# Romania (pypi · romania-mcp-server)

Romanian company reports, ONRC search, public contracts, VAT checks and local monitoring

- Trust score: 79/100 (medium)
- Change this week: −14
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- pypi · `romania-mcp-server`: 79/100 (this document), [markdown](https://verifymcp.io/servers/robyroro-romania-mcp/romania-mcp-server.md), [page](https://verifymcp.io/servers/robyroro-romania-mcp/romania-mcp-server)

## Channel facts

- Registry: `pypi`
- Package: `romania-mcp-server`
- Version: `0.2.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 49/100
  - Malware scan not yet available for this package.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs hatchling.build at install time, a recognised build step with no custom scripting around it.
  - 3 of 33 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to robyroro/romania-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 14 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 69/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2904 tokens (~138/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 100/100
  - No destabilizing schema changes in the last 30 days.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 21 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the Romania MCP server?

Romania runs locally as a PyPI package, launched with uvx romania-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add robyroro-romania-mcp -- uvx romania-mcp-server
```

### Cursor

```json
{
  "mcpServers": {
    "robyroro-romania-mcp": {
      "command": "uvx",
      "args": [
        "romania-mcp-server"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "robyroro-romania-mcp": {
      "command": "uvx",
      "args": [
        "romania-mcp-server"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add robyroro-romania-mcp -- uvx romania-mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "robyroro-romania-mcp": {
      "type": "local",
      "command": [
        "uvx",
        "romania-mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add robyroro-romania-mcp --command uvx --arg romania-mcp-server
```

### Hermes

```yaml
mcp_servers:
  robyroro-romania-mcp:
    command: "uvx"
    args: ["romania-mcp-server"]
```

### Netclaw

```json
{
  "McpServers": {
    "robyroro-romania-mcp": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "romania-mcp-server"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add robyroro-romania-mcp -t stdio -c uvx -a romania-mcp-server
```

### Other

```json
{
  "mcpServers": {
    "robyroro-romania-mcp": {
      "command": "uvx",
      "args": [
        "romania-mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-03 (score 79, −15)

- [security regression] Malware scan: pass → unverified

### 2026-11-02 (score 94, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-31 (score 79, +1)

- [security] Stability: 0.97 → pass

### 2026-10-30 (score 78, −15)

- [security regression] Malware scan: pass → unverified

### 2026-10-29 (score 93, +1)

No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-27 (score 92, +1)

No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-24 (score 91, +1)

No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-22 (score 90, +16)

- [security improvement] Malware scan: unverified → pass

## MCP tools (21)

### `company_lookup` (~270 tokens)

Company lookup (ANAF)

Official status of Romanian companies from ANAF's public registry: name, address,
registration number (J...), CAEN code, registration date, whether it's deregistered
(radiată), VAT registered (and since when), VAT on collection, split VAT, declared
fiscally inactive, and in the RO e-Factura registry. Each company comes with a
'warnings' list (deregistered, fiscally inactive, suspended).

Use it to vet suppliers or clients, e.g. checking a list of suppliers for fiscally
inactive ones, since buyers generally can't deduct expenses or VAT on their invoices.
Only searches by CUI, not by name. CUIs with a wrong control digit are returned
under 'invalid' without asking ANAF. ANAF allows about one request per second, so
every 100 CUIs take a second. Cached for 6h.

Input parameters:

- `cuis` (array, required): One or more CUIs, with or without RO, e.g. ["14399840", "RO18547290"]. Up to 500 in one call.
- `date`: Check the status as it was on this day (YYYY-MM-DD or DD.MM.YYYY), e.g. an invoice date to see if the supplier was VAT registered then. Defaults to today.

### `company_financials` (~231 tokens)

Company financials (bilanț)

Financial statements a Romanian company filed with ANAF, year by year: revenue
(cifra de afaceri), total income and expenses, net profit or loss (net_result),
average employees, debts, equity, cash, receivables, inventory and fixed assets.
Amounts are in RON. Years with nothing filed are marked filed=false.

