish company check MCP server require authentication?

Yes. pl-firmy: Polish company check asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the pl-firmy: Polish company check MCP server still maintained?

pl-firmy: Polish company check is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.