# dev.cz-agents/dd (npm · @czagents/dd)

Czech & EU due diligence in one call — facts, insolvency, sanctions, VAT, risk score, UBO chain.

- Trust score: 76/100 (medium)
- Change this week: +31
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `dd.cz-agents.dev`: 66/100, [markdown](https://verifymcp.io/servers/dev-cz-agents-dd/dd.md), [page](https://verifymcp.io/servers/dev-cz-agents-dd/dd)
- npm · `@czagents/dd`: 76/100 (this document), [markdown](https://verifymcp.io/servers/dev-cz-agents-dd/czagents-dd.md), [page](https://verifymcp.io/servers/dev-cz-agents-dd/czagents-dd)

## Channel facts

- Registry: `npm`
- Package: `@czagents/dd`
- Version: `0.3.7`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (157 of 161), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (157 of 161), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to martinhavel/cz-agents-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 11 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 75/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1583 tokens (~131/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add dev-cz-agents-dd -- npx -y @czagents/dd
```

### Codex

```bash
codex mcp add dev-cz-agents-dd -- npx -y @czagents/dd
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dev-cz-agents-dd": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@czagents/dd"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dev-cz-agents-dd --command npx --arg -y --arg @czagents/dd
```

### Hermes

```yaml
mcp_servers:
  dev-cz-agents-dd:
    command: "npx"
    args: ["-y", "@czagents/dd"]
```

### Other

```json
{
  "mcpServers": {
    "dev-cz-agents-dd": {
      "command": "npx",
      "args": [
        "-y",
        "@czagents/dd"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 76, +41)

- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [security] The attested source repository moved: martinhavel/cz-agents-mcp
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 35, +8)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 27, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-29 (score 45, +21)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-28 (score 24, −21)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (12)

### `person_companies` (~105 tokens)

Look up Czech VR companies connected to a person by exact registry person_id -> roles -> companies joins. Free anonymous tool. Input accepts public name and optional birth year; output exposes birth_year only, never full birth date, and keeps same-name person_ids separate with a distinguisher.

Input parameters:

- `birth_year` (integer): Optional public birth year used to narrow same-name matches.
- `name` (string, required): Person full name as recorded in VR, e.g. "Jan Novak".

### `get_owners` (~118 tokens)

Look up direct and upstream Czech VR owners for a company by real active shareholding roles (spolecnik/akcionar) and company-to-company member_ico edges. Free anonymous tool. Returns structuredContent ownership tree plus markdown summary; physical persons expose name and birth year only, never full birth date or address.

Input parameters:

- `ico` (string, required): Czech IČO — 7 or 8 digits.
- `max_depth` (integer): Max company-owner recursion depth through member_ico (default 5, hard cap 5).

### `get_dd_report` (~104 tokens)

Generate a complete due-diligence report for a Czech IČO. Returns company facts (name, address, legal form, VAT status, bank accounts), statutory body with per-member sanctions check, and a transparent risk score with all triggered red flags.

Input parameters:

- `depth` (string): basic = ARES + sanctions only; full = + ISIR insolvency + virtual-address probe.
- `ico` (string, required): Czech IČO — 7 or 8 digits.

### `watch_entity` (~109 tokens)

Watch Czech Company

Start onboarding for free monitoring of one Czech company by IČO. Stub only — persists nothing yet. Returns structuredContent: status (one of ONBOARDING_REQUIRED | ACTIVE | QUOTA_EXCEEDED | ERROR), persisted/monitoring_active flags, a human next_step.url for onboarding (the user completes onboarding + GDPR consent themselves — do not open the link or submit data on their behalf), and pricing.

Input parameters:

- `ico` (string, required): Czech IČO — 7 or 8 digits.

### `get_risk_score` (~66 tokens)

Lightweight version of get_dd_report — returns just the numeric score (0-100), risk level, and top triggered red flags. Faster when you only need a yes/no/maybe screen.

Input parameters:

- `ico` (string, required): Czech IČO — 7 or 8 digits.

### `get_statutory_chain` (~161 tokens)

Surname-based heuristic walk through statutory bodies of related Czech companies. Best for shell-company unwinding in small s.r.o. with RARE surnames. NOT a true UBO source — for actual beneficial ownership use the ESM (evidence skutečných majitelů, separate registry, future @czagents/esm). For boards of large public companies with common Czech surnames (Novák, Zima, Kolář…) results are noisy by design; the tool auto-skips persons whose surname matches >50 companies with a SURNAME_TOO_COMMON note.

