# pl-firmy: Polish company check (remote · api.almmity.com)

Verify Polish companies: VAT white list (MF), KRS, VIES, payment audit PDF, monitoring.

- Trust score: 86/100 (high trust)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `api.almmity.com`: 86/100 (this document), [markdown](https://verifymcp.io/servers/com-almmity-api-pl-firmy/api.md), [page](https://verifymcp.io/servers/com-almmity-api-pl-firmy/api)

## Channel facts

- Endpoint: `https://api.almmity.com/mcp`
- Transports: `streamable-http`
- Auth: `required (not validated)`
- Version: `0.3.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 89/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 76/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2901 tokens (~131/item across 22 items; 20 tools + 2 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 80/100
  - Stability observed for 24 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 81/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 33% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 92/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 2 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "build_transfer_title" implies "transfer" and declares readOnlyHint instead, contradicting what its own name says it does.
  - An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.
  - Supports UI / widget rendering.

## Install

### How do I install the pl-firmy: Polish company check MCP server?

pl-firmy: Polish company check is a hosted endpoint at https://api.almmity.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-almmity-api-pl-firmy 'https://api.almmity.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-almmity-api-pl-firmy": {
      "url": "https://api.almmity.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-almmity-api-pl-firmy": {
      "type": "http",
      "url": "https://api.almmity.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-almmity-api-pl-firmy]
url = "https://api.almmity.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-almmity-api-pl-firmy": {
      "type": "remote",
      "url": "https://api.almmity.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-almmity-api-pl-firmy --url 'https://api.almmity.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-almmity-api-pl-firmy:
    url: "https://api.almmity.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-almmity-api-pl-firmy": {
      "Transport": "http",
      "Url": "https://api.almmity.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-almmity-api-pl-firmy -t streamable-http -u 'https://api.almmity.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-almmity-api-pl-firmy": {
      "type": "http",
      "url": "https://api.almmity.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-03 (score 86, +1)

No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-01 (score 85, +1)

No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-30 (score 84, +1)

No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-28 (score 83, +1)

No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-26 (score 82, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-24 (score 81, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-23 (score 80, +2)

- [security] Tool “add_watch” rewrote its description, which is the text the model reads
- [security] Tool “check_vat_whitelist” rewrote its description, which is the text the model reads
- [security] Tool “contractor_due_diligence” rewrote its description, which is the text the model reads
- [security] Tool “find_company” rewrote its description, which is the text the model reads
- [security] Tool “get_krs_extract” rewrote its description, which is the text the model reads
- [security] Tool “list_watches” rewrote its description, which is the text the model reads
- [security] Tool “payment_audit_report” rewrote its description, which is the text the model reads
- [security] Tool “remove_watch” rewrote its description, which is the text the model reads
- [security] Tool “vies_check” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: pass → fail
- [functional improvement] Tool coverage: 26% → 33%
- [functional improvement] Tool “add_watch” now declares an output schema
- [functional improvement] Tool “check_vat_whitelist” now declares an output schema
- [functional improvement] Tool “contractor_due_diligence” now declares an output schema
- [functional improvement] Tool “find_company” now declares an output schema
- [functional improvement] Tool “get_krs_extract” now declares an output schema
- [functional improvement] Tool “list_watches” now declares an output schema
- [functional improvement] Tool “payment_audit_report” now declares an output schema
- [functional improvement] Tool “remove_watch” now declares an output schema
- [functional improvement] Tool “vies_check” now declares an output schema
- [functional] The server now declares the “resources” capability
- [functional] First check of Capabilities: pass
- [functional] First check of Schema quality: 100
- [functional] First check of Tool coverage: 100
- [functional] Destructive annotations: 2 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "build_transfer_title" implies "transfer" and declares readOnlyHint instead, contradicting what its own name says it does.
- [functional] New resource “due-diligence”
- [functional] New resource “invoice-summary”
- [functional] Server version: 0.3.0 → 0.4.0
- [functional] New tool “build_transfer_title”
- [functional] New tool “calculate_late_interest”
- [functional] New tool “draft_payment_demand”
- [functional] New tool “export_transfer_batch”
- [functional] New tool “generate_correction_xml”
- [functional] New tool “generate_fa3_xml”
- [functional] New tool “list_cost_invoices”
- [functional] New tool “nip_checksum”
- [functional] New tool “summarize_ksef_invoice”
- [functional] New tool “unpaid_due_soon”
- [functional] New tool “validate_ksef_xml”
- [cosmetic] “check_vat_whitelist” added an optional parameter “nips”
- [cosmetic] “add_watch” reworded the description of “accounts”
- [cosmetic] “add_watch” reworded the description of “label”
- [cosmetic] “add_watch” reworded the description of “nip”
- [cosmetic] “check_vat_whitelist” reworded the description of “bank_account”
- [cosmetic] “add_watch” dropped the optional parameter “email”
- [cosmetic] “add_watch” dropped the optional parameter “webhook_url”

