Company Data MCP Server Documentation

Connect CompanyProof to AI agents over Streamable HTTP MCP. Read tool names, OAuth and API key options, verification behavior and usage errors.

MODEL CONTEXT PROTOCOL · COMPANYPROOF

Give agents typed CompanyProof company tools.

CompanyProof MCP uses stateless Streamable HTTP. Connect ChatGPT directly to https://companyproof.ai/v2/mcp and complete CompanyProof OAuth sign-in; do not paste an API key into ChatGPT. Custom MCP clients may continue to send a CompanyProof bearer API key.

STREAMABLE HTTP · PUBLIC BETA

CompanyProof MCP

https://companyproof.ai/v2/mcp

Copy this address into your MCP client’s server settings. Opening it in a browser shows this connection guide.

ChatGPT connects with OAuth. The server exposes read-only company search and profile tools under company.read, plus the consequential verify_company_claims tool under proof.write. Custom MCP clients may authenticate tool calls with a CompanyProof bearer API key.

REMOTE MCP CONFIGURATION

{
  "mcpServers": {
    "companyproof": {
      "type": "http",
      "url": "https://companyproof.ai/v2/mcp",
      "headers": {
        "Authorization": "Bearer ${COMPANYPROOF_API_KEY}"
      }
    }
  }
}

This API-key configuration is for custom MCP clients, not ChatGPT, and is not universal client syntax. Use the client’s secure secret-substitution feature so ${COMPANYPROOF_API_KEY} is replaced before the request is sent; never send that placeholder literally.

READsearch_companies

Inputs: identifier_type, identifier, country, optional subdivision, city_or_state and limit. Identifier types include name, registration_number, vat_tax_id and ticker. Returns the same typed company list as REST search. OAuth requires company.read; API-key clients require eligible live access. Each call consumes one shared credit.

READget_company_profile

Input: company_id. Returns the CompanyProof profile envelope and section availability. OAuth requires company.read; API-key clients require eligible live access. Each call consumes one shared credit.

WRITEverify_company_claims

Inputs: company, exactly one of answer or claims, optional monitor and idempotency_key. OAuth requires proof.write. API-key clients may use eligible test or live keys. The tool writes a proof and consumes claim credits.

1 · SERVER/DISCOVER

curl --request POST \
  --url https://companyproof.ai/v2/mcp \
  --header "Content-Type: application/json" \
  --header "Accept: application/json, text/event-stream" \
  --header "MCP-Protocol-Version: 2026-07-28" \
  --header "Mcp-Method: server/discover" \
  --data '{
    "jsonrpc": "2.0",
    "id": "discover",
    "method": "server/discover",
    "params": {
      "_meta": {
        "io.modelcontextprotocol/protocolVersion": "2026-07-28",
        "io.modelcontextprotocol/clientInfo": { "name": "companyproof-client", "version": "1.0.0" },
        "io.modelcontextprotocol/clientCapabilities": {}
      }
    }
  }'

2 · TOOLS/LIST

curl --request POST \
  --url https://companyproof.ai/v2/mcp \
  --header "Content-Type: application/json" \
  --header "Accept: application/json, text/event-stream" \
  --header "MCP-Protocol-Version: 2026-07-28" \
  --header "Mcp-Method: tools/list" \
  --data '{
    "jsonrpc": "2.0",
    "id": "tools",
    "method": "tools/list",
    "params": {
      "_meta": {
        "io.modelcontextprotocol/protocolVersion": "2026-07-28",
        "io.modelcontextprotocol/clientInfo": { "name": "companyproof-client", "version": "1.0.0" },
        "io.modelcontextprotocol/clientCapabilities": {}
      }
    }
  }'

3 · TOOLS/CALL · VERIFY

curl --request POST \
  --url https://companyproof.ai/v2/mcp \
  --header "Authorization: Bearer $COMPANYPROOF_TEST_KEY" \
  --header "Content-Type: application/json" \
  --header "Accept: application/json, text/event-stream" \
  --header "MCP-Protocol-Version: 2026-07-28" \
  --header "Mcp-Method: tools/call" \
  --header "Mcp-Name: verify_company_claims" \
  --data '{
    "jsonrpc": "2.0",
    "id": "verify",
    "method": "tools/call",
    "params": {
      "name": "verify_company_claims",
      "arguments": {
        "company": {
          "name": "CompanyProof Sandbox Limited",
          "country": "GB",
          "registration_number": "CP000001"
        },
        "claims": [
          { "field": "status", "published": "Active" }
        ],
        "monitor": false,
        "idempotency_key": "verify_agent_01J62E8A"
      },
      "_meta": {
        "io.modelcontextprotocol/protocolVersion": "2026-07-28",
        "io.modelcontextprotocol/clientInfo": { "name": "companyproof-client", "version": "1.0.0" },
        "io.modelcontextprotocol/clientCapabilities": {}
      }
    }
  }'

01
server/discover
Discovery is public. Use current protocol version 2026-07-28. Send the matching MCP-Protocol-Version and Mcp-Method headers plus the protocol version, client identity and capabilities in params._meta. The result identifies CompanyProof and its supported versions.
02
tools/list
Tool listing is public. Send Mcp-Method: tools/list and the same request metadata. The JSON result contains deterministic tool order, live input/output schemas, annotations, required OAuth scopes and private cache hints.
03
tools/call
Tool calls require CompanyProof OAuth scopes or a bearer API key. Send Mcp-Method: tools/call and a matching Mcp-Name. Successful JSON results return typed structuredContent plus a JSON text fallback.

2025 client compatibility

Clients using 2025-11-25 or 2025-06-18 remain supported through the initialization-based Streamable HTTP flow: initialize, notifications/initialized, then tools/list or tools/call. Legacy post-initialization requests include the negotiated MCP-Protocol-Version and receive SSE responses. The server is stateless and does not issue MCP-Session-Id.

MCP error boundary

Discovery and tool listing do not require credentials. Tool calls require a valid OAuth token with the tool’s scope or a CompanyProof API key; missing, invalid or insufficient authorization returns an authentication challenge or failure without running the tool. A valid live credential on a billing-suspended account returns HTTP 402 with billing_payment_required and no OAuth challenge; restore billing instead of reconnecting, and the same credential resumes automatically. An unreadable MCP body can fail before JSON-RPC dispatch with HTTP 400 invalid_request_body; an MCP message over 128 KiB fails with HTTP 413 body_too_large. Network or account throttling can fail with HTTP 429 and Retry-After. A valid MCP exchange can still return result.isError: true. Completed CompanyProof operations put the REST error envelope in result.content[0].text, so branch on error.code when that text parses as JSON. SDK argument-validation failures can instead be plain text beginning with Input validation error; treat unparseable text as diagnostic, not as a stable error-code contract. Completed operation results preserve available REST context in result._meta: companyproof.ai/http-status is a number; companyproof.ai/retry-after, companyproof.ai/rate-limit, companyproof.ai/rate-remaining, companyproof.ai/rate-reset, companyproof.ai/usage-limit, companyproof.ai/usage-remaining and companyproof.ai/usage-reset are header-value strings and appear only when the corresponding value exists. Mcp-Name applies to tools/call, not tools/list. Read-only annotations describe side effects, not cost: search and profile still consume one shared credit. Apply your client’s approval and budget policy to every tool, and require approval for verify_company_claims.

Beta compatibility policy

CompanyProof may add optional fields and new tools during beta. Existing tool names and required fields will not be removed or renamed without a documented version transition. Keep custom-client keys in the client’s secure credential store, use OAuth for ChatGPT and use an idempotency key for retrying verification.

Open platform examples and the tool contract →