Use it to see if a company is real and how it's doing: a shop with zero revenue and
no employees, or with negative equity, is worth a closer look. Banks and insurers
file a different layout, their lines come through under 'other'. Data starts
around 2020 for some companies. Takes about a second per year. Cached for 24h.

Input parameters:

- `cui` (string, required): Company fiscal code (CUI / CIF), with or without the RO prefix, e.g. "14399840" or "RO14399840".
- `years` (integer): How many years to fetch, counting back from last year. Statements for a year are filed by mid next year, so the most recent one can still be missing.

### `court_cases` (~361 tokens)

Court cases (Portal Just)

Court cases from Portal Just, the public portal of every Romanian court: case
number, court, category (civil, criminal, insolvency...), stage, subject, parties
and their roles, latest outcome and next hearing. For a party it also counts its
roles (defendant, creditor...) and lists insolvency cases where it's the debtor,
the strongest red flag for a company.

Prefer cui for companies: the portal has no fiscal codes, so a name search also
returns other companies with similar names. A big company being creditor or
plaintiff in many cases is normal, look at the roles. Portal Just caps a search at
1000 cases. Usually answers in 1-5s. Cached for 3h.

Input parameters:

- `case_number`: Case number, e.g. "17902/3/2023". Use instead of or together with party.
- `court`: Only cases at this court, e.g. "Tribunalul Cluj" or "Judecatoria Sectorul 4". Ambiguous names return an error listing the matching courts.
- `cui`: A company's CUI. Its exact name and county come from ANAF, so only that company's cases are kept and insolvency is checked at the right court. Best for companies.
- `limit` (integer): How many cases to return in detail, most recently updated first. Counts cover all of them.
- `party`: Name of a party to search for, e.g. "Dante International". "SC" and the legal form (SRL, SA) are dropped so different spellings match. Diacritics don't matter.
- `since`: Only cases registered on or after this day (YYYY-MM-DD or DD.MM.YYYY).

### `exchange_rate` (~210 tokens)

BNR exchange rate

Official National Bank of Romania (BNR) reference rate: how many RON one unit of a
currency is worth on a day, and optionally an amount converted to RON. rate_date is
the day of the fixing that was used.

BNR publishes once per working day around 13:00. For a VAT invoice in foreign
currency the usual rule is the last rate published before the invoice date, so
ask for the day before. Cached for 1h (past years for 30 days).

Input parameters:

- `amount`: Amount in that currency to convert to RON, e.g. 1500 for 1500 EUR.
- `currency` (string): ISO code like "EUR", "USD", "GBP", or "ALL" for every currency BNR publishes.
- `date`: Day to get the rate for (YYYY-MM-DD or DD.MM.YYYY), from 2005 on. Weekends and holidays give the last rate before. Defaults to the latest rate.

### `shop_check` (~225 tokens)

Online shop check

Is an online shop legit? Reads the CUI off the site (homepage, then terms /
contact pages), then checks the company at ANAF, its last two years of financials,
insolvency and other cases on Portal Just, and how long the site has been online
(Wayback Machine). Returns a risk level (high / medium / low / unknown) with
red_flags, warnings and good_signs, plus all the data behind them.

Use this first for "e țeapă?" questions, then the other tools to dig deeper. The
result is signals, not proof: a scam can copy a real company's CUI, which is why it
checks that the company name appears on the site. Fetches a few pages of the shop
like a browser would. Takes 5-20s.

Input parameters:

- `cui`: The company's CUI, if you already know it or the site hides it from bots.
- `url` (string, required): The shop's address, e.g. "https://example.ro" or just "example.ro".

### `iban_check` (~134 tokens)

IBAN check

Check that an IBAN is well formed (length and mod-97 check digits, catches typos)
and, for Romanian IBANs, which bank issued it and whether it's a State Treasury
account. Works for any country's IBAN, offline, nothing is sent anywhere.

A valid IBAN only means the number is well formed: it doesn't prove the account
exists or who owns it. Use company_lookup to check the company you're paying.

Input parameters:

- `iban` (string, required): IBAN to check, spaces allowed, e.g. "RO49 AAAA 1B31 0075 9384 0000".