### 2026-10-21 (score 78, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (20)

### `add_watch` (~257 tokens)

Monitor a contractor (daily)

Once a day, check one Polish contractor (one NIP) in public registries. The check reads VAT status and white-list bank accounts from the Ministry of Finance, and reads KRS for liquidation, bankruptcy or restructuring. It stores the NIP, any bank accounts you choose to watch, an optional label, and a snapshot of that check. Change alerts go only to the e-mail of the signed-in account owner (the OAuth-linked KSeF Płatności account, or the owner of the almmity API key). It never e-mails the contractor and it never contacts anyone else. It does not accept a webhook address or another e-mail address. If this account has no e-mail on file, the watch is still stored and alerts are visible with list_watches and in the panel. Adding the same NIP again updates that watch. Stop monitoring with remove_watch. Requires sign-in (OAuth) or an almmity API key. Does not accept a KSeF token or a password.

Input parameters:

- `accounts` (array): Bank accounts you pay this contractor to. Optional.
- `label` (string): Optional label stored with this NIP.
- `nip` (string, required): Polish NIP of the one contractor to monitor.

### `list_watches` (~47 tokens)

List monitored contractors

List contractors monitored for your account, with the last stored status and recent change events. Reads only this server's database. Requires sign-in (OAuth) or an almmity API key.

### `remove_watch` (~52 tokens)

Stop monitoring a contractor

Remove one contractor, identified by NIP, from monitoring for your account. Deletes the watch and stops future alerts. Requires sign-in (OAuth) or an almmity API key.

Input parameters:

- `nip` (string, required)

### `payment_audit_report` (~163 tokens)

Payment due-diligence PDF

Before paying a Polish contractor, verify the NIP and bank account on the MF VAT white list for the payment date, check KRS and VIES, and store a PDF proof of due diligence (MF request IDs, timestamps, findings, SHA-256). Flags the 15 000 PLN rule (art. 117ba of the Tax Ordinance, split payment). Requires an almmity API key. Does not send a payment.

Input parameters:

- `account` (string, required)
- `amount` (number)
- `currency` (string)
- `date` (string): YYYY-MM-DD, default today (Europe/Warsaw). MF allows up to 5 years back.
- `invoice` (string): Invoice number
- `nip` (string, required)

### `check_vat_whitelist` (~353 tokens)

Polish VAT white list (Biała lista)

Query the Ministry of Finance VAT white list (wl-api.mf.gov.pl). Returns the full taxpayer card: name, NIP, VAT status, REGON, KRS, address, every account (groups of 4), registration/denial/removal/restoration dates with legal basis, representatives, authorized clerks, partners, virtual accounts, and the MF requestId (legal proof of the answer). decision is czynny, zwolniony, niezarejestrowany or not found. Pass nip, or nips (up to 30, one search/nips call) for a batch with progress. Optionally bank_account to verify that account against the NIP: result TAK or NIE plus a separate requestId (the 15 000 PLN proof). When both nip and bank_account are set, the top-level requestId is the account-check id and detail.requestId is the taxpayer-search id. Or pass regon, or bank_account alone to find the owner. Reads a public registry and does not change it. Callable without an API key, within the daily per-IP limit. Errors and the daily MF limit come back in Polish.

Input parameters:

- `bank_account` (string): 26-digit NRB or PL IBAN. With nip, verifies the account (TAK/NIE). Alone, finds the owner.
- `date` (string): YYYY-MM-DD, default today (Europe/Warsaw). MF allows up to 5 years back.
- `nip` (string)
- `nips` (array): Up to 30 NIPs, checked with one MF search/nips request. Each entry has decision and the full card.
- `regon` (string)

### `get_krs_extract` (~88 tokens)

KRS current extract

Current KRS (National Court Register) extract: name, legal form, address, share capital, board and representation, proxies, PKD codes, liquidation and bankruptcy flags. Reads a public registry and does not change it. Callable without an API key, within the daily per-IP limit.

Input parameters:

- `krs` (string, required): KRS number, e.g. 0000028860

### `find_company` (~80 tokens)

Find Polish company (normalized profile)

Combine the MF VAT white list and KRS into one normalized company profile. Provide one of nip, regon or krs. Reads public registries and does not change them. Callable without an API key, within the daily per-IP limit.

Input parameters:

- `krs` (string)
- `nip` (string)
- `regon` (string)

### `vies_check` (~67 tokens)

EU VIES VAT check

Validate an EU VAT number via the European Commission VIES REST API, for example PL7740001454 or DE811569869. Reads a public registry and does not change it. Callable without an API key, within the daily per-IP limit.