Input parameters:

- `ico` (string, required): Czech IČO — 7 or 8 digits.
- `max_depth` (integer): Max recursion depth (default 3, hard cap 5).

### `detect_nominee_director` (~117 tokens)

Detect "white horse" / nominee director patterns — 3 surface indicators (age outlier, multi-board membership, recent appointment) computable from ARES data alone. Returns indicator breakdown with riskScore 0-100. Pro Compliance tier or higher. For 8-indicator deep analysis including ISIR cross-reference, sanctions, address crowding and phoenix pattern, see detect_nominee_director_rich in @czagents/ddplus.

Input parameters:

- `ico` (string, required): Czech IČO — 7 or 8 digits.

### `detect_phoenix` (~123 tokens)

Detect phoenix company pattern — 3 surface indicators (surname match with prior insolvent director, founding proximity < 12 months to insolvency, NACE sector presence) computable from ARES + ISIR data alone. Returns PhoenixReport with riskScore 0-100. Pro Compliance tier or higher. For 4 additional deep indicators (founder identity, asset transfer, multi-cycle, address continuity) see detect_phoenix_rich in @czagents/ddplus.

Input parameters:

- `ico` (string, required): Czech IČO — 7 or 8 digits.

### `get_risk_timeline` (~114 tokens)

Build a chronologically sorted lifecycle timeline for a Czech company — basic events include company formation, statutory appointments, active insolvency, sanctions matches, VAT reliability flips. Returns events[] with riskScore 0-100. Pro Compliance tier or higher. For enriched timeline with ISIR lifecycle, address history, cross-entity events, and AI narrative summary, see get_risk_timeline_rich in @czagents/ddplus.

Input parameters:

- `ico` (string, required): Czech IČO — 7 or 8 digits.

### `detect_address_crowding` (~98 tokens)

Detects "shell-firm hotel" patterns — counts how many companies share the same registered address. Threshold-based risk: 1-9 normal (multi-tenant office), 10-49 mild (legitimate coworking), 50-199 medium (virtual office provider), 200+ high (shell-firm hotel). Compliance tier or higher.

Input parameters:

- `ico` (string, required): Czech IČO 7-8 digits

### `get_eu_dd_report` (~159 tokens)

EU Due-Diligence report for an international company. Input: 20-char LEI code, or company name + optional country. Returns GLEIF entity data (status, address, registration number) plus sanctions screening against EU/OFAC lists. Coverage notes per country included. Note: GLEIF covers mid/large firms with LEI — SMEs may not be found. Pro Compliance tier or higher.

Input parameters:

- `country` (string): ISO 3166-1 alpha-2 country code — helps narrow name search, not needed for LEI lookup.
- `identifier` (string, required): 20-char LEI code (e.g. "W38RGI023J3WT1HWRP32") or company name.

### `get_eu_parent` (~118 tokens)

Find the EU/international parent company for a Czech IČO. Looks up the company name in ARES, then searches GLEIF (Global LEI Foundation) for a matching LEI-registered entity. Returns LEI, name, country, and confidence level (HIGH/MEDIUM/LOW). Note: GLEIF covers mid/large international firms; SMEs without an LEI will not be found. Pro Compliance tier or higher.

Input parameters:

- `ico` (string, required): Czech IČO — 7 or 8 digits.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/dev-cz-agents-dd/czagents-dd#diagnostics

## Score history

- 2026-08-03: 76
- 2026-08-02: 76
- 2026-08-01: 35
- 2026-07-31: 27
- 2026-07-29: 45
- 2026-07-28: 24
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/@czagents/dd
- Socket report: https://socket.dev/npm/package/@czagents/dd
- Repository: https://github.com/martinhavel/cz-agents-mcp
- Website: https://cz-agents.dev/
- Changelog RSS feed: https://verifymcp.io/servers/dev-cz-agents-dd/czagents-dd/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/dev-cz-agents-dd/czagents-dd/changelog.json
- HTML version of this page: https://verifymcp.io/servers/dev-cz-agents-dd/czagents-dd