### `company_report` (~111 tokens)

Company report

Company status, financial trends, court candidates and imported public contracts, with source receipts.
Missing data stays visible. Does not save a history snapshot or make a credit decision.

Input parameters:

- `cui` (string, required): Company fiscal code (CUI / CIF), with or without the RO prefix, e.g. "14399840" or "RO14399840".
- `refresh` (boolean): Fetch again instead of using cached source responses.
- `years` (integer): Financial years to check, counting back from last year.

### `company_search` (~140 tokens)

Find a company by name

Search the imported ONRC index. Returns its publication dates; choose a CUI and verify it with ANAF.

Input parameters:

- `caen`: Four-digit CAEN code; requires the CAEN export for authorized activities.
- `caen_version`: CAEN revision, 2 or 3; requires its matching authorized-activities export.
- `county`: County as written in the imported ONRC file, e.g. Cluj.
- `limit` (integer): Maximum company matches on this page.
- `name` (string, required): Part of the company name; diacritics are optional.
- `offset` (integer): Number of matches to skip for pagination.

### `company_snapshot` (~79 tokens)

Save a company snapshot

Fetch a fresh report and save it locally for later comparisons. Saves partial results with their errors.

Input parameters:

- `cui` (string, required): Company fiscal code (CUI / CIF), with or without the RO prefix, e.g. "14399840" or "RO14399840".
- `years` (integer): Financial years to include in the saved observation.

### `company_history` (~72 tokens)

Saved company reports

Read local observations. The history starts when you first save a snapshot.

Input parameters:

- `cui` (string, required): Company fiscal code (CUI / CIF), with or without the RO prefix, e.g. "14399840" or "RO14399840".
- `limit` (integer): Maximum saved reports, newest first.

### `company_changes` (~77 tokens)

What changed at a company

Compare the latest two saved observations. Does not fetch or save new data.
Failed checks are reported as availability changes, never as deleted financials or closed cases.

Input parameters:

- `cui` (string, required): Company fiscal code (CUI / CIF), with or without the RO prefix, e.g. "14399840" or "RO14399840".

### `company_watch` (~109 tokens)

Watch a company

Save a local watch. Run monitor_run or the CLI monitor periodically to check due companies.
No background process or external notification is started by this tool.

Input parameters:

- `cui` (string, required): Company fiscal code (CUI / CIF), with or without the RO prefix, e.g. "14399840" or "RO14399840".
- `enabled` (boolean): False pauses this company's watch; its saved reports are kept.
- `interval_hours` (integer): Hours between checks when the monitor is run.

### `company_watchlist` (~35 tokens)

Company watchlist

Read the local watchlist and the next check times.

Input parameters:

- `limit` (integer): Maximum watches to return, including paused watches.

### `monitor_run` (~40 tokens)

Check due company watches

Fetch fresh reports for due watches, save snapshots and return meaningful changes or new failures.

Input parameters:

- `limit` (integer): Maximum due watches to check during this run.

### `supplier_check` (~105 tokens)

Check a supplier list

Create or resume a local supplier review. Returns progress and the ID to pass on the next call.

Input parameters:

- `cuis`: CUIs for a new check; omit when resuming a job.
- `job_id`: ID returned by a previous supplier_check call to continue pending items.
- `limit` (integer): Suppliers to process in this call; results are saved after each supplier.
- `years` (integer): Financial years for a new job. Resumed jobs keep their original setting.

### `supplier_results` (~89 tokens)

Supplier results and CSV export

Read saved results, with findings first and incomplete checks clearly marked. CSV retains source receipts.

Input parameters:

- `format` (string): Return structured JSON or CSV text; no file is written.
- `job_id` (string, required): Supplier check ID returned by supplier_check.
- `limit` (integer): Suppliers on this page; follow next_offset for more.
- `offset` (integer): Number of sorted suppliers to skip.

### `vat_check` (~90 tokens)

EU VAT check (VIES)

Check a trading partner's current intra-EU VAT registration with VIES. Unavailable is not invalid.
Run for a requested partner check, not general-purpose company harvesting.

