Gleif
NPM · @PIPEWORX/MCP-GLEIF · 2 COMPONENTS
GLEIF MCP — Global Legal Entity Identifier Foundation (free, no auth)
Available components
Last scanned (14 hours ago)
Scores higher than 76% of npm servers
Category Finance and Payments
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to pipeworx-io/mcp-gleif). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 2 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability66
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2939 tokens (~267/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
- Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 11 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +27
- Known CVEs: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Dependency health: unverified → pass ▲ functional
- 2 Nov 26 −26
- Malware scan: pass → unverified ▼ security
- Known CVEs: pass → unverified ▼ security
- Dependency health: pass → unverified ▼ functional
- Package version: 0.2.0 → 0.2.1 functional
- 1 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 0 to 3. That category is still filling its 30-day observation window: 0 days of observed history at the previous scan, 1 at this one. The score rises as the window fills, whether or not the server changes.
- 29 Oct 26 79
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/@pipeworx/mcp-gleif@0.2.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | pipeworx-io/mcp-gleif |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/pipeworx-io/mcp-gleif/.github/workflows/publish.yml@refs/heads/main |
| Rekor log index | 3637325319 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:d2470351759c0a4f3156d33b8955cbd1b556a563bbb71becbef0274e8e61f0bbaa2bc6aec691504099183213fcbfad91f2151dab60e17f4a281882424 |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
bic_to_lei ~199
Resolve a SWIFT/BIC bank identifier code (8 or 11 characters, e.g. "DEUTDEFF" or "DEUTDEFFXXX") to the bank's legal entity: LEI, registered legal name, jurisdiction, and status, via the official GLEIF BIC-to-LEI mapping. Answers "which legal entity is behind this BIC" / "LEI for SWIFT code X" for cross-border bank identity (KYC, counterparty due diligence, payments). A branch BIC that has no mapping of its own falls back to the head office (the trailing "XXX" form) and says so.
| Name | Type | Req | Description |
|---|---|---|---|
| bic | string | yes | SWIFT/BIC code, 8 or 11 characters, e.g. "DEUTDEFF", "CHASUS33" or "DEUTDEFFXXX". 8-character codes are treated as the head office ("XXX" branch). |
No output schema declared.
No examples provided.
decode_elf_code ~245
Decode an ISO 20275 Entity Legal Form (ELF) code to its registered name, language, country and jurisdiction. This is the 4-character code GLEIF publishes as `legal_form` on every LEI record (get_lei, search_lei results) — "XJHM" decodes to Sweden's "Aktiebolag", for example. Two sentinel codes carry no country or jurisdiction: "8888" (no specific legal form recorded — used where the concept does not apply, e.g. some government entities) and "9999" (legal form not yet classified by the registering LOU); both are flagged via `is_sentinel` rather than answered as a plain lookup miss. get_lei already decodes this field inline as legal_form_decoded — call this tool directly only when you have a bare code from elsewhere.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | 4-character ISO 20275 ELF code, e.g. "XJHM" (Sweden, Aktiebolag) or the sentinel "8888"/"9999". Read it off an LEI record's legal_form field — do not guess one. |
No output schema declared.
No examples provided.
decode_registration_authority ~194
Decode a GLEIF Registration Authority (RA) code to the national business register's name, website and jurisdiction(s). This is the code GLEIF publishes as `registration_authority` on every LEI record (get_lei, search_lei results), naming the register that assigned the entity's `registered_as` id — "RA000585" decodes to the UK's Companies House, for example. Bare digits are zero-padded and prefixed with "RA" automatically ("585" -> "RA000585"). get_lei already decodes this field inline as registration_authority_decoded — call this tool directly only when you have a bare code from elsewhere.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | GLEIF Registration Authority code, "RA" + 6 digits, e.g. "RA000585" (UK Companies House). Bare digits (e.g. "585") are accepted and normalized. |
No output schema declared.
No examples provided.
get_lei ~263
Fetch the full Level 1 LEI record for a legal entity. Returns legal name, registered address, headquarters address, entity category, legal form, registration authority, LEI registration status (ISSUED / LAPSED / RETIRED / ...), jurisdiction, parent LEI (if any), and timestamps. Accepts a company NAME as well as a 20-character LEI — a name is resolved against the registry here and the match is echoed back as resolved_from_name. Answers "is this company's LEI still active or has it lapsed" and "where is this entity registered".
| Name | Type | Req | Description |
|---|---|---|---|
| lei | string | yes | 20-character LEI code (e.g. "HWUPKR0MPOU8FGXBT394") OR the company NAME (e.g. "Wirecard AG") — a name is resolved here automatically and the match is echoed back as resolved_from_name. Pass the name… |
No output schema declared.
