MCP server exposing Nordic Data API — company, VAT, sanctions, KYB and address data across 15 European countries to AI agents
Nordic Data MCP exposes 10 tools with consistent naming (verb_noun pattern) and basic descriptions. However, critical gaps undermine production readiness: (1) Parameter descriptions lack format constraints, ranges, and validation guidance, e.g., 'country' accepts 'lowercase ISO code' but no enum or pattern is enforced; (2) Output schemas are not documented, LLMs cannot predict response structure for chaining; (3) Error handling is absent, no recovery guidance or categorization; (4) Three meta-tools (list_endpoints, get_endpoint_schema, call_endpoint) expose a generic API gateway pattern that invites hallucinated endpoint names and parameter misuse. Tool descriptions average ~80 chars (below 194-char baseline), lacking WHEN/WHY context. No tool declares permissions, audit trails, or idempotency guarantees.
Autocomplete address suggestions for supported countries (DK, NO, SE, FI, FR)
Discovery meta-tool: call any endpoint in the Nordic Data API with custom parameters
Enriched company data for supported countries (DK, NO, SE, FI)
Discovery meta-tool: get the schema and parameters for a specific API endpoint
Complete KYB report including identity, persons, financials, LEI, VAT, sanctions, adverse media, and risk score
Discovery meta-tool: list all available endpoints in the Nordic Data API
Get the basic registry record and confirm the legal entity
Output schemas not documented. LLMs cannot predict response structure, breaking tool chaining. E.g., kyb_full returns unknown fields, agent cannot extract person_id for downstream calls.
Parameter descriptions lack format constraints and validation rules. 'country' parameter says 'lowercase ISO code' but no enum, pattern, or list of valid values. LLMs will hallucinate invalid country codes.
Generic API gateway tools (list_endpoints, get_endpoint_schema, call_endpoint) expose unvalidated endpoint names and parameters. LLMs will invent endpoint names; no schema validation prevents malformed requests.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 46 | 2025-06-18+ | v2 |
Look up Legal Entity Identifier (LEI) data
Screen one or more names against UN/EU/OFAC/PEP lists
Validate a VAT number and report the registered business behind it
No error handling guidance. Tools lack recovery hints, error categorization (retryable vs fatal), or actionable error messages. E.g., 'Company not found' should suggest search_* alternatives.
No pagination or result limits documented. Tools returning lists (screen_sanctions, autocomplete_address) lack limit/offset parameters and max result count guidance, risking context window exhaustion.