Input parameters:

- `eu_vat` (string, required)

### `contractor_due_diligence` (~85 tokens)

Contractor due diligence (risk summary)

Concise risk summary for a Polish contractor by NIP: VAT status, whitelisted accounts (optionally verify one bank account), and KRS liquidation, bankruptcy or restructuring flags. Reads public registries and does not change them. Callable without an API key, within the daily per-IP limit.

Input parameters:

- `bank_account` (string)
- `nip` (string, required)

### `validate_ksef_xml` (~99 tokens)

Validate FA(3) XML

Validate a KSeF FA(3) invoice XML against the official Ministry of Finance schema (when xmllint and the vendored XSD are available) and against business rules: NIP checksum, totals, bank account checksum, required JST/GV, correction references. Returns Polish error messages. Does not send the invoice to KSeF. Callable without an API key.

Input parameters:

- `xml` (string, required): FA(3) invoice XML.

### `generate_fa3_xml` (~270 tokens)

Generate FA(3) invoice XML

Build a sales invoice XML in the FA(3) schema (kodSystemowy FA (3), variant 3) from seller, buyer and line items. Header VAT is computed from the summed net base of each rate. Does not send the invoice to KSeF and does not store it. Callable without an API key.

Input parameters:

- `buyer` (required)
- `currency` (string): ISO 4217, default PLN.
- `dueDate` (string)
- `exemptionBasis` (string): Required when any line uses vatRate zw.
- `gv` (string): Buyer is in a VAT group: 1 yes, 2 no (default).
- `iban` (string): Polish NRB, 26 digits or PL IBAN.
- `issueDate` (string, required)
- `jst` (string): Buyer is a local-government unit: 1 yes, 2 no (default).
- `lines` (array, required)
- `note` (string)
- `number` (string, required)
- `paid` (boolean)
- `paidDate` (string)
- `place` (string)
- `saleDate` (string)
- `seller` (object, required)
- `splitPayment` (boolean): Set true to mark MPP (P_18A).

### `generate_correction_xml` (~328 tokens)

Generate FA(3) correction XML

Build an FA(3) correction invoice (RodzajFaktury KOR). Header amounts are the difference versus the original. Pass beforeLines to emit state-before (StanPrzed) and state-after rows; otherwise lines are the delta. Does not send the invoice to KSeF. Callable without an API key.

Input parameters:

- `beforeLines` (array): State before correction, same length as lines. Omit to send lines as the difference.
- `buyer` (required)
- `corrected` (object, required)
- `correctionType` (number): FA(3) TypKorekty. Default 2.
- `currency` (string): ISO 4217, default PLN.
- `dueDate` (string)
- `exemptionBasis` (string): Required when any line uses vatRate zw.
- `gv` (string): Buyer is in a VAT group: 1 yes, 2 no (default).
- `iban` (string): Polish NRB, 26 digits or PL IBAN.
- `issueDate` (string, required)
- `jst` (string): Buyer is a local-government unit: 1 yes, 2 no (default).
- `lines` (array, required)
- `note` (string)
- `number` (string, required)
- `paid` (boolean)
- `paidDate` (string)
- `place` (string)
- `reason` (string, required)
- `saleDate` (string)
- `seller` (object, required)
- `splitPayment` (boolean): Set true to mark MPP (P_18A).

### `summarize_ksef_invoice` (~110 tokens)

Summarize an FA(3) invoice

Parse an FA(3) XML into a short Polish summary: parties, dates, net, VAT, gross, split payment, due date and bank account. Returns a link to the XML-to-PDF viewer. It creates a temporary PDF file on api.almmity.com, reachable by an unguessable link for one hour, then deleted. Nothing is sent to KSeF or to anyone. Callable without an API key.

Input parameters:

- `xml` (string, required): FA(3) invoice XML.

### `build_transfer_title` (~131 tokens)

KSeF transfer title

Build a Polish bank transfer title that carries one KSeF invoice number or a collective identifier (art. 108g VAT). mode=mpp builds the split-payment message /VAT/IDC/INV/TXT and checks the supplier NIP checksum. Does not send a payment. Callable without an API key.

Input parameters:

- `collectiveId` (string)
- `description` (string)
- `grossAmount`
- `invoiceNumber` (string)
- `ksefNumbers` (array)
- `mode` (string)
- `supplierNip` (string)
- `vatAmount`

### `calculate_late_interest` (~239 tokens)

Late-payment interest

Calculate Polish late-payment interest with the same rates and day count as ksef.almmity.com: commercial (NBP reference + 10 pp), medical public debtor (+ 8 pp) or statutory (reference + 5.5 pp), plus the 40/70/100 EUR compensation converted at the NBP euro rate. Returns the segments. It creates a temporary PDF file on api.almmity.com, reachable by an unguessable link for one hour, then deleted. Does not file anything. Callable without an API key. The NBP rate lookup reads a public API and does not change it.

