Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Romania

PYPI · ROMANIA-MCP-SERVER

Romanian company reports, ONRC search, public contracts, VAT checks and local monitoring

Available components

−14 this week 79 Trust /100

Last scanned (5 hours ago)

Scores higher than 78% of PyPI servers

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security49
  • Malware scan not yet available for this package.Unverified
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
  • 3 of 33 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to robyroro/romania-mcp). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 14 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability69
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 2904 tokens (~138/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 21 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Nov 26 −15
    • Malware scan: pass → unverified ▼ security
  • 2 Nov 26 +15
    • Malware scan: unverified → pass ▲ security
  • 31 Oct 26 +1
    • Stability: 0.97 → pass security
  • 30 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
  • 29 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 27 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 24 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.

  • 22 Oct 26 +16
    • Malware scan: unverified → pass ▲ security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed pypi/romania-mcp-server@0.2.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem pypi
Reason Verified
Discovered via Registry attestation endpoint
Source repo robyroro/romania-mcp
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/robyroro/romania-mcp/.github/workflows/publish.yml@refs/tags/v0.2.0
Rekor log index 3359389728
Predicate type PyPI publish attestation https://docs.pypi.org/attestations/publish/v1
Subject digest sha256:888ffabe3f6264476da6af14dd560be1a1d91a56677ee9edb1741fe27ff7d704

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted hatchling.build

Background: Why install scripts are a supply-chain risk →

Dependencies 33 packages
Packages resolved 33
Stale 2
No linked repository 1
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 21 exposed · ~2,758 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
company_changes ~77

Compare the latest two saved observations. Does not fetch or save new data. Failed checks are reported as availability changes, never as deleted financials or closed cases.

NameTypeReqDescription
cuistringyesCompany fiscal code (CUI / CIF), with or without the RO prefix, e.g. "14399840" or "RO14399840".

No output schema declared.

No examples provided.

company_contracts ~135

Find contracts by supplier CUI in imported SEAP exports. Values are contract amounts, not payments. No matches is not proof that no contracts exist outside the imported coverage.

NameTypeReqDescription
cuistringyesCompany fiscal code (CUI / CIF), with or without the RO prefix, e.g. "14399840" or "RO14399840".
limitinteger–Maximum contracts on this page; totals cover all imported matches.
offsetinteger–Number of contracts to skip.
since––Earliest contract date, YYYY-MM-DD.
until––Latest contract date, YYYY-MM-DD.

No output schema declared.

No examples provided.

company_financials ~231

Financial statements a Romanian company filed with ANAF, year by year: revenue (cifra de afaceri), total income and expenses, net profit or loss (net_result), average employees, debts, equity, cash, receivables, inventory and fixed assets. Amounts are in RON. Years with nothing filed are marked filed=false. Use it to see if a company is real and how it's doing: a shop with zero revenue and no employees, or with negative equity, is worth a closer look. Banks and insurers file a different layout, their lines come through under 'other'. Data starts around 2020 for some companies. Takes about a second per year. Cached for 24h.

NameTypeReqDescription
cuistringyesCompany fiscal code (CUI / CIF), with or without the RO prefix, e.g. "14399840" or "RO14399840".
yearsinteger–How many years to fetch, counting back from last year. Statements for a year are filed by mid next year, so the most recent one can still be missing.

No output schema declared.

No examples provided.

company_history ~72

Read local observations. The history starts when you first save a snapshot.

NameTypeReqDescription
cuistringyesCompany fiscal code (CUI / CIF), with or without the RO prefix, e.g. "14399840" or "RO14399840".
limitinteger–Maximum saved reports, newest first.

No output schema declared.

No examples provided.

company_lookup ~270

Official status of Romanian companies from ANAF's public registry: name, address, registration number (J...), CAEN code, registration date, whether it's deregistered (radiată), VAT registered (and since when), VAT on collection, split VAT, declared fiscally inactive, and in the RO e-Factura registry. Each company comes with a 'warnings' list (deregistered, fiscally inactive, suspended). Use it to vet suppliers or clients, e.g. checking a list of suppliers for fiscally inactive ones, since buyers generally can't deduct expenses or VAT on their invoices. Only searches by CUI, not by name. CUIs with a wrong control digit are returned under 'invalid' without asking ANAF. ANAF allows about one request per second, so every 100 CUIs take a second. Cached for 6h.

NameTypeReqDescription
cuisarrayyesOne or more CUIs, with or without RO, e.g. ["14399840", "RO18547290"]. Up to 500 in one call.
date––Check the status as it was on this day (YYYY-MM-DD or DD.MM.YYYY), e.g. an invoice date to see if the supplier was VAT registered then. Defaults to today.