Input parameters:

- `country` (string, required): EU member state code, e.g. RO or DE; EL for Greece, XI for Northern Ireland.
- `vat_number` (string, required): Trading partner's VAT number, with or without the matching country prefix.

### `dataset_catalog` (~64 tokens)

Find official data exports

Find official export files and resource IDs. Check the file's period before importing it.

Input parameters:

- `limit` (integer): Maximum datasets to list with their resource IDs.
- `query` (string, required): data.gov.ro search, e.g. organization:onrc or achizitii publice.

### `dataset_import` (~159 tokens)

Import an official export

Download and atomically index a CSV, XLSX or ODS export locally. Large ONRC files can take minutes.
Reimporting a resource replaces its rows after validation. Other datasets and reports are kept.

Input parameters:

- `kind` (string, required): onrc for OD_FIRME, caen for OD_CAEN_AUTORIZAT, procurement for contract exports.
- `period_end`: Last day covered by a procurement export, YYYY-MM-DD.
- `period_start`: First day covered by a procurement export, YYYY-MM-DD.
- `published_on` (string, required): Publication or snapshot date stated by the source, YYYY-MM-DD; not today's date by default.
- `resource_id` (string, required): Resource ID from dataset_catalog. Downloads from data.gov.ro only.

### `dataset_status` (~22 tokens)

Imported datasets

List local dataset provenance, coverage periods, skipped rows and file hashes.

### `company_contracts` (~135 tokens)

Company public contracts

Find contracts by supplier CUI in imported SEAP exports. Values are contract amounts, not payments.
No matches is not proof that no contracts exist outside the imported coverage.

Input parameters:

- `cui` (string, required): Company fiscal code (CUI / CIF), with or without the RO prefix, e.g. "14399840" or "RO14399840".
- `limit` (integer): Maximum contracts on this page; totals cover all imported matches.
- `offset` (integer): Number of contracts to skip.
- `since`: Earliest contract date, YYYY-MM-DD.
- `until`: Latest contract date, YYYY-MM-DD.

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/robyroro-romania-mcp/romania-mcp-server#diagnostics

## Score history

- 2026-11-05: 79
- 2026-11-04: 79
- 2026-11-03: 79
- 2026-11-02: 94
- 2026-11-01: 79
- 2026-10-31: 79
- 2026-10-30: 78
- 2026-10-29: 93
- 2026-10-28: 92
- 2026-10-27: 92
- 2026-10-26: 91
- 2026-10-25: 91
- 2026-10-24: 91
- 2026-10-23: 90
- 2026-10-22: 90
- 2026-10-21: 74
- 2026-10-20: 88
- 2026-10-19: 88
- 2026-10-18: 87
- 2026-10-17: 87
- 2026-10-16: 86
- 2026-10-15: 86
- 2026-10-14: 85
- 2026-10-13: 64
- 2026-10-12: 64
- 2026-10-04: 79
- 2026-10-03: 64
- 2026-10-02: 64
- 2026-10-01: 64

## Common questions

### What is the Romania MCP server?

Romania is an MCP server listed in the public MCP registry as io.github.robyroro/romania-mcp. Romanian company reports, ONRC search, public contracts, VAT checks and local monitoring. This page covers its PyPI package (romania-mcp-server).

### Is the Romania MCP server safe to use?

Romania scores 79 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Romania MCP server expose?

Romania exposes 21 tools: company_lookup, company_financials, court_cases, exchange_rate, shop_check, and 16 more. Their descriptions and schemas cost roughly 2,758 tokens of context every time the server is loaded.

### Is the Romania MCP server still maintained?

Romania is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Romania MCP server under?

Romania declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/romania-mcp-server/
- Socket report: https://socket.dev/pypi/package/romania-mcp-server
- Repository: https://github.com/robyroro/romania-mcp
- Changelog RSS feed: https://verifymcp.io/servers/robyroro-romania-mcp/romania-mcp-server.xml
- Changelog JSON feed: https://verifymcp.io/servers/robyroro-romania-mcp/romania-mcp-server.json
- HTML version of this page: https://verifymcp.io/servers/robyroro-romania-mcp/romania-mcp-server