Apier MCP Server — Norwegian company data and compliance for AI agents

Apier is a hosted MCP (Model Context Protocol) server that gives AI agents structured access to Norwegian company data and regulatory compliance. It resolves any 9-digit organisasjonsnummer (organisation number) against Brønnøysundregistrene (the Brønnøysund Register Centre / Enhetsregisteret), answers who holds signing authority for a company (signaturrett and prokura), reads annual accounts (årsregnskap) from Regnskapsregisteret, computes filing deadlines for MVA, A-melding and Årsregnskap, and brokers fullmakt — scoped, revocable company→agent authority delegated through an Altinn 3 systembruker, authenticated upstream via Maskinporten against Skatteetaten and other agencies. This repository is the thin, hardened npm proxy (@apier-no/mcp) that connects local stdio MCP clients to the hosted server.

What you can ask

With this server connected, an AI agent can answer questions like:

• "What's the organisasjonsnummer for Equinor?" (search_companies)
• "Who can legally sign on behalf of org number 923 609 016 — and is it signaturrett or prokura?" (get_company_authority)
• "Is this company VAT-registered, and what regulatory obligations does it have?" (get_company_summary)
• "What filing deadlines is this company facing in the next six months?" (get_company_deadlines)
• "Show me the latest annual accounts (årsregnskap) for this company." (get_company_accounts)
• "What is the Altinn 3 equivalent of this old Altinn 2 role code?" (get_altinn_migration_guidance)
• "What's the current Norges Bank exchange rate for EUR to NOK?" (get_exchange_rate)
• "Request a fullmakt so I can act on behalf of this company, then verify it before filing." (request_fullmakt, check_fullmakt)

Tools

All 25 tools exposed by the hosted server at https://www.apier.no/api/mcp (discovered live via tools/list):

Quickstart

Hosted endpoint (streamable HTTP)

The fastest path — no install. Point any streamable-HTTP-capable MCP client at:

https://www.apier.no/api/mcp

Discovery is keyless: initialize, tools/list, resources and prompts all work without credentials, so an agent can explore the full catalogue before authenticating. An API key (Authorization: Bearer apier_live_…) is needed only for protected tool calls. Get a key at https://www.apier.no/dashboard/keys.

npx stdio proxy (@apier-no/mcp)

For stdio-only clients, this package wraps mcp-remote, reads APIER_API_KEY from your environment, removes it from the spawned child's environment, redacts it from stderr, and forwards it as an Authorization: Bearer header argument on the child's command line (visible to local process inspection on multi-user systems — see SECURITY.md).

Published as @apier-no/mcp. The @apier scope was unavailable, so this package ships under the @apier-no scope.

Claude Desktop / Cursor (claude_desktop_config.json / ~/.cursor/mcp.json):

{
  "mcpServers": {
    "apier": {
      "command": "npx",
      "args": ["-y", "@apier-no/mcp"],
      "env": { "APIER_API_KEY": "apier_live_<your_key_here>" }
    }
  }
}

VS Code (.vscode/mcp.json):

{
  "servers": {
    "apier": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@apier-no/mcp"],
      "env": { "APIER_API_KEY": "apier_live_<your_key_here>" }
    }
  }
}

Zed (settings.json):

{
  "context_servers": {
    "apier": {
      "source": "custom",
      "command": "npx",
      "args": ["-y", "@apier-no/mcp"],
      "env": { "APIER_API_KEY": "apier_live_<your_key_here>" }
    }
  }
}

Ready-to-paste config files for each client live in examples/.

Configuration

Security

• APIER_API_KEY is read by the parent process and scrubbed from the spawned child's environment, and stderr is passed through a redactor that strips Bearer …, apier_(live|test)_…, ghp_…, and Authorization: substrings. The key is still forwarded to the child as an Authorization: Bearer --header argument, which local process inspection (ps aux, /proc/<pid>/cmdline) can reveal on multi-user systems — see SECURITY.md.
• Non-https endpoints are rejected before spawn; mcp-remote is exact-pinned and releases are published with npm provenance via GitHub Actions Trusted Publishing (OIDC).
• Treat client config files (claude_desktop_config.json, .cursor/mcp.json, …) like .env files — never commit them with a real key.

Full threat model and disclosure policy: SECURITY.md.

Documentation

• MCP server docs: https://www.apier.no/docs/mcp
• Apier platform docs: https://apier.no/docs

License

MIT