CompanyLens vs registercheck.de API

CompanyLens 3

Closed service. No changelog, release notes, dated API change or dated docs page was found; the OpenAPI document carries no date and the sitemap no lastmod (0). So no releases in the last 90 days can be counted (0). A contact address and a demo form, with no public tracker or community channel (3 of 15). No official SDK (0). No package to judge (0). 0+0+3+0+0 = 3. The low figure is the checklist's reading of a service with no dated public record, not evidence of neglect.

registercheck.de API 58

Last dated change 3 November 2026, the day before this check (30). Dated changelog entries on 3 November, 30 and 26 October, 17, 16, 15, 9, 8, 2 and 1 October, and 17 September, all inside 90 days (20). Public changelog, support and sales addresses and a Slack Connect channel for customers, with no public tracker to judge response times (8 of 15). No official SDK. The 21 October reading of the official MCP registry came from the registry's JSON API, which is not used as evidence, and the docs name no registry listing, so the line has no evidence (0 of 15). No package to judge (0). 30 + 20 + 8 + 0 + 0 = 58.

CompanyLens 70

16 MCP tools (15), with get_company returning a core profile and get_company_section fetching only officers or owners, and get_company_batch taking up to 20 companies (20 of 25 with 5 added back). page and pageSize up to 100 with a meta total, and jurisdiction and status filters on search (16 of 20). Errors are JSON with a code, message and correlation id, and the troubleshooting table maps 401 causes to fixes (15 of 20). The data surface is GETs; the only delete is deactivating an API key. MCP tool annotations weren't readable without connecting (12 of 20). Few required parameters, but no official SDK, only a Postman collection (7 of 15). 20+16+15+12+7 = 70.

registercheck.de API 84

Lists take limit up to 100 (the company filter up to 1,000 since 26 October), the company record carries a counts block so an agent can skip empty sub-resources, and expand=roles and expand=tax_ids inline data at no charge. No field selection (18 of 25). One cursor envelope on every list, a structured filter endpoint, and unknown parameters refused with 400 rather than ignored (20). RFC 9457 problem documents with a stable code, errors[] naming each field, and required_credits on 402 (20). Idempotency-Key on every POST with documented replay and conflict codes. The MCP docs mark which of the 13 tools change data and say delete_monitor asks for confirmation; the tool annotations were not readable without signing in (18 of 20). Search needs only name. No official SDK; generated snippets in seven languages and Standard Webhooks libraries for verification (8 of 15). 18 + 20 + 20 + 18 + 8 = 84.

CompanyLens 72

OpenAPI 3.0.4 at api.companylens.io/swagger/v1/swagger.json, behind the Swagger playground linked from the API reference, 20 operations and 55 schemas (25). llms.txt with endpoints, tools and pricing; no Markdown twins of docs pages (7 of 10). Tool descriptions say what each returns and some say when to call it ('use to discover valid jurisdiction slugs before calling other tools'), but llms.txt names four tools (search_entities, get_entity_detail, search_officers, execute_query) and /api/v1 paths that match neither the 16-tool page nor the /v1 paths in the spec, and gives 18 jurisdictions where the site says 19 (11 of 20). 74 parameters, 17 marked required and 12 with enums or schema references (10 of 15). Errors 400, 401, 404, 422, 429, 501 and 503 in the spec, a troubleshooting page, examples pages for REST and MCP and a Postman collection (14 of 15). The path carries v1, but no changelog was found (5 of 15). 25+7+11+10+14+5 = 72.

registercheck.de API 83

The docs name a public OpenAPI 3.1 document at api.registercheck.de/v1/openapi.json, which on 21 October covered 53 operations but was thin (11 schemas, no security scheme, FastAPI's default 422 where the API answers 400). The richer OpenAPI 3.2 document behind the reference (61 operations, 213 schemas, 68 enums) was embedded in the pages and not served as a file. Both per the 21 October check, not re-read (20 of 25). llms.txt, llms-full.txt and per-page Markdown (10). Reference descriptions say when to use an endpoint, what it costs and where coverage ends. Two pages still disagree, as the authentication guide gives 400 for a missing key where the errors guide gives 401 for no valid key, and the quickstart prices contact endpoints that the roadmap lists as not served (16 of 20). Typed parameters with lengths, ranges and enums such as register_type, and since 26 October the company filter refuses input its schema refuses (13 of 15). Examples in seven languages and example responses on reference pages, and a full error code table, less the inconsistencies above (12 of 15). A dated changelog and a migration guide with Deprecation and Sunset headers, but /v1 changes in place with no new version (12 of 15). 20 + 10 + 16 + 13 + 12 + 12 = 83.

CompanyLens 47

REST keys rotate and revoke at once from the dashboard, with a separate sandbox prefix, but carry the whole account with no per-endpoint restrictions. The MCP server uses OAuth through Clerk with dynamic client registration and only openid, profile and email scopes, or long-lived service tokens on Agent plans. No key in the URL (20 of 30). The data surface is read-only; no write actions on registry data (15 of 20). Company names, addresses and officer details are filed by third parties, with no prompt-injection guidance (5 of 15). get_usage and the usage endpoint show plan use; the privacy policy says audit logs are kept at least a year, with no per-call log documented for customers (7 of 15). security.txt answered 403 and no disclosure policy, bug bounty or certification was found (0 of 20). 20+15+5+7+0 = 47.

registercheck.de API 40

Bearer keys only, never in the URL, revocable on the next request. Keys are not scoped and carry the account's full permissions, including deleting lists and monitors. The MCP server uses OAuth 2.1 with five scopes such as companies:read and monitors:write (20 of 30). No read-only key. The MCP docs page (docs.registercheck.de/docs/mcp) says delete_monitor stops a monitor after the assistant asks the user to confirm, and that is the source credited; the tool annotations themselves were not readable without signing in (8 of 20). Company names, purposes and person names are filed by the public and returned verbatim, with no guidance on treating them as untrusted (5 of 15). A usage breakdown by endpoint and key exists, but the docs say it is unreliable and may show empty. Request-Id on error responses, and Registercheck-Credits-Charged on every response to a call made with a key, whatever its status (7 of 15). Security programme 0 of 20, mostly because we couldn't read the vendor's site. www.registercheck.de, where a security page, disclosure policy or certification would normally be published, answered robots.txt with a bot check on 21 October and 4 November, so whether a programme exists there is unchecked, not found missing. What we could check was empty, with no security.txt on the docs host (404 on 4 November) or on the api and mcp hosts (21 October) and no disclosure route, bug bounty or certification in the docs. Webhooks are signed with HMAC-SHA256 under Standard Webhooks. 20 + 8 + 5 + 7 + 0 = 40.