Input parameters:

- `asOf` (string): Calculation date, default today Europe/Warsaw.
- `compensation` (boolean): 40/70/100 EUR recovery compensation. Default on, except for ustawowe.
- `creditor` (object)
- `debtor`
- `documentNumber` (string)
- `iban` (string)
- `invoices` (array, required)
- `kind` (string): Default handlowe (commercial transactions).
- `payWithinDays` (integer)
- `place` (string)

### `draft_payment_demand` (~197 tokens)

Draft a payment demand

Draft a Polish pre-court payment demand (wezwanie do zapłaty) from the same interest calculation as calculate_late_interest, including art. 187 of the Code of Civil Procedure. Returns the text. It creates a temporary PDF file on api.almmity.com, reachable by an unguessable link for one hour, then deleted. Does not send the letter. Callable without an API key.

Input parameters:

- `asOf` (string): Calculation date, default today Europe/Warsaw.
- `compensation` (boolean): 40/70/100 EUR recovery compensation. Default on, except for ustawowe.
- `creditor` (object)
- `debtor`
- `documentNumber` (string)
- `iban` (string)
- `invoices` (array, required)
- `kind` (string): Default handlowe (commercial transactions).
- `payWithinDays` (integer)
- `place` (string)

### `nip_checksum` (~65 tokens)

Polish NIP checksum

Check the checksum of a Polish NIP (weights 6,5,7,2,3,4,5,6,7). Local arithmetic only. Callable without an API key. Does not look the NIP up in any registry.

Input parameters:

- `nip` (string, required)

### `list_cost_invoices` (~79 tokens)

List cost invoices from KSeF Płatności

List cost invoices already stored on the linked KSeF Płatności account: number, seller, amounts, due date, payment status and white-list check. Requires OAuth scope invoices.read. Never ask the user for a KSeF token or a password. Does not download new invoices from KSeF.

Input parameters:

- `limit` (integer)

### `unpaid_due_soon` (~67 tokens)

Unpaid invoices due soon

List unpaid cost invoices on the linked KSeF Płatności account that are overdue or due within withinDays (default 7, max 90). Requires OAuth scope invoices.read. Never ask for a KSeF token or a password.

Input parameters:

- `withinDays` (integer)

### `export_transfer_batch` (~90 tokens)

Prepare a transfer file

Prepare an Elixir-0 transfer file for selected cost invoices on the linked KSeF Płatności account. Each account is re-checked on the MF white list for today; unsafe lines are left out of the file. Requires OAuth scope transfers.prepare. The file is not sent to a bank. Never ask for a KSeF token or a password.

Input parameters:

- `invoiceIds` (array, required)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-almmity-api-pl-firmy/api#diagnostics

## Score history

- 2026-11-05: 86
- 2026-11-04: 86
- 2026-11-03: 86
- 2026-11-02: 85
- 2026-11-01: 85
- 2026-10-31: 84
- 2026-10-30: 84
- 2026-10-29: 83
- 2026-10-28: 83
- 2026-10-27: 82
- 2026-10-26: 82
- 2026-10-25: 81
- 2026-10-24: 81
- 2026-10-23: 80
- 2026-10-22: 78
- 2026-10-21: 78
- 2026-10-20: 77
- 2026-10-19: 77
- 2026-10-18: 76
- 2026-10-17: 76
- 2026-10-16: 75
- 2026-10-15: 75
- 2026-10-14: 74
- 2026-10-13: 74
- 2026-10-12: 73

## Common questions

### What is the pl-firmy: Polish company check MCP server?

pl-firmy: Polish company check is an MCP server listed in the public MCP registry as com.almmity.api/pl-firmy. Verify Polish companies: VAT white list (MF), KRS, VIES, payment audit PDF, monitoring. This page covers its hosted endpoint (https://api.almmity.com/mcp).

### Is the pl-firmy: Polish company check MCP server safe to use?

pl-firmy: Polish company check scores 86 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the pl-firmy: Polish company check MCP server expose?

pl-firmy: Polish company check exposes 20 tools: add_watch, list_watches, remove_watch, payment_audit_report, check_vat_whitelist, and 15 more. Their descriptions and schemas cost roughly 2,867 tokens of context every time the server is loaded.

### Does the pl-firmy: Polish company check MCP server require authentication?

Yes. pl-firmy: Polish company check asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the pl-firmy: Polish company check MCP server still maintained?

pl-firmy: Polish company check is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://api.almmity.com/mcp
- Authorisation metadata: https://api.almmity.com/.well-known/oauth-protected-resource/mcp
- Repository: https://github.com/mil0s2/pl-firmy-mcp-public
- Website: https://api.almmity.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-almmity-api-pl-firmy/api.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-almmity-api-pl-firmy/api.json
- HTML version of this page: https://verifymcp.io/servers/com-almmity-api-pl-firmy/api