No examples provided.
get_lei_relationships ~153
Fetch Level 2 corporate hierarchy for an LEI: direct parent, ultimate parent, and direct children. Use to map ownership trees across multinational groups. Accepts a company NAME as well as an LEI.
| Name | Type | Req | Description |
|---|---|---|---|
| lei | string | yes | 20-character LEI code (e.g. "HWUPKR0MPOU8FGXBT394") OR the company NAME (e.g. "Apple Inc") — a name is resolved here automatically and the match is echoed back as resolved_from_name. Do not guess an… |
No output schema declared.
No examples provided.
gleif_group_members ~365
Every entity in a corporate group, across all jurisdictions, in ONE call — built on the GLEIF golden copy (every Level 2 relationship record). Give any member of the group (LEI or company name): the tool climbs to the group's ultimate accounting-consolidation parent and returns every entity that reports it as ultimate parent, every descendant over direct-parent links, and the international branches of any of them. Aggregates are over the WHOLE group (member_count, jurisdiction_count, by_jurisdiction); the member list is capped by `limit` and says so. Each member carries depth below the root, direct_parent_lei, consolidation % where reported, jurisdiction and LEI status. Answers "all subsidiaries of Siemens worldwide", "which countries does this group have legal entities in", "who is the ultimate parent of this company and what else does it own". Use this over lei_hierarchy_tree for large groups (that tool walks one node at a time and truncates at 150). Fund-management links (IS_FUND-MANAGED_BY / IS_SUBFUND_OF) are NOT ownership and are not included. Response carries data_as_of (the GLEIF publish time the answer reflects).
| Name | Type | Req | Description |
|---|---|---|---|
| lei | string | yes | A 20-character LEI of ANY group member, e.g. "W38RGI023J3WT1HWRP32" (Siemens AG), OR a company name, e.g. "Siemens" — resolved against the GLEIF entity register (a subsidiary match still lands on the… |
| limit | number | – | Max members to list, 1-2000 (default 300). Counts and by_jurisdiction always cover the whole group. |
No output schema declared.
No examples provided.
gleif_lei_screen ~553
Bulk screen of LEI registrations in a jurisdiction across all ~3.4M LEIs in the GLEIF golden copy. Filter by registration status (LAPSED, RETIRED, ANNULLED, ISSUED ...), entity status, category, most recent legal-entity event (MERGERS_AND_ACQUISITIONS, ABSORPTION, DISSOLUTION, LIQUIDATION, CHANGE_LEGAL_NAME ...), a name fragment, and a lookback window in days. Answers "which LEIs in Germany lapsed in the last 30 days", "Delaware entities retired this quarter", "UK entities with a merger event in the last 90 days", "new LEIs issued in Luxembourg this week". The window applies to status_date — the date the current status took effect: LAPSED = the renewal date that was missed, RETIRED/ANNULLED = entity expiration date (else last update), ISSUED = initial registration — or to the event date when event_type is given. Returns total (exact up to 100,000) plus a page of rows, newest first, with data_as_of. Sole-proprietor names are withheld (personal data); call get_lei for one record.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Entity category. |
| entity_status | string | – | Legal entity status. |
| event_type | string | – | The MOST RECENT legal-entity event recorded on the LEI (earlier events are not matched). When given, since_days applies to the event date instead of status_date. A merger shows up as RETIRED plus MER… |
| jurisdiction | string | yes | Legal jurisdiction: ISO 3166-1 alpha-2 country ("DE", "GB", "US") or a subdivision ("US-DE", "CA-ON"). A country code includes its subdivisions. Common country names are converted. |
| limit | number | – | Rows per page, 1-500 (default 100). |
| name_contains | string | – | Case-insensitive fragment of the legal or other name, at least 3 characters, e.g. "bank". |
| offset | number | – | Rows to skip for paging (default 0). |
| registration_status | string | – | LEI registration status. LAPSED = renewal missed (the company may still exist); RETIRED = the entity ceased, including by merger (pair with event_type to tell which). |
| since_days | number | – | Only entities whose status_date (or event date, with event_type) falls within the last N days, 1-3650. |
No output schema declared.
No examples provided.
isin_to_lei ~188
Resolve an ISIN (12-character international securities identifier, e.g. "CH0038863350" or "DE0007164600") to the LEGAL ENTITY that issued the security: its LEI, registered legal name, jurisdiction, and status, via the official GLEIF ISIN-to-LEI mapping. Answers "who issued this security" / "which company is behind ISIN X" for non-US as well as US securities. An ISIN identifies one security while the issuer typically has many — the response says what it resolved TO. A valid ISIN with no mapping yet is reported as unmapped (the mapping lags new issuance), distinct from an invalid ISIN.
| Name | Type | Req | Description |
|---|---|---|---|
| isin | string | yes | 12-character ISIN, e.g. "CH0038863350" (2-letter country prefix + 9-char NSIN + check digit) |
No output schema declared.
No examples provided.
lei_hierarchy_tree ~193
Walk the FULL corporate ownership hierarchy for an entity in one call: the ancestor chain from the entity up to its ultimate parent, plus a multi-level tree of subsidiaries below it (breadth-first over GLEIF Level 2 direct-child records, depth-limited, depth stated in the response). Accepts a 20-character LEI or a company NAME. Answers "everything this group ultimately controls" / "full subsidiary tree of Deutsche Bank" / "who is at the top of this entity's ownership chain" — use get_lei_relationships instead when one hop (direct parent + direct children) is enough.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | number | – | How many generations of subsidiaries to descend: 1-4, default 2. The ancestor chain upward is always walked to the top regardless. |
| lei | string | yes | 20-character LEI code OR a company name (resolved automatically, match echoed back). |
No output schema declared.
No examples provided.
lei_to_isins ~167
List ALL ISINs (securities) issued by a legal entity, from the official GLEIF ISIN-to-LEI mapping. Accepts a 20-character LEI or a company NAME (resolved automatically and echoed back). Answers "what securities has this company issued" / "all ISINs for Nestlé". Returns the full set — bonds, share lines, ADRs — not a single value; an entity that exists but has no mapped ISINs returns an empty set with that stated.
| Name | Type | Req | Description |
|---|---|---|---|
| lei | string | yes | 20-character LEI code (e.g. "KY37LUS27QQX7BB93L28") OR a company name (e.g. "Nestlé") — names are resolved via the LEI registry first. |
No output schema declared.
No examples provided.
search_lei ~366
Search the GLEIF LEI registry by legal entity name. Returns matched entities with their 20-character LEI, jurisdiction, status, and BIC/ISIN cross-references. Use the LEI to resolve canonical identity across SEC, OpenSanctions, and counterparty databases. Name matching is whole-token AND against the REGISTERED legal name, so abbreviations that do not literally appear ("Microsoft Corp", "Toyota Motor Corp") match nothing on their own; this tool automatically retries with legal-form suffixes dropped, with the words joined ("Exxon Mobil" -> "ExxonMobil"), and finally against GLEIF fuzzy autocomplete. The response always reports `match_mode` and `searched_as` so you can see which query actually produced the rows.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Restrict to the legal address country. ISO 3166-1 alpha-2, e.g. "US", "DE", "JP". Alpha-3 codes and country names are accepted for the common jurisdictions and converted; anything unrecognized is rej… |
| page_size | number | – | 1-200 (default 25) |
| query | string | yes | Legal entity name (full or partial), e.g. "Apple Inc." or "Siemens Aktiengesellschaft" |
| status | string | – | Entity status (ACTIVE | INACTIVE | NULL) or LEI registration status (ISSUED | LAPSED | ANNULLED | PENDING_TRANSFER | PENDING_ARCHIVAL | DUPLICATE | RETIRED | MERGED). GLEIF keeps these in two differe… |
No output schema declared.
No examples provided.
How do I install the Gleif MCP server?
Gleif runs locally as an npm package, launched with npx -y @pipeworx/mcp-gleif. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @pipeworx/mcp-gleif
claude mcp add pipeworx-io-gleif -- npx -y @pipeworx/mcp-gleif
What is the Gleif MCP server?
Gleif is an MCP server listed in the public MCP registry as io.github.pipeworx-io/gleif. GLEIF MCP, Global Legal Entity Identifier Foundation (free, no auth). This page covers its npm package (@pipeworx/mcp-gleif).
Is the Gleif MCP server safe to use?
Gleif scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Gleif MCP server expose?
Gleif exposes 11 tools: search_lei, get_lei, get_lei_relationships, isin_to_lei, lei_to_isins, and 6 more. Their descriptions and schemas cost roughly 2,886 tokens of context every time the server is loaded.
Is the Gleif MCP server still maintained?
Gleif is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Gleif MCP server under?
Gleif declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.