Apier

Apier MCP Server — Norwegian company data and compliance for AI agents

Apier is a hosted MCP (Model Context Protocol) server that gives AI agents structured access to Norwegian company data and regulatory compliance. It resolves any 9-digit organisasjonsnummer (organisation number) against Brønnøysundregistrene (the Brønnøysund Register Centre / Enhetsregisteret), answers who holds signing authority for a company (signaturrett and prokura), reads annual accounts (årsregnskap) from Regnskapsregisteret, computes filing deadlines for MVA, A-melding and Årsregnskap, and brokers fullmakt — scoped, revocable company→agent authority delegated through an Altinn 3 systembruker, authenticated upstream via Maskinporten against Skatteetaten and other agencies. This repository is the thin, hardened npm proxy (@apier-no/mcp) that connects local stdio MCP clients to the hosted server.

What you can ask

With this server connected, an AI agent can answer questions like:

• "What's the organisasjonsnummer for Equinor?" *(search_companies)*
• "Who can legally sign on behalf of org number 923 609 016 — and is it signaturrett or prokura?" *(get_company_authority)*
• "Is this company VAT-registered, and what regulatory obligations does it have?" *(get_company_summary)*
• "What filing deadlines is this company facing in the next six months?" *(get_company_deadlines)*
• "Show me the latest annual accounts (årsregnskap) for this company." *(get_company_accounts)*
• "What is the Altinn 3 equivalent of this old Altinn 2 role code?" *(get_altinn_migration_guidance)*
• "What's the current Norges Bank exchange rate for EUR to NOK?" *(get_exchange_rate)*
• "Request a fullmakt so I can act on behalf of this company, then verify it before filing." *(request_fullmakt, check_fullmakt)*

Tools

All 25 tools exposed by the hosted server at https://www.apier.no/api/mcp (discovered live via tools/list on 2026-10-10; each row is the opening sentence of the live description, so the full text is one tools/list call away):

Try without a key

Starting this proxy requires `APIER_API_KEY` (see Quickstart). The proxy forwards whatever bearer you give it as Authorization: Bearer … and never inspects the key's shape. Without a real key you still have two sandbox paths, both served from synthetic fixtures and never from a government register:

• Direct HTTP to the sandbox mirror under /api/v1/sandbox/ on apier.no. Every Category B company endpoint has a mirror there. It is not zero-auth: it expects a *self-invented* sandbox bearer, apier_sandbox_test_ (any suffix of 1–64 characters from A-Za-z0-9_-), which the server recognises by its prefix and answers with fixtures — no signup and no key store behind it. A separate, truly zero-auth mirror lives under /api/v1/sandbox/public/ for the single fixture org 999999999.
• The same sandbox bearer on the hosted MCP endpoint https://www.apier.no/api/mcp. Send Authorization: Bearer apier_sandbox_test_ and the fixture-backed company tools (get_company_context, get_company_obligations, get_company_deadlines, get_company_summary, get_company_verification, explain_compliance_error, get_company_authority, get_company_accounts, get_company_filing_history) are routed to the sandbox mirror, with _meta.is_sandbox: true on every result; the remaining tools answer exactly as they would without a key. Because this proxy forwards the bearer unchanged, setting APIER_API_KEY to such a value lets a stdio client rehearse those tools against fixtures too.

List the canonical sandbox test data (no auth at all):

curl -sL https://apier.no/api/v1/sandbox/fixtures

Trimmed response — … marks omitted fields:

{"success":true,"data":{"schema_version":"1.0.0",

"reserved_test_orgs":[{"org_number":"999000001","name":"Sandbox AS","entity_type":"AS","data_tier":"tier_1", …}], "realistic_orgs":[{"org_number":"818000006","name":"Fjellberg Regnskap AS","entity_type":"AS","data_tier":"tier_1_2"}, …], "magic_scenarios":[{"org_number":"999660010","state":"konkurs","label":"Bankrupt (konkurs)"}, …], …}}

Verify the bankrupt fixture company with a self-invented bearer — any suffix of 1–64 chars from A-Za-z0-9_- after apier_sandbox_test_ works; here bash's $RANDOM supplies one. (This call goes to the www host directly: the apex→www 308 redirect makes curl drop the Authorization header.)

curl -s -H "Authorization: Bearer apier_sandbox_test_$RANDOM" https://www.apier.no/api/v1/sandbox/company/999660010/verify

Trimmed response — … marks omitted fields:

{"success":true,"data":{"org_number":"999660010","name":"Sandbox Konkurs AS",

"verification_status":"fail", "signals":{"is_active":false,"not_bankrupt":false, …}, "summary":"Selskapet er ikke aktivt registrert i Enhetsregisteret.", …}}

Don't confuse the two prefixes: a real API key is apr_ _… (apr_free_, apr_starter_, apr_pro_ or apr_ent_) and comes from signup via https://www.apier.no/docs/authentication, while apier_sandbox_test_ is self-generated and needs no signup. (Earlier README versions mentioned apier_live_ / apier_test_ keys; no key of that shape was ever issued.) GET /api/v1/sandbox/fixtures is the canonical machine-readable table of sandbox test data.

Quickstart

Hosted endpoint (streamable HTTP)

The fastest path — no install. Point any streamable-HTTP-capable MCP client at:

https://www.apier.no/api/mcp

Discovery is keyless: initialize, tools/list, resources and prompts all work without credentials, so an agent can explore the full catalogue before authenticating. An API key (Authorization: Bearer apr_ _…) is needed only for protected tool calls. See https://www.apier.no/docs/authentication for how to get a key, then create one in the dashboard at https://www.apier.no/dashboard.

npx stdio proxy (@apier-no/mcp)

For stdio-only clients, this package wraps mcp-remote, reads APIER_API_KEY from your environment, removes it from the spawned child's environment, redacts it from stderr, and hands the bearer value over out-of-band so it never appears on the child's command line — see SECURITY.md.

mcp-remote moved from geelen/mcp-remote to punkpeye/mcp-remote; the npm package name is unc