No output schema declared.

No examples provided.

company_report ~111

Company status, financial trends, court candidates and imported public contracts, with source receipts. Missing data stays visible. Does not save a history snapshot or make a credit decision.

NameTypeReqDescription
cuistringyesCompany fiscal code (CUI / CIF), with or without the RO prefix, e.g. "14399840" or "RO14399840".
refreshboolean–Fetch again instead of using cached source responses.
yearsinteger–Financial years to check, counting back from last year.

No output schema declared.

No examples provided.

company_search ~140

Search the imported ONRC index. Returns its publication dates; choose a CUI and verify it with ANAF.

NameTypeReqDescription
caen––Four-digit CAEN code; requires the CAEN export for authorized activities.
caen_version––CAEN revision, 2 or 3; requires its matching authorized-activities export.
county––County as written in the imported ONRC file, e.g. Cluj.
limitinteger–Maximum company matches on this page.
namestringyesPart of the company name; diacritics are optional.
offsetinteger–Number of matches to skip for pagination.

No output schema declared.

No examples provided.

company_snapshot ~79

Fetch a fresh report and save it locally for later comparisons. Saves partial results with their errors.

NameTypeReqDescription
cuistringyesCompany fiscal code (CUI / CIF), with or without the RO prefix, e.g. "14399840" or "RO14399840".
yearsinteger–Financial years to include in the saved observation.

No output schema declared.

No examples provided.

company_watch ~109

Save a local watch. Run monitor_run or the CLI monitor periodically to check due companies. No background process or external notification is started by this tool.

NameTypeReqDescription
cuistringyesCompany fiscal code (CUI / CIF), with or without the RO prefix, e.g. "14399840" or "RO14399840".
enabledboolean–False pauses this company's watch; its saved reports are kept.
interval_hoursinteger–Hours between checks when the monitor is run.

No output schema declared.

No examples provided.

company_watchlist ~35

Read the local watchlist and the next check times.

NameTypeReqDescription
limitinteger–Maximum watches to return, including paused watches.

No output schema declared.

No examples provided.

court_cases ~361

Court cases from Portal Just, the public portal of every Romanian court: case number, court, category (civil, criminal, insolvency...), stage, subject, parties and their roles, latest outcome and next hearing. For a party it also counts its roles (defendant, creditor...) and lists insolvency cases where it's the debtor, the strongest red flag for a company. Prefer cui for companies: the portal has no fiscal codes, so a name search also returns other companies with similar names. A big company being creditor or plaintiff in many cases is normal, look at the roles. Portal Just caps a search at 1000 cases. Usually answers in 1-5s. Cached for 3h.

NameTypeReqDescription
case_number––Case number, e.g. "17902/3/2023". Use instead of or together with party.
court––Only cases at this court, e.g. "Tribunalul Cluj" or "Judecatoria Sectorul 4". Ambiguous names return an error listing the matching courts.
cui––A company's CUI. Its exact name and county come from ANAF, so only that company's cases are kept and insolvency is checked at the right court. Best for companies.
limitinteger–How many cases to return in detail, most recently updated first. Counts cover all of them.
party––Name of a party to search for, e.g. "Dante International". "SC" and the legal form (SRL, SA) are dropped so different spellings match. Diacritics don't matter.
since––Only cases registered on or after this day (YYYY-MM-DD or DD.MM.YYYY).

No output schema declared.

No examples provided.

dataset_catalog ~64

Find official export files and resource IDs. Check the file's period before importing it.

NameTypeReqDescription
limitinteger–Maximum datasets to list with their resource IDs.
querystringyesdata.gov.ro search, e.g. organization:onrc or achizitii publice.

No output schema declared.

No examples provided.

dataset_import ~159

Download and atomically index a CSV, XLSX or ODS export locally. Large ONRC files can take minutes. Reimporting a resource replaces its rows after validation. Other datasets and reports are kept.

NameTypeReqDescription
kindstringyesonrc for OD_FIRME, caen for OD_CAEN_AUTORIZAT, procurement for contract exports.
period_end––Last day covered by a procurement export, YYYY-MM-DD.
period_start––First day covered by a procurement export, YYYY-MM-DD.
published_onstringyesPublication or snapshot date stated by the source, YYYY-MM-DD; not today's date by default.
resource_idstringyesResource ID from dataset_catalog. Downloads from data.gov.ro only.

No output schema declared.

No examples provided.

dataset_status ~22

List local dataset provenance, coverage periods, skipped rows and file hashes.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

exchange_rate ~210

Official National Bank of Romania (BNR) reference rate: how many RON one unit of a currency is worth on a day, and optionally an amount converted to RON. rate_date is the day of the fixing that was used. BNR publishes once per working day around 13:00. For a VAT invoice in foreign currency the usual rule is the last rate published before the invoice date, so ask for the day before. Cached for 1h (past years for 30 days).

NameTypeReqDescription
amount––Amount in that currency to convert to RON, e.g. 1500 for 1500 EUR.
currencystring–ISO code like "EUR", "USD", "GBP", or "ALL" for every currency BNR publishes.
date––Day to get the rate for (YYYY-MM-DD or DD.MM.YYYY), from 2005 on. Weekends and holidays give the last rate before. Defaults to the latest rate.

No output schema declared.

No examples provided.

iban_check ~134

Check that an IBAN is well formed (length and mod-97 check digits, catches typos) and, for Romanian IBANs, which bank issued it and whether it's a State Treasury account. Works for any country's IBAN, offline, nothing is sent anywhere. A valid IBAN only means the number is well formed: it doesn't prove the account exists or who owns it. Use company_lookup to check the company you're paying.

NameTypeReqDescription
ibanstringyesIBAN to check, spaces allowed, e.g. "RO49 AAAA 1B31 0075 9384 0000".

No output schema declared.

No examples provided.

monitor_run ~40

Fetch fresh reports for due watches, save snapshots and return meaningful changes or new failures.

NameTypeReqDescription
limitinteger–Maximum due watches to check during this run.

No output schema declared.

No examples provided.

shop_check ~225

Is an online shop legit? Reads the CUI off the site (homepage, then terms / contact pages), then checks the company at ANAF, its last two years of financials, insolvency and other cases on Portal Just, and how long the site has been online (Wayback Machine). Returns a risk level (high / medium / low / unknown) with red_flags, warnings and good_signs, plus all the data behind them. Use this first for "e țeapă?" questions, then the other tools to dig deeper. The result is signals, not proof: a scam can copy a real company's CUI, which is why it checks that the company name appears on the site. Fetches a few pages of the shop like a browser would. Takes 5-20s.

NameTypeReqDescription
cui––The company's CUI, if you already know it or the site hides it from bots.
urlstringyesThe shop's address, e.g. "https://example.ro" or just "example.ro".

No output schema declared.

No examples provided.

supplier_check ~105

Create or resume a local supplier review. Returns progress and the ID to pass on the next call.

NameTypeReqDescription
cuis––CUIs for a new check; omit when resuming a job.
job_id––ID returned by a previous supplier_check call to continue pending items.
limitinteger–Suppliers to process in this call; results are saved after each supplier.
yearsinteger–Financial years for a new job. Resumed jobs keep their original setting.

No output schema declared.

No examples provided.

supplier_results ~89

Read saved results, with findings first and incomplete checks clearly marked. CSV retains source receipts.

NameTypeReqDescription
formatstring–Return structured JSON or CSV text; no file is written.
job_idstringyesSupplier check ID returned by supplier_check.
limitinteger–Suppliers on this page; follow next_offset for more.
offsetinteger–Number of sorted suppliers to skip.

No output schema declared.

No examples provided.

vat_check ~90

Check a trading partner's current intra-EU VAT registration with VIES. Unavailable is not invalid. Run for a requested partner check, not general-purpose company harvesting.

NameTypeReqDescription
countrystringyesEU member state code, e.g. RO or DE; EL for Greece, XI for Northern Ireland.
vat_numberstringyesTrading partner's VAT number, with or without the matching country prefix.

No output schema declared.

No examples provided.

Install

How do I install the Romania MCP server?

Romania runs locally as a PyPI package, launched with uvx romania-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · romania-mcp-server

# add to Claude Code
claude mcp add robyroro-romania-mcp -- uvx romania-mcp-server
Common questions

What is the Romania MCP server?

Romania is an MCP server listed in the public MCP registry as io.github.robyroro/romania-mcp. Romanian company reports, ONRC search, public contracts, VAT checks and local monitoring. This page covers its PyPI package (romania-mcp-server).

Is the Romania MCP server safe to use?

Romania scores 79 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Romania MCP server expose?

Romania exposes 21 tools: company_lookup, company_financials, court_cases, exchange_rate, shop_check, and 16 more. Their descriptions and schemas cost roughly 2,758 tokens of context every time the server is loaded.

Is the Romania MCP server still maintained?

Romania is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Romania MCP server under?

